Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
12.exe

Overview

General Information

Sample name:	12.exe
Analysis ID:	1544430
MD5:	d4e6ee6762c4f87650cd3e591ff7f71a
SHA1:	91be75dc4311c405c0267df327330fdaf585ba9b
SHA256:	b53a2e87ac17942649c2fc60f3247c898faf563d84f596344cfacd03350b031a
Tags:	exemammnRansomwareuser-NoName
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

×

Process Tree

System is w10x64

12.exe (PID: 5284 cmdline: "C:\Users\user\Desktop\12.exe" MD5: D4E6EE6762C4F87650CD3E591FF7F71A)

conhost.exe (PID: 5788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 12.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 12.exe

ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F32EE0 CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,__CxxThrowException@8,CryptAcquireContextA,		0_2_00F32EE0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F334A0 CryptReleaseContext,		0_2_00F334A0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F335B0 CryptGenRandom,CryptReleaseContext,__CxxThrowException@8,		0_2_00F335B0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F948A0 CryptReleaseContext,		0_2_00F948A0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F33040 CryptAcquireContextA,GetLastError,CryptReleaseContext,		0_2_00F33040
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F333D0 CryptReleaseContext,		0_2_00F333D0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F33410 CryptGenRandom,__CxxThrowException@8,		0_2_00F33410

Source: 12.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 12.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:

Binary string: G:\Mammon\Release\Mammon.pdb source: 12.exe

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F08240 FindFirstFileW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,Concurrency::details::HardwareAffinity::operator!=,std::_Container_base12::~_Container_base12,		0_2_00F08240
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00EFC5B0 FindFirstFileW,operator!=,operator!=,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,std::_Container_base12::~_Container_base12,		0_2_00EFC5B0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00EFCE60 FindFirstFileW,operator!=,std::_Container_base12::~_Container_base12,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,Concurrency::details::HardwareAffinity::operator!=,std::_Container_base12::~_Container_base12,		0_2_00EFCE60
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F49A22 GetFileAttributesExW,GetLastError,___std_fs_open_handle@16,GetLastError,GetFileInformationByHandle,FindFirstFileExW,FindClose,		0_2_00F49A22
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00EF9C50 FindFirstFileW,std::_Container_base12::~_Container_base12,operator!=,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,std::_Container_base12::~_Container_base12,		0_2_00EF9C50
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F82D68 FindFirstFileExA,		0_2_00F82D68

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00F07E90 GetLogicalDriveStringsW,GetDriveTypeW,std::_Container_base12::~_Container_base12,

Source: 12.exe	String found in binary or memory: https://t.me/mamondec
Source: 12.exe	String found in binary or memory: https://t.me/mamondec1-Com
Source: 12.exe, 00000000.00000002.3267018222.000000000079E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/mamondecDOq

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F346D0		0_2_00F346D0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F2E400		0_2_00F2E400
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F640FE		0_2_00F640FE
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F38525		0_2_00F38525
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F50630		0_2_00F50630
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F1C740		0_2_00F1C740
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F38C9F		0_2_00F38C9F
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F2D0A4		0_2_00F2D0A4
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F2D097		0_2_00F2D097
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F39026		0_2_00F39026
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F65170		0_2_00F65170
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F392B7		0_2_00F392B7
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F55317		0_2_00F55317
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F15450		0_2_00F15450
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F2D440		0_2_00F2D440
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F396F0		0_2_00F396F0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F15650		0_2_00F15650
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F817B9		0_2_00F817B9
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F158F0		0_2_00F158F0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F1D860		0_2_00F1D860
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F79C63		0_2_00F79C63
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F2DD89		0_2_00F2DD89
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F35EA0		0_2_00F35EA0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F2DFAD		0_2_00F2DFAD
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F3A080		0_2_00F3A080
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F661BF		0_2_00F661BF
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F46690		0_2_00F46690
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F2E85B		0_2_00F2E85B
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F46970		0_2_00F46970
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F72B60		0_2_00F72B60
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F36B50		0_2_00F36B50
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F3AC00		0_2_00F3AC00
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F46D00		0_2_00F46D00
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F4AD00		0_2_00F4AD00
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F52E31		0_2_00F52E31
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F6F041		0_2_00F6F041
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F471A0		0_2_00F471A0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F63560		0_2_00F63560
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F737B0		0_2_00F737B0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F638D2		0_2_00F638D2
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F379C0		0_2_00F379C0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F63B7C		0_2_00F63B7C
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F47B50		0_2_00F47B50
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F47DF0		0_2_00F47DF0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F63E43		0_2_00F63E43
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F4FE4A		0_2_00F4FE4A
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F87F44		0_2_00F87F44

Source: C:\Users\user\Desktop\12.exe	Code function: String function: 00EE8040 appears 80 times
Source: C:\Users\user\Desktop\12.exe	Code function: String function: 00F4B7C6 appears 88 times
Source: C:\Users\user\Desktop\12.exe	Code function: String function: 00F4C8AD appears 84 times
Source: C:\Users\user\Desktop\12.exe	Code function: String function: 00F4CBB0 appears 63 times

Source: 12.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal56.winEXE@2/5@0/0

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00F49D99 GetDiskFreeSpaceExW,GetLastError,GetDiskFreeSpaceExW,GetLastError,

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5788:120:WilError_03

Source: 12.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\12.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 12.exe

ReversingLabs: Detection: 52%

Source: unknown	Process created: C:\Users\user\Desktop\12.exe "C:\Users\user\Desktop\12.exe"
Source: C:\Users\user\Desktop\12.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\12.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Section loaded: cryptbase.dll			Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Section loaded: cryptsp.dll			Jump to behavior
Source: C:\Users\user\Desktop\12.exe	Section loaded: rsaenh.dll			Jump to behavior

Source: 12.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 12.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 12.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 12.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 12.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 12.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 12.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 12.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: G:\Mammon\Release\Mammon.pdb source: 12.exe

Source: 12.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 12.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 12.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 12.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 12.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00F5B6A5 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F4C887 push ecx; ret		0_2_00F4C89A
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F4CBF6 push ecx; ret		0_2_00F4CC09

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00F4AD00 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Users\user\Desktop\12.exe

API coverage: 5.9 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\12.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F08240 FindFirstFileW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,Concurrency::details::HardwareAffinity::operator!=,std::_Container_base12::~_Container_base12,		0_2_00F08240
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00EFC5B0 FindFirstFileW,operator!=,operator!=,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,std::_Container_base12::~_Container_base12,		0_2_00EFC5B0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00EFCE60 FindFirstFileW,operator!=,std::_Container_base12::~_Container_base12,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,Concurrency::details::HardwareAffinity::operator!=,std::_Container_base12::~_Container_base12,		0_2_00EFCE60
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F49A22 GetFileAttributesExW,GetLastError,___std_fs_open_handle@16,GetLastError,GetFileInformationByHandle,FindFirstFileExW,FindClose,		0_2_00F49A22
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00EF9C50 FindFirstFileW,std::_Container_base12::~_Container_base12,operator!=,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,std::_Container_base12::~_Container_base12,		0_2_00EF9C50
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F82D68 FindFirstFileExA,		0_2_00F82D68

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00F07E90 GetLogicalDriveStringsW,GetDriveTypeW,std::_Container_base12::~_Container_base12,

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00F6C6AF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00F5B6A5 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00F77781 mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00F83CF0 GetProcessHeap,

