Edit tour

Windows Analysis Report
ufp4rvU3SP.exe

Overview

General Information

Sample name:	ufp4rvU3SP.exe renamed because original name is a hash value
Original sample name:	56267b2331a42b473283d7f2798cc1f5.exe
Analysis ID:	1540301
MD5:	56267b2331a42b473283d7f2798cc1f5
SHA1:	29407f372b0612ca134bdb5bb8d92e969d75318d
SHA256:	eb701cd5f43f77e8c9eb399bbb9c0bff5b14004925b92c6210bf2ccf3a1135e7
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Machine Learning detection for sample

Sigma detected: New RUN Key Pointing to Suspicious Folder

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

ufp4rvU3SP.exe (PID: 7672 cmdline: "C:\Users\user\Desktop\ufp4rvU3SP.exe" MD5: 56267B2331A42B473283D7F2798CC1F5)

MSBuild.exe (PID: 7728 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 7736 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

Honda.exe (PID: 7900 cmdline: "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

conhost.exe (PID: 7908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7852 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7672 -s 280 MD5: C31336C1EFC2CCB44B4326EA793040F2)

Honda.exe (PID: 8164 cmdline: "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

conhost.exe (PID: 8176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Honda.exe (PID: 3568 cmdline: "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

conhost.exe (PID: 3352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Honda.exe (PID: 1872 cmdline: "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

conhost.exe (PID: 5276 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe", EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ProcessId: 7736, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleApp_7517da1fddef4d3d95457c1862f6f97b

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe", EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ProcessId: 7736, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleApp_7517da1fddef4d3d95457c1862f6f97b

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ProcessId: 7736, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleApp_6d4e6e429fc6404698bba07c4b921c78.lnk

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: ufp4rvU3SP.exe

ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: ufp4rvU3SP.exe

Joe Sandbox ML: detected

Source: ufp4rvU3SP.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ufp4rvU3SP.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: Honda.exe, 00000007.00000000.1437423752.0000000000D92000.00000002.00000001.01000000.00000008.sdmp, Honda.exe.3.dr

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe

Code function: 0_2_0012D2FE FindFirstFileExW,

0_2_0012D2FE

Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45

Source: ufp4rvU3SP.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: ufp4rvU3SP.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: ufp4rvU3SP.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: ufp4rvU3SP.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: ufp4rvU3SP.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: ufp4rvU3SP.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: ufp4rvU3SP.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: ufp4rvU3SP.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: ufp4rvU3SP.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: ufp4rvU3SP.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: ufp4rvU3SP.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: Amcache.hve.6.dr	String found in binary or memory: http://upx.sf.net
Source: ufp4rvU3SP.exe	String found in binary or memory: https://sectigo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_00112805	0_2_00112805
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_0012F840	0_2_0012F840
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_001310A3	0_2_001310A3
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_0011F9EC	0_2_0011F9EC
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_00112A0F	0_2_00112A0F
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_00119B05	0_2_00119B05
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_00127C32	0_2_00127C32
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_0012943C	0_2_0012943C
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_0011FD34	0_2_0011FD34
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_00122D90	0_2_00122D90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_01283108	3_2_01283108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_01289A30	3_2_01289A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_01280848	3_2_01280848
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_01287850	3_2_01287850
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_012842E8	3_2_012842E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_012807B0	3_2_012807B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_01289A20	3_2_01289A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_01287A9C	3_2_01287A9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 3_2_012842C8	3_2_012842C8
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 7_2_02EE5A41	7_2_02EE5A41
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 7_2_02EE2788	7_2_02EE2788
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 7_2_02EE1E2F	7_2_02EE1E2F
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 10_2_01581CC0	10_2_01581CC0
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 10_2_01582788	10_2_01582788
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 10_2_01585A41	10_2_01585A41
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 13_2_024E5A41	13_2_024E5A41
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 13_2_024E2788	13_2_024E2788
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 13_2_024E1CC0	13_2_024E1CC0
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 15_2_00BF2CC8	15_2_00BF2CC8
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 15_2_00BF5AA8	15_2_00BF5AA8
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 15_2_00BF1E2F	15_2_00BF1E2F
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Code function: 15_2_00BF2CC1	15_2_00BF2CC1

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe

Code function: String function: 0011A280 appears 50 times

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7672 -s 280

Source: ufp4rvU3SP.exe

Static PE information: invalid certificate

Source: ufp4rvU3SP.exe	Binary or memory string: OriginalFilename vs ufp4rvU3SP.exe
Source: ufp4rvU3SP.exe, 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLKSM.exe< vs ufp4rvU3SP.exe

Source: ufp4rvU3SP.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Honda.exe.3.dr, TaskParameter.cs	Task registration methods: 'CreateNewTaskItemFrom'
Source: Honda.exe.3.dr, OutOfProcTaskHostNode.cs	Task registration methods: 'RegisterTaskObject', 'UnregisterPacketHandler', 'RegisterPacketHandler', 'UnregisterTaskObject', 'GetRegisteredTaskObject'
Source: Honda.exe.3.dr, TaskLoader.cs	Task registration methods: 'CreateTask'
Source: Honda.exe.3.dr, RegisteredTaskObjectCacheBase.cs	Task registration methods: 'GetLazyCollectionForLifetime', 'RegisterTaskObject', 'DisposeObjects', 'IsCollectionEmptyOrUncreated', 'UnregisterTaskObject', 'DisposeCacheObjects', 'GetRegisteredTaskObject', 'GetCollectionForLifetime'

Source: Honda.exe.3.dr, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Honda.exe.3.dr, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Honda.exe.3.dr, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent(bool)
Source: Honda.exe.3.dr, NodeEndpointOutOfProcBase.cs	Security API names: System.IO.Pipes.PipeSecurity.AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: Honda.exe.3.dr, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: Honda.exe, 00000007.00000002.1452577570.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\*.sln
Source: Honda.exe, 0000000F.00000002.1707572701.0000000002741000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qSC:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.sln
Source: Honda.exe, 00000007.00000000.1437423752.0000000000D92000.00000002.00000001.01000000.00000008.sdmp, Honda.exe.3.dr	Binary or memory string: .configAMSBUILDDIRECTORYDELETERETRYCOUNTCMSBUILDDIRECTORYDELETRETRYTIMEOUT.sln
Source: Honda.exe, 00000007.00000000.1437423752.0000000000D92000.00000002.00000001.01000000.00000008.sdmp, Honda.exe.3.dr	Binary or memory string: MSBuild MyApp.sln /t:Rebuild /p:Configuration=Release
Source: Honda.exe, 00000007.00000000.1437423752.0000000000D92000.00000002.00000001.01000000.00000008.sdmp, Honda.exe.3.dr	Binary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb
Source: Honda.exe, 0000000A.00000002.1546707297.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, Honda.exe, 0000000D.00000002.1626557756.00000000026E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q.C:\Users\user\AppData\Local\Temp\Honda\*.sln
Source: Honda.exe, 0000000D.00000002.1625582789.00000000008D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Users\user\AppData\Local\Temp\Honda\<.slnF
Source: Honda.exe, 00000007.00000002.1452577570.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, Honda.exe, 00000007.00000000.1437423752.0000000000D92000.00000002.00000001.01000000.00000008.sdmp, Honda.exe, 0000000A.00000002.1546707297.0000000002FD1000.00000004.00000800.00020000.00000000.sdmp, Honda.exe, 0000000D.00000002.1626557756.00000000026E1000.00000004.00000800.00020000.00000000.sdmp, Honda.exe, 0000000F.00000002.1707572701.0000000002741000.00000004.00000800.00020000.00000000.sdmp, Honda.exe.3.dr	Binary or memory string: *.sln
Source: Honda.exe, 0000000A.00000002.1544379399.00000000010D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Users\user\AppData\Local\Temp\Honda\<.sln
Source: Honda.exe, 00000007.00000000.1437423752.0000000000D92000.00000002.00000001.01000000.00000008.sdmp, Honda.exe.3.dr	Binary or memory string: MSBuild MyApp.csproj /t:Clean
Source: Honda.exe, 00000007.00000000.1437423752.0000000000D92000.00000002.00000001.01000000.00000008.sdmp, Honda.exe.3.dr	Binary or memory string: /ignoreprojectextensions:.sln
Source: Honda.exe, 00000007.00000000.1437423752.0000000000D92000.00000002.00000001.01000000.00000008.sdmp, Honda.exe.3.dr	Binary or memory string: MSBUILD : error MSB1048: Solution files cannot be debugged directly. Run MSBuild first with an environment variable MSBUILDEMITSOLUTION=1 to create a corresponding ".sln.metaproj" file. Then debug that.

Source: classification engine

Classification label: mal72.evad.winEXE@15/13@0/0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleApp_6d4e6e429fc6404698bba07c4b921c78.lnk

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8176:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7672
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7908:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3352:120:WilError_03

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\Honda

Jump to behavior

Source: ufp4rvU3SP.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ufp4rvU3SP.exe

ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\ufp4rvU3SP.exe "C:\Users\user\Desktop\ufp4rvU3SP.exe"
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7672 -s 280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Jump to behavior

Source: GoogleApp_6d4e6e429fc6404698bba07c4b921c78.lnk.3.dr

LNK file: ..\..\..\..\..\..\Local\Temp\Honda\Honda.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: ufp4rvU3SP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: ufp4rvU3SP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: ufp4rvU3SP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: ufp4rvU3SP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: ufp4rvU3SP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: ufp4rvU3SP.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: ufp4rvU3SP.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: ufp4rvU3SP.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: ufp4rvU3SP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: ufp4rvU3SP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: ufp4rvU3SP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: ufp4rvU3SP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: ufp4rvU3SP.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: ufp4rvU3SP.exe

Static PE information: section name: .bsp

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_0011992C push ecx; ret		0_2_0011993F
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_00112F17 push eax; ret		0_2_00112F76

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleApp_6d4e6e429fc6404698bba07c4b921c78.lnk

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleApp_6d4e6e429fc6404698bba07c4b921c78.lnk

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GoogleApp_7517da1fddef4d3d95457c1862f6f97b			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GoogleApp_7517da1fddef4d3d95457c1862f6f97b			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1280000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 4DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 2EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 30C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 50C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 1580000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 2FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 2DA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 24E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 26E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 2500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: BB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 2740000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Memory allocated: 2650000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-19984

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe

API coverage: 3.8 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7824	Thread sleep count: 323 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7764	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe TID: 8028	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe TID: 7252	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe TID: 3344	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe TID: 2060	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe

Code function: 0_2_0012D2FE FindFirstFileExW,

0_2_0012D2FE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\conhost.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: Amcache.hve.6.dr	Binary or memory string: VMware
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.6.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.6.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.6.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.6.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.6.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.6.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.6.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.6.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.6.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.6.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.6.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.6.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.6.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.6.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.6.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.6.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.6.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe

Code function: 0_2_00112F17 LdrInitializeThunk,

0_2_00112F17

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe

Code function: 0_2_0011A085 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0011A085

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_00112F7C mov edi, dword ptr fs:[00000030h]	0_2_00112F7C
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_00123BBE mov ecx, dword ptr fs:[00000030h]	0_2_00123BBE
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_0012CC6F mov eax, dword ptr fs:[00000030h]	0_2_0012CC6F

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe

Code function: 0_2_0012E177 GetProcessHeap,

0_2_0012E177

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_0011A085 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0011A085
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_0011A212 SetUnhandledExceptionFilter,	0_2_0011A212
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_00120B69 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00120B69
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: 0_2_00119E74 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00119E74

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 410000	Jump to behavior
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 412000	Jump to behavior
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: D54008	Jump to behavior

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"	Jump to behavior

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: EnumSystemLocalesW,	0_2_00130031
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: EnumSystemLocalesW,	0_2_00127026
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: EnumSystemLocalesW,	0_2_0013007C
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: EnumSystemLocalesW,	0_2_00130117
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_001301A2
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: GetLocaleInfoW,	0_2_001303F5
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: GetLocaleInfoW,	0_2_001274EF
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0013051E
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0012FD8F
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: GetLocaleInfoW,	0_2_00130624
Source: C:\Users\user\Desktop\ufp4rvU3SP.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_001306F3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Framework\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ufp4rvU3SP.exe

Code function: 0_2_0011A2C5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0011A2C5

Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.6.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	311 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	41 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	21 Registry Run Keys / Startup Folder	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	311 Process Injection	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	22 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ufp4rvU3SP.exe	61%	ReversingLabs	Win32.Trojan.LummaC
ufp4rvU3SP.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	0%	URL Reputation	safe
http://upx.sf.net	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	ufp4rvU3SP.exe	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	ufp4rvU3SP.exe	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.6.dr	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	ufp4rvU3SP.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	ufp4rvU3SP.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	ufp4rvU3SP.exe	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	ufp4rvU3SP.exe	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	ufp4rvU3SP.exe	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	ufp4rvU3SP.exe	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	ufp4rvU3SP.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	ufp4rvU3SP.exe	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540301
Start date and time:	2024-10-23 17:03:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ufp4rvU3SP.exe renamed because original name is a hash value
Original Sample Name:	56267b2331a42b473283d7f2798cc1f5.exe
Detection:	MAL
Classification:	mal72.evad.winEXE@15/13@0/0
EGA Information:	Successful, ratio: 16.7%
HCA Information:	Successful, ratio: 94% Number of executed functions: 143 Number of non-executed functions: 53
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.126.32.74, 40.126.32.72, 40.126.32.68, 40.126.32.138, 20.190.160.20, 40.126.32.133, 40.126.32.136, 20.190.160.17, 93.184.221.240, 20.42.65.92, 20.12.23.50, 192.229.221.95, 13.85.23.206, 20.3.187.198
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ctldl.windowsupdate.com.delivery.microsoft.com, slscr.update.microsoft.com, wu.ec.azureedge.net, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, wu.azureedge.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, blobcollector.events.data.trafficmanager.net, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, hlb.apr-52dd2-0.edgecastdns.net, sls.update.microsoft.com, umwatson.events.data.microsoft.com, wu-b-net.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target Honda.exe, PID 1872 because it is empty
Execution Graph export aborted for target Honda.exe, PID 3568 because it is empty
Execution Graph export aborted for target Honda.exe, PID 7900 because it is empty
Execution Graph export aborted for target Honda.exe, PID 8164 because it is empty
Execution Graph export aborted for target MSBuild.exe, PID 7736 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: ufp4rvU3SP.exe

Simulations

Behavior and APIs

Time	Type	Description
17:04:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run GoogleApp_7517da1fddef4d3d95457c1862f6f97b "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
17:04:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run GoogleApp_7517da1fddef4d3d95457c1862f6f97b "C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
17:04:25	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleApp_6d4e6e429fc6404698bba07c4b921c78.lnk

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	igCCUqSW2T.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	juwXcVX5AK.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	qBtDOzhQnS.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	https://email.email.pandadoc.net/c/eJxUkMtu2zoQhp9G3NkQhxQlLbRIjo8QpKjRS5qi3QTD4TCmZYuyRNm1nr4w0PSyGwzmG3z_7xprlPWVcJHmI_fpJbjmguOnLn78cm0vTw-4fw8_dttdENzIEmoji9oYsWsAtST2VKmiVOSoJqdyVNYa9pUnKUIDOWiZA0hTgDZrUNoXnphIopaly3TORwyH9YC9Qxdp3XMSYXpJIxKjPXCTxpnFodmlNEyZusugzaDFYfiDUDxm0L7pZ9CeIVNtih33mdpIlF4hGzaGIM8ta2mV83UNlbFYlJCbQhsoM9WKPqbgA2EKsb_VACXX1jKtlM9hpQHcqiKvVsZXuvB16WTBIo6v2IflN7T_8Ly_7-p6G_bz4wbM8n1Sp6MYG7ePPU-Zzu186Pg0H4abuhj5HKZfrF4mPLvT5vndMpR0h183E0MpUvOW7q9xlXB85X820-3i3IC4xLGbBiS-Pf3v-o2eUuge_l-21bG_2vt-fvz8MwAA__9XraZ6	Get hash	malicious	Unknown	Browse	192.229.221.95
	igCCUqSW2T.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	tfduJDS9iM.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	otq9AG1EIk.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	KO8mPIAMHh.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	otq9AG1EIk.exe	Get hash	malicious	Unknown	Browse	192.229.221.95

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\Honda\Honda.exe	igCCUqSW2T.exe	Get hash	malicious	Unknown	Browse
	juwXcVX5AK.exe	Get hash	malicious	Unknown	Browse
	qBtDOzhQnS.exe	Get hash	malicious	Unknown	Browse
	igCCUqSW2T.exe	Get hash	malicious	Unknown	Browse
	tfduJDS9iM.exe	Get hash	malicious	Unknown	Browse
	otq9AG1EIk.exe	Get hash	malicious	Unknown	Browse
	KO8mPIAMHh.exe	Get hash	malicious	Unknown	Browse
	tfduJDS9iM.exe	Get hash	malicious	Unknown	Browse
	otq9AG1EIk.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ufp4rvU3SP.exe_f473e7d92347dce301baac3bbe865c96d17095_54d7168b_e9a717ee-61ef-48e7-8587-1f2c24c7fb8e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6551038540789501
Encrypted:	false
SSDEEP:	96:lcFFoWAs7hgzxTMjh6tQXIDcQvc6QcEVcw3cE/n+HbHg/5hZAX/d5FMT2SlPkpX2:ipAd80BU/gjhzuiFKZ24IO8LBq
MD5:	D72FA1C6BBF2489788655B7BE442B914
SHA1:	E52408708D2BCD5BC86DEA12FAE5C4823E49C945
SHA-256:	DA39777D66138E53B8B8A3635A426AFE9410017CE4E32A58EA322450C705BF2D
SHA-512:	46B79568C08F8D7B712BAC8F65A849931DDF2D46012051031004CE70E88FE02684921DA9EF64245765273829AF91CDFDF17A9A9E50395F03F8EAB5A218F7705E
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.1.6.9.4.4.6.9.7.1.7.9.6.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.1.6.9.4.4.7.5.9.6.8.0.8.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.9.a.7.1.7.e.e.-.6.1.e.f.-.4.8.e.7.-.8.5.8.7.-.1.f.2.c.2.4.c.7.f.b.8.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.a.0.7.7.9.1.0.-.e.f.b.2.-.4.0.5.9.-.8.8.4.2.-.3.1.c.9.a.4.7.e.d.7.0.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.u.f.p.4.r.v.U.3.S.P...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.f.8.-.0.0.0.1.-.0.0.1.4.-.9.c.2.0.-.1.5.c.e.5.c.2.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.9.7.1.8.2.e.e.a.b.a.8.1.6.e.1.b.e.f.e.6.b.0.9.d.b.c.a.5.3.4.4.0.0.0.0.f.f.f.f.!.0.0.0.0.2.9.4.0.7.f.3.7.2.b.0.6.1.2.c.a.1.3.4.b.d.b.5.b.b.8.d.9.2.e.9.6.9.d.7.5.3.1.8.d.!.u.f.p.4.r.v.U.3.S.P...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F8A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Oct 23 15:04:07 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	41386
Entropy (8bit):	1.6708722927420803
Encrypted:	false
SSDEEP:	192:Z1RirJqrOAPlWc7hgH2OOAE/vm7dRqIQ+KDk:iJ9APlWc7AZ7dRqbQ
MD5:	9424A96BE11B4515F78D1F592E024FE6
SHA1:	4FCEF27C7165C7EE535AAD000F008A097B048C62
SHA-256:	E155C6AC5848717E6E40613231C3720F6C0061F0172868BAD0A4768F27036CD4
SHA-512:	BCCBFC1CB0D5B89023AEE08A9C862B0E4479B639E9E2B86854CD32EBC4AF5B81656572BF0268F742830D54F84FF96C38A818798645DB4681ACFBB8683AF9C176
Malicious:	false
Preview:	MDMP..a..... .......g..g........................d...........d...............T.......8...........T...........................0...........................................................................................eJ..............GenuineIntel............T...........f..g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6FE8.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8374
Entropy (8bit):	3.6904986415410006
Encrypted:	false
SSDEEP:	192:R6l7wVeJTa6zb5zbe6YSFSU9tyDyGgmfA4QPpr789blbGsfgfjm:R6lXJO6zdzi6YASU9t2TgmfA4Q+lblfx
MD5:	E842D7CCEFAFAAF2BDB9E96583D7514C
SHA1:	52876465285C566A2F23DE43A43A212E2B4B890F
SHA-256:	3FE158AA36B74AC4B665FF82D4EC760AD982C29BE4ACB3457EE7FDFB663B78C9
SHA-512:	668B65139119C1F2EE3FB7CACA3D714766C4288FCC188FE3F8013823A5919C572BACDAAC49A7087950D54436C85211A6BC78FBB6B8CE9C7CCAD05DEC982B4C84
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.6.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7018.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4696
Entropy (8bit):	4.465101796608262
Encrypted:	false
SSDEEP:	48:cvIwWl8zsSJg77aI9A/hWpW8VYRYm8M4JnUFq+q8vm1xDSprPaad:uIjfgI7Iw7VdJzKqpkbaad
MD5:	D6795F0E7F58F7FC0CAEC670A5BBD030
SHA1:	A6691937A45632AB2D3609F54F1FC1752FB0D872
SHA-256:	B771E97519924FB4A22E73FBC1B5D7B9725C91D09869016EBDAAB52E8090CDE3
SHA-512:	4E6980761B39E1A8DB402005DF9F22DC44B588DCC890C3ED53682F90BD634C4021FD1B4349D890805C452403604C78172BFD7138EDDE5A3B80D05B98C375295E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="556206" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Honda.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\Honda\Honda.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	841
Entropy (8bit):	5.351831766340675
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhPKIE4oKNzKoIvEE4xDqE4j:MxHKlYHKh3oPtHo6wvEHxDqHj
MD5:	98DCC730A3C77DCDCA7CD8717EB5D42A
SHA1:	639509210C17EB73F5DB581FA8CA46B1157D8806
SHA-256:	E3C80885BCC7FE4F349EFB0470D261E0DE273EE26D47AF09C79F1B4B2F891E49
SHA-512:	7D11C53167839D428DAE35BF759C73FC0C7C49F2DE35CC99E4F8B69CDD40DFBEEF6D355F15FAB1EED62A64AF94E7BA311C0F8E07C3DA6F3A63410CC3E9882B78
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..2,"Microsoft.Build.Framework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.Build, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	636
Entropy (8bit):	5.363873409814957
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhadDLI4MNsf6cv:ML9E4KlKDE4KhKiKhwE4Tye
MD5:	43484EA7D5BD7DE47119BC063D65D7AF
SHA1:	FCE0A3922FB3E421F8EF74E9A94E60F8DE7F97F5
SHA-256:	C00C48279B0CCFF866BB59D1DD5B77C65594B86BD4D16DE0F2EFAD2778F57A23
SHA-512:	A56C0609179C003044AFEC26019EAEC0ECC772108327EB01F817B88780981289A61E795F6E8745FDEAE99D8543B57344F80A9542BDA2933787C5C8331C869820
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\bb5812ab3cec92427da8c5c696e5f731\System.Net.Http.ni.dll",0..