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F6C6AF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00F6C6AF
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F4C9F0 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00F4C9F0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F4CB52 SetUnhandledExceptionFilter,		0_2_00F4CB52
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F4CC0B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00F4CC0B

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00F4C2FF cpuid

Source: C:\Users\user\Desktop\12.exe	Code function: EnumSystemLocalesW,		0_2_00F7C906
Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoW,		0_2_00F7CDEF
Source: C:\Users\user\Desktop\12.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,		0_2_00F85932
Source: C:\Users\user\Desktop\12.exe	Code function: EnumSystemLocalesW,		0_2_00F85BB9
Source: C:\Users\user\Desktop\12.exe	Code function: EnumSystemLocalesW,		0_2_00F85C9F
Source: C:\Users\user\Desktop\12.exe	Code function: EnumSystemLocalesW,		0_2_00F85C04
Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,		0_2_00F85D30
Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoW,		0_2_00F85F80
Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,		0_2_00F860A9
Source: C:\Users\user\Desktop\12.exe	Code function: GetLocaleInfoW,		0_2_00F861B0
Source: C:\Users\user\Desktop\12.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,		0_2_00F8627D

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00F7CE59 GetSystemTimeAsFileTime,

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00F8050E _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

Source: C:\Users\user\Desktop\12.exe

Code function: 0_2_00F52B6C GetVersionExW,Concurrency::details::platform::InitializeSystemFunctionPointers,Concurrency::details::WinRT::Initialize,__CxxThrowException@8,

Source: C:\Users\user\Desktop\12.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00EE15F0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,		0_2_00EE15F0
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00EE1590 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,		0_2_00EE1590
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F5D6B9 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,		0_2_00F5D6B9
Source: C:\Users\user\Desktop\12.exe	Code function: 0_2_00F5E3E0 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::InternalContextBase::SwitchOut,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,		0_2_00F5E3E0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	26 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
12.exe	53%	ReversingLabs	Win32.Infostealer.Tinba
12.exe	100%	Avira	TR/FileCoder.csxlc

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://t.me/mamondec1-Com	12.exe	false		unknown
https://t.me/mamondec	12.exe	false		unknown
https://t.me/mamondecDOq	12.exe, 00000000.00000002.3267018222.000000000079E000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544430
Start date and time:	2024-10-29 12:25:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	12.exe
Detection:	MAL
Classification:	mal56.winEXE@2/5@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 83 Number of non-executed functions: 217
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: 12.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\RSADecryptKey\ID.DAT

Process:	C:\Users\user\Desktop\12.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	10
Entropy (8bit):	3.321928094887362
Encrypted:	false
SSDEEP:	3:haN:u
MD5:	30449CF77CC065CB7ECE961D844E3E9E
SHA1:	DFCECA5AE93F2EFFF7B29852E3A6CE23D971B5C1
SHA-256:	3801620940F30AD0F072C063BCB7A9E45C92395158C7660145FC21728EE0037D
SHA-512:	4DBE30A5A35B26FC4EC19D63E7DC3414F27574311A5ED84E5487FF62F751A8BDE951DBB28A341F96FE103DF83B24651C36A8CDA1A1BE64E2D53EE12B6DC65F17
Malicious:	false
Reputation:	low
Preview:	DP8WG91XFS

C:\RSADecryptKey\KEY.DAT

Process:	C:\Users\user\Desktop\12.exe
File Type:	data
Category:	dropped
Size (bytes):	3873
Entropy (8bit):	7.951398094272129
Encrypted:	false
SSDEEP:	96:gHp4E2KCn1S7aNtjF7TCFEhIeg4E1euv24cIWseUbfy6bfbJ:CGcuLyESebEIW5cblUm6HJ
MD5:	57D9ED6F817B9EC84CFFBD09D64266B9
SHA1:	2ECB61BD3C6104E7F141A898585AB94C31244810
SHA-256:	6BD0A83C241D2B820FF54B7BC84BAB977D9D8D50EB3E121725DFF42CB6DA7290
SHA-512:	4A8BA83E4AC52D74A599F418927DF4FDFFB588C93189B70AC53FF8B1AAFFC1718249D4D3F51E6EC49814709B612B038045C1FB62E945ACB47E5A9F3684B16C8B
Malicious:	false
Reputation:	low
Preview:	k[.SLC...\..W......d..20.D./.x\|.......s....../..xS.......g.z..6.Y....su.x^f...KEY.:... .p...7.A.....i.W\@...Y-yu0.2.e\...j@....&.J'\7q.P$....E.f..o.f.9.8..x..)r..."..ax.K.].;..D7...+:.c..%'L.D=..I..f.ZO../......O.....R.`.2..S$Z.;.7......3.?..c.!...sq.b$............Bti.4.."QB4..TE.-^M...'...QG}4.6?..g1..r....\|.i"<...n..16.....xn..RCS.G`.1...p(....Y..~.O."......`{..`...w'.^...,..?\.....>.}..W....mgf.....G:...(....N..@........d..\|.'X......q\..1.vPNd.....EIv1.'3.U..g.....(..{............r......tu.<S/.;.FS.{....[e..k@.z.UGC(.i@...>c..#w_s..U.k.Y..%.Z...s...)J.J.Ij....y.....V%.`..8...mG..u.z,.N]c%.._...}..3Fo.A........>.@ .<.....r...>.r.R.~,..W...b.G....L.o.._.G.j<.hq...s..9..U.o\.....b...0.w..#......6..`.H.UB...Kr.Z;l."6..._.....9Y...W.K..fB.cP.T.Y........g..lt..~(.R..6.".D..D.......1.zZ.....{1.nR.C>.s@a.....K[.X~2'...:0MU-f-^.oF.`...]...$.p..i..>.ur..../...&......D.QF.J)......78..%.1........(n0..a..r....d...4x.SQ...E..2..N.x..Q}...IP

C:\RSADecryptKey\KEY.txt

Process:	C:\Users\user\Desktop\12.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

C:\RSADecryptKey\Public.txt

Process:	C:\Users\user\Desktop\12.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	754
Entropy (8bit):	6.006722588887071
Encrypted:	false
SSDEEP:	12:CZFecQt9jFE9nkfNgQ8lIhfDWv4Bcibkto3moEK5kHY+oUoiByMGF:0ccKFE9kfNgvIhfDSGcGJk5zPQMS
MD5:	03ECC958CE2768C6E4FCB894C70CE963
SHA1:	B2E8D5CBE80608630F56AE0ADB9C553805B88378
SHA-256:	CA5CB3C96B568272F66AD513CC826544C8C2ED64FFCB66267607E63E8AFE3942
SHA-512:	05375462553C657361A8564F8330E2719B4BD6427C78CAE6F514BDFA4D98B259A5246B8100F18FFFB5FF242AD35C52C6D8FB399306A029E522DCF4A7233AF315
Malicious:	false
Reputation:	low
Preview:	MIICIDANBgkqhkiG9w0BAQEFAAOCAg0AMIICCAKCAgEAuVhWVdY4F17I4F6qkjkNHymleuvN..go4j3dYdNYgG7IbLBLlp2UWFWPuFcXhDyc9SzQoF4CaqYx7m/NucHO23PlQS0ss5QsL5fT9f..dSTZO2vRxa5wUlomoAfYq1Dua/+HSShBR4DGw+o/BPpitJaDwYRaxlUXBknzcNqE5LZ1d5mr..ZKHn34qe05OKt0r9urhrf+QAaV91ErcvdHQ1BMoeq+WZxtzVj68FbgEmSOKnLv6jaWcOxH9g..cM8253L+O6lhStGMeL/VJAt3OznGnfL0K03I9kvpfuQC3pdEQxgUf7XxnBXOaMlbxjq54Gwz..1rzXawf7ZQ9cnqNRLdBxmFxdt+hu9wlSywcr+o9BQfs77/sdGvUWpJfaD/C8ZI7EsYnj/QRb..R0CDLqXFEOATg3/+k1XA0S32nXYUPSKiu6F7+uyZnAZZTs2Fp1PhpEkL30SWZ6bIhnwkSBJB..tYSNXFiDSQ0Mvc6AdngTRc6I6rba6dbhQM7D5tRtdiAJV0pql+o4akUlbjwx9+Xd1iyAqm75..hL1BYKAgvHvUzS2lIuNSnUx5QHryDa8zbeZ6BI2mB/O3EFK9AorodlLVNf3sYaCzeTKBtufl..uk0C4JtqMdwXfUiT+9ZaPJqbDS19k1mFeaxkGMYWHsV1VJ3W2glWTLrYTy0QSpSt/F9hI/vG..zP86rbMCARE=..