C:\Users\user\AppData\Local\Temp\Honda\Honda.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	262432
Entropy (8bit):	6.179415524830389
Encrypted:	false
SSDEEP:	3072:7a0t0yH5wCwie3NnQNLpj/Wnqvsw2XpFU4rwOeTubZSzf02RFihx2uzj:m0ny3nnKpqnZRXfw702birr/
MD5:	8FDF47E0FF70C40ED3A17014AEEA4232
SHA1:	E6256A0159688F0560B015DA4D967F41CBF8C9BD
SHA-256:	ED9884BAC608C06B7057037CC91D90E4AE5F74DD2DBCE2AF476699C6D4492D82
SHA-512:	BD69D092ED4F9C5E1F24EAF5EC79FB316469D53849DC798FAE0FCBA5E90869B77EE924C23CC6F692198FF25827AB60AD47BB46CADD6E0AADDE7731CBAFB013BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: igCCUqSW2T.exe, Detection: malicious, Browse Filename: juwXcVX5AK.exe, Detection: malicious, Browse Filename: qBtDOzhQnS.exe, Detection: malicious, Browse Filename: igCCUqSW2T.exe, Detection: malicious, Browse Filename: tfduJDS9iM.exe, Detection: malicious, Browse Filename: otq9AG1EIk.exe, Detection: malicious, Browse Filename: KO8mPIAMHh.exe, Detection: malicious, Browse Filename: tfduJDS9iM.exe, Detection: malicious, Browse Filename: otq9AG1EIk.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.].........."...0..\|...B......:.... ........@.. ...............................L....`....................................O........>.............. A........................................................... ............... ..H............text...Xz... ...\|.................. ..`.rsrc....>.......@...~..............@..@.reloc..............................@..B........................H........)...................\|...........................................{.......v.(=....r...p({...-..+..}........0..%........(....-......(z.....&..}..............................0..5........(....-...-.r+..ps>...z.....i(z.....&..}......................%......>....(?...(....N..(@....oA...(....:...(B...(....:...(C...(....*....(........0..G........(....,....(....-...}......r...p(x...&.(v.....}......&..}....................7.......0..f........-.r7..ps>...z .....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleApp_6d4e6e429fc6404698bba07c4b921c78.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Wed Oct 23 14:04:06 2024, mtime=Wed Oct 23 14:04:06 2024, atime=Sat Dec 7 08:10:48 2019, length=262432, window=hide
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	4.961321765393267
Encrypted:	false
SSDEEP:	24:8Rc9FJR6gKx8YQE5ryhREsQAkMIK+E6E6ptz1Zqygm:8Rc7JRINQw+hRVkMIK+/ZtZwyg
MD5:	1075EC8836DC6E584656935B37C2A966
SHA1:	02D6331903C80CBECDFB9F45AFCC79A84C0965A1
SHA-256:	9E6E97F9A7395E741C7AB52DAA50B57808C53CE4D255BB343281553851DDBF20
SHA-512:	836792F4B86EFFDC1BF8A7AB541618CD16657475B41CB660F688F3E8EBC048B6FDBC9411A4FF8B64200DE9D4F998626C63E5B2357F4531ED7B164A31BFBC310E
Malicious:	false
Preview:	L..................F....".....O.\%....O.\%..{.#7... .........................:..DG..Yr?.D..U..k0.&...&.......y.Yd...a.].\%....j.\%......t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)BWY.x..........................d...A.p.p.D.a.t.a...B.P.1.....WY.x..Local.<......EW)BWY.x.............................L.o.c.a.l.....N.1.....WY.x..Temp..:......EW)BWY.x.............................T.e.m.p.....P.1.....WY.x..Honda.<......WY.xWY.x.....(........................H.o.n.d.a.....\.2. ....OYI".Honda.exe.D......WY.xWY.x.....(..........p.............H.o.n.d.a...e.x.e.......a...............-.......`...........a........C:\Users\user\AppData\Local\Temp\Honda\Honda.exe..,.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.H.o.n.d.a.\.H.o.n.d.a...e.x.e.........\|....I.J.H..K..:...`.......X.......506013...........hT..CrF.f4... .C..Yc...,...E...hT..CrF.f4... .C..Yc...,...E..............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372063883413596
Encrypted:	false
SSDEEP:	6144:ZFVfpi6ceLP/9skLmb0ayWWSPtaJG8nAge35OlMMhA2AX4WABlguNBiL:PV1QyWWI/glMM6kF7Dq
MD5:	DBDA216667D4EDDC28F8A6759B27FE1D
SHA1:	73B90DBD49D81DC6891F3B269EBEF79A8B01529F
SHA-256:	58353F960C625BCB7DCBD95FB773155B10202FB2E043159691B7019A5B3C6C29
SHA-512:	02DCED2B47B934D50A697ADA327C9AC12AE31E5643DD452A3A92AECDDBA63AA645389E05CE0CD6774DE131F9093C75D2C6CAAE072FDAEA89AF4BDE23A9B55415
Malicious:	false
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm....\%..............................................................................................................................................................................................................................................................................................................................................D.h.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\Honda\Honda.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	298
Entropy (8bit):	4.924206445966445
Encrypted:	false
SSDEEP:	6:zx3M1tFAbQtASR30qyMstwYVoRRZBXVN+J0fFdCsq2UTiMdH8stCal+n:zK13P30ZMt9BFN+QdCT2UftCM+
MD5:	932782CF70ED00D22C0B08B5027B4E31
SHA1:	78F460A2155D9E819B8452C281285D7E0A7AC14F
SHA-256:	F2C2477FB3FD0A30F3D3D8637EF9C774B43E940043635DF90CDD804799A2ECE7
SHA-512:	C83E72797C03CABCAB066B95BAEEBB13944143846794061CF9482EA3B283979E470930047FDAE72A6F06F51F3127FF39DAAEFAAD7557E3AD49F590B9E7B78D24
Malicious:	false
Preview:	Microsoft (R) Build Engine version 4.8.4084.0..[Microsoft .NET Framework, version 4.0.30319.42000]..Copyright (C) Microsoft Corporation. All rights reserved.....MSBUILD : error MSB1003: Specify a project or solution file. The current working directory does not contain a project or solution file...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.858231551366821
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ufp4rvU3SP.exe
File size:	294'016 bytes
MD5:	56267b2331a42b473283d7f2798cc1f5
SHA1:	29407f372b0612ca134bdb5bb8d92e969d75318d
SHA256:	eb701cd5f43f77e8c9eb399bbb9c0bff5b14004925b92c6210bf2ccf3a1135e7
SHA512:	2f9c0b086e8fa4123db6b640ee27abfc2f5f05743d4750002f4de0c6b0b5c7861f2329573fddf92cc608ec50c25b1f0b61d177f448b1d663f885c341a53fb634
SSDEEP:	6144:QuEDjIKQebn/EWGIezYFuJ1RAldW7FMWuAJc5alr7v:NWIKQeb/E3JUlABNJcAlr7v
TLSH:	3354AE2279C0C472D66325310AF4DBB56B7DF9700F655A8F67A80B7E0F702819B31A6B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........L..v...v...v...u...v...s.a.v...r...v...w...v...w.M.v...r...v...u...v...s...v.......v.......v...t...v.Rich..v................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x409922
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6716513E [Mon Oct 21 13:03:58 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	31770ac6e89309fe8c99522fb04f055c

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	31/08/2023 02:00:00 31/08/2026 01:59:59
Subject Chain	CN=Privacy Technologies OU, O=Privacy Technologies OU, S=Harjumaa, C=EE
Version:	3
Thumbprint MD5:	AD1BCBF19AE2F91BB114D33B85359E56
Thumbprint SHA-1:	141D90A1BA8F61863FBEDDF7DD1D66C1D1E0B128
Thumbprint SHA-256:	A08EA2A7A257AD690B988446951E9DEF2986A2F3F546B6F0902805330F3B6B48
Serial:	00D0461B529F67189D43744E9CEFE172AE

Entrypoint Preview

Instruction
call 00007F3EBCD74ED0h
jmp 00007F3EBCD7435Fh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F3EBCD73F02h
jmp 00007F3EBCD744C2h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00432180h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00432180h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00432180h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30bc0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x43000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x44e00	0x2e80
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x44000	0x2104	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2e088	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2e0c0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2dfc8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x26000	0x158	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x247c5	0x24800	6dae0d479bc611c4ee23089dfeba7452	False	0.583623180650685	data	6.665208556636056	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x26000	0xb3c6	0xb400	a83439cce44dd8cdadafac7224d8129d	False	0.4263237847222222	data	4.900884880517839	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x32000	0x106cc	0xf800	165c81362e9bab5d52efe1dce4311a7c	False	0.915495841733871	data	7.834803492227552	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x43000	0x1e0	0x200	9866eeb93e80b773405f3d7936b83641	False	0.52734375	data	4.7074344725994175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x44000	0x2104	0x2200	1f7fd92f797137669f7137f1f00d6e76	False	0.7344898897058824	data	6.455013830478276	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bsp	0x47000	0x3000	0x3000	cb48a2ce30fdb738d07aa9b335b543e2	False	0.033772786458333336	data	0.3557900760954866	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x43060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

GlobalFindAtomA, RaiseException, GetCurrentThreadId, IsProcessorFeaturePresent, GetLastError, FreeLibraryWhenCallbackReturns, CreateThreadpoolWork, SubmitThreadpoolWork, CloseThreadpoolWork, GetModuleHandleExW, WakeAllConditionVariable, SleepConditionVariableSRW, InitOnceComplete, InitOnceBeginInitialize, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, WideCharToMultiByte, CloseHandle, QueryPerformanceCounter, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, MultiByteToWideChar, LCMapStringEx, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, GetStringTypeW, GetCPInfo, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsDebuggerPresent, GetStartupInfoW, GetCurrentProcessId, InitializeSListHead, CreateFileW, RtlUnwind, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleFileNameW, GetStdHandle, WriteFile, HeapAlloc, HeapFree, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetFileType, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, ReadFile, GetFileSizeEx, SetFilePointerEx, ReadConsoleW, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, SetStdHandle, HeapSize, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 23, 2024 17:04:00.908982992 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:00.909085989 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:00.909933090 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:00.909992933 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:00.910196066 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:00.910245895 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:00.911932945 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:00.911973000 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:00.912997961 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:00.913111925 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:00.918432951 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:00.918545961 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.039443016 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.039747000 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.039834976 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.039879084 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.039940119 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.040066004 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.043693066 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.044418097 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.045115948 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.048907995 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.049026966 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.049452066 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.049514055 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.049583912 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.049884081 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.050491095 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.050921917 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.052495956 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.056277990 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.058089972 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.176580906 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.179263115 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.179419041 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.179446936 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.179485083 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.181435108 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.181459904 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.183811903 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.183886051 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.184751034 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.185379982 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.185446978 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.185869932 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.186774969 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.187252045 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.193810940 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.313960075 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.315531969 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.315567970 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.315593004 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.317812920 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.317876101 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.318569899 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.319792986 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.319868088 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.320417881 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.320485115 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.321794033 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.322144985 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.323748112 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.327270985 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.371566057 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.439589024 CEST	49671	443	192.168.2.8	204.79.197.203
Oct 23, 2024 17:04:01.451003075 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.451025009 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.451093912 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.451385975 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.451886892 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.451931953 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.454668999 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.454710007 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.454757929 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.454972029 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.455013990 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.455722094 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.458484888 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.459005117 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.459748030 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.460841894 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.461352110 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.464066029 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.464602947 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.465365887 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.588502884 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.589215994 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.589294910 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.590858936 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.591279984 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.591345072 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.591387987 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.591516972 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.592350006 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.593561888 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.594038963 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.594611883 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.596762896 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.596837044 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.599097967 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.599450111 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.600963116 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.724127054 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.724306107 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.724318027 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.724481106 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.726039886 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.726106882 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.726231098 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.726882935 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.726938009 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.727788925 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:01.783301115 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:01.783328056 CEST	49673	443	192.168.2.8	23.206.229.226
Oct 23, 2024 17:04:01.783337116 CEST	49677	80	192.168.2.8	192.229.211.108
Oct 23, 2024 17:04:02.095967054 CEST	49672	443	192.168.2.8	23.206.229.226
Oct 23, 2024 17:04:02.156157970 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.161515951 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.172593117 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.177894115 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.186012030 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.186444044 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.191390991 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.191965103 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.201853037 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.207207918 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.293796062 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.306004047 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.306240082 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.318793058 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.319133997 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.319670916 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.319749117 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.324587107 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.328402042 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.333944082 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.334112883 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.339591980 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.347995996 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.350219965 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.355798960 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.451576948 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.461877108 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.461951971 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.467005968 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.480356932 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.480428934 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.482655048 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.491449118 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.492350101 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.497844934 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.531347990 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.539953947 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.540736914 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.546092033 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.591579914 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.624825954 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.625118017 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.625130892 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.625214100 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.649868011 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.655304909 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.664100885 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.672521114 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.672646999 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.673041105 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.673055887 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.673109055 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.687724113 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.694236994 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.702862978 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.703737020 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.934382915 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.934525967 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.935218096 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.935295105 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.935622931 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.935674906 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.936722040 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:02.967411041 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:02.972918034 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.063297987 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.063360929 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.063452959 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.063786030 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.064526081 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.064585924 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.064619064 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.094619036 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.099559069 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.099654913 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.110481024 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.111730099 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.117224932 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.120702028 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.125212908 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.126380920 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.175604105 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.230113983 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.233133078 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.239487886 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.244854927 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.245013952 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.245079994 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.247730017 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.270905972 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.270972967 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.270984888 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.271054983 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.271347046 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.271409035 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.271460056 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.274868965 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.274955988 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.275166988 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.280297995 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.327591896 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.366763115 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.366777897 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.366887093 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.369385958 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.375668049 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.398643970 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.401001930 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.407357931 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.407382965 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.407449007 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.408483982 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.410720110 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.410895109 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.411147118 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.416405916 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.464515924 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.502409935 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.504668951 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.510200977 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.533782959 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.544383049 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.544459105 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.544460058 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.545275927 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.545345068 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:03.637389898 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:04:03.689656019 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:04:09.783294916 CEST	49676	443	192.168.2.8	52.182.143.211
Oct 23, 2024 17:04:11.392673969 CEST	49673	443	192.168.2.8	23.206.229.226
Oct 23, 2024 17:04:11.705159903 CEST	49672	443	192.168.2.8	23.206.229.226
Oct 23, 2024 17:04:12.408293009 CEST	49677	80	192.168.2.8	192.229.211.108
Oct 23, 2024 17:04:13.494051933 CEST	443	49706	23.206.229.226	192.168.2.8
Oct 23, 2024 17:04:13.495275974 CEST	49706	443	192.168.2.8	23.206.229.226
Oct 23, 2024 17:04:50.252392054 CEST	49704	80	192.168.2.8	104.18.38.233
Oct 23, 2024 17:04:50.252490997 CEST	49705	80	192.168.2.8	172.64.149.23
Oct 23, 2024 17:04:50.252537012 CEST	49703	80	192.168.2.8	104.18.38.233
Oct 23, 2024 17:04:50.276179075 CEST	80	49704	104.18.38.233	192.168.2.8
Oct 23, 2024 17:04:50.276194096 CEST	80	49705	172.64.149.23	192.168.2.8
Oct 23, 2024 17:04:50.276204109 CEST	80	49703	104.18.38.233	192.168.2.8
Oct 23, 2024 17:04:50.276305914 CEST	49704	80	192.168.2.8	104.18.38.233
Oct 23, 2024 17:04:50.276308060 CEST	49705	80	192.168.2.8	172.64.149.23
Oct 23, 2024 17:04:50.276344061 CEST	49703	80	192.168.2.8	104.18.38.233
Oct 23, 2024 17:05:33.634818077 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:05:33.635942936 CEST	49707	443	192.168.2.8	13.107.253.45
Oct 23, 2024 17:05:33.642438889 CEST	443	49707	13.107.253.45	192.168.2.8
Oct 23, 2024 17:05:33.642518997 CEST	49707	443	192.168.2.8	13.107.253.45

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 23, 2024 17:04:22.433922052 CEST	1.1.1.1	192.168.2.8	0x7087	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:04:22.433922052 CEST	1.1.1.1	192.168.2.8	0x7087	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 23, 2024 17:04:35.761883974 CEST	1.1.1.1	192.168.2.8	0x1fd6	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 23, 2024 17:04:35.761883974 CEST	1.1.1.1	192.168.2.8	0x1fd6	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	11:04:06
Start date:	23/10/2024
Path:	C:\Users\user\Desktop\ufp4rvU3SP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\ufp4rvU3SP.exe"
Imagebase:	0x110000
File size:	294'016 bytes
MD5 hash:	56267B2331A42B473283D7F2798CC1F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:04:06
Start date:	23/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x240000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:04:06
Start date:	23/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xa10000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:04:06
Start date:	23/10/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7672 -s 280
Imagebase:	0xac0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:04:07
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\Honda\Honda.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
Imagebase:	0xd90000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:04:07
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:04:17
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\Honda\Honda.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
Imagebase:	0xc20000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:04:17
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:04:25
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\Honda\Honda.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
Imagebase:	0x290000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:04:25
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:04:34
Start date:	23/10/2024
Path:	C:\Users\user\AppData\Local\Temp\Honda\Honda.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Honda\Honda.exe"
Imagebase:	0x300000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:04:34
Start date:	23/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.9%
Total number of Nodes:	1392
Total number of Limit Nodes:	7

Executed Functions

Function 00112F7C Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00150260,000004E4,00000040,?), ref: 00112FD1

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1aaecb8d5df924af27933b3fec800b3be531c279c9abff2fcec9e058f295162c
Instruction ID: 06b4179fa6a2ffce8012d5f21ca3e6c7b6dcc920941a829b85de9f07469824da
Opcode Fuzzy Hash: 1aaecb8d5df924af27933b3fec800b3be531c279c9abff2fcec9e058f295162c
Instruction Fuzzy Hash: 5C1102722047059FE31CEF24C805B9AB3D0EB58720F00482DF9648B3D2DBB5E991CA96

Function 0012C9D4 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 0012CA5B
__alloca_probe_16.LIBCMT ref: 0012CB1C
__freea.LIBCMT ref: 0012CB83

Part of subcall function 00127A23: HeapAlloc.KERNEL32(00000000,0012DBAE,?,?,0012DBAE,00000220,?,?,?), ref: 00127A55

__freea.LIBCMT ref: 0012CB98
__freea.LIBCMT ref: 0012CBA8

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 1ef2f9104011fc8005c8d9f52f856853a7016f4ec34f0d88072588610c7b32c6
Instruction ID: d04dbebe4e4d0c42e8209b5e69ff098749a450c71d166561f72a4136d0dbc83f
Opcode Fuzzy Hash: 1ef2f9104011fc8005c8d9f52f856853a7016f4ec34f0d88072588610c7b32c6
Instruction Fuzzy Hash: D451B57260022A6FEF259E64EC82EBF7AA9EF54750B150128FE04E7151E775CD60C7E0

Function 0012DDAA Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0012D8DA: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 0012D905

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,0012DBF1,?,00000000,?,?,?), ref: 0012DE0B
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,0012DBF1,?,00000000,?,?,?), ref: 0012DE4D

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: b314ba49b9fab940e7e7cf19160e2bf8d3007d3be74f4a86621611b0ea28db66
Instruction ID: 6153f9c6b8e4aa092ea5867444e92a22db97dec1be9d2c926485cf27c36a7844
Opcode Fuzzy Hash: b314ba49b9fab940e7e7cf19160e2bf8d3007d3be74f4a86621611b0ea28db66
Instruction Fuzzy Hash: 72515470A003659EDB25CF35F8816BABBF4EFA1310F19806EE0838B251E7749996CB51

Function 0012762C Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,0012CAC2,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00127660
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,0012CAC2,?,?,00000000,?,00000000), ref: 0012767E

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 28faae609ec410fe894dc50d2beee7fdd1080269b6cd8be5e1cf5816de8a5546
Instruction ID: c4803571271dc61df02bf8352600c67b1876585eee45108a72f05648063071de
Opcode Fuzzy Hash: 28faae609ec410fe894dc50d2beee7fdd1080269b6cd8be5e1cf5816de8a5546
Instruction Fuzzy Hash: B4F0983200462ABBCF126F94EC09DDE3F26EF583A0F068110FA1965560CB36C972EB94

Function 0012D9AE Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,0012DBFD,0012DBF1,00000000), ref: 0012D9E0

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 42bf34fdc0fe4c13b74a27cd47ed7f84d0c80c0ff543560b6685c11d1f42c05c
Instruction ID: 6ebe7d978d3bc4db4b0b08a3189d9ff95be0a6ba9b56fa02bb6f60a80b05d55e
Opcode Fuzzy Hash: 42bf34fdc0fe4c13b74a27cd47ed7f84d0c80c0ff543560b6685c11d1f42c05c
Instruction Fuzzy Hash: 045159719082689FCB218F28EC84EFA7BB8EB56304F2405EDE59AC7142C3349E55DF20

Function 001157E2 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 001157EF

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b8fda4a49745283d9c7f1d36e0c4840413838e1903fc80ba632bb2638c99e012
Instruction ID: 37557f5dd0335792a28d700e2d52207a3c4ab895225829164d824e6961c54afc
Opcode Fuzzy Hash: b8fda4a49745283d9c7f1d36e0c4840413838e1903fc80ba632bb2638c99e012
Instruction Fuzzy Hash: 7DD0A7749042087BCF0CFBB5D849CDE73BCAF18701B9044B8B5158B5A6EB30E94AC741

Non-executed Functions

Function 001310A3 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00131287

Strings

1#SNAN, xrefs: 001311AF
1#IND, xrefs: 001311A8
1#INF, xrefs: 001311D9
1#QNAN, xrefs: 001311B6

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 650bb460f95da6d20d66651bd38178bfd9de91cb9b4269d860b6cdf70bfb54df
Instruction ID: e56aa4f109060c9a77b6a6eb349175354576eab7cfb27c3431a3cc1e301c8e5d
Opcode Fuzzy Hash: 650bb460f95da6d20d66651bd38178bfd9de91cb9b4269d860b6cdf70bfb54df
Instruction Fuzzy Hash: 38D23871E082299FDB69DF28DD407EAB7B5EB54305F1441EAD80DE7240EB78AE858F40

Function 0013051E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0013083C,00000002,00000000,?,?,?,0013083C,?,00000000), ref: 001305B7
GetLocaleInfoW.KERNEL32(?,20001004,0013083C,00000002,00000000,?,?,?,0013083C,?,00000000), ref: 001305E0
GetACP.KERNEL32(?,?,0013083C,?,00000000), ref: 001305F5

Strings

ACP, xrefs: 0013053C
OCP, xrefs: 00130572

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: ff64ba572482135bd9bed5bd7cb91b76809af8dd78e4d9e1bee6a0569588712d
Instruction ID: 21b1a06b5fbdffe793ca89c6b590c25d928606ae78c12cddfa47fe96733d0481
Opcode Fuzzy Hash: ff64ba572482135bd9bed5bd7cb91b76809af8dd78e4d9e1bee6a0569588712d
Instruction Fuzzy Hash: 9D21C232A41105EAEB3ACF24CD61B9773E6AB5CB60F568564E94AD7110E732DE80CB90

Function 001306F3 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00128DB3: GetLastError.KERNEL32(?,00000008,001269CC), ref: 00128DB7
Part of subcall function 00128DB3: SetLastError.KERNEL32(00000000,00140710,00000024,0011DDA3), ref: 00128E59

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 001307FF
IsValidCodePage.KERNEL32(00000000), ref: 00130848
IsValidLocale.KERNEL32(?,00000001), ref: 00130857
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0013089F
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 001308BE

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 71e9a00e1ecd3399ad2c3b193ecb60a97a37ff83172471c543f6c3b0489811b0
Instruction ID: 613837f0b8cd0453b0a4269782cb42f4a280f0637419883f526ae86bdc4abd01
Opcode Fuzzy Hash: 71e9a00e1ecd3399ad2c3b193ecb60a97a37ff83172471c543f6c3b0489811b0
Instruction Fuzzy Hash: BD518E72E00209ABDB16DFA5DC51BAE77F8BF1C700F044469F955EB190EB70AA44CBA1

Function 0012FD8F Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00128DB3: GetLastError.KERNEL32(?,00000008,001269CC), ref: 00128DB7
Part of subcall function 00128DB3: SetLastError.KERNEL32(00000000,00140710,00000024,0011DDA3), ref: 00128E59

GetACP.KERNEL32(?,?,?,?,?,?,00124F88,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0012FE50
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00124F88,?,?,?,00000055,?,-00000050,?,?), ref: 0012FE7B
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0012FFDE

Strings

utf8, xrefs: 0012FF4D

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: a7f96cf4313167abe541ad2d12a9925690847a1c460006773a56ab789a4b3483
Instruction ID: 0681dd109337c1e5ad163b4234bb67520ac5e992fea033bab47bce4430e8824d
Opcode Fuzzy Hash: a7f96cf4313167abe541ad2d12a9925690847a1c460006773a56ab789a4b3483
Instruction Fuzzy Hash: C3710432600226ABEB29AB74ED46BABB3B8EF15700F15403DF505D7181FB70ED628760

Function 00127C32 Relevance: 6.3, APIs: 4, Instructions: 337COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00127CBF

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 345b19b73ae581e04342a76ae529d1a1f04ad07f21d6b651d60a02739456ec14
Instruction ID: af0f51afe32f1ffc4401e25621d505cc17bf8897619253bbd0f38dab3c56750d
Opcode Fuzzy Hash: 345b19b73ae581e04342a76ae529d1a1f04ad07f21d6b651d60a02739456ec14
Instruction Fuzzy Hash: 0FB16B3290C2669FDB158F68E891BFFBBA5EF55300F1541AAE815AB3C1D3349D21C7A0

Function 0011A085 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0011A091
IsDebuggerPresent.KERNEL32 ref: 0011A15D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0011A176
UnhandledExceptionFilter.KERNEL32(?), ref: 0011A180

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 001275d15626fb70e199a436db06e6e2c470d6323ebf0d4821a15db50e9bdd2d
Instruction ID: c4489d1dae6bfafd4e191b0e8af6ab175644d20073a41b07d991978082f799f3
Opcode Fuzzy Hash: 001275d15626fb70e199a436db06e6e2c470d6323ebf0d4821a15db50e9bdd2d
Instruction Fuzzy Hash: AA31F5B5D02218ABDF25DFA4D9497CDBBB8AF18300F5041AAE40DAB250EB719BC4CF45

Function 001301A2 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00128DB3: GetLastError.KERNEL32(?,00000008,001269CC), ref: 00128DB7
Part of subcall function 00128DB3: SetLastError.KERNEL32(00000000,00140710,00000024,0011DDA3), ref: 00128E59

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 001301F6
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00130240
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00130306

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: e46b85f1a6e9cd6ca8308b466d6266364ccea2a5b9801c7d943e1336ad571dc3
Instruction ID: 8700c85347a1e282895675d965cc8bd03828ab6b3185a89f5e63b81ea58e0b8b
Opcode Fuzzy Hash: e46b85f1a6e9cd6ca8308b466d6266364ccea2a5b9801c7d943e1336ad571dc3
Instruction Fuzzy Hash: 0661BD719002179FDB2A9F28CCA6BAA77E9FF18300F1080A9E905D6585FB74DD94DB50

Function 00120B69 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00120C61
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00120C6B
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00120C78

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2e90168d1c0cb8b6e23076daffced5b5a1b478d44104a17a4c40862184c6b86d
Instruction ID: 7742794dd61ffc73ef004d2b5f89437765205a1c328b8c2291afffa0265283d6
Opcode Fuzzy Hash: 2e90168d1c0cb8b6e23076daffced5b5a1b478d44104a17a4c40862184c6b86d
Instruction Fuzzy Hash: 0831C47490122CABCB25DF64D9897DCBBB8BF18310F5042EAE41DA7261E7709BC58F45

Function 00112805 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 477COMMON

Download Yara Rule

Strings

ios base: %i, xrefs: 0011297D

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: H_prolog3_catch
String ID: ios base: %i
API String ID: 3886170330-1055636949
Opcode ID: b60fc6ed9c8e20eb129152434e6603381158ab3ca867044ebf00e4650ea0499c
Instruction ID: b8e3c6e28653f296abd4c77e50fc0ab15cd396a37853f3613bc7230cb01dc516
Opcode Fuzzy Hash: b60fc6ed9c8e20eb129152434e6603381158ab3ca867044ebf00e4650ea0499c
Instruction Fuzzy Hash: E3E175729087168FC71CDF78D8812EABBE1EF99320F54463EE965972D1E33589818B81

Function 00122D90 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6c2b0c2b7731d556a830f47680bcf32448849bf7266fb62c648a6abdd5fe24
Instruction ID: 7f09ce8ccd65a3534b5ca1e745c26b398a98fc864f6032ecd6bdfd8470e7c860
Opcode Fuzzy Hash: 5d6c2b0c2b7731d556a830f47680bcf32448849bf7266fb62c648a6abdd5fe24
Instruction Fuzzy Hash: B0F16071E002299FDF14CFA8D880AADFBB1FF48314F158269E825A7380D735AE55CB94

Function 00112A0F Relevance: 1.9, APIs: 1, Instructions: 384COMMON

Download Yara Rule

APIs

Part of subcall function 0011301A: __EH_prolog3_catch.LIBCMT ref: 00113021

_Deallocate.LIBCONCRT ref: 00112E06

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: DeallocateH_prolog3_catch
String ID:
API String ID: 20358830-0
Opcode ID: b205591d52042a80474cd02ee0ade2311398e6ed513a44da6cb67509e3884182
Instruction ID: 043e55e6742c78fb21d015e4b70c8484e70d0f91c2a0132ee361bf04933d4f41
Opcode Fuzzy Hash: b205591d52042a80474cd02ee0ade2311398e6ed513a44da6cb67509e3884182
Instruction Fuzzy Hash: CCB1C333D14A1A4BC70CDE78D9511EEFA95EF9A320F55433BE925EB3D0E3358A428684

Function 0012943C Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00129437,?,?,00000008,?,?,00134915,00000000), ref: 00129669

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: b942bea0fc546f28199f64933d9acea8ba464fc5351fa7e0ae9195c133b5cbb3
Instruction ID: bb2a65a83f06fec838b9b6cbda47ee83610044501ac0c89e9bf8f60bfd51d35f
Opcode Fuzzy Hash: b942bea0fc546f28199f64933d9acea8ba464fc5351fa7e0ae9195c133b5cbb3
Instruction Fuzzy Hash: 23B14C71610618CFD719CF2CD48ABA57BE0FF45364F258659E89ACF2A1C335E9A2CB40

Function 00119B05 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00119B1B

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 3ac86fac2e861fea57027dae1a077cdca342985bb2dc247b56d4019e91f5fd8a
Instruction ID: 3fcd8891897c755a3547c7ca98f4639ad05cbeaec09ef341e563b236869fcaf1
Opcode Fuzzy Hash: 3ac86fac2e861fea57027dae1a077cdca342985bb2dc247b56d4019e91f5fd8a
Instruction Fuzzy Hash: 8EA1AEB5910645CFDB28CF54E8916ADBBF0FB4A720F14816AE911EBBA0D334A9C1CF50

Function 0012D2FE Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f141755375a5098304a55601371dc6bf2fa8440d705b05b06138ae20846bc104
Instruction ID: 94cfeb9c28d5a7cfb706381fba53042c4347481a33b4d800c5e45fd680e80ae9
Opcode Fuzzy Hash: f141755375a5098304a55601371dc6bf2fa8440d705b05b06138ae20846bc104
Instruction Fuzzy Hash: 8C41C5B5C0422DAFCF20DF69EC89AAABBB9EF55304F5442D9E408D3211DB309E958F50

Function 0011FD34 Relevance: 1.6, Strings: 1, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 0011FEC2

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: e33870634044e12d7e07d2789735371644d8e38e4ea05c5c0f266d5dd42c6118
Instruction ID: a4c06b489b9a36eface8e2128ee20fd4dd81dd82661dbfdb4106ace443fef729
Opcode Fuzzy Hash: e33870634044e12d7e07d2789735371644d8e38e4ea05c5c0f266d5dd42c6118
Instruction Fuzzy Hash: 03C1CF3060064A8FDB2DCFA8D4946FEBBA1BF19300F25463DE456972A2D731AD87CB51

Function 001303F5 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00128DB3: GetLastError.KERNEL32(?,00000008,001269CC), ref: 00128DB7
Part of subcall function 00128DB3: SetLastError.KERNEL32(00000000,00140710,00000024,0011DDA3), ref: 00128E59

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00130449

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: bec3a587a9fe0905b186e3e86f1516dc8cd45965056dd901808d7dcbdabcef9b
Instruction ID: 6d5b3e54f3e0379579fc3a37e05cd01ebec9e1d7ca7bbc0e434c160f36502cf7
Opcode Fuzzy Hash: bec3a587a9fe0905b186e3e86f1516dc8cd45965056dd901808d7dcbdabcef9b
Instruction Fuzzy Hash: 0A21C272601216ABEB299B64DC52ABA33E8EF58310F10407AFA05D6181EB34DE949B50

Function 0013007C Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00128DB3: GetLastError.KERNEL32(?,00000008,001269CC), ref: 00128DB7
Part of subcall function 00128DB3: SetLastError.KERNEL32(00000000,00140710,00000024,0011DDA3), ref: 00128E59

EnumSystemLocalesW.KERNEL32(001301A2,00000001,00000000,?,-00000050,?,001307D3,00000000,?,?,?,00000055,?), ref: 001300EE

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: d34fcc16ecd7f68b6685c4cb77204fc9aa00530ff6d6349f25e480cddf49a1a0
Instruction ID: f084c93b412a3d93657a3b9409b9115d5c27471641f713631e889c901f94cf58
Opcode Fuzzy Hash: d34fcc16ecd7f68b6685c4cb77204fc9aa00530ff6d6349f25e480cddf49a1a0
Instruction Fuzzy Hash: 1111E5366047059FDB1C9F39D8A16BAB7D2FF84358F18842DE98687B40E771A942CB40

Function 00130624 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00128DB3: GetLastError.KERNEL32(?,00000008,001269CC), ref: 00128DB7
Part of subcall function 00128DB3: SetLastError.KERNEL32(00000000,00140710,00000024,0011DDA3), ref: 00128E59

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,001303BE,00000000,00000000,?), ref: 00130650

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: b1f93968fa9bafd51d8e2ed74cfe468c6e43571c3d34ffa66f462ecd467b6eac
Instruction ID: 89fd0ae61fcdffd39ff8929d2898bd1ee97f2305ba13d2575bacaa219e4b57fb
Opcode Fuzzy Hash: b1f93968fa9bafd51d8e2ed74cfe468c6e43571c3d34ffa66f462ecd467b6eac
Instruction Fuzzy Hash: 4BF0F9B2600125BBDB2957608C17BBB7BE4DB84764F164428EC06A3184EB70FF51C5D0

Function 00130117 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00128DB3: GetLastError.KERNEL32(?,00000008,001269CC), ref: 00128DB7
Part of subcall function 00128DB3: SetLastError.KERNEL32(00000000,00140710,00000024,0011DDA3), ref: 00128E59

EnumSystemLocalesW.KERNEL32(001303F5,00000001,?,?,-00000050,?,00130797,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00130161

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: defe2ac4eeda47a709f10ebf294d0da6499487e18ed6c82db56b4e369059613b
Instruction ID: bce5a393628f4cf9533d5c3b8dc0da938eb64963568a782fd6b861074742cbe8
Opcode Fuzzy Hash: defe2ac4eeda47a709f10ebf294d0da6499487e18ed6c82db56b4e369059613b
Instruction Fuzzy Hash: 65F0F6363043046FDB295F399C91A7A7BD1EF84768F09842CFA454B690D7B19C41C650

Function 00127026 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00120E12: EnterCriticalSection.KERNEL32(?,?,00128A8B,?,001407B0,00000008,00128C4F,?,0011EE66,?), ref: 00120E21

EnumSystemLocalesW.KERNEL32(00127019,00000001,00140750,0000000C,001273EB,00000000), ref: 0012705E

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 5413f808b5274cb6de50bcbcaf18012c2cb30d07bbc679c18e34748817346ed0
Instruction ID: cd5d65c60aa77b153aad87504274f377e3ea6e33ca47d3551f47d818fb99e515
Opcode Fuzzy Hash: 5413f808b5274cb6de50bcbcaf18012c2cb30d07bbc679c18e34748817346ed0
Instruction Fuzzy Hash: 84F0A936A04314EFDB00DF98E842B8D77F0FB09B21F10452AF4009B2A1D7B949908F80

Function 00130031 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00128DB3: GetLastError.KERNEL32(?,00000008,001269CC), ref: 00128DB7
Part of subcall function 00128DB3: SetLastError.KERNEL32(00000000,00140710,00000024,0011DDA3), ref: 00128E59

EnumSystemLocalesW.KERNEL32(0012FF8A,00000001,?,?,?,001307F5,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00130068

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 37fee9d3241a85b6b3b5d90a7002024dbea214b47d75535bca6c5dcb54202037
Instruction ID: 3885f95948a933c95ec5e79a669344e4f7332ebf958ef7bfa442e0d55dcbbec7
Opcode Fuzzy Hash: 37fee9d3241a85b6b3b5d90a7002024dbea214b47d75535bca6c5dcb54202037
Instruction Fuzzy Hash: A8F0553A30020567CB089F35D85576A7FD0EFC2750F0A406CFA098B290C7759843CB90

Function 001274EF Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00125AEE,?,20001004,00000000,00000002,?,?,001250F0), ref: 00127523

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 4839021a54c66ea7a6baf3d9693f9645d958a8b75218c8d9fab153fcd1528698
Instruction ID: 02fa343ef3e4c646c27e3579bd71c2f304a7237793eaaaf30402bbae65252d14
Opcode Fuzzy Hash: 4839021a54c66ea7a6baf3d9693f9645d958a8b75218c8d9fab153fcd1528698
Instruction Fuzzy Hash: AAE04F35504639BBCF122F60EC09A9FBF15EF54761F058010FD05652A1CB718971AAD5

Function 0011A212 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000A21E,00119799), ref: 0011A217

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d0831f50a52083a68f2601768563b87bbae0db2fef9bd7f160c6333172045386
Instruction ID: 8706dd5e3be95491b6718ac6c445a33a1feffd1099534a7162b0ee3c8d144703
Opcode Fuzzy Hash: d0831f50a52083a68f2601768563b87bbae0db2fef9bd7f160c6333172045386
Instruction Fuzzy Hash:

Function 0012E177 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0012E177

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 08790a476e7e438c2f42362abe73c2335f41a749b08987a9754099e6d3e1b237
Instruction ID: 9ccd73dab35e91318b709cb46327386cf288d1d10d90b250d08b8eedd9940a89
Opcode Fuzzy Hash: 08790a476e7e438c2f42362abe73c2335f41a749b08987a9754099e6d3e1b237
Instruction Fuzzy Hash: 9EA00171601205DB97618F35AA096093AA9BB8A692B058169E809DA961EB349490AA11

Function 0012F840 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: e7b68c32baafd3d130dbf1c9a5b3a2df96c09bf134afbf4da95477fd66b41fec
Instruction ID: 7b11e5d1490a73b36c50e50d73eacbd54d42e1882fac52977c4a8e33255effed
Opcode Fuzzy Hash: e7b68c32baafd3d130dbf1c9a5b3a2df96c09bf134afbf4da95477fd66b41fec
Instruction Fuzzy Hash: A7B124355007559BCB38AF24EC92BB7B3B9EF54308F14453DEA4786680FBB4A996CB00

Function 0011F9EC Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66df9657bcbac95ac7c02c947ae6ed9687520078744ee2aa2631c65a93c87b2a
Instruction ID: cf4459b36485423567730ce393c430be45e1fa0c03bfe2f2b81ec290e713adaa
Opcode Fuzzy Hash: 66df9657bcbac95ac7c02c947ae6ed9687520078744ee2aa2631c65a93c87b2a
Instruction Fuzzy Hash: 40B1DF70904A0A8BCF2CCE68D5A5AFEB7B1AF44314F24063ED856D7291C735A9C3CB95

Function 00112F17 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f18cfb66ebe3af73f3d357e425b69826e362a4cf6dbb2fbb9e9d17ac4bd4b161
Instruction ID: a938a33f5efcb9dd4590999106225c3cebaff9d94ad5717dc3774589069efd43
Opcode Fuzzy Hash: f18cfb66ebe3af73f3d357e425b69826e362a4cf6dbb2fbb9e9d17ac4bd4b161
Instruction Fuzzy Hash: 09E0927060A30097E30C9A54D59A75B3AE9EBC9300F50C03DF189EB3D0DFB8688887D2

Function 0012CC6F Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9be6b6f35371869e062396f73cb3a676a20dd67872fdeac340a7b63f963c531
Instruction ID: cc6aeb5a80099716afad7c43a2ed9f42f50ff26bccff0744ae5249bac019a428
Opcode Fuzzy Hash: c9be6b6f35371869e062396f73cb3a676a20dd67872fdeac340a7b63f963c531
Instruction Fuzzy Hash: 30E08C72925238EBCB24DB88D90499AF3ECEB44B00F110496B605D3200C370DE10CBD0

Function 00123BBE Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5235bc6f45b747b251e4dee57095da2f280f55043986cdd14d68c6e044f9f23d
Instruction ID: c24412a3c079cb464151d137c9b7db72e17cfd634268c404df5036475391778a
Opcode Fuzzy Hash: 5235bc6f45b747b251e4dee57095da2f280f55043986cdd14d68c6e044f9f23d
Instruction Fuzzy Hash: 22C08C34200A6C4ACE298D10A2B53A83354ABE2B82F90048DC5660B642CB2EADA2D602

Function 001192CD Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 001192D3
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 001192E1
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 001192F2
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00119303

Strings

kernel32.dll, xrefs: 001192CE
GetSystemTimePreciseAsFileTime, xrefs: 001192E7
GetTempPath2W, xrefs: 001192F8
GetCurrentPackageId, xrefs: 001192DB

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 239131d89b18ed76863c9fb7fd77c9990b11b406e53936f9d45b02b686649df2
Instruction ID: aff1563fa8c9f56cb334a876a8ca1fe13fea08ab60aaf622f43df4b745a9f9d2
Opcode Fuzzy Hash: 239131d89b18ed76863c9fb7fd77c9990b11b406e53936f9d45b02b686649df2
Instruction Fuzzy Hash: 4BE0ECB6595310FBE7165F74BC0E8853AB4AB057537008661B415D2AA0E7B808C0DB50

Function 0012B85E Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 0012BAD7

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: ab69235b08da2b5df6d10b908066076aac9cc47b544b349fa792c6dd2c788afc
Instruction ID: 3142f57cb3a71c7503639b83ac7b084b185b15e7744ce050271e3cf9b4858e73
Opcode Fuzzy Hash: ab69235b08da2b5df6d10b908066076aac9cc47b544b349fa792c6dd2c788afc
Instruction Fuzzy Hash: 21B13570A08229AFDF15CF98E8C0BBD7BB1BF69310F184058E414AB392C7719DA1CB60

Function 001190E3 Relevance: 12.2, APIs: 8, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 0011912C
__alloca_probe_16.LIBCMT ref: 00119158
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00119197
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001191B4
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 001191F3
__alloca_probe_16.LIBCMT ref: 00119210
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00119252
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00119275

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 429e9e62f6f54013337730bef0e102277a5a31d066e6c230e0bf6e3f5051996f
Instruction ID: b31bf68c06b5f59235074b459b442a700f23d6d4f333fc7436c2972db36600a1
Opcode Fuzzy Hash: 429e9e62f6f54013337730bef0e102277a5a31d066e6c230e0bf6e3f5051996f
Instruction Fuzzy Hash: 5351B072A0021ABBEF284FA4CC55FEB7BA9EF55750F254139F924A6150E7309D90CBA0

Function 0011CE02 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 0011CF21
___TypeMatch.LIBVCRUNTIME ref: 0011D02F
CallUnexpected.LIBVCRUNTIME ref: 0011D19C

Strings

csm, xrefs: 0011CF58
csm, xrefs: 0011CE3F
csm, xrefs: 0011CEAC

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: ebc091f2b7b53f59048e81ceec5285713547579e94f013312f2a7e781cbc4b0f
Instruction ID: 085d32fe87964fabc8645691127c76a40e71de7ed619fd4f94d95ab45bb8f5b7
Opcode Fuzzy Hash: ebc091f2b7b53f59048e81ceec5285713547579e94f013312f2a7e781cbc4b0f
Instruction Fuzzy Hash: 2BB14971800219EFDF1DDFA4E8819EEBBB5BF28311F144169F8156B212D731EA92CB91

Function 0011C8D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0011C907
___except_validate_context_record.LIBVCRUNTIME ref: 0011C90F
_ValidateLocalCookies.LIBCMT ref: 0011C998
__IsNonwritableInCurrentImage.LIBCMT ref: 0011C9C3
_ValidateLocalCookies.LIBCMT ref: 0011CA18

Strings

csm, xrefs: 0011C9AD

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 8c3453cc1ab5127a696b2b70f877d01cfd83a40a836626cae06c5dc89cd9412e
Instruction ID: 290bdae6ae159ed559aab1a93af79abba88c32db6366e0f2ca691dbc86d9f757
Opcode Fuzzy Hash: 8c3453cc1ab5127a696b2b70f877d01cfd83a40a836626cae06c5dc89cd9412e
Instruction Fuzzy Hash: C241E330A4021DABCF18DF68C881ADEBBB5AF45318F148165F8159B392D731EA81CFD1

Function 001271EF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,F8250000,?,58880D5A,?,001272FC,0011EE66,?,F8250000,00000000), ref: 001272B0

Strings

ext-ms-, xrefs: 0012725A
api-ms-, xrefs: 00127246

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: cf88a8b29e0dd22687ebc08a932ea2bb4a98bf0da664d4136a5549b430357722
Instruction ID: ad49ec8e7fc7a4cc09aafd67063d228987fa88b6cbb075d784bf029eec2e4acf
Opcode Fuzzy Hash: cf88a8b29e0dd22687ebc08a932ea2bb4a98bf0da664d4136a5549b430357722
Instruction Fuzzy Hash: 3D213A36A04230E7DF319B61FC85A5B3768EF01360F250110F916A72D0E730ED14C6E0

Function 001173C5 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001173CC
std::_Lockit::_Lockit.LIBCPMT ref: 001173D6
int.LIBCPMT ref: 001173ED

Part of subcall function 00111830: std::_Lockit::_Lockit.LIBCPMT ref: 00111841
Part of subcall function 00111830: std::_Lockit::~_Lockit.LIBCPMT ref: 0011185B

codecvt.LIBCPMT ref: 00117410
std::_Facet_Register.LIBCPMT ref: 00117427
std::_Lockit::~_Lockit.LIBCPMT ref: 00117447
Concurrency::cancel_current_task.LIBCPMT ref: 00117454

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 022a96fc9acbdecfab2a5456fcf8c66ef285ae6fbae47b5cd28c3137930f31dd
Instruction ID: 54667335a10f5d092759d6674197247dd436b6ff8ae49de70d0b66b4f7ed3944
Opcode Fuzzy Hash: 022a96fc9acbdecfab2a5456fcf8c66ef285ae6fbae47b5cd28c3137930f31dd
Instruction Fuzzy Hash: 2701003690421AEBCB0AEBA4D8157FDBB71AF90320F244429E8116B7C2DF709D858B81

Function 0011CA94 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0011CA8B,0011AD89,001169F4,58880D5A,?,?,?,?,001352D0,000000FF), ref: 0011CAA2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0011CAB0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0011CAC9
SetLastError.KERNEL32(00000000,?,0011CA8B,0011AD89,001169F4,58880D5A,?,?,?,?,001352D0,000000FF), ref: 0011CB1B

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6d405bcfbf829b1cd49cabe59dadbba67aaca2048b66030ca916dc3b3549fc30
Instruction ID: d12535f27bf97b873163859ad32ad03e632c341810e876bb6b9aaac855575a1e
Opcode Fuzzy Hash: 6d405bcfbf829b1cd49cabe59dadbba67aaca2048b66030ca916dc3b3549fc30
Instruction Fuzzy Hash: 8E01D4762497116EEA2D2B747C869EA2B95EB127B9320023DF225924F1FFA14DC092C4

Function 00123BE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,58880D5A,?,?,00000000,001354C3,000000FF,?,00123B70,00123CA0,?,00123B44,00000000), ref: 00123C15
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00123C27
FreeLibrary.KERNEL32(00000000,?,?,00000000,001354C3,000000FF,?,00123B70,00123CA0,?,00123B44,00000000), ref: 00123C49

Strings

mscoree.dll, xrefs: 00123C0E
CorExitProcess, xrefs: 00123C1F

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 4fac4ee605d48c17721cdd810bd9a187548ba1d115e351527167b8a0e71fff6b
Instruction ID: d498f667ef231a750606190917661e9575fecdd0aee0a01aecc5f320c30699a4
Opcode Fuzzy Hash: 4fac4ee605d48c17721cdd810bd9a187548ba1d115e351527167b8a0e71fff6b
Instruction Fuzzy Hash: 9601D631A40629FFDB158F50DC09FAEBBB8FB04F11F004525F921A26D0DBB89940CA90

Function 00118BAA Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00118BBE
AcquireSRWLockExclusive.KERNEL32(00000003,?,00000002,?,001134CC,?,?), ref: 00118BDD
AcquireSRWLockExclusive.KERNEL32(00000003,00000000,00000000,?,00000002,?,001134CC,?,?), ref: 00118C0B
TryAcquireSRWLockExclusive.KERNEL32(00000003,00000000,00000000,?,00000002,?,001134CC,?,?), ref: 00118C66
TryAcquireSRWLockExclusive.KERNEL32(00000003,00000000,00000000,?,00000002,?,001134CC,?,?), ref: 00118C7D

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: 31bce7f4970abac29380311b95045f11a570d36e9a1f8b82adcab6ed57649e5e
Instruction ID: 3c7257e46d7ea60420728c31722d4f5b66665f8d5adc3f18c096c4801f14295d
Opcode Fuzzy Hash: 31bce7f4970abac29380311b95045f11a570d36e9a1f8b82adcab6ed57649e5e
Instruction Fuzzy Hash: 25411871902A06DBCB28DF65C581AEAB3F5FF09350B508939E456D7A40EB30E9C4CBB0

Function 001148F7 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00114903
int.LIBCPMT ref: 00114916

Part of subcall function 00111830: std::_Lockit::_Lockit.LIBCPMT ref: 00111841
Part of subcall function 00111830: std::_Lockit::~_Lockit.LIBCPMT ref: 0011185B

std::_Facet_Register.LIBCPMT ref: 00114949
std::_Lockit::~_Lockit.LIBCPMT ref: 0011495F
Concurrency::cancel_current_task.LIBCPMT ref: 0011496A

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 51f1cb43523f27a991dc48ee50a716099bba502f2971b8d3eba7b5a298475d80
Instruction ID: 4a009c34460eda83c1f51a04d86133ae7525eb0f67d27060d85f6fe19559875a
Opcode Fuzzy Hash: 51f1cb43523f27a991dc48ee50a716099bba502f2971b8d3eba7b5a298475d80
Instruction Fuzzy Hash: EA012B32900118FBCB1DAB54D8158DEB768DF95764B204175F9156B291EF30DEC2C7C0

Function 00114A2F Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00114A3B
int.LIBCPMT ref: 00114A4E

Part of subcall function 00111830: std::_Lockit::_Lockit.LIBCPMT ref: 00111841
Part of subcall function 00111830: std::_Lockit::~_Lockit.LIBCPMT ref: 0011185B

std::_Facet_Register.LIBCPMT ref: 00114A81
std::_Lockit::~_Lockit.LIBCPMT ref: 00114A97
Concurrency::cancel_current_task.LIBCPMT ref: 00114AA2

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 216cb3e8544f425bcb8e7603dd10709b324770cfad25b0877be35179453d4150
Instruction ID: e268b403e66f2f239b1b5912008f15600cc309644e2de22b084437395806c904
Opcode Fuzzy Hash: 216cb3e8544f425bcb8e7603dd10709b324770cfad25b0877be35179453d4150
Instruction Fuzzy Hash: 8B01F237910214EBCB1CAB54E8158DEB768DF91760B210138F9069B290EF309EC28780

Function 00114F6E Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00114F7A
int.LIBCPMT ref: 00114F8D

Part of subcall function 00111830: std::_Lockit::_Lockit.LIBCPMT ref: 00111841
Part of subcall function 00111830: std::_Lockit::~_Lockit.LIBCPMT ref: 0011185B

std::_Facet_Register.LIBCPMT ref: 00114FC0
std::_Lockit::~_Lockit.LIBCPMT ref: 00114FD6
Concurrency::cancel_current_task.LIBCPMT ref: 00114FE1

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 4dd0ddf7b9f3a8be7dc8b6c1da8355925f66bee4d3c6ff21d2f6433a25290283
Instruction ID: f81953fc825d4b9f6325c40d7d32c4c411b296397db7efdc567d2d16b9b4616f
Opcode Fuzzy Hash: 4dd0ddf7b9f3a8be7dc8b6c1da8355925f66bee4d3c6ff21d2f6433a25290283
Instruction Fuzzy Hash: 7D01A232910215FBCB1DAB58E8058DEBB69DF95760B244569FE15AB390EF30DEC2C780

Function 001187C2 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 001187C9
std::_Lockit::_Lockit.LIBCPMT ref: 001187D4
std::_Lockit::~_Lockit.LIBCPMT ref: 00118842

Part of subcall function 00118925: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0011893D

std::locale::_Setgloballocale.LIBCPMT ref: 001187EF
_Yarn.LIBCPMT ref: 00118805

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 6dfc6c4d8e559311fd8549ca2d032f07068ce826b6a45d7d045e0c2965a0a6aa
Instruction ID: 13a21bb4d71558095c9d53fbac96f3ec9638825c564d492f6f6dfc5534e9e262
Opcode Fuzzy Hash: 6dfc6c4d8e559311fd8549ca2d032f07068ce826b6a45d7d045e0c2965a0a6aa
Instruction Fuzzy Hash: 2A018475A01265EBC70AEF20D8555BC7B72FFD4350B148069E81157781CF745EC6CB81

Function 0011DB97 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,0011DB48,?,?,00000000,?,?,?,0011DC72,00000002,FlsGetValue,00137CF0,FlsGetValue), ref: 0011DBA4
GetLastError.KERNEL32(?,0011DB48,?,?,00000000,?,?,?,0011DC72,00000002,FlsGetValue,00137CF0,FlsGetValue,?,?,0011CAB5), ref: 0011DBAE
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 0011DBD6

Strings

api-ms-, xrefs: 0011DBBB

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 5a4951de122ff68afdb74c5256e8e18d4d221d5fd612543a283cb595603d1742
Instruction ID: 590dcf8c871750eaaaf0f4f94adc705302cd42d79911e882b1fd5269a4c835a5
Opcode Fuzzy Hash: 5a4951de122ff68afdb74c5256e8e18d4d221d5fd612543a283cb595603d1742
Instruction Fuzzy Hash: 1BE04F30288308B7EF241B61FD47F993F55AB01B54F104430F94EA98E1EB61D8D49589

Function 00129DB0 Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(58880D5A,00000000,00000000,7556F550), ref: 00129E13

Part of subcall function 0012CDFB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0012CB79,?,00000000,-00000008), ref: 0012CEA7

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0012A06E
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0012A0B6
GetLastError.KERNEL32 ref: 0012A159

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 6ac3d22a10cd8f0c50e22f04f620de8dbeb0a9d0979963cd2759a365855af115
Instruction ID: b0db5f4ab0e002dc84d445342851dc464698f977302049789791737a73815cbc
Opcode Fuzzy Hash: 6ac3d22a10cd8f0c50e22f04f620de8dbeb0a9d0979963cd2759a365855af115
Instruction Fuzzy Hash: 1ED18BB5E002689FCF15CFA8E8809EDBBB5FF48310F58412AE856EB351D730A865CB50

Function 0011CBAB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0011CC72
___AdjustPointer.LIBCMT ref: 0011CC95
___AdjustPointer.LIBCMT ref: 0011CD31

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: fe74485ccbc31fc7231fb73dcd7d7e53dd74c8730adbfb907be8c4ade5d649fd
Instruction ID: 93c9fa6544ab6b3663b2d30dd7960cb29b7f511bda767206aa9bb860ef5da99a
Opcode Fuzzy Hash: fe74485ccbc31fc7231fb73dcd7d7e53dd74c8730adbfb907be8c4ade5d649fd
Instruction Fuzzy Hash: AC51CD72685606AFDB2D8F54E841BFABBA4FF50710F284139E80987691E731ACC0DBD1

Function 0012D0BB Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0012CDFB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0012CB79,?,00000000,-00000008), ref: 0012CEA7

GetLastError.KERNEL32 ref: 0012D11F
__dosmaperr.LIBCMT ref: 0012D126
GetLastError.KERNEL32(?,?,?,?), ref: 0012D160
__dosmaperr.LIBCMT ref: 0012D167

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: a91fb28f69da77334337a3456ed4d729b2e09eed9552870622100675fa7f514b
Instruction ID: 00d5d095a78c9b2b5a7d9050cdcf68017e343340297bd449c7916e194aca1522
Opcode Fuzzy Hash: a91fb28f69da77334337a3456ed4d729b2e09eed9552870622100675fa7f514b
Instruction Fuzzy Hash: 1621B071200225AFEB24AF65FC8192FB7A9FF143647018818F86997560DB30EC70CB90

Function 001232F6 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d0961245a02f573d4bb680483196725cd13ad55bc50b8adb9514081f943066
Instruction ID: 4e96853bb1494c9167e0f80e90aca28cb298b49ec6a435089c28b4b543c0b0b5
Opcode Fuzzy Hash: c7d0961245a02f573d4bb680483196725cd13ad55bc50b8adb9514081f943066
Instruction Fuzzy Hash: 5C218B71600225BFDB24EF65EC4196EB7AABF203647108528F865D7240EF38EF3097A0

Function 0012E06A Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0012E072

Part of subcall function 0012CDFB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,0012CB79,?,00000000,-00000008), ref: 0012CEA7

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0012E0AA
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0012E0CA

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: fab47b61bd2c9bbbdd31638b32badb7ab52a0bb3fb4d9a1498e7c194d76f7d33
Instruction ID: f11f9b57c3d4c81159fa05c997652e1dcc2e581ae7ec9bee8d5a1aa3e1d8920b
Opcode Fuzzy Hash: fab47b61bd2c9bbbdd31638b32badb7ab52a0bb3fb4d9a1498e7c194d76f7d33
Instruction Fuzzy Hash: 1A11C4B16051367FAB2227B2BC8DCAF6DACEE953947110024F901A2141FF749D2142B1

Function 00133966 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,00000000,00000000,00000000,?,00132877,00000000,00000001,00000000,7556F550,?,0012A1AD,7556F550,00000000,00000000), ref: 0013397D
GetLastError.KERNEL32(?,00132877,00000000,00000001,00000000,7556F550,?,0012A1AD,7556F550,00000000,00000000,7556F550,7556F550,?,0012A734,00000000), ref: 00133989