\Device\ConDrv

Process:	C:\Users\user\Desktop\12.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	3.753434386188785
Encrypted:	false
SSDEEP:	3:opI9S1XoyR/:omUqyV
MD5:	D00381ADB6305C0CA316C802BB1D7CE1
SHA1:	4929BA5F0D84D2D403A5474206FB6619FCA47CAB
SHA-256:	198550B907276D77B74951235BD1A179078EAB5D6284A47998A23C7C0264BAB7
SHA-512:	449679944A1F623B64A1DCCC104094396A93BB2E7A630B42CE446C50DF7D52D5C73BAAFA9C40382BB8FDB433E62C3729E45FA57B7E69C1A550E91761D7B62D44
Malicious:	false
Reputation:	low
Preview:	C:\..1-Com....2-dir..Choose:

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.583817331975598
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	12.exe
File size:	997'376 bytes
MD5:	d4e6ee6762c4f87650cd3e591ff7f71a
SHA1:	91be75dc4311c405c0267df327330fdaf585ba9b
SHA256:	b53a2e87ac17942649c2fc60f3247c898faf563d84f596344cfacd03350b031a
SHA512:	30b52db708ba2e7fba610825496542ecca38cd9b342ab9e930110c8cc767e0ddb3a9e9ab57a043b9156c2703556a9528193db1495f55d5a0c1eb536d846fc898
SSDEEP:	24576:nS6XklOGApJ6vstNPuPROYrIzOCMPhm3g1gmunB:nS6eOGApsvX5/M6C7geBnB
TLSH:	28258D207602F536E8B304F68EBDEA5E501CFD5007655ADFB3C8666E4AB48D12E33993
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........}..\|...\|...\|.bV....\|.bV..s.\|.bV....\|..../..\|...y/U.\|...x/..\|.......\|...}.v.\|...y/..\|.}.y/..\|.}.....\|.}.~/..\|.Rich..\|........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x46c210
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66FC7290 [Tue Oct 1 22:07:12 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	aabe76e81d032a0fd3912dd269708aa2

Entrypoint Preview

Instruction
call 00007F31B4C819A3h
jmp 00007F31B4C80BCDh
int3
int3
int3
int3
int3
int3
cmp cl, 00000040h
jnc 00007F31B4C80D77h
cmp cl, 00000020h
jnc 00007F31B4C80D68h
shld edx, eax, cl
shl eax, cl
ret
mov edx, eax
xor eax, eax
and cl, 0000001Fh
shl edx, cl
ret
xor eax, eax
xor edx, edx
ret
int3
push esi
mov eax, dword ptr [esp+14h]
or eax, eax
jne 00007F31B4C80D8Ah
mov ecx, dword ptr [esp+10h]
mov eax, dword ptr [esp+0Ch]
xor edx, edx
div ecx
mov ebx, eax
mov eax, dword ptr [esp+08h]
div ecx
mov esi, eax
mov eax, ebx
mul dword ptr [esp+10h]
mov ecx, eax
mov eax, esi
mul dword ptr [esp+10h]
add edx, ecx
jmp 00007F31B4C80DA9h
mov ecx, eax
mov ebx, dword ptr [esp+10h]
mov edx, dword ptr [esp+0Ch]
mov eax, dword ptr [esp+08h]
shr ecx, 1
rcr ebx, 1
shr edx, 1
rcr eax, 1
or ecx, ecx
jne 00007F31B4C80D56h
div ebx
mov esi, eax
mul dword ptr [esp+14h]
mov ecx, eax
mov eax, dword ptr [esp+10h]
mul esi
add edx, ecx
jc 00007F31B4C80D70h
cmp edx, dword ptr [esp+0Ch]
jnbe 00007F31B4C80D6Ah
jc 00007F31B4C80D71h
cmp eax, dword ptr [esp+08h]
jbe 00007F31B4C80D6Bh
dec esi
sub eax, dword ptr [esp+10h]
sbb edx, dword ptr [esp+14h]
xor ebx, ebx
sub eax, dword ptr [esp+08h]
sbb edx, dword ptr [esp+0Ch]
neg edx
neg eax
sbb edx, 00000000h
mov ecx, edx
mov edx, ebx
mov ebx, ecx
mov ecx, eax
mov eax, esi
pop esi
retn 0010h
int3
int3

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe1b84	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xed000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xee000	0xac20	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xcf350	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xcf460	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xcf3c0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb5000	0x234	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb3c0a	0xb3e00	fb0cae030696caa1dc9919c6ad8de0c5	False	0.4671687695448228	data	6.596706338829282	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb5000	0x2d880	0x2da00	975e074796cc72e19d8890f1b536cd33	False	0.37914169520547947	data	5.048372166875648	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xe3000	0x94a0	0x6c00	46b470985e0a41b7b6eb92e2977ddbaa	False	0.1622902199074074	data	4.933537473400661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xed000	0x1e0	0x200	e004de00c8e4161f9a8b96a63f27f057	False	0.53125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xee000	0xac20	0xae00	5770e65cea08e5886129734ea3b19784	False	0.5582121048850575	data	6.523366272247362	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xed060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