Part of subcall function 0013394F: CloseHandle.KERNEL32(FFFFFFFE,00133999,?,00132877,00000000,00000001,00000000,7556F550,?,0012A1AD,7556F550,00000000,00000000,7556F550,7556F550), ref: 0013395F

___initconout.LIBCMT ref: 00133999

Part of subcall function 00133911: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00133940,00132864,7556F550,?,0012A1AD,7556F550,00000000,00000000,7556F550), ref: 00133924

WriteConsoleW.KERNEL32(00000000,0000000C,00000000,00000000,?,00132877,00000000,00000001,00000000,7556F550,?,0012A1AD,7556F550,00000000,00000000,7556F550), ref: 001339AE

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e4650b4aef35c875b2825056d3b6118fe7ebaf35d640fe331a0e59ec7ae8ee42
Instruction ID: a11bee805515876d96b0623c88c5dc4353e214acf8a9a24403c7c8890c7ed7f4
Opcode Fuzzy Hash: e4650b4aef35c875b2825056d3b6118fe7ebaf35d640fe331a0e59ec7ae8ee42
Instruction Fuzzy Hash: 12F03036400124FBCF225FD5DC49B9D3F26FB593B1F444410FA2995531CB7289A0DB94

Function 0011D1A7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0011D1CC

Strings

MOC, xrefs: 0011D1DE
RCC, xrefs: 0011D1E6

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 25dd48ba96e98ef958c78dad59bb2363fec1f0ad867bec0d58a3696488254084
Instruction ID: 50f7a63177c1e7bd68facdc368e727a8ab26c3852d2cf18804adbde287e34901
Opcode Fuzzy Hash: 25dd48ba96e98ef958c78dad59bb2363fec1f0ad867bec0d58a3696488254084
Instruction Fuzzy Hash: 04417A31900209AFCF1ADFA8ED81AEEBBB5FF48304F148169F91567211D335D990DB91

Function 00116AB5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00116B3D
RaiseException.KERNEL32(?,?,?,?,?), ref: 00116B62

Part of subcall function 0011AD9B: RaiseException.KERNEL32(E06D7363,00000001,00000003,00111365,?,?,?,?,00111365,?,00140B30), ref: 0011ADFB

Part of subcall function 0011DD93: IsProcessorFeaturePresent.KERNEL32(00000017,0011F12B,?,?,?,?,00000000,001208D9,?,?,?), ref: 0011DDAF

Strings

csm, xrefs: 00116AF1

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 54d0155cbfff0baab5c0744a44ae97f5bd94f08579845d2d153993eef63143d0
Instruction ID: 8e6371b2e058c17ec22aa3e7d64067ead5db4998e5d005d0df779087e55f3355
Opcode Fuzzy Hash: 54d0155cbfff0baab5c0744a44ae97f5bd94f08579845d2d153993eef63143d0
Instruction Fuzzy Hash: A621BE31E00218EBCF28DFA5E945AEEB7B9EF10710F58042DE405AB6A0D731ADC5CB91

Function 0011175B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00111762
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0011179A

Part of subcall function 001188C0: _Yarn.LIBCPMT ref: 001188DF
Part of subcall function 001188C0: _Yarn.LIBCPMT ref: 00118903

Strings

bad locale name, xrefs: 001117A8

Memory Dump Source

Source File: 00000000.00000002.1837059286.0000000000111000.00000020.00000001.01000000.00000003.sdmp, Offset: 00110000, based on PE: true

Associated: 00000000.00000002.1837040493.0000000000110000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837081964.0000000000136000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837098281.0000000000142000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837114702.0000000000150000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837128826.0000000000151000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837142116.0000000000153000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1837156286.0000000000157000.00000008.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_110000_ufp4rvU3SP.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: fe57886a64bb609b2e5a410e939055f538c4f87b84610181df07b995f20732b9
Instruction ID: f98367120d44a07172ada6be6d23678039fb54fa059515cd30468d5253d439ed
Opcode Fuzzy Hash: fe57886a64bb609b2e5a410e939055f538c4f87b84610181df07b995f20732b9
Instruction Fuzzy Hash: 89F01772509B409E83349F7A9481483FBE4BE292213948E3EE1DEC3A11D730A444CB6A

Analysis Process: MSBuild.exePID: 7736, Parent PID: 7672COMMON

Executed Functions

Function 01280848 Relevance: 10.0, Strings: 6, Instructions: 2508COMMON

Download Yara Rule

Strings

b6K, xrefs: 012808C4
>%kl, xrefs: 0128192D
K$S , xrefs: 01280A78
;(:, xrefs: 01280959
tmB, xrefs: 01282F70
K(:, xrefs: 0128099F

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID: ;(:$>%kl$K$S $K(:$b6K$tmB
API String ID: 0-3814818819
Opcode ID: b5a80706081fb3f06c1dbdfd14cae427994b9a0a5564d02eed3e5e2b4382b9be
Instruction ID: e9afa9da6c631a51b4314cf12c89c624c5d0638c672610c2728f1f3319f834c8
Opcode Fuzzy Hash: b5a80706081fb3f06c1dbdfd14cae427994b9a0a5564d02eed3e5e2b4382b9be
Instruction Fuzzy Hash: FC539E74E112198FCB64DF68D984A9DBBF5BB48304F1481EAE819EB355E730AE85CF40

Function 012842E8 Relevance: 9.4, Strings: 5, Instructions: 3155COMMON

Download Yara Rule

Strings

qul}, xrefs: 012844D1
H, xrefs: 01285716
7qs, xrefs: 01284D3C
6I(k, xrefs: 01284484
uZD, xrefs: 012853E5

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID: 6I(k$7qs$qul}$uZD$H
API String ID: 0-2913260691
Opcode ID: aa4bf3baa535a5e86e2bc957bf23a27ef3846362f2d0b05cf48175bead7daa06
Instruction ID: 69fbe79e91e2b1bd69c4104c69a3b42e2dcde83b54d4ba44da9e406d1bd61870
Opcode Fuzzy Hash: aa4bf3baa535a5e86e2bc957bf23a27ef3846362f2d0b05cf48175bead7daa06
Instruction Fuzzy Hash: 6573C274E112298FCB64DF68D884A99BBF5FB48304F1481EAE919E7355E730AE85CF40

Function 012842C8 Relevance: 5.7, Strings: 3, Instructions: 1918COMMON

Download Yara Rule

Strings

qul}, xrefs: 012844D1
6I(k, xrefs: 012845A4
uZD, xrefs: 012853E5

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID: 6I(k$qul}$uZD
API String ID: 0-2795441010
Opcode ID: ff46abb19624bd0fdf108f328d5a3ea008a2b878987d568f75832ad82c5a73f8
Instruction ID: 41790f217f7aedfdcba506fe4b091a835e9541c8266d84bf7118b3f8ab260dc2
Opcode Fuzzy Hash: ff46abb19624bd0fdf108f328d5a3ea008a2b878987d568f75832ad82c5a73f8
Instruction Fuzzy Hash: 4C239E74E012198FCB94DFA9D984A99BBF5FB48304F1481AAD819EB355E730EE85CF40

Function 012807B0 Relevance: 5.4, Strings: 4, Instructions: 400COMMON

Download Yara Rule

Strings

b6K, xrefs: 012808C4
K$S , xrefs: 01280A78
;(:, xrefs: 01280959
K(:, xrefs: 0128099F

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID: ;(:$K$S $K(:$b6K
API String ID: 0-896138553
Opcode ID: 7d3583d9b93f2880e5d5cd6d7a3c4097c1f2b3a570eba92452feffee8751da85
Instruction ID: 8462159dd8392b843e1a7d9dfb7efeacbbb29be57350dc2890fb08d8365d712e
Opcode Fuzzy Hash: 7d3583d9b93f2880e5d5cd6d7a3c4097c1f2b3a570eba92452feffee8751da85
Instruction Fuzzy Hash: 1E022335E112489FCB01EFA8C49499DBBF1FF89304B1581AAD405EB3A6EB35ED49CB41

Function 01289A30 Relevance: 4.6, Strings: 3, Instructions: 868COMMON

Download Yara Rule

Strings

g2%, xrefs: 01289FA7
(jgA, xrefs: 01289C51
E"W, xrefs: 0128A327

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID: (jgA$E"W$g2%
API String ID: 0-2601187164
Opcode ID: b6b76fcca479b9150f6c3624ee306fea5ab274c2e5473640886b2730c8d62ec7
Instruction ID: 89b56910aef1de070fd0af0bbfbcc5566333378fb5e8bac7bf795256893de8d2
Opcode Fuzzy Hash: b6b76fcca479b9150f6c3624ee306fea5ab274c2e5473640886b2730c8d62ec7
Instruction Fuzzy Hash: EE92E474E112198FDB64DFA8D984B9DBBF1FB88300F1481AAD419E7355EB30AA85CF50

Function 01287850 Relevance: 2.2, Strings: 1, Instructions: 948COMMON

Download Yara Rule

Strings

Fx^., xrefs: 01287B3F

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID: Fx^.
API String ID: 0-1027054592
Opcode ID: f91957ea96e877462fd6637a2ce95dd29371ce4165bbfd1a5534d7fd9b44ada0
Instruction ID: e0efb398241da18a7efd8ab1f61b8af620619bb12cee3513345392bca4dfd613
Opcode Fuzzy Hash: f91957ea96e877462fd6637a2ce95dd29371ce4165bbfd1a5534d7fd9b44ada0
Instruction Fuzzy Hash: B3920075E11219CFDB50DFA9C880A9DBBF1BF48304F2481AAE419EB395E730AA45CF51

Function 01283108 Relevance: 1.6, Strings: 1, Instructions: 307COMMON

Download Yara Rule

Strings

-x, xrefs: 012831A5

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID: -x
API String ID: 0-1059959070
Opcode ID: b6d57eeafad564426348458d142c131a27b354e770b2098e4e8b76af147ef362
Instruction ID: 5a69934f3e5f41ab1cc896463f41967b0d44bdcd916daa24e28638223428cb28
Opcode Fuzzy Hash: b6d57eeafad564426348458d142c131a27b354e770b2098e4e8b76af147ef362
Instruction Fuzzy Hash: 0AD10179E112098FCB54DFA8E984A9CBBF2FB48300F148566E809EB399D734E955CF40

Function 01283A49 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c26eff83923cfeb844c80f7b48f4a307ac1dca5a548e4ca80f0a0aed888d48b
Instruction ID: 18234553fddba44c2b2e2613e137aa80f7470e3369ba4c3f5913d03a2de4d8ea
Opcode Fuzzy Hash: 6c26eff83923cfeb844c80f7b48f4a307ac1dca5a548e4ca80f0a0aed888d48b
Instruction Fuzzy Hash: 9B42EA35A11646CFCB05EFACD884A9CB7B1BF88314B198694E015EB3A6C730EC96CF44

Function 01288488 Relevance: .5, Instructions: 458COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b70fadae57573a3f07995ce60e85839640029f03ca2b084603c6a3f849a18c5
Instruction ID: 61545032dad302059f1e8d53830168eedcc310ff52e4b8fe249b6c4c12b8eeb1
Opcode Fuzzy Hash: 0b70fadae57573a3f07995ce60e85839640029f03ca2b084603c6a3f849a18c5
Instruction Fuzzy Hash: 82718C31A112068FCB11EF6CE88099DBBB1FF84324B198759D015EB396CB34EC95CB94

Function 01288A35 Relevance: .4, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16ad641b259c8d1511364ba8fef123824af1898776b15e0c5233974786404313
Instruction ID: bfe94b1f9132befd58f8831c25ab18b32d03c82b0c4c0771f228390c569d5700
Opcode Fuzzy Hash: 16ad641b259c8d1511364ba8fef123824af1898776b15e0c5233974786404313
Instruction Fuzzy Hash: 4921C132D06249AFDB05EFB8D8806DEBFF2EF8A710F2485A6D501A7251CB312D14CB21

Function 01288F60 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 989cf276e68e89debd751bc8ab6ebc8bb03e295b6b2d7afa44a2207eed8cc033
Instruction ID: c092eeb72733e4937ad81dfd849d50d7ded1386630aff6bf487fdc9bcc06e02c
Opcode Fuzzy Hash: 989cf276e68e89debd751bc8ab6ebc8bb03e295b6b2d7afa44a2207eed8cc033
Instruction Fuzzy Hash: 63E16A71A152048FDB14DFA8D884AADBBF6FB89304F15816AD509EB386DB34ED81CF50

Function 012895B9 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df9dab0f0290c7d96af452e7594b046bf9c6a4499cb1c6d14946330610b4733f
Instruction ID: ea761dc9e64846c669a04e7870cd638c615195630a3c776b13a1f53078f6d5e1
Opcode Fuzzy Hash: df9dab0f0290c7d96af452e7594b046bf9c6a4499cb1c6d14946330610b4733f
Instruction Fuzzy Hash: 68A19D31A11606CFCB11EFACE88096DB7F2BF84314B188669E019DB396D730EC91CB84

Function 01283680 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42addf8872cb7ee5f90910667ddef9c3692e552e1270a41017ba3b9c037c2812
Instruction ID: 1c5ea2005b1ae4f6eb4d652bd713e5ad2384a685555aa57744102151096dbe6d
Opcode Fuzzy Hash: 42addf8872cb7ee5f90910667ddef9c3692e552e1270a41017ba3b9c037c2812
Instruction Fuzzy Hash: 6381CF71A116028FDB25EF6CD88499DBBF2FF887007188659D052EB396D730ED96CB90

Function 01288348 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd879fddddc04029373a77f2caa35a7e3f037fb4079e6b98c6612d28c2bc2a5
Instruction ID: d0e15951c6786bae9eee73abe4d3c6d7d6949e8e119096bc18971fbd96b0bc63
Opcode Fuzzy Hash: 1bd879fddddc04029373a77f2caa35a7e3f037fb4079e6b98c6612d28c2bc2a5
Instruction Fuzzy Hash: 0C515A70D11219DFDF14EFA9C98479EBBF5BF88704F14802AE515A7284DB749846CF80

Function 0128A770 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b7baa2d8977b01adba34f66b90ce8de88df643bb2b5f226b431a8b224126a60
Instruction ID: bcd1cc6956a6bd9af09dd8b3c7e22bbc27543aa1990b3c8845ffcc7ea83b1766
Opcode Fuzzy Hash: 6b7baa2d8977b01adba34f66b90ce8de88df643bb2b5f226b431a8b224126a60
Instruction Fuzzy Hash: DD514971E21319DFDB14EFAAD98579EBBF5BF88700F14812AD419A7280DB749842CB90

Function 0128A764 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 871510de243bd01fe3dfb1bb6a189cbab977631834d85b70ccc875ad7af848c3
Instruction ID: e082f6d79fd39a9bbdc76939891d51c03be040d988429de3f8a0e95f171b7d35
Opcode Fuzzy Hash: 871510de243bd01fe3dfb1bb6a189cbab977631834d85b70ccc875ad7af848c3
Instruction Fuzzy Hash: 10416A70D21219DFDB14DFA9C9857AEBBF1BF48700F14812AE415EB280DB749846CF91

Function 01289478 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f238335ee56c098de6dbdefdb561d72078a6c6031026ef9451ca93dc57dd77
Instruction ID: 4d777700ade4d47b4c03b1b83bb8e651ca6a5c5a50b510426075c591f94c39a6
Opcode Fuzzy Hash: c0f238335ee56c098de6dbdefdb561d72078a6c6031026ef9451ca93dc57dd77
Instruction Fuzzy Hash: EC314832D102189FCF01DFA8D8C09EEBBB8EF85314F1549A6D011EB290DB35A806CBA1

Function 0128A424 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31f58f54fa237e7eeda9c704d35593fe2672688cdd6d3ee14fe7349579002055
Instruction ID: afb0223d09b4854bd71da3321b49b42786afa58ca778ca1f328daba862c804e1
Opcode Fuzzy Hash: 31f58f54fa237e7eeda9c704d35593fe2672688cdd6d3ee14fe7349579002055
Instruction Fuzzy Hash: 34310A30A002468FC716EF6CE8945AAB7B6FFC5300B15C266D405CB296EF34EC42CB50

Function 012830F8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31aad87655fdbbe97a352cb51283dfdf0bf6669a446fe3da99ee9bfdc21ebfea
Instruction ID: a28a7c7f9bf6a5d2fdb3155d9b167bbf53ef7166e16e0cec1ac7693198718ad3
Opcode Fuzzy Hash: 31aad87655fdbbe97a352cb51283dfdf0bf6669a446fe3da99ee9bfdc21ebfea
Instruction Fuzzy Hash: D4319A34A112058FDB44DBA8D994A99BBF6FB88300F04C06AD915E7389DB34EE11CF50

Function 01283938 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d9b82e159388720ec0a7e99bbe8a63d68cf5eec47b5d83144a03805b2dd3726
Instruction ID: 0af4669f95d7f1603f7f130576ea3c7b623684ac4001fa60e97bd19e080e339a
Opcode Fuzzy Hash: 5d9b82e159388720ec0a7e99bbe8a63d68cf5eec47b5d83144a03805b2dd3726
Instruction Fuzzy Hash: 6231D532E102099FCF14DBA8D8849EEFBB5AF84310F15856AD511A7290DB70A90ACB95

Function 0128A920 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b4df5f22deb6583be7582f5d019aa4c7658be0d0cedf3797a2e7bb41e546074
Instruction ID: 9cb066bd4727b66e1a87de4853c1a10823ff70ca8257f04e238bc966e428dd80
Opcode Fuzzy Hash: 3b4df5f22deb6583be7582f5d019aa4c7658be0d0cedf3797a2e7bb41e546074
Instruction Fuzzy Hash: B73112B5D12259DFDB14DFAAD984ADEFBF5AF88310F10802AE505B7280DB74A845CB90

Function 0128A915 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d24372372ce1663a62ceadd90fc6c3e0c3126d1acd52a438d4d1324cba2720c9
Instruction ID: 537cb6fb91e98c26cf24f14d57586b64ffde55670881fa380d3bc168c0ed0513
Opcode Fuzzy Hash: d24372372ce1663a62ceadd90fc6c3e0c3126d1acd52a438d4d1324cba2720c9
Instruction Fuzzy Hash: AF2144B0C11249DFDB14DFAAC984B9EBFF4AF48300F20802AE405B7280DB75A845CB50

Function 01282FD3 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5456a6eba7cd602f7dd5f612c5aded2f8502abbd495de7bfbf85a7ce508db6b0
Instruction ID: 926dda48fd96105334363b76ad1faec71642f8c1e9fc37cc78417767ff01deae
Opcode Fuzzy Hash: 5456a6eba7cd602f7dd5f612c5aded2f8502abbd495de7bfbf85a7ce508db6b0
Instruction Fuzzy Hash: 442129366052598FCB02DB68C8445DD7B71FF86324F1941EAC0519B1E3DB36A91ACB90

Function 01288D38 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80d5e0553888873bf1806b0efa0e581941440ef67be359592af64b8348686de3
Instruction ID: c64c25690f958dcd82bb976d8e2c4c994bfde3a086221912c9dfcdf81f628048
Opcode Fuzzy Hash: 80d5e0553888873bf1806b0efa0e581941440ef67be359592af64b8348686de3
Instruction Fuzzy Hash: 6F218E72E02209AFDF05EFB8D8806DEBBF6AFC9710F108566D501A7241DB315D148B61

Function 0128392A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41c14d719994a1b0d91caadac41a9bf4ab4927d8b96424fb9539623e4662c2ec
Instruction ID: 2c7e509430ef737a071c0730e83ca42a80c453a6558b141d6c41bf969bc30ffa
Opcode Fuzzy Hash: 41c14d719994a1b0d91caadac41a9bf4ab4927d8b96424fb9539623e4662c2ec
Instruction Fuzzy Hash: 8A115E32D002498FCB05CFA8E8C09DDBBB5FF59310F25826AD421AB291D735A919CF94

Function 0122D035 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1439617385.000000000122D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0122D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_122d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b92b5f3d9f743c0ff2a2ea8750afbeef1364ec22828a944440ee361bedfcbc37
Instruction ID: a4f61e8236a59b136aa67054c0b8e2ff0853287bb2379a2902f30563664926ab
Opcode Fuzzy Hash: b92b5f3d9f743c0ff2a2ea8750afbeef1364ec22828a944440ee361bedfcbc37
Instruction Fuzzy Hash: 7F01A771018358BAF7205A66CCC476BBF98EF81765F14C41AEE094B192C67D9941CA71