GetLogicalDriveStringsW, GetDriveTypeA, GetDriveTypeW, FreeConsole, GetLastError, FindNextFileW, QueryPerformanceCounter, QueryPerformanceFrequency, GetCurrentThread, GetThreadTimes, SetEndOfFile, FindFirstFileW, lstrcmpW, SetLastError, FindClose, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, FormatMessageW, EnterCriticalSection, LeaveCriticalSection, TryEnterCriticalSection, DeleteCriticalSection, GetCurrentThreadId, GetCurrentDirectoryW, CreateDirectoryW, CreateFileW, DeleteFileW, FindFirstFileExW, GetDiskFreeSpaceExW, GetFileAttributesExW, GetFileInformationByHandle, AreFileApisANSI, CloseHandle, GetModuleHandleW, GetProcAddress, CopyFileW, MoveFileExW, DuplicateHandle, WaitForSingleObjectEx, Sleep, GetCurrentProcess, SwitchToThread, GetExitCodeThread, EncodePointer, DecodePointer, InitializeCriticalSectionAndSpinCount, CreateEventW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetTickCount, CompareStringW, LCMapStringW, GetLocaleInfoW, GetCPInfo, SetEvent, ResetEvent, InitializeSListHead, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, TerminateProcess, GetCurrentProcessId, CreateTimerQueue, SignalObjectAndWait, CreateThread, SetThreadPriority, GetThreadPriority, GetLogicalProcessorInformation, CreateTimerQueueTimer, ChangeTimerQueueTimer, DeleteTimerQueueTimer, GetNumaHighestNodeNumber, GetProcessAffinityMask, SetThreadAffinityMask, RegisterWaitForSingleObject, UnregisterWait, FreeLibrary, FreeLibraryAndExitThread, GetModuleFileNameW, GetModuleHandleA, LoadLibraryExW, GetVersionExW, VirtualAlloc, VirtualProtect, VirtualFree, ReleaseSemaphore, InterlockedPopEntrySList, InterlockedPushEntrySList, InterlockedFlushSList, QueryDepthSList, UnregisterWaitEx, LoadLibraryW, RaiseException, RtlUnwind, ExitThread, GetModuleHandleExW, ExitProcess, GetModuleFileNameA, GetStdHandle, WriteFile, GetCommandLineA, GetCommandLineW, GetACP, HeapAlloc, HeapFree, GetFileType, GetDateFormatW, GetTimeFormatW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, FlushFileBuffers, GetConsoleCP, GetConsoleMode, ReadFile, ReadConsoleW, SetFilePointerEx, GetTimeZoneInformation, HeapReAlloc, HeapSize, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, GetProcessHeap, SetStdHandle, WriteConsoleW

ADVAPI32.dll

CryptReleaseContext, CryptAcquireContextA, CryptGenRandom

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: 12.exePID: 5284, Parent PID: 1028

General

Target ID:	0
Start time:	07:25:54
Start date:	29/10/2024
Path:	C:\Users\user\Desktop\12.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\12.exe"
Imagebase:	0xee0000
File size:	997'376 bytes
MD5 hash:	D4E6EE6762C4F87650CD3E591FF7F71A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5788, Parent PID: 5284

General

Target ID:	1
Start time:	07:25:54
Start date:	29/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 12.exePID: 5284, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	7.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6%
Total number of Nodes:	2000
Total number of Limit Nodes:	27

Executed Functions

Function 00F346D0 Relevance: 32.1, APIs: 9, Strings: 9, Instructions: 643
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F347B7
__CxxThrowException@8.LIBVCRUNTIME ref: 00F347CD
__CxxThrowException@8.LIBVCRUNTIME ref: 00F348D0
std::make_error_code.LIBCPMTD ref: 00F34ADB
std::ios_base::failure::failure.LIBCPMTD ref: 00F34C3F
__CxxThrowException@8.LIBVCRUNTIME ref: 00F34C4D

Strings

FileStore: maximum seek offset exceeded, xrefs: 00F348A7
InputFileName, xrefs: 00F34964
InputBinaryMode, xrefs: 00F34996
ios_base::badbit set, xrefs: 00F34AE4, 00F34B84, 00F34BAD, 00F34C15
ios_base::failbit set, xrefs: 00F34C1F, 00F34C3B
FileSink: output stream not opened, xrefs: 00F3478E
InputFileNameWide, xrefs: 00F3493B
ios_base::eofbit set, xrefs: 00F34C24
InputStreamPointer, xrefs: 00F3497E

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw$std::ios_base::failure::failurestd::make_error_code
String ID: FileSink: output stream not opened$FileStore: maximum seek offset exceeded$InputBinaryMode$InputFileName$InputFileNameWide$InputStreamPointer$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2082275273-1625547482
Opcode ID: 5c7c31174de6dd63b8d190125ee1e8e3b09a53336ddff290b8f158555292c805
Instruction ID: f3d4d08d99dfdd68b963afd98c5ef78f61babce2414cc06ca83ed9b76aaa55ff
Opcode Fuzzy Hash: 5c7c31174de6dd63b8d190125ee1e8e3b09a53336ddff290b8f158555292c805
Instruction Fuzzy Hash: 1932BC71A002099FDB14DF68C881FAAB7E5FF88720F14852DE8169B392DB75F905DB90

Function 00F8050E Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00F80590
_free.LIBCMT ref: 00F805B4
_free.LIBCMT ref: 00F8073B
GetTimeZoneInformation.KERNELBASE(?,00000000,00000000,00000000,?,00FA721C), ref: 00F8074D
WideCharToMultiByte.KERNEL32(00000000,00000000,Eastern Standard Time,000000FF,00000000,0000003F,00000000,?,?), ref: 00F807C5
WideCharToMultiByte.KERNEL32(00000000,00000000,Eastern Summer Time,000000FF,?,0000003F,00000000,?), ref: 00F807F2
_free.LIBCMT ref: 00F80907

Strings

Eastern Summer Time, xrefs: 00F807EB
Eastern Standard Time, xrefs: 00F807BE

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 314583886-239921721
Opcode ID: 364f9c26aa5517607d247cf6841a8ae484170ec6e38e4c5f32b7ed19aadfcde2
Instruction ID: 673756c15e3062ee17e1441917f132ca8a25ae54cefc68454bffab36a8579678
Opcode Fuzzy Hash: 364f9c26aa5517607d247cf6841a8ae484170ec6e38e4c5f32b7ed19aadfcde2
Instruction Fuzzy Hash: F2C12B71D04249AFDB20BF78CC41BEE7BA8EF81320F54416AE44497252EB358D49FB91

Function 00F32EE0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 123
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,F58088C3,?,?,00000000), ref: 00F32F25
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00F8FFF8,000000FF,?,00F33620), ref: 00F32F2B
CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000008), ref: 00F32F3F
CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000028), ref: 00F32F50
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00F8FFF8,000000FF), ref: 00F32F75
__CxxThrowException@8.LIBVCRUNTIME ref: 00F32FA4

Strings

Crypto++ RNG, xrefs: 00F32F37, 00F32F4A
CryptAcquireContext, xrefs: 00F32F7B

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: AcquireContextCrypt$ErrorLast$Exception@8Throw
String ID: CryptAcquireContext$Crypto++ RNG
API String ID: 297295237-1159690233
Opcode ID: f8f85487fcc0ad2780af812290c6acdbe2c7fa1f6dd2718fe5073f21e0c8bb8c
Instruction ID: 150ef24a3881c6a59e05949a81f7194b221b6d7cf9b5911873de82f7dfae4210
Opcode Fuzzy Hash: f8f85487fcc0ad2780af812290c6acdbe2c7fa1f6dd2718fe5073f21e0c8bb8c
Instruction Fuzzy Hash: 1A41B571A44749AFDB10DF65CC41F9AF7FCFB49B20F10462AF515A7280EBB4A9049B60

Function 00F335B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135encryptionCOMMON

Download Yara Rule

APIs

CryptGenRandom.ADVAPI32(00000000,?,00000000,00000001), ref: 00F33630
CryptReleaseContext.ADVAPI32(?,00000000), ref: 00F3364F

Part of subcall function 00F33040: GetLastError.KERNEL32(00000010,F58088C3,7508FC30,?), ref: 00F33090

__CxxThrowException@8.LIBVCRUNTIME ref: 00F336BA

Part of subcall function 00F63148: RaiseException.KERNEL32(?,?,?,00F4C9DF,?,00000000,?,?,?,?,?,?,00F4C9DF,?,00FBFECC), ref: 00F631A8