Function 0122D034 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1439617385.000000000122D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0122D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_122d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b90c43f285cb51723d7280ca0a165a691ce51ffdc89822b25ec250ab811203e
Instruction ID: 388c0239e7e391efa37c0c2391e6c4ba0b6522ce2d7847acca24c82bd249db42
Opcode Fuzzy Hash: 6b90c43f285cb51723d7280ca0a165a691ce51ffdc89822b25ec250ab811203e
Instruction Fuzzy Hash: ADF0C271004358AEE7208E1ACC84BA6FF98EB40774F18C45AEE084B292C2799840CA71

Function 01289350 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1440055950.0000000001280000.00000040.00000800.00020000.00000000.sdmp, Offset: 01280000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_1280000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 518bec573b89b1f4c6ddeb593dc69f1cb149435526192c90621e633db3e11d97
Instruction ID: 5ca7a4368ba7b4fb20c57d0df8f1a926050047e6fd19834322d5b17a61dd4301
Opcode Fuzzy Hash: 518bec573b89b1f4c6ddeb593dc69f1cb149435526192c90621e633db3e11d97
Instruction Fuzzy Hash: DFC04C30840115CBFB356B69E518BEC7675FB44205F109495E289D62A4CF310DC1DF31

Analysis Process: Honda.exePID: 7900, Parent PID: 7736COMMON

Executed Functions

Function 02EE2788 Relevance: 2.0, Instructions: 2015COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67de205bac02454b17aeeb3570d2ecf54734f44b3d01fcddb9eb6a2b5bbe2e35
Instruction ID: f423c923a1b71de9dd1b5f7c50db279c57d3c610fa01c056931bb71170551dc1
Opcode Fuzzy Hash: 67de205bac02454b17aeeb3570d2ecf54734f44b3d01fcddb9eb6a2b5bbe2e35
Instruction Fuzzy Hash: 52038B31A5071ADFEB11DF64CC44B99B7B6FFC9B00F5182A5E5096B290DBB0AE91CB40

Function 02EE5A41 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d371a5daf29b97a8ecc0f01a732948f8b99e58f9e91b2e6976e40a3007f2a558
Instruction ID: 81e4451353ad582e9a233f3d39009e71a240a6365afac93ab702e0f1f420cfe0
Opcode Fuzzy Hash: d371a5daf29b97a8ecc0f01a732948f8b99e58f9e91b2e6976e40a3007f2a558
Instruction Fuzzy Hash: EFF18C30A40315DFDB28DF65C994BAEB7F2EF88708F94D429D406AB291DB35AC41CB90

Function 02EE4C69 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5f17f89b49a90f9c869fb40a03235554fa82e6293ac963bc58963dbbf87a97
Instruction ID: 848791f31ab704af4a462d9d88d281e76b8ed72b1181d629ff3ac9027def670a
Opcode Fuzzy Hash: fb5f17f89b49a90f9c869fb40a03235554fa82e6293ac963bc58963dbbf87a97
Instruction Fuzzy Hash: 2321DE30A442548FEB05DBB5C9657ED7BF2FF89204F149068D402BB284DB385801CBA2

Function 02EE4868 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93cbd4851b75301f44da37926f642304ca118b7ec3f4a7ef06c3bbf0b1dd685d
Instruction ID: 532b30c5697f7afd5c67541133dda964cf731ce88c5d5c089b09e3f372828b51
Opcode Fuzzy Hash: 93cbd4851b75301f44da37926f642304ca118b7ec3f4a7ef06c3bbf0b1dd685d
Instruction Fuzzy Hash: F2A16830640A05CFCB15DF28D484A69BBF2FF85314F46D5A9E44A9B6A6E730FD84CB84

Function 02EE1063 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b29ad885c77f9c39e4b7d8949983fb7846257aa25686bd8ef42d3808bee585be
Instruction ID: 70dcc699ac7094a21c6e1352f88f95caaded5048d839f0b683b2b0d8d09b9d8b
Opcode Fuzzy Hash: b29ad885c77f9c39e4b7d8949983fb7846257aa25686bd8ef42d3808bee585be
Instruction Fuzzy Hash: 60913871E40218DFCF05DFE5D8549EEBBBAEF88300F14806AE50AAB250DB399945DF91

Function 02EE5E28 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21ea3118d00fda8bf0e7108890670cb9f52ae0f98a6a2bd6b0c66709cb99c6bf
Instruction ID: 084af6d16aa47e93d0442b980e8cd0b82212f73c06bbf42ec47e2a33232115bf
Opcode Fuzzy Hash: 21ea3118d00fda8bf0e7108890670cb9f52ae0f98a6a2bd6b0c66709cb99c6bf
Instruction Fuzzy Hash: FB615B34A40214DFDB14DF69D894BAEBBB2EF88714F549465E806AB391DB34AC41CBA0

Function 02EE17C8 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6722b1d8d16d5031232749bf28a1f2db24674507bdc837ffb347001ad2288d41
Instruction ID: e6d6aa1844f87a6fef41c72c4fa695e5b826ca100a5f216227c78928ffdcdf86
Opcode Fuzzy Hash: 6722b1d8d16d5031232749bf28a1f2db24674507bdc837ffb347001ad2288d41
Instruction Fuzzy Hash: 5B519D31E002189FDF19DBB9A8146EEBFB2EF85310F14C0AAD45AE7250EB354A55CB91

Function 02EE1CC0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78521f1475cdda0bc4e56df964f693792f0e69f95ef5596ff0cbc900da585add
Instruction ID: 798f215ebb3152cc22d335ecd240a83394a72a74bf898ba45c8114a1f7ffb5f9
Opcode Fuzzy Hash: 78521f1475cdda0bc4e56df964f693792f0e69f95ef5596ff0cbc900da585add
Instruction Fuzzy Hash: E241D130B50205CFDB09EF65D848A9E7BB2FF85315B10C1A9E80ADB364EB389D45CB91

Function 02EE0848 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed143a7884f69efe72928eda1f6df1b7c934f59577c8c7e8b2ee39f44232b03d
Instruction ID: e9084eccb8c01eb6971f8717033bcf3abd6538b52499a231d2f56f8e250f0e2a
Opcode Fuzzy Hash: ed143a7884f69efe72928eda1f6df1b7c934f59577c8c7e8b2ee39f44232b03d
Instruction Fuzzy Hash: C2418C70E40209DFDB04EBB8E844B9DBBB2FF84304F10D169E505AB255EB759D45CB91

Function 02EE1CB0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53840e6eaac8ff65e050cb75c458c38f2c711d58c783a978e5c799bb97db04f8
Instruction ID: e8ba0b1a0f93e6585a280152f74c73785933a4b72f924f1c23acf38bc9aafc47
Opcode Fuzzy Hash: 53840e6eaac8ff65e050cb75c458c38f2c711d58c783a978e5c799bb97db04f8
Instruction Fuzzy Hash: F6418C34A50205DFDB08EF65D84499EB7B6EF89205B10C269E80ADB364EB34AD45CF91

Function 02EE2777 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9294a07ab7111f233cce9492ade199fb2144be176c6443c27f20efd2afdbe0d9
Instruction ID: 42e9a55dbb0f12dfbb49db1460490b7404ee81e0795dd4fbb542e8467db042e9
Opcode Fuzzy Hash: 9294a07ab7111f233cce9492ade199fb2144be176c6443c27f20efd2afdbe0d9
Instruction Fuzzy Hash: 0F319E31A80304CFDB248F65D844BA97BFAEF45304F45D8A9EA06CB291D779D840CB60

Function 02EE0838 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc41048f62c9ace3e7b375b791c73d64718587cd18ae914856fc457706e983df
Instruction ID: aa282aa8ba5b6a024194f8402da4c46bc32f95da2061f3161996ee4e83a53598
Opcode Fuzzy Hash: dc41048f62c9ace3e7b375b791c73d64718587cd18ae914856fc457706e983df
Instruction Fuzzy Hash: 1531AF70A90348DFDB00EFA8E480BDDBBB2FF84304F50D125E4056B255DB759886CB51

Function 02EE1B68 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56460b603081f5b46a8427542eab85ebcb660e80f9795d2e9d13ef5fb2aae7f0
Instruction ID: 3fc01883e38d72be0f56d475b40896f482bebe374f352696a098612c0b5de0a7
Opcode Fuzzy Hash: 56460b603081f5b46a8427542eab85ebcb660e80f9795d2e9d13ef5fb2aae7f0
Instruction Fuzzy Hash: DD214870B40215DFCB48EFB9D88896DB7B6AF49B0572144A8E40ADF361DB36DC42CB81

Function 02EE1B78 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be254994ffbd20359717c9ceac6c2a8fb161bcb95d973ec7b0a3617dca4ad725
Instruction ID: e5449ae1109679151f5cfd220acd57fead5e14334b8fb6124122352196ed9c76
Opcode Fuzzy Hash: be254994ffbd20359717c9ceac6c2a8fb161bcb95d973ec7b0a3617dca4ad725
Instruction Fuzzy Hash: F0213970B40215CFCB48EFB9D49896DB7B6AF48B05B2144A9E40ADF361DB36DC41CB81

Function 02EE4F48 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 942df6eb09511d05549e5362a16780c5ddcd03fccd4754cf726a5ffb4d6741c0
Instruction ID: e8e877d644e2aba4995ff7149bf4a564fa0b32f0c8ad139d46a10e8ae2cac83f
Opcode Fuzzy Hash: 942df6eb09511d05549e5362a16780c5ddcd03fccd4754cf726a5ffb4d6741c0
Instruction Fuzzy Hash: 2C116030A442198BEB04DFA6C5547AE7BF2FF88704F549429D502B7384DF799D00DBA1

Function 02EE6060 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d6656bc58d25ff769184d3631e717a4962e68a7126ac7e2d046abe22020928
Instruction ID: 9427d6ffeb9d7c7ea1ce7d0cf1d92222afdf31fb070a7b4b3148ef2c84dce741
Opcode Fuzzy Hash: 91d6656bc58d25ff769184d3631e717a4962e68a7126ac7e2d046abe22020928
Instruction Fuzzy Hash: 9B110270E003589FCB26DB79A8587AE7FB6EFC5314F1081AED005DB252EB750905CB91

Function 02EE5218 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c988337e905f54c653c1ddb84d0c3bedfbec517d3f6570d73b867531f14ced5e
Instruction ID: 4c523185ce1ccd6533e8fb4be98ce71b676c25d2f1ab70f9c5a25a9843132b3f
Opcode Fuzzy Hash: c988337e905f54c653c1ddb84d0c3bedfbec517d3f6570d73b867531f14ced5e
Instruction Fuzzy Hash: E7018431B50231DFC7199B79E85491AB7E9DF8961131581F5E805DB371CA75EC01CB90

Function 02EE5228 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 473124d288c052170b4b16858b5caf925c8780b31ae02d82a3a43fae00085e52
Instruction ID: 3d51144ce3f8c5e34e02ef4c32684418d5855fecad6071553112430b80167725
Opcode Fuzzy Hash: 473124d288c052170b4b16858b5caf925c8780b31ae02d82a3a43fae00085e52
Instruction Fuzzy Hash: F2F04472B10130DFC7149F79E44491A77EEDF8DA6531541B9E805DB330CA75EC018B90

Function 02EE0A98 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 764c1134c8a170e58142a1cb4e22a0499211f96b34e58f13982a7a4228a7190f
Instruction ID: e2d62e25e2c3599fd182161626a5de98a7038dfc8b298b7ca7fc744d236d1d76
Opcode Fuzzy Hash: 764c1134c8a170e58142a1cb4e22a0499211f96b34e58f13982a7a4228a7190f
Instruction Fuzzy Hash: 85017B30B883C18BCF046BB1D4642B93FA1AB41258B4404FDD807D3281CFADCC81C790

Function 02EE0AA8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36eb78670c242290760cdc0f6b003aef002144baff76a7055e6cf4f92c6f670a
Instruction ID: e386ca89371249911e498c8bfc1bb9bbd6223ae895a154db6cd29bb72956fc3c
Opcode Fuzzy Hash: 36eb78670c242290760cdc0f6b003aef002144baff76a7055e6cf4f92c6f670a
Instruction Fuzzy Hash: 4CF06230B8431587CF086BB5E46872A3A95A740A59B8444B9990BD3380DFE9DC90C7D1

Function 02EE4B34 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5898c1a1c3ab675e1bc3131673e1234feaa892e3f3632e621146b1d3605a8be
Instruction ID: 02553242e61019842d84bb6c02e4184bd3951823207acaf13dcf27e4a45930fe
Opcode Fuzzy Hash: b5898c1a1c3ab675e1bc3131673e1234feaa892e3f3632e621146b1d3605a8be
Instruction Fuzzy Hash: 7BF0FA66D49294EFCB01CBF6AC690ECBFB1EF85204B44C0EAD05687261E7788A05CB51

Function 02EE0ED7 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da588a821d5ec913edab3953b297ae8afe207f347be995a74fe5c7eec8edc0c2
Instruction ID: 8ab372888cda2a5d446c8dd8369ec63960e6678e7ad07d44cedccc7e73a2aac9
Opcode Fuzzy Hash: da588a821d5ec913edab3953b297ae8afe207f347be995a74fe5c7eec8edc0c2
Instruction Fuzzy Hash: 19F02772E61255CFDB00CBA4E5862CC7FA0EB1624431060DAC40497205FA704E02CB42

Function 02EE13B0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 408be9ef161b582484291f2903240d59980bcd6e526aed57ed7271740ea77245
Instruction ID: a47b52030d2801e533abd831b29758bd1bb968d31fbce0b1a73484983ccf69e5
Opcode Fuzzy Hash: 408be9ef161b582484291f2903240d59980bcd6e526aed57ed7271740ea77245
Instruction Fuzzy Hash: 92F017B0690206CFDB14EF64D158A68BBB2FF89704F108468E40A9F3A1CB79DC41CF00

Function 02EE5148 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f1763b846369cf5c78c036ef26b9ecac1ffe2292e4fb408f7c36ce34934c6d
Instruction ID: b8ff34d6c4826575600d7b492f3f94bb5e516f9319c86fbd35769821b637c02e
Opcode Fuzzy Hash: 55f1763b846369cf5c78c036ef26b9ecac1ffe2292e4fb408f7c36ce34934c6d
Instruction Fuzzy Hash: F4E09B357512149FC704EF26E85895EBBAAEBC83517504639E509C3315DE359C1187A0

Function 02EE0F28 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f4a30b2e26c185ae0f1c9f54336a3d802523f2c587d5a9072c7a49486272cf3
Instruction ID: dbcf9544d89a143efe44df4dd1d05180dcbeb223027d15a66d21000670fb3418
Opcode Fuzzy Hash: 7f4a30b2e26c185ae0f1c9f54336a3d802523f2c587d5a9072c7a49486272cf3
Instruction Fuzzy Hash: 7EE09230955345DFCB06DFB4E9115AC7FF1EB4620072042EAD409D7212EB341E00DB52

Function 02EE0F70 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 709b8a9117c395ec54d323df566e43ab970ea962d8b4f80ca2edc9e0b1ca2574
Instruction ID: 0e9f23d8d6460ff30074fb6d6d351c560c8b5e70b5c367e86807aff06cbce829
Opcode Fuzzy Hash: 709b8a9117c395ec54d323df566e43ab970ea962d8b4f80ca2edc9e0b1ca2574
Instruction Fuzzy Hash: 07E02E3290F3404FD7019ABAE8107823BE98B02220B01C0FBE84AF3222E280CC00C3D3

Function 02EE0F38 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1452289741.0000000002EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2ee0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57e5ec3c9aec592eca8e76fc1638b286443b9a70290f670317a61ed025eab88a
Instruction ID: 09cb012ccaee37a7314c998c98a78188ad2ba45ecdb78a1010830b6f487d20fe
Opcode Fuzzy Hash: 57e5ec3c9aec592eca8e76fc1638b286443b9a70290f670317a61ed025eab88a
Instruction Fuzzy Hash: 0DD05E30E5020CEFCB04EFB8EA0159DBBF9EB85200B2095A9D808E3201FF316F009B81

Analysis Process: Honda.exePID: 8164, Parent PID: 4084COMMON

Executed Functions

Function 01582788 Relevance: 2.0, Instructions: 2005COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bd67a26b447549c6065606b28d2d782ad81baa071aef14cd859964a82c9959f
Instruction ID: 923924ae080e57e5ff9c8ad5ba1922e885a3f3e1240ecef44bb88e54524fc316
Opcode Fuzzy Hash: 0bd67a26b447549c6065606b28d2d782ad81baa071aef14cd859964a82c9959f
Instruction Fuzzy Hash: 87039D31A0131A9FE721EF64CC44B9DB7B7FFC9B00F5186A5E5086B295DBB06A91CB40

Function 01581CC0 Relevance: 1.6, Strings: 1, Instructions: 373COMMON

Download Yara Rule

Strings

", xrefs: 01581F97

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: f824fe941a58ff1a7a3da7d72e032a2dabe6d9c5b1a39bbb1a176700ede824e2
Instruction ID: 1fe5a0cdf134a9af7ad8ef735ade2f1d28d24034bc34d9dc45f71d4f6e80073c
Opcode Fuzzy Hash: f824fe941a58ff1a7a3da7d72e032a2dabe6d9c5b1a39bbb1a176700ede824e2
Instruction Fuzzy Hash: 78D19F34A0060ACFDB19EF69C8946AEBBF2FF88310F148569D415EF295DB30D946CB91

Function 01585A41 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 983b7ffc8daee9afffd020ac23112f00d93ee7eece954ca88cb96dee76c331c6
Instruction ID: 187e8f7091f2316af5f5829dea65b055a97c3bb34cfbeaa347289cc69e30f7c4
Opcode Fuzzy Hash: 983b7ffc8daee9afffd020ac23112f00d93ee7eece954ca88cb96dee76c331c6
Instruction Fuzzy Hash: F2F1B130A11205CFEB25EF68C944BAEB7F2BF84705F148469D416AF295EB31EC41CB50

Function 015817C8 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

], xrefs: 01581942

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID: ]
API String ID: 0-3352871620
Opcode ID: d3c9d31cc153c20a14eb2b4506bae39ffee272a0df0fb152c26725714cdbb74e
Instruction ID: 6c792aa5f4ca972d2731728e520683e36880d17ad9031f62acf3c5b238259741
Opcode Fuzzy Hash: d3c9d31cc153c20a14eb2b4506bae39ffee272a0df0fb152c26725714cdbb74e
Instruction Fuzzy Hash: 6A51D171E002099FCB15EBA998146EEBFF1FFC5210F1080AAD459EB254EB344A0ACB91

Function 01584C68 Relevance: .4, Instructions: 419COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f7a4602d7fef692dd6a05e530faaf8410fa7182e975dd998ff43efe85f60ad5
Instruction ID: c16d4d49f7eff89fe3f12f2aa994f1c46b164ffdac721e9e0c8dba984d2680ca
Opcode Fuzzy Hash: 8f7a4602d7fef692dd6a05e530faaf8410fa7182e975dd998ff43efe85f60ad5
Instruction Fuzzy Hash: 4E11A271A0524A8FEB04EBBAC5597AD7BF2BF88300F14402DD512BB384DF3559118BA1

Function 01584868 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a61e13d95dc12fbd710653e480a105b95dc061f600b2c45330825bd7c854503
Instruction ID: efdf641daed22f8b7d967093123547859fd22edd901b511766aa947f4fd004c8
Opcode Fuzzy Hash: 0a61e13d95dc12fbd710653e480a105b95dc061f600b2c45330825bd7c854503
Instruction Fuzzy Hash: 47A148302006068FD715EF18C484A69BBF2FF81310F4AC5A9E859AF626E770ED95CB94

Function 01581062 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f862aab81cb7c0b6559856b1ef0a169b27a2d7feeaa8cf13c3f21ffbfa1441d
Instruction ID: d39a524bdf372dfaac5c5301be8bb4428aa64cac19fbad72825574b4823e4355
Opcode Fuzzy Hash: 4f862aab81cb7c0b6559856b1ef0a169b27a2d7feeaa8cf13c3f21ffbfa1441d
Instruction Fuzzy Hash: 4F914071A00208EFDB15EFE5D8549EEBBFABF48300F14812AE516EB254DB359906DF90

Function 01585E28 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d488c4e73d965b66b1573f6dbb6a7d6fa430de2e85376e8c9d186379f883ac8c
Instruction ID: 2dc90e8a5f5a5a2e56de43c34f5aea5a1813594afa4f2a364abdccf0e000d9cf
Opcode Fuzzy Hash: d488c4e73d965b66b1573f6dbb6a7d6fa430de2e85376e8c9d186379f883ac8c
Instruction Fuzzy Hash: 61617C71B102199FDB15EF68D894BAEBBF2BF88714F148065E905EB395DB309C41CB90