Strings

CryptGenRandom, xrefs: 00F33694

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Crypt$ContextErrorExceptionException@8LastRaiseRandomReleaseThrow
String ID: CryptGenRandom
API String ID: 1600773198-3616286655
Opcode ID: 5253004c21e089a931adc3dc892b7e39f9c9113b27591fef0c148f7887dd1c21
Instruction ID: 6113506cd131fa5885f8940aba2af2a1ca6eeaabd9cf1f0e3c0212575a3454c4
Opcode Fuzzy Hash: 5253004c21e089a931adc3dc892b7e39f9c9113b27591fef0c148f7887dd1c21
Instruction Fuzzy Hash: 46419FB1904249EFDB10DFA5DC45F9EFBB8FF15720F10412AE815A7281EB74AA08DB61

Function 00F07E90 Relevance: 4.7, APIs: 3, Instructions: 201COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNELBASE(00000068,?,0000000C,F58088C3), ref: 00F07F0F
GetDriveTypeW.KERNELBASE(?,?,?), ref: 00F08008
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F081F5

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Drive$Container_base12Container_base12::~_LogicalStringsTypestd::_
String ID:
API String ID: 537271169-0
Opcode ID: 320f0b89c83e755492bdf058d80074bd25267f77157d4f07acdaa40c5c4f86c1
Instruction ID: d83bd04d4ab1e4992a9a9a1dc3fed24a13349c1f8777dae4fa7f8ea80cf9a887
Opcode Fuzzy Hash: 320f0b89c83e755492bdf058d80074bd25267f77157d4f07acdaa40c5c4f86c1
Instruction Fuzzy Hash: B1910771900229DBCB24DB14CD91BEEB7B4BF58304F1081E9E54A67291EB706F99EF80

Function 00F2E400 Relevance: 2.3, Strings: 1, Instructions: 1005COMMON

Download Yara Rule

Strings

, xrefs: 00F2E660

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 681920d7e99563de1c3174b9181243e0f31066773bf3896a62ea7ca1bf14bee3
Instruction ID: f723d8ea7b40c7d74502aec78c94f9910685b9c0e0b7830cd57e9adadab80675
Opcode Fuzzy Hash: 681920d7e99563de1c3174b9181243e0f31066773bf3896a62ea7ca1bf14bee3
Instruction Fuzzy Hash: 41A23A74A00118DFCB18CF98E5A1ABDB7F1FB48310F25409DE586AB392C635AE55EF50

Function 00F334A0 Relevance: 1.6, APIs: 1, Instructions: 81encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00F3352A

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: 1776f49a64aad000831f2909eb4a567ee2288e0b5a97aecc44b7f94cf23a95b7
Instruction ID: 043ae608c664f937cd79cf43fc29d207a8d1944540b2b0f7e96a4d48110154a8
Opcode Fuzzy Hash: 1776f49a64aad000831f2909eb4a567ee2288e0b5a97aecc44b7f94cf23a95b7
Instruction Fuzzy Hash: C8210872E042199BD720DF59ED4BF59B7E8EB44B34F04012AED0583380E775ED00A696

Function 00F08810 Relevance: 77.0, APIs: 14, Strings: 29, Instructions: 1783
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F0F5A0: Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 00F0F5D8

operator!=.LIBCPMTD ref: 00F08A02

Strings

RSADecryptKey, xrefs: 00F08ECE
C:\RSADecryptKey\Public.txt, xrefs: 00F092B5
C:\RSADecryptKey\Public.txt, xrefs: 00F09446
Date:, xrefs: 00F096EA
C:\RSADecryptKey\KEY.DAT, xrefs: 00F088E9
RSADecryptKey, xrefs: 00F08AD3
RSADecryptKey, xrefs: 00F08A19
C:\RSADecryptKey\ID.DAT, xrefs: 00F09031
C:\RSADecryptKey\Public.txt, xrefs: 00F0A484
, xrefs: 00F09BCC
C:\, xrefs: 00F09F81
RSADecryptKey\KEY.DAT, xrefs: 00F08E14
C:\RSADecryptKey\KEY.DAT, xrefs: 00F098C6
C:\RSADecryptKey\KEY.DAT, xrefs: 00F0A445
DP8WG91XFS, xrefs: 00F08887, 00F09045, 00F09346, 00F0936B, 00F095E7
RSADecryptKey\KEY.DAT, xrefs: 00F0A081
ID:, xrefs: 00F095EC
Mail:, xrefs: 00F09686
C:\RSADecryptKey\KEY.txt, xrefs: 00F09519
C:\RSADecryptKey\ID.dat, xrefs: 00F0A4C2
Data:, xrefs: 00F09616
C:\RSADecryptKey\ID.DAT, xrefs: 00F0A722
C:\RSADecryptKey\Key.txt, xrefs: 00F098B2
I:\, xrefs: 00F09FA0
MIICIDANBgkqhkiG9w0BAQEFAAOCAg0AMIICCAKCAgEA0dC+ob8iPEud5bPewH2vl6KgK178dv180rUpshPMI4G1c9eZtGRwrx1OdkiPp7ivSH92nixHBcVkRl6vHEH5xV0HjqazkekQkLiiDIVBKWhBZ2llA7d1Dt2MfAFIe7NQIgRDjMFRJ9Mfxgfr4AhCdkv8Av1DAUbf7Bmb/Mtxr9siyVJUeJITi8SmzXubMh2zkz0F6ppj2sDVzP+uo07MmIiQ, xrefs: 00F0889C
C:\RSADecryptKey\Public.txt, xrefs: 00F0A62A
C:\RSADecryptKey\ID.DAT, xrefs: 00F0A229
%d-%m-%Y %H:%M:%S, xrefs: 00F094D7
\RSADecryptKey\KEY.DAT, xrefs: 00F09FC3

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Base::ChoresConcurrency::details::GroupScheduleSegmentUnrealizedoperator!=
String ID: ID:$Data:$Date:$Mail:$ $%d-%m-%Y %H:%M:%S$C:\$C:\RSADecryptKey\ID.DAT$C:\RSADecryptKey\ID.DAT$C:\RSADecryptKey\ID.DAT$C:\RSADecryptKey\ID.dat$C:\RSADecryptKey\KEY.DAT$C:\RSADecryptKey\KEY.DAT$C:\RSADecryptKey\KEY.DAT$C:\RSADecryptKey\KEY.txt$C:\RSADecryptKey\Key.txt$C:\RSADecryptKey\Public.txt$C:\RSADecryptKey\Public.txt$C:\RSADecryptKey\Public.txt$C:\RSADecryptKey\Public.txt$DP8WG91XFS$I:\$MIICIDANBgkqhkiG9w0BAQEFAAOCAg0AMIICCAKCAgEA0dC+ob8iPEud5bPewH2vl6KgK178dv180rUpshPMI4G1c9eZtGRwrx1OdkiPp7ivSH92nixHBcVkRl6vHEH5xV0HjqazkekQkLiiDIVBKWhBZ2llA7d1Dt2MfAFIe7NQIgRDjMFRJ9Mfxgfr4AhCdkv8Av1DAUbf7Bmb/Mtxr9siyVJUeJITi8SmzXubMh2zkz0F6ppj2sDVzP+uo07MmIiQ$RSADecryptKey$RSADecryptKey$RSADecryptKey$RSADecryptKey\KEY.DAT$RSADecryptKey\KEY.DAT$\RSADecryptKey\KEY.DAT
API String ID: 156086389-2131334368
Opcode ID: 3de1c372109ae54fee2aac29aae69c03e4fa4833fff4227419316298fb1438cf
Instruction ID: 150d1c9fbcf1c8bd2475922811abfb47b488114d9340b1735522d59accc413a3
Opcode Fuzzy Hash: 3de1c372109ae54fee2aac29aae69c03e4fa4833fff4227419316298fb1438cf
Instruction Fuzzy Hash: F6033971D0429D9ADB25EB64CC51BEEB7B4AF14300F0481E9A24977282DBB46F88EF51

Function 00F10280 Relevance: 39.4, APIs: 18, Strings: 4, Instructions: 870
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F07E90: GetLogicalDriveStringsW.KERNELBASE(00000068,?,0000000C,F58088C3), ref: 00F07F0F
Part of subcall function 00F07E90: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F081F5

Part of subcall function 00EE1D10: char_traits.LIBCPMTD ref: 00EE1D4D

FreeConsole.KERNEL32(?,?,?,?), ref: 00F10530
GetDriveTypeA.KERNEL32(00000000,00000000,00000004,?,?), ref: 00F105CA
operator!=.LIBCPMTD ref: 00F105E2
FreeConsole.KERNEL32(?,?), ref: 00F1112E
Concurrency::details::VirtualProcessor::IsAvailable.LIBCMTD ref: 00F11328
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F1168E
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F1169A
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F116A6
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F116D0
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F116EB

Strings

mammoncomltd@gmail.com, xrefs: 00F102B2
1-Com2-dirChoose:, xrefs: 00F10510
*, xrefs: 00F1152F
https://t.me/mamondec, xrefs: 00F102C6

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Container_base12Container_base12::~_std::_$ConsoleDriveFree$AvailableConcurrency::details::LogicalProcessor::StringsTypeVirtualchar_traitsoperator!=
String ID: *$1-Com2-dirChoose:$https://t.me/mamondec$mammoncomltd@gmail.com
API String ID: 3530596360-177152249
Opcode ID: f4743cdf740a05c2cc3b7546541724b964f288a1e4569a80bbae4867db1c944d
Instruction ID: cbf3b4c068deff9867ea21803c79c06973fd783bbb430d69865a0696ceda1eaf
Opcode Fuzzy Hash: f4743cdf740a05c2cc3b7546541724b964f288a1e4569a80bbae4867db1c944d
Instruction Fuzzy Hash: EE923571D0525CDBCB25EB64CC95BEEB7B4AF58300F5041E9A10A67292DB702F88EF91

Function 00F094A2 Relevance: 21.4, APIs: 1, Strings: 11, Instructions: 441
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strftime.LIBCMT ref: 00F094E5

Part of subcall function 00F05970: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00F059B4

Part of subcall function 00EE2200: char_traits.LIBCPMTD ref: 00EE2243

Part of subcall function 00F05590: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00F055DE

Strings

C:\RSADecryptKey\KEY.txt, xrefs: 00F09519
, xrefs: 00F09BCC
C:\RSADecryptKey\KEY.DAT, xrefs: 00F098C6
Date:, xrefs: 00F096EA
Data:, xrefs: 00F09616
C:\RSADecryptKey\Key.txt, xrefs: 00F098B2
DP8WG91XFS, xrefs: 00F095E7
#, xrefs: 00F094A5
ID:, xrefs: 00F095EC
Mail:, xrefs: 00F09686
%d-%m-%Y %H:%M:%S, xrefs: 00F094D7

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::$_strftimechar_traits
String ID: ID:$Data:$Date:$Mail:$ $#$%d-%m-%Y %H:%M:%S$C:\RSADecryptKey\KEY.DAT$C:\RSADecryptKey\KEY.txt$C:\RSADecryptKey\Key.txt$DP8WG91XFS
API String ID: 2150282084-927231896
Opcode ID: d4d792bb511986a6d21f6b7d33ece4c961def5d72b9a4ae20fcc40cab4eaa796
Instruction ID: 669a02d0df1021865f1fe25fee9b131de7da424464db9ee066241ac063fa72e1
Opcode Fuzzy Hash: d4d792bb511986a6d21f6b7d33ece4c961def5d72b9a4ae20fcc40cab4eaa796
Instruction Fuzzy Hash: 33222871D0429C9ADB25EB54CC95BEDB7B4AF54300F0081E9E24977292DBB06F88DF51

Function 00F342F0 Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::make_error_code.LIBCPMTD ref: 00F344D7
std::ios_base::failure::failure.LIBCPMTD ref: 00F34639
__CxxThrowException@8.LIBVCRUNTIME ref: 00F34647

Strings

OutputBinaryMode, xrefs: 00F343A2
ios_base::badbit set, xrefs: 00F344E0, 00F3457E, 00F345A7, 00F3460F, 00F34635
ios_base::failbit set, xrefs: 00F34619
OutputStreamPointer, xrefs: 00F3438A
ios_base::eofbit set, xrefs: 00F3461E
OutputFileNameWide, xrefs: 00F34347
OutputFileName, xrefs: 00F34370

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throwstd::ios_base::failure::failurestd::make_error_code
String ID: OutputBinaryMode$OutputFileName$OutputFileNameWide$OutputStreamPointer$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1223328998-481334218
Opcode ID: 72bcaa844a583c5c80d0a0515ae0acadb31ea00e9d8ab439453f2a3164e21fe8
Instruction ID: 86af6e75c6b6c527d56d10c2243dbe245dac827a437ce1bd161da5fdd215dba1
Opcode Fuzzy Hash: 72bcaa844a583c5c80d0a0515ae0acadb31ea00e9d8ab439453f2a3164e21fe8
Instruction Fuzzy Hash: 18C1FF71A003099FDB14CF68C981FAAB7E4FF44314F14856DE819AB292EB75FA05DB81

Function 00F8793E Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F8760C: CreateFileW.KERNELBASE(00000000,00000000,?,00F879E7,?,?,00000000,?,00F879E7,00000000,0000000C), ref: 00F87629

GetLastError.KERNEL32 ref: 00F87A52
__dosmaperr.LIBCMT ref: 00F87A59
GetFileType.KERNELBASE(00000000), ref: 00F87A65
GetLastError.KERNEL32 ref: 00F87A6F
__dosmaperr.LIBCMT ref: 00F87A78
CloseHandle.KERNEL32(00000000), ref: 00F87A98
CloseHandle.KERNEL32(?), ref: 00F87BE2
GetLastError.KERNEL32 ref: 00F87C14
__dosmaperr.LIBCMT ref: 00F87C1B

Strings

H, xrefs: 00F87BA0

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: d5f67637dde11c2aa4b82f2b070e2332a1aca39ef4e2cfcd77eb95b9336b2002
Instruction ID: 9b960ca663a815e0175a703ca36124569090923e4107271e684e0721f626eb4f
Opcode Fuzzy Hash: d5f67637dde11c2aa4b82f2b070e2332a1aca39ef4e2cfcd77eb95b9336b2002
Instruction Fuzzy Hash: 5EA10832A082099FDF19BF78DC52BEE7BA1AB06320F240159F8519B3E1D735D912EB51

Function 00F7EB20 Relevance: 13.8, APIs: 9, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea2446f680a635e25af1af8a24e0f159b84eae9d7235c16d4ee0705d5dd8303f
Instruction ID: 1d48eef5b47cfacdf24a2bfe1a5b678695586899162beffd824b148bb001922a
Opcode Fuzzy Hash: ea2446f680a635e25af1af8a24e0f159b84eae9d7235c16d4ee0705d5dd8303f
Instruction Fuzzy Hash: 26C1C775D04249AFDB11DFA8CC45BAD7FB4AF0E320F14848BE498A7392C7749941EB62

Function 00F33FE0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ios_base::badbit set, xrefs: 00F3421D
FileSink: output stream not opened, xrefs: 00F342A4

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID: FileSink: output stream not opened$ios_base::badbit set
API String ID: 0-2369792863
Opcode ID: 2bf68932ff65b23880cc610b7960e0340a2258eda387996ccc8ab434e3fd6e3a
Instruction ID: 7ce37ca84748ba75f8c155d9876c38c341d45bc1b763a9471562a26b354d456c
Opcode Fuzzy Hash: 2bf68932ff65b23880cc610b7960e0340a2258eda387996ccc8ab434e3fd6e3a
Instruction Fuzzy Hash: A9918C71E047099FDB18DFA8C941BAEB7B4FF58720F00862EE815A7681DB35B950DB90

Function 00F755DE Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 200
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__cftoe.LIBCMT ref: 00F7560A
__cftoe.LIBCMT ref: 00F7563C

Strings

#=, xrefs: 00F75604, 00F75622, 00F75637, 00F75609

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: __cftoe
String ID: #=
API String ID: 4189289331-909207662
Opcode ID: 0ffc713ea65da4d72a33a16d85e0702763480409b2e953d9f9af18421d7367dd
Instruction ID: d0060f244cc7d5df56f0cdbefbe964d5831a2423c7b12f70e692c16615f9a8bb
Opcode Fuzzy Hash: 0ffc713ea65da4d72a33a16d85e0702763480409b2e953d9f9af18421d7367dd
Instruction Fuzzy Hash: F6513B32C00605ABDB249B68CC41FAE77A9EF49B30F54C21BF81DD2192DB75D901BA66

Function 00F806E3 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 171
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNELBASE(?,00000000,00000000,00000000,?,00FA721C), ref: 00F8074D
WideCharToMultiByte.KERNEL32(00000000,00000000,Eastern Standard Time,000000FF,00000000,0000003F,00000000,?,?), ref: 00F807C5
WideCharToMultiByte.KERNEL32(00000000,00000000,Eastern Summer Time,000000FF,?,0000003F,00000000,?), ref: 00F807F2
_free.LIBCMT ref: 00F8073B

Part of subcall function 00F7B207: HeapFree.KERNEL32(00000000,00000000,?,00F84A0A,?,00000000,?,00000000,?,00F84CAE,?,00000007,?,?,00F850A9,?), ref: 00F7B21D
Part of subcall function 00F7B207: GetLastError.KERNEL32(?,?,00F84A0A,?,00000000,?,00000000,?,00F84CAE,?,00000007,?,?,00F850A9,?,?), ref: 00F7B22F

_free.LIBCMT ref: 00F80907

Strings

Eastern Summer Time, xrefs: 00F807EB
Eastern Standard Time, xrefs: 00F807BE

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 1286116820-239921721
Opcode ID: 3f1c184faf0c79958ad89fc276c5645e57319c8319c2254148ae0e96caa1cadb
Instruction ID: be8bdeaa0b140887750241d82f57d009e8ed593f7f4f5a121e98a168bd7b0a9d
Opcode Fuzzy Hash: 3f1c184faf0c79958ad89fc276c5645e57319c8319c2254148ae0e96caa1cadb
Instruction Fuzzy Hash: FF51D671D00209EBDB10EFA9DD42DEE77B8EF41320B50426AE455971A1EB349E45FB90

Function 00EFDA20 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 167
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

char_traits.LIBCPMTD ref: 00EFDA44
char_traits.LIBCPMTD ref: 00EFDA57

Strings

, xrefs: 00EFDB16

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: char_traits
String ID:
API String ID: 1158913984-3916222277
Opcode ID: 3506bf007627c0e697926483926f393d0e712733adb279870159a9c0692338d6
Instruction ID: 3090c08ff83036afd7708d103c2073be1a3f9f6947d9198d026a72ff7ddc3420
Opcode Fuzzy Hash: 3506bf007627c0e697926483926f393d0e712733adb279870159a9c0692338d6
Instruction Fuzzy Hash: 5551487190814CEFCF14EFE4D8819FDBBB6AF54304F04512AE602BB246EB31A945CB91

Function 00F2C450 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ios_base::badbit set, xrefs: 00F2C598, 00F2C5C0
ios_base::failbit set, xrefs: 00F2C5A1
ios_base::eofbit set, xrefs: 00F2C5A6

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 0-1866435925
Opcode ID: 77a113fde9bc4411c0f37a5e8d0c504b41ce82ade4051164416a8dad759a3717
Instruction ID: 155b43beed3476c68db5dfc43a7386c8718084151b10a10625d0ab7c567d79bb
Opcode Fuzzy Hash: 77a113fde9bc4411c0f37a5e8d0c504b41ce82ade4051164416a8dad759a3717
Instruction Fuzzy Hash: A1418872A002189FDB10DF59D981BAAB7F4FF48324F18806EE9069B761C775ED40DB90

Function 00F34E10 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::make_error_code.LIBCPMTD ref: 00F34F5A
std::ios_base::failure::failure.LIBCPMTD ref: 00F34F67
__CxxThrowException@8.LIBVCRUNTIME ref: 00F34F75

Strings

ios_base::badbit set, xrefs: 00F34F3E, 00F34F66
ios_base::failbit set, xrefs: 00F34F47
ios_base::eofbit set, xrefs: 00F34F4C

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throwstd::ios_base::failure::failurestd::make_error_code
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1223328998-1866435925
Opcode ID: 33f3361c5b42c9867b0ae3f24bbd61e7bf4cd0883b2a5b5098a935049eb3c7d3
Instruction ID: 1db970f5e3a259394dfca2bebdd15ec00e784572bfef04e56efd53c554cd07cb
Opcode Fuzzy Hash: 33f3361c5b42c9867b0ae3f24bbd61e7bf4cd0883b2a5b5098a935049eb3c7d3
Instruction Fuzzy Hash: 7941BD76A002049FDB10CF69C581B99B7F4FF48328F2882ADE4169B791C771ED44DB90

Function 00F732EB Relevance: 9.3, APIs: 6, Instructions: 284COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00F73478
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F73494
__allrem.LIBCMT ref: 00F734AB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F734C9
__allrem.LIBCMT ref: 00F734E0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F734FE

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: a77e04eae13f337b5024c1669fd718388e8668834d07a787b6af0674abc8c966
Instruction ID: 41e1dfaa950d512af23662f20a7b7c10457fc931ad98f9bf5989731c8480cf2e
Opcode Fuzzy Hash: a77e04eae13f337b5024c1669fd718388e8668834d07a787b6af0674abc8c966
Instruction Fuzzy Hash: C481DA72A00716BBE724AE79CC41B6A73A9AF41730F14C12BF459D7281EB74DB00B752

Function 00F0CF80 Relevance: 9.2, APIs: 6, Instructions: 170COMMON

Download Yara Rule

APIs

std::ios_base::good.LIBCPMTD ref: 00F0CFBF
std::ios_base::getloc.LIBCPMTD ref: 00F0D036
std::locale::~locale.LIBCPMTD ref: 00F0D064
char_traits.LIBCPMTD ref: 00F0D0CC
std::ios_base::good.LIBCPMTD ref: 00F0D162