Function 01580848 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a52fe92dcc5e6fcddab1cff3c5e3388a94ab8d90bda14de5e105a10ba85e1961
Instruction ID: 8e588254c7dbc1c7e5d4d40e7876b35774ea1a42b6bb57dc6ad03f8ad5eed031
Opcode Fuzzy Hash: a52fe92dcc5e6fcddab1cff3c5e3388a94ab8d90bda14de5e105a10ba85e1961
Instruction Fuzzy Hash: 79415F70A012099FDB04EBBCE854B9D7BF2FF84314F10816AE505AB399DB749949CB92

Function 01581CB0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43f596893284a6df219c9e368991af18e5a34f99e24058aa92e0771427c66c3e
Instruction ID: b5b3639f7f4ae3e88ebded43e860a35e66d90fc23f8ff1613f85a5619bbfb5cf
Opcode Fuzzy Hash: 43f596893284a6df219c9e368991af18e5a34f99e24058aa92e0771427c66c3e
Instruction Fuzzy Hash: 1541AF35A002099FD718EF28D858A9EB7F6FF84211B118569E516DF368EB309D05CB91

Function 01582777 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b2c94e66e05742778ce8131dfba524b56ba0caabdb4b5eedeeb8a6b41177b6d
Instruction ID: db7e7276ffba74feca179184629fa74548bf7d9fc16f1a02579aea1f77c860fe
Opcode Fuzzy Hash: 2b2c94e66e05742778ce8131dfba524b56ba0caabdb4b5eedeeb8a6b41177b6d
Instruction Fuzzy Hash: DA218B31A102049FEB24EFA9D848BB97FE6BF44211F4984AAE415EF291D339D944CB60

Function 01580838 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a80133d1b67379523d0d45e7ca62797765e1b2bd2ca702ab2363d95d63842a3b
Instruction ID: 33a8e874acb188b85c1d1feebd82a39d1a24a9814e6cb9fcb98ddbd9887f4a8d
Opcode Fuzzy Hash: a80133d1b67379523d0d45e7ca62797765e1b2bd2ca702ab2363d95d63842a3b
Instruction Fuzzy Hash: 7F319134A0130DDFDB05EBA8E894BDDBBB2FF84314F10812AE5056F259DB74984ACB52

Function 01581B68 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 721d13f0588237ea9f90cdaae960c546f6cf9bdc6bb37e4d2b724299d65977f4
Instruction ID: bce3de34d124a47aa258a3fca19093257cc3c6b13a10caeef5d49088d574e3d1
Opcode Fuzzy Hash: 721d13f0588237ea9f90cdaae960c546f6cf9bdc6bb37e4d2b724299d65977f4
Instruction Fuzzy Hash: 7A212B75B00115CFCB88EFB9C488A6DBBB6BF48611B2144A9E506EF361DB35DC02CB90

Function 01581B78 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06b909b3794975469fb5342ece163ceb17b8aad7878bb29dfc0986f63d386d63
Instruction ID: 24baa6471baf19570749fa42a3f3697430ea4329e75bafd89cbd446843d1673e
Opcode Fuzzy Hash: 06b909b3794975469fb5342ece163ceb17b8aad7878bb29dfc0986f63d386d63
Instruction Fuzzy Hash: D7210C74B00115CFCB88EFB9C49896DBBB6AF49711B2144A9E506DF361DB35DC02CB90

Function 01584F48 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07b24e18511f49e3b07807d5aafafc3b75edb6585e5ee34be59f86880470023d
Instruction ID: 04daf7ca7bb79ed6001c3d437d687390479ee24cbbd854287f6a79b3518797f0
Opcode Fuzzy Hash: 07b24e18511f49e3b07807d5aafafc3b75edb6585e5ee34be59f86880470023d
Instruction Fuzzy Hash: 91118670A0524A8FEB04FBBAC5587AE7BF2BF88300F144429D502BB384DF7599119BA1

Function 01586060 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c30f56722bce01a70add600b2cce701b25bfec10db3eaddf7f0338b7cef44be
Instruction ID: 21bbe7478adf451bd98ac45e03bd18ce2788da2f81513f9eeed385ef27ca5b7d
Opcode Fuzzy Hash: 3c30f56722bce01a70add600b2cce701b25bfec10db3eaddf7f0338b7cef44be
Instruction Fuzzy Hash: 010126B1D003089FD719EB79D80979E7BF6FBC4328F10446DD0199B241DF7559068791

Function 01585218 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19df9a2af65183a70749dde8ffddc9c94161e406a5a364aeb06063280685c43b
Instruction ID: 492d2351bb8ddfdef2a6bdeacdbc865095ce8e19190d4a43a43dc5421c204b15
Opcode Fuzzy Hash: 19df9a2af65183a70749dde8ffddc9c94161e406a5a364aeb06063280685c43b
Instruction Fuzzy Hash: 2901A772B101209FC7589B79E458A2A77AAEF8972131541BAE805DB375CB71DC028B90

Function 01585228 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b39fe6e26d49ec533660931207cad96d6be72af58e8254fbb9d7cc34b71154e
Instruction ID: e29aa166e91e3944dfd9d3266201c2564ab51462c4dd14c165e7140086db9272
Opcode Fuzzy Hash: 9b39fe6e26d49ec533660931207cad96d6be72af58e8254fbb9d7cc34b71154e
Instruction Fuzzy Hash: 50F0A472B101208FC714AB39E458D1A77EEEF8DA2131201B9E805DB334CA71EC018B90

Function 01580A98 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30e5ab0853c31bc0fb43048191f07dd92f3c32061291229195f1c254e52e982
Instruction ID: 2a22a28f5c88b6d0059bc1c62be29df27ff12aa304e5a24c4c4a3d7001fa854f
Opcode Fuzzy Hash: e30e5ab0853c31bc0fb43048191f07dd92f3c32061291229195f1c254e52e982
Instruction Fuzzy Hash: F501A2307043459BE7186B74E4696A97BA2BB41721B0504BEE902CB3D4DFA9C88AD790

Function 01580AA8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ce1dbb36432b39a1394cceec98747ba23049ff68a3c6ac1fbaf4c645205ad2a
Instruction ID: ba2fececcded5d44a29cf2e4d2286d4e898200cb0256c4d63e950b640037b2ff
Opcode Fuzzy Hash: 5ce1dbb36432b39a1394cceec98747ba23049ff68a3c6ac1fbaf4c645205ad2a
Instruction Fuzzy Hash: 41F0243070020897E7147BB8E86C76E7A96BB40A02F050539EA02CB3C4EFB2C849C7D0

Function 01584B34 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de5ab808d2e7eb1e9a5f6c16c3c72dd4eea7a8f53cf232ac0d2af75b1f25bac3
Instruction ID: 32e34dbe05e6aad40ac0090ec47a2ae8d2545d113f8558f89d1e7c1260234370
Opcode Fuzzy Hash: de5ab808d2e7eb1e9a5f6c16c3c72dd4eea7a8f53cf232ac0d2af75b1f25bac3
Instruction Fuzzy Hash: 1FF0F061D09344EFDB02DBB5A85829CBFB1EF85204B0480DAD0569B625E77446059B51

Function 01585148 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5980d5ecfccfcddb81fc7dbb3589ed0f7883da50c1db060c63473b2039e652
Instruction ID: ea6dbc8f115569fec878444485a392d222e2f82047d8cdbb2ec81245067bd489
Opcode Fuzzy Hash: 2c5980d5ecfccfcddb81fc7dbb3589ed0f7883da50c1db060c63473b2039e652
Instruction Fuzzy Hash: 4FE022353011049FC310EE29E89895ABBAAEBC83217108139E54EC7319CF318C058BA0

Function 015813B0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9093c3628e2503fa2085cd7fe4bbf436dffa0b41d53a834c1015926c3ac24b9
Instruction ID: 303752681d2facde8f40c0708730608ca54cd1cdc0c9d892b488a3851a9d9f7f
Opcode Fuzzy Hash: f9093c3628e2503fa2085cd7fe4bbf436dffa0b41d53a834c1015926c3ac24b9
Instruction Fuzzy Hash: A2F0F4B4600206CFCB14EF74D1A8A68BBB2BF88704F104869E5069F3A1CB799805CF01

Function 01580F28 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a16d5508fd9e70c81768cd122ea1a099f2f42c4ee5686819ebc6369eac3e7c0c
Instruction ID: 408ab9b482703f65f81a4f152eddd7cb39390e16edb00285a0ec42fdd3c6b78a
Opcode Fuzzy Hash: a16d5508fd9e70c81768cd122ea1a099f2f42c4ee5686819ebc6369eac3e7c0c
Instruction Fuzzy Hash: BDE026B1900109AFC700DBA4DC077DCB7E4FB80314F1005D9C405D7302EA706E019741

Function 01580F70 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a17fe42ff6cf6a518bccf6b540a310e60637d03adb0b2014b3b7f8cf10f1ab
Instruction ID: 645c6e9b5170bc205a4ed3144f9648ca0346903379c6e40de6a8d1c7ad5eded5
Opcode Fuzzy Hash: 40a17fe42ff6cf6a518bccf6b540a310e60637d03adb0b2014b3b7f8cf10f1ab
Instruction Fuzzy Hash: 44E02B7151A3500FC741667CA8006E737F8BBA22A4B0144FBFC45DB292E204CC088BE4

Function 01580F38 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1546409871.0000000001580000.00000040.00000800.00020000.00000000.sdmp, Offset: 01580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_1580000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57872451e0f278b39a8936e0a3fbb7640df1f7310e7ec03e957dc7b0515e97a5
Instruction ID: 41e723117ead279d51f16ae8527d8178974736ee1abd2af63a27ea93f68fcb9f
Opcode Fuzzy Hash: 57872451e0f278b39a8936e0a3fbb7640df1f7310e7ec03e957dc7b0515e97a5
Instruction Fuzzy Hash: 31D05EB1A0120DEFCB00EFB8E90559DBBF9FB84218B1045A9D809D7304FB716F10AB91

Analysis Process: Honda.exePID: 3568, Parent PID: 4084COMMON

Executed Functions

Function 024E2788 Relevance: 2.0, Instructions: 2018COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0734109d2974796bba1f5ee1908b3c2e100d16de1a6e9e2f9aeb7855cbf995a
Instruction ID: f4fc1a1eb74b597fcd372e010b5179567b0e543507fbf7301011a7c15bc28acb
Opcode Fuzzy Hash: b0734109d2974796bba1f5ee1908b3c2e100d16de1a6e9e2f9aeb7855cbf995a
Instruction Fuzzy Hash: B703AC31A0071ADFEB11EF64CC04B9EB7B6FFC9B00F518295E5096B295DBB06A85CB50

Function 024E1CC0 Relevance: 1.7, Strings: 1, Instructions: 478COMMON

Download Yara Rule

Strings

", xrefs: 024E1F97

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID: "
API String ID: 0-123907689
Opcode ID: 7512d78bf7d3c129626b62b46b86e7ffe12a9942522be7827b27e439171b076d
Instruction ID: a5d23fa4ea51e68fd38289b7e66335bbf13412c73f31a1bf9e38a062287790b2
Opcode Fuzzy Hash: 7512d78bf7d3c129626b62b46b86e7ffe12a9942522be7827b27e439171b076d
Instruction Fuzzy Hash: 47029F30A00206CFEF15DF68C880AAEB7B6BF89301F14856AD51ADB395DB70DD46CB91

Function 024E5A41 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89bfdf504d5b27f6475bc4e5c0a8c185d9fca625c80e693990a6bd98ac872c3b
Instruction ID: 69fc7d22de85a71a9ecf0570a738e26d4fe3ceb75ff87bc42231af6c6d6f2b81
Opcode Fuzzy Hash: 89bfdf504d5b27f6475bc4e5c0a8c185d9fca625c80e693990a6bd98ac872c3b
Instruction Fuzzy Hash: 45F1BF30A00305DFEB24DF68C994B6EB7F2BF8970AF54842AD5169B395DB31E845CB90

Function 024E4C69 Relevance: .4, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e6cc70fae7c48a10903fd3c35757317e0faf2c0d61aadab475d91bfbc51256
Instruction ID: 212352cf3a30a6a1f2b22bc1dd503e2aa71cf24186bf78d7753b1b9a76587d83
Opcode Fuzzy Hash: 83e6cc70fae7c48a10903fd3c35757317e0faf2c0d61aadab475d91bfbc51256
Instruction Fuzzy Hash: 2721C030A082458FEB05EBB5C8557AE7BB2BF8A301F14406AE443FB384DB755905CBA2

Function 024E4868 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb93608280aeab82c6bc4563961723eef6c8aa61e12c91998fe90f24486c4a3d
Instruction ID: 1523cf045ca0cb2ab455b5133359c86b0d2b3577669f9fa5fcff931d3f8ecd44
Opcode Fuzzy Hash: fb93608280aeab82c6bc4563961723eef6c8aa61e12c91998fe90f24486c4a3d
Instruction Fuzzy Hash: 21A18C30200605CFEB15DF68D584A69BBF2FF85321F46C5AAE04A9B666D730FD84CB94

Function 024E1063 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f7c49e3cf9a72f6a1544b8a1f910dc61da73ce3037268404712ad168ec2eb5
Instruction ID: e91b8242ff1d4c17ab922f94f866ad9ec7fccda67f6eb0bbc3acf028bca7b643
Opcode Fuzzy Hash: b3f7c49e3cf9a72f6a1544b8a1f910dc61da73ce3037268404712ad168ec2eb5
Instruction Fuzzy Hash: 2B914A71A00208EFDF05EFE5D8549EEBBBABF89301F14802AE506EB254DB359946CF50

Function 024E5E28 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26f74f907d80882130631442217b8eb9d40f1ad8c5dd963cd5b5ab6c0a4ab2d0
Instruction ID: a28d34858163c8c18c205345a196f48f4a7d548f304fe1f515d976a470a03939
Opcode Fuzzy Hash: 26f74f907d80882130631442217b8eb9d40f1ad8c5dd963cd5b5ab6c0a4ab2d0
Instruction Fuzzy Hash: 91619D34A042149FEB04DF69D894BAEBBB2BF89715F148066E506EB395DB34DC41CFA0

Function 024E0848 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbaff7515c5e9950714fa3765ec9f24d2a3ae962f02ac60c16e2a6ae7292e0d2
Instruction ID: 60bf67b9a29f770bcbbb738a35e045d980926547d73f2fcc198ba3d232ce4643
Opcode Fuzzy Hash: dbaff7515c5e9950714fa3765ec9f24d2a3ae962f02ac60c16e2a6ae7292e0d2
Instruction Fuzzy Hash: 7741A470A00208DFDB05EBBCE8547AEBBB2FF84301F149065D415AF359EB719945CB91

Function 024E1CB0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63f59192bcb35f420b079342a4e3f30346dcde1a5f84297213623c2ec678dbe1
Instruction ID: 9a4b225fa571155b438c1d005b340f3f9d8767b22e3fb10fc57b453c6c9c7ced
Opcode Fuzzy Hash: 63f59192bcb35f420b079342a4e3f30346dcde1a5f84297213623c2ec678dbe1
Instruction Fuzzy Hash: 6C41A234A00205DFEB05DF68D8449AE77F6FF89311B14816AE41ACB369DB70AD0ACF51

Function 024E1C73 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e16a054cdc98a4653fc34dbe6d1387fc60a01d405f70b2694bcc544ff0251f4
Instruction ID: ae8957f6650236d1304b0a2d39fc438231277b5af36e2e370951652872dc2c1b
Opcode Fuzzy Hash: 0e16a054cdc98a4653fc34dbe6d1387fc60a01d405f70b2694bcc544ff0251f4
Instruction Fuzzy Hash: E841B338600605CFEB05DF24D8949AE7BB6FF86311B1481AAE41A8F379DB30AD05CF51

Function 024E1B68 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f86082d70c55536b3b96136dc0f21d783fe30a76bc5e4d8d0e09d565fd20e62b
Instruction ID: 82e40a6cb1576e255f449d0fed7dcc193dccb38b79a3e4af8c0a9318c164801b
Opcode Fuzzy Hash: f86082d70c55536b3b96136dc0f21d783fe30a76bc5e4d8d0e09d565fd20e62b
Instruction Fuzzy Hash: 7E314F70B40215CFCB48EFB9C49896EB7B6AF49B15B1144A9D40ADF361DB36DC02CB91

Function 024E2777 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8b506c9e2637f6ff2723cf7e1f886924f7864c1a1d245bac2e6751dbab43949
Instruction ID: 85618530febe5552e9196e24b27eeb3930e1bc2fc980598067fd926f009ff606
Opcode Fuzzy Hash: d8b506c9e2637f6ff2723cf7e1f886924f7864c1a1d245bac2e6751dbab43949
Instruction Fuzzy Hash: 22319130A002048FFB14CF69DC54BAA7BFABF46312F4584AAD816CB691D7B4D945CB60

Function 024E0838 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f16dfc0edd712ecc1b407ac5e3ebb6a10fa42a67ae1d7a294616cf52ea76807
Instruction ID: 7bf1f1e9defd913de9856f908f083b5535ff67385acd1f84287e91bb8b581240
Opcode Fuzzy Hash: 9f16dfc0edd712ecc1b407ac5e3ebb6a10fa42a67ae1d7a294616cf52ea76807
Instruction Fuzzy Hash: 35318174900248DFEB01EBA8E894BDEBFB2FF84305F14A155E411AF359DB719889CB91

Function 024E1B78 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 613b20bc9a7d53f4c02590bfbc5a94889bc42ae289c6bb2ffa40dea888ca7e1a
Instruction ID: c49d3d685057f49318e0e22e013aff1af7fc6e178d1d5377ef4f4e65de17a48f
Opcode Fuzzy Hash: 613b20bc9a7d53f4c02590bfbc5a94889bc42ae289c6bb2ffa40dea888ca7e1a
Instruction Fuzzy Hash: 45211D74B40115CFCB48EFB9C49896DB7B6EF49B15B2144A9E40ADB361DB35DC01CB81

Function 024E4F48 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b26dc036c46c0c359e2b2f3c07b34879d80c504878ece59f7e4deccf244b475
Instruction ID: 0c1796487c0917272a02a0ab7e2cfc058069daa5d3032e60b9bcb23cb2652ef5
Opcode Fuzzy Hash: 6b26dc036c46c0c359e2b2f3c07b34879d80c504878ece59f7e4deccf244b475
Instruction Fuzzy Hash: 20119030A042098BEF05EBB5C9547AE7BF2BF88705F144029D502BB384DF3599048BA2

Function 024E6060 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c91ce399ed536eafcc0d7511bd7438e79fd98b814754bb10e666a5460327bf4
Instruction ID: 5982b8a94d5258c5abcf191eb59bd45e8de11fbdf267d9f48c7f755dbfaa3111
Opcode Fuzzy Hash: 8c91ce399ed536eafcc0d7511bd7438e79fd98b814754bb10e666a5460327bf4
Instruction Fuzzy Hash: 38112071E083885FCB16DB7998587AE7FB1ABC2310F1140AED045CB242DB310809CB51

Function 024E5218 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a069802f38ee63c62e729bd85a333164c10a118319e2c5825b3682706cb75c07
Instruction ID: 06302ad49bc1f96007a6f4f2c07175e96d4bb9cc37a6b57e8c4be8dfe682f229
Opcode Fuzzy Hash: a069802f38ee63c62e729bd85a333164c10a118319e2c5825b3682706cb75c07
Instruction Fuzzy Hash: 1001F735B002208FC7059B79E81491ABBBAEF8A61131500F6E805CF339CA31EC028BA0

Function 024E18F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bf0d7dd73051a72de1eea4e5857d5fd2028575d5ac1192886556339aafe33c0
Instruction ID: 796aa361f40e7657bb54aaf59fc2a0b114b677df734a84891344f7b73e3708b2
Opcode Fuzzy Hash: 1bf0d7dd73051a72de1eea4e5857d5fd2028575d5ac1192886556339aafe33c0
Instruction Fuzzy Hash: 08010876A001188FDF50EFA9E8006EEBBB5EB94322F40843BD55EE7240E7716A55CB91

Function 024E5228 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bae5c79dd94e6128dbc1965165c06c4dbde69736768078868b5c7d17278b4f4
Instruction ID: 591b48fd8361434c37b0c61ef0508da1751f7f38cfe3443fe886d55e86f782fb
Opcode Fuzzy Hash: 3bae5c79dd94e6128dbc1965165c06c4dbde69736768078868b5c7d17278b4f4
Instruction Fuzzy Hash: CCF06876B101309FC754AB79E85491A77EEEF8DA6631501B9E905DF334CA71EC018B90