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: std::ios_base::good$char_traitsstd::ios_base::getlocstd::locale::~locale
String ID:
API String ID: 2604327947-0
Opcode ID: 876922d1c7ecb1d4bff2e5b3379ec2d179d936b6cba8994b28358a965320f262
Instruction ID: 2888a532ceb5c758d755861307f20af4d12f333d2556de45c3d4fea2688cc9d6
Opcode Fuzzy Hash: 876922d1c7ecb1d4bff2e5b3379ec2d179d936b6cba8994b28358a965320f262
Instruction Fuzzy Hash: 0C613CB5E00109DFDB04DFA4C891ABEF7B1BF48304F148259E915AB396DB35AD06EB90

Function 00F0D1B0 Relevance: 9.2, APIs: 6, Instructions: 170COMMON

Download Yara Rule

APIs

std::ios_base::good.LIBCPMTD ref: 00F0D1EF
std::ios_base::getloc.LIBCPMTD ref: 00F0D266
std::locale::~locale.LIBCPMTD ref: 00F0D294
char_traits.LIBCPMTD ref: 00F0D303
std::ios_base::good.LIBCPMTD ref: 00F0D399

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: std::ios_base::good$char_traitsstd::ios_base::getlocstd::locale::~locale
String ID:
API String ID: 2604327947-0
Opcode ID: 2036ed6e9a28bf745a522c83c9fc605b65e2ae1998a0b6b1cfc9771ca10d527f
Instruction ID: 2359c6119f23f7231458f6b4aa1f3996057dfb4e6b46d9e2204bbab6ec4586f2
Opcode Fuzzy Hash: 2036ed6e9a28bf745a522c83c9fc605b65e2ae1998a0b6b1cfc9771ca10d527f
Instruction Fuzzy Hash: 8A614DB4E002099FCB04DFA4D891ABEF7B1FF88304F148159E9116B396DB35AD06EB91

Function 00EE6300 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EE632D

Part of subcall function 00EED050: std::_Lockit::_Lockit.LIBCPMT ref: 00EED070
Part of subcall function 00EED050: std::_Lockit::~_Lockit.LIBCPMT ref: 00EED09A

std::locale::_Getfacet.LIBCPMTD ref: 00EE6355
std::bad_alloc::bad_alloc.LIBCMTD ref: 00EE6390
__CxxThrowException@8.LIBVCRUNTIME ref: 00EE639E
std::_Lockit::~_Lockit.LIBCPMT ref: 00EE641D

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8GetfacetThrowstd::bad_alloc::bad_allocstd::locale::_
String ID:
API String ID: 3299565587-0
Opcode ID: c7632c942ae6ccfae2f7a41212ad578bb2deedac1707dd5d559537141122c1d8
Instruction ID: fd1f5b86e8fb9234202b607b3691f38dace7edb5b2ff849b4374e933e0149927
Opcode Fuzzy Hash: c7632c942ae6ccfae2f7a41212ad578bb2deedac1707dd5d559537141122c1d8
Instruction Fuzzy Hash: FA41E874D0024DDFCB04EFA5D991AEEB7B0BF58710F108169E92277291DB346A05DFA1

Function 00F01A60 Relevance: 7.7, APIs: 5, Instructions: 209COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 00F01AD7

Part of subcall function 00EF9450: std::locale::locale.LIBCPMTD ref: 00EF946A

Part of subcall function 00EE61C0: std::_Lockit::_Lockit.LIBCPMT ref: 00EE61ED
Part of subcall function 00EE61C0: std::locale::_Getfacet.LIBCPMTD ref: 00EE6215
Part of subcall function 00EE61C0: std::_Lockit::~_Lockit.LIBCPMT ref: 00EE62DD

std::locale::~locale.LIBCPMTD ref: 00F01AFF
char_traits.LIBCPMTD ref: 00F01BFC
std::ios_base::width.LIBCPMTD ref: 00F01CA9

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Lockitstd::_$GetfacetLockit::_Lockit::~_char_traitsstd::ios_base::getlocstd::ios_base::widthstd::locale::_std::locale::localestd::locale::~locale
String ID:
API String ID: 2839838247-0
Opcode ID: fd46ae5afabf73ca28f0c8a49c65dc7db940ff20f9c8ebf989ce919f703941c7
Instruction ID: 2d5a092971d35d8b1a2ade0e7a746cef43666a81cfc67beec9544784b21ec6f3
Opcode Fuzzy Hash: fd46ae5afabf73ca28f0c8a49c65dc7db940ff20f9c8ebf989ce919f703941c7
Instruction Fuzzy Hash: 5F911C74D01248DFDB04DF94C891BEEBBB1FF48314F248119E90AAB391DB34AA45EB90

Function 00F78FEA Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F7F17C: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00F8172E,?,00000000,?,00F83CCB,?,00000004,00000000,?,?,?,00F7817F), ref: 00F7F1AE

_free.LIBCMT ref: 00F790F5
_free.LIBCMT ref: 00F7910C
_free.LIBCMT ref: 00F7912B
_free.LIBCMT ref: 00F79146
_free.LIBCMT ref: 00F7915D

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 3adb6bd148579c87042e0715205506368875762f6034f6c1fbeb6d9331a3d16a
Instruction ID: 00b7c5db02d515843b9fd44cd0812a3e8ee6969c5cdcd150389bc9be4a9eb20f
Opcode Fuzzy Hash: 3adb6bd148579c87042e0715205506368875762f6034f6c1fbeb6d9331a3d16a
Instruction Fuzzy Hash: F7510272A04305AFDB20DF29CC41B6A77F5EF49720B14856AE80DD72A0E7B5D901EB42

Function 00F08C77 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

operator!=.LIBCPMTD ref: 00F08CDB

Part of subcall function 00F100B0: ___std_fs_space@16.LIBCPMT ref: 00F100D5

__aulldiv.LIBCMT ref: 00F08E03

Part of subcall function 00F01E10: char_traits.LIBCPMTD ref: 00F01E5D

Part of subcall function 00F0F5A0: Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 00F0F5D8

Concurrency::details::SchedulerBase::HasSearchers.LIBCONCRTD ref: 00F09193

Strings

RSADecryptKey, xrefs: 00F08ECE
RSADecryptKey\KEY.DAT, xrefs: 00F08E14

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Base::Concurrency::details::$ChoresGroupScheduleSchedulerSearchersSegmentUnrealized___std_fs_space@16__aulldivchar_traitsoperator!=
String ID: RSADecryptKey$RSADecryptKey\KEY.DAT
API String ID: 714118446-1337536221
Opcode ID: 6fdddc168724b9c0b37e582b4d8d833a2b04c1b3e4fc2b1f2e6d152a17e5768e
Instruction ID: 51545aa200b045fe565ba454ab31db7e9a3ce25a06b4a30c96d2f4b9a8212c1d
Opcode Fuzzy Hash: 6fdddc168724b9c0b37e582b4d8d833a2b04c1b3e4fc2b1f2e6d152a17e5768e
Instruction Fuzzy Hash: 0A812975C0426C9ADB28DB24CC90BEDBBB4AF48300F1480E9E24DA7282DB715F85EF51

Function 00F7D58D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,00F48FDB,?,00F7D4AB,00F48FDB,00