Function 024E0A98 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 291975dbb49711006c519b3e7e73ef144f6cc4ede007167af6e46b0c75626323
Instruction ID: a841689560eb498f615cd4b82de0ca98e5885b6e36f384308ac37902fe367700
Opcode Fuzzy Hash: 291975dbb49711006c519b3e7e73ef144f6cc4ede007167af6e46b0c75626323
Instruction Fuzzy Hash: 2B01DB303082944FEF0467B4A8746AB3B967F82656B0414ABD443C77E5DFA6C886CB50

Function 024E0AA8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2787868b84f66c7d4f0b88a9edb5b4c9ff0c23654042049400499cde8eeceb83
Instruction ID: 354e1e0affda624fa755d9ed0b95fd742fc32a7c16d0c785e5c5d66af7035353
Opcode Fuzzy Hash: 2787868b84f66c7d4f0b88a9edb5b4c9ff0c23654042049400499cde8eeceb83
Instruction Fuzzy Hash: 59F0963070421887EF0477B4E86872B779AB781A56F04146A9907D7794DFF6C885CB90

Function 024E4B34 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd091c2c9b9d0f2c93f18ebd648f47cb0241764c5a88c425474c315ef7af005
Instruction ID: 18c49c2e726d10693934998dd7d234735543d52aa489772ec09162210972c9d2
Opcode Fuzzy Hash: 3bd091c2c9b9d0f2c93f18ebd648f47cb0241764c5a88c425474c315ef7af005
Instruction Fuzzy Hash: 07F02471D05284EFEB01CBF59C540ECBF71EF86205B0880DBD15687A25E7748609CB51

Function 024E13B0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 743250f03e0c5f17db8d36ff0b3955a0f9982172f8ea40e27956b0727a65015e
Instruction ID: 3c73ddfdc7ad18d23a663881ed2814ca87b33b32ff170b323da4a98259d7b571
Opcode Fuzzy Hash: 743250f03e0c5f17db8d36ff0b3955a0f9982172f8ea40e27956b0727a65015e
Instruction Fuzzy Hash: 90F0F4B4640205CFEB14EF74D558A68BBB2FF89705F2044A9E41A9F3A5CB799C45CF00

Function 024E5148 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d6e24c249027222bf3ded51c6ebb7f56409e742279d350c139580e602e796ac
Instruction ID: cd43e5e625d80683d8624855e13142e715116e9b260382172866a5091769f827
Opcode Fuzzy Hash: 9d6e24c249027222bf3ded51c6ebb7f56409e742279d350c139580e602e796ac
Instruction Fuzzy Hash: 93E092353012049FD308EF29E89896BBBAAFBCE7617508539E50AC3725DF359C05C7A0

Function 024E0F28 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9699c1b89d237b925c9ccb8b18a5ca99a6fa301b7740863a3c1c11a3c3c6fee8
Instruction ID: 6450b930ee97f3fd890b56a5260feea26491519c5a9d439742ccc98034174e32
Opcode Fuzzy Hash: 9699c1b89d237b925c9ccb8b18a5ca99a6fa301b7740863a3c1c11a3c3c6fee8
Instruction Fuzzy Hash: FAE01230909389DFD706DFB8D91155CBBB0FB87300B2041EBD445DB656E6311F048B61

Function 024E0F70 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dff15a8afae43b159c91e8cf25a4017f9aa54676854edb1cf1dfe37f50dab47d
Instruction ID: 3e2d014403a94270cf89245f7b0236cd5dbefbaf4460eefc02468e1dffb051a8
Opcode Fuzzy Hash: dff15a8afae43b159c91e8cf25a4017f9aa54676854edb1cf1dfe37f50dab47d
Instruction Fuzzy Hash: F9E02B3000D3800FD7025E75A8102423BE95B13101B0114F7D8A3C7352E5C08C5587E6

Function 024E0F38 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1626239279.00000000024E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_24e0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a51f2d568b06448dcad1f4b88c79ec4557f9ebc20aacb3cfa962a43809e9624
Instruction ID: 74197c06233d0d02b39c11c5401f427ffd0bdf369b11ece4fc045e70fde0fa87
Opcode Fuzzy Hash: 8a51f2d568b06448dcad1f4b88c79ec4557f9ebc20aacb3cfa962a43809e9624
Instruction Fuzzy Hash: 2ED01730A04208EF8B00EFB8E94155DBBF9FB85201B2081A9D809D7305EA716F149B81

Analysis Process: Honda.exePID: 1872, Parent PID: 4084COMMON

Executed Functions

Function 00BF2CC8 Relevance: 1.6, Instructions: 1603COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dea4755f904acbc56b7c8c4efda8b256ef3d748bbf1bc3473bb2063950f9abe
Instruction ID: d2a6747d0755790b724e18621fce321edec1d9cc3a3407e796abd18b4e3d38d2
Opcode Fuzzy Hash: 7dea4755f904acbc56b7c8c4efda8b256ef3d748bbf1bc3473bb2063950f9abe
Instruction Fuzzy Hash: 9DE28F35A0071A9FE721EB64CC44B99B3B6FFC9B00F518695E6083B295DBB06ED5CB40

Function 00BF2CC1 Relevance: 1.6, Instructions: 1593COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eabeaa9ff37fb3d282b81209823cdd66ae216f96d644b97af00541b77111cdcf
Instruction ID: b4e2618951db3c51b78a30d7032036a5f54d467b1ad4d3ab9bee7760cf20aa5f
Opcode Fuzzy Hash: eabeaa9ff37fb3d282b81209823cdd66ae216f96d644b97af00541b77111cdcf
Instruction Fuzzy Hash: 4DE28F35A0071A9FE721EB64CC44B99B3B6FFC9B00F518695E6083B295DBB06ED5CB40

Function 00BF5AA8 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e463e7445462e9f0cc3fa39f957ffb872b336f9d965f5b96485090149c8db075
Instruction ID: c9ab25ac0b67d4604373d79cb96859e7635f5b4bbdc48ce9d3e0cf7fbbfc91ec
Opcode Fuzzy Hash: e463e7445462e9f0cc3fa39f957ffb872b336f9d965f5b96485090149c8db075
Instruction Fuzzy Hash: 05A1AC34A01B09CFDB34DF24C984B7AB7F2EB84701F148469D6169B2A5DB35EC49CB90

Function 00BF2788 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b096ce3d1eadc38a429c5b4a82b9ea2e8798260bcfb50d1b92a29de367591c85
Instruction ID: 629657ed4d5fa414ed776a95f609aa102eb1579386b58749e866fa53ca5ceafa
Opcode Fuzzy Hash: b096ce3d1eadc38a429c5b4a82b9ea2e8798260bcfb50d1b92a29de367591c85
Instruction Fuzzy Hash: FDF17635610208CFDB15DF68C948BAEBBF6EF88301F4580A9E9068B2A1DB35DD95DB50

Function 00BF106D Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3abc45027c02273152d2a82378a0234126009f1d37f94c02d41fe6fd3425c6
Instruction ID: 237c6bdaa432d217f104c0f95c1a20499b16e3d8470a1cc9b5e34927a5402d02
Opcode Fuzzy Hash: 7d3abc45027c02273152d2a82378a0234126009f1d37f94c02d41fe6fd3425c6
Instruction Fuzzy Hash: 84916875A00208DFCB15DFE5D8549EEBBFAEF88300F14842AE506E7254DB35A946DF90

Function 00BF1CC0 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5558008012aa392ba6e2573f036abe84b3ec058256ab1561f9acfb7b8bdf9838
Instruction ID: 8635f366febdb2c91429a920d4f4ae86eb71a10e4026afd65d334a3296ca8bc3
Opcode Fuzzy Hash: 5558008012aa392ba6e2573f036abe84b3ec058256ab1561f9acfb7b8bdf9838
Instruction Fuzzy Hash: 92411739700209CFDB15EF78D8449AA7BF2FF85300710C5A6E419DB265DB34AD0ACB51

Function 00BF1CB0 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b4c935d3f8568d3b98984a0d6b311285600416303f450676702e594d562e69
Instruction ID: b104afc47bb966e5316fa5fffdd9d4e9ad9be7ee7c5253c1c672e252203a1e0e
Opcode Fuzzy Hash: d1b4c935d3f8568d3b98984a0d6b311285600416303f450676702e594d562e69
Instruction Fuzzy Hash: 5341F339604209DFD715DF38D8449AEBBF2FF89310B14C5AAE4058B266DB34AD0ACF61

Function 00BF0848 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b5e0be4a9b624d3ae3170bf494fdb7b334d12b6242e94a15917fdc930ba36ed
Instruction ID: cd5af87ab64e48c803690f7c28079a12f0f7ddc85be817b017d1123f35d4cead
Opcode Fuzzy Hash: 4b5e0be4a9b624d3ae3170bf494fdb7b334d12b6242e94a15917fdc930ba36ed
Instruction Fuzzy Hash: 23417234A1020C9FDB05EBBCE854BADBBF2FF84300F148155E515AB2A6EB749945CB91

Function 00BF2777 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56797a8a222969125680846fbf44e1b0c95df1da49f818989dbde4895f27571e
Instruction ID: d996acdf15332a574c42c045ff8c96789dc278ab625e29719feefeafcab2f968
Opcode Fuzzy Hash: 56797a8a222969125680846fbf44e1b0c95df1da49f818989dbde4895f27571e
Instruction Fuzzy Hash: A7318B31A082088FD724CF69D954BBD7BF6EF85310F0984EAE505CB1A2D7389D89CB60

Function 00BF6070 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1590d85c591fa9c6ca8023f1be3acf04347bbc5ae5a953fc0dde535aa4059de
Instruction ID: 3400c03df58eac2e69c009894e8237680936732f3c68f0264f30e441b3b5e8b7
Opcode Fuzzy Hash: d1590d85c591fa9c6ca8023f1be3acf04347bbc5ae5a953fc0dde535aa4059de
Instruction Fuzzy Hash: D621F435E042099FCB14EBB9D854BAEBBF6FFC8310F10806EE51997241EF745A058B91

Function 00BF0838 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9249ce4191f8add8c81752c0137adcc5b35ca79707d134da38272d2e39886338
Instruction ID: 221734554d23a780823050c99a9f3faa44a4469cc6ead7ae607f7f09922344f3
Opcode Fuzzy Hash: 9249ce4191f8add8c81752c0137adcc5b35ca79707d134da38272d2e39886338
Instruction Fuzzy Hash: 05317234A0024CDFEB01EBB8E884B9DBBF2FF84304F14C155E5056B26ADB749989CB51

Function 00BF1B73 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b6446e360bfbfb7cac03eb8dc9f5e65a4a3bf7ab7f09a03edc72519af78b673
Instruction ID: f30c81d686511e4bbcc97ff84282b794622d97968e89a21dafb530ed2050c831
Opcode Fuzzy Hash: 3b6446e360bfbfb7cac03eb8dc9f5e65a4a3bf7ab7f09a03edc72519af78b673
Instruction Fuzzy Hash: 68212874B40115CFCB48EFB8C49896DBBB2AF4870172149A9E506DB361DB35DC02CB80

Function 00BF1B78 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 179f1f028c17fcd009fd161467f957c16b1e0e4604fe77db7efcbdcc7544d05c
Instruction ID: 7cd8eae5a549a5b85deb917471f62360d0d59b6817aa59c88075c96c9720d583
Opcode Fuzzy Hash: 179f1f028c17fcd009fd161467f957c16b1e0e4604fe77db7efcbdcc7544d05c
Instruction Fuzzy Hash: 9D21E774B00115CFCB48EFB9C49896DBBB6EF49B1172148A9E506DB361DB35DD01CB80

Function 00BF5FB8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a7f1950c0a30676f6ae3c16c1cc3bdb525f7f512186771c1193a0a5c22d5eaf
Instruction ID: f5e788a8778652ef0652e265726e042bcac3406f7de216964714c62df3bd6d4e
Opcode Fuzzy Hash: 7a7f1950c0a30676f6ae3c16c1cc3bdb525f7f512186771c1193a0a5c22d5eaf
Instruction Fuzzy Hash: 8111C4353041149FC3149B78D898A7E77E2ABC8750B2580A9F906CB365CF34CC06DB90

Function 00BF4F3F Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa44e0b116b50c3a69c4ee56afca263c6fdca45b10dff4b37d70dad0336ecb5
Instruction ID: c246d69b32ac627b9683cb374c04643079460b89bc69e53c42565403ba0cdc26
Opcode Fuzzy Hash: dfa44e0b116b50c3a69c4ee56afca263c6fdca45b10dff4b37d70dad0336ecb5
Instruction Fuzzy Hash: 3811D374A082588FDB10EBB5C8547FE7BF1AF88300F148069D505B7384DB399909EBA1

Function 00BF4F48 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94480a49ff14c93f24967c3d44612a124aa515b249285811b20f4cda39fcddcb
Instruction ID: 8b25de5493d6ad7e11ea2f02212f6a814551a30d1080e56e940f9405687ee3be
Opcode Fuzzy Hash: 94480a49ff14c93f24967c3d44612a124aa515b249285811b20f4cda39fcddcb
Instruction Fuzzy Hash: 0B11B274A042098FDB14EBB5C9557BE7BF2AF88300F148069D605B7384DF359D04ABA1

Function 00BF606D Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d12bb30cbfdd6d78491de3fb9b5060d35d63954eb7cb0fd70ec6f92eade5986
Instruction ID: 4cba5332833039da52cc1370536157a12e467e343202c50c369cdfc8f677e364
Opcode Fuzzy Hash: 4d12bb30cbfdd6d78491de3fb9b5060d35d63954eb7cb0fd70ec6f92eade5986
Instruction Fuzzy Hash: C8014531E082585FCB25DB79A858BAE7FF2EBC4314F1481AEE0159B281DF750906CB91

Function 00BF18F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5883d93b93d121bede76cadea2f4a56e72caa28f84e010e14551a1f436a71da
Instruction ID: a444573c1302bc66f71f7f37762a7534b17a9715719187d83ce913287f93356a
Opcode Fuzzy Hash: b5883d93b93d121bede76cadea2f4a56e72caa28f84e010e14551a1f436a71da
Instruction Fuzzy Hash: 3F015236A001088FCB50EF99E8106EEBBF4EF84321F00C47AD659E3250E7705959CBD0

Function 00BF4AB4 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5152664b29d5a6c87ac9b939ea82a2b97160969f3a2130060b3a01c3dfe33c50
Instruction ID: e63fa70f2d8338ef2c4f78c492185a96ad9ed608f4c9f524f67556f2d48c8e58
Opcode Fuzzy Hash: 5152664b29d5a6c87ac9b939ea82a2b97160969f3a2130060b3a01c3dfe33c50
Instruction Fuzzy Hash: 7F012C70E00218AFDB44EBB9D858B9DBBF6EFC9701F1080A9E409D7365EB345A05DB90

Function 00BF5224 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae3db02beaccaf01f364e3c6053dac11e5e6d26bbb7a1fcf5bbaa329c10d1da
Instruction ID: b249fcd2375c4d48f51cf1e4a40e1f15e21b17260449ae8b3c39499849a09d5f
Opcode Fuzzy Hash: 2ae3db02beaccaf01f364e3c6053dac11e5e6d26bbb7a1fcf5bbaa329c10d1da
Instruction Fuzzy Hash: 8901A476B501318FC714AB79E844D6AB7EADFC9A2131542BAE805DB331CB75EC028B90

Function 00BF5228 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23092679e28d037419f6ee663a21cfaf36faf08860dafd227145225995417413
Instruction ID: 06b38cf9b11d008f79941bd07300c017abd08a9e618fb8e1926bd5443d600771
Opcode Fuzzy Hash: 23092679e28d037419f6ee663a21cfaf36faf08860dafd227145225995417413
Instruction Fuzzy Hash: 77F0A476B101218FC714AB79E44492AB7EEDF89A2131141AAE805DB330CB71EC018B90

Function 00BF0A98 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 194f65dffebc8167a7d1cd4d937ec44ffa1905cee04819cbc6778a3ff0d8a609
Instruction ID: a099024f7d0f05317959f57972ca51810d9a2f40fd480c8659ff1447cbd951d0
Opcode Fuzzy Hash: 194f65dffebc8167a7d1cd4d937ec44ffa1905cee04819cbc6778a3ff0d8a609
Instruction Fuzzy Hash: 0D01F2383183848BD719A774AC68B3A3BA19B42741F0944EAEA02C32E3DBB9CC45C750

Function 00BF0AA8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 513dc9e4b6d225eb636307ac8cec3858438679dab2bdea4350223e341d92bcc3
Instruction ID: 256983010582b6928cab188a7a8269ddfd8d188815b13b103168b03bd6ccc448
Opcode Fuzzy Hash: 513dc9e4b6d225eb636307ac8cec3858438679dab2bdea4350223e341d92bcc3
Instruction Fuzzy Hash: 20F0F63871430487C718B774EC5873A36E5A744B42F0444AAEA02C33A2EFB5DC44D790

Function 00BF4B34 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0e4082d9b234e7ff8fb1b70033209ec9aa34695172ce95bd594a6e3711c7d9a
Instruction ID: c35cfa15045473d11b0bbb00450e96bc0027a21743f9e9b690c036bbe597cb8b
Opcode Fuzzy Hash: d0e4082d9b234e7ff8fb1b70033209ec9aa34695172ce95bd594a6e3711c7d9a
Instruction Fuzzy Hash: A5F0F075D09358EFCB01CBB5AC540ECBFB1EF85300B5480DAD05687126E7788609DB51

Function 00BF5146 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f220be998585bdb373ce46f19fb0fa1b04060bd6daa3cd006faf8282d1b9c7
Instruction ID: cc3217f38f8bc3f6d9b88c10008c3778b3392f70ea85413ca7e7b99cfd7e0e49
Opcode Fuzzy Hash: d8f220be998585bdb373ce46f19fb0fa1b04060bd6daa3cd006faf8282d1b9c7
Instruction Fuzzy Hash: 21E065367151009FC714DB25EC949AEBBAAEBC9361714863EE50AC3365CB758C079B50

Function 00BF5148 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d58630ab35f161bb780e3be773070d635450191efb12229e78ce6049bc487084
Instruction ID: a69d7f73cad0b1f5d766631399c95e81fe8d0ba02482c6588ace9d7026883ec2
Opcode Fuzzy Hash: d58630ab35f161bb780e3be773070d635450191efb12229e78ce6049bc487084
Instruction Fuzzy Hash: 13E092367151049FC314EF29EC9895ABBEEFBC9361750853AE50AC3325DF359C0297A0

Function 00BF13B0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aad225ed3234b6c20fa1a61e4295fb648035e8c7869d2b1a917c8bcb2bba64a
Instruction ID: f6170f8884285855fa17005d20fa61ef19061448412441770c6c0d5649b48c8f
Opcode Fuzzy Hash: 3aad225ed3234b6c20fa1a61e4295fb648035e8c7869d2b1a917c8bcb2bba64a
Instruction Fuzzy Hash: 02F0B778640245CFDB14EF74D559A68BBB1FF88705F2048A9E50A9B3A1CB79EC05DF10

Function 00BF0F38 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa7876e3269d83189991c0d1bb0d0b6738ddfb5f6669f2bbd5817b734eb19923
Instruction ID: ad6b1f5504980f6433f78a60e87a6e8a49e36e12bf81c61a80dde321a5fa6c84
Opcode Fuzzy Hash: aa7876e3269d83189991c0d1bb0d0b6738ddfb5f6669f2bbd5817b734eb19923
Instruction Fuzzy Hash: 2DD01730A0020CEF8B00EFB8E90169DBBF9EB88201F1081A9980CD3214EB316F009B81

Function 00BF0F34 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1707113791.0000000000BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_bf0000_Honda.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba78771b74a133105d70418158d1c25f73469f53d1b1dd090aa6c35bfc957207
Instruction ID: 331160abb5ebe2b5aa2ee2a09d656e35619f3e20a128ccc5f354718b3be2387e
Opcode Fuzzy Hash: ba78771b74a133105d70418158d1c25f73469f53d1b1dd090aa6c35bfc957207
Instruction Fuzzy Hash: 37E0EC30A01249EF8B50DBB8E90159CBBF1EB85201F1081ADA40DD3215EB315F049B41

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ufp4rvU3SP.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ufp4rvU3SP.exe_f473e7d92347dce301baac3bbe865c96d17095_54d7168b_e9a717ee-61ef-48e7-8587-1f2c24c7fb8e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F8A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6FE8.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7018.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Honda.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

C:\Users\user\AppData\Local\Temp\Honda\Honda.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleApp_6d4e6e429fc6404698bba07c4b921c78.lnk

C:\Windows\appcompat\Programs\Amcache.hve

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
ufp4rvU3SP.exe

Function 00112F7C Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Function 0012C9D4 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Function 0012DDAA Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Function 0012762C Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Function 0012D9AE Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Function 001157E2 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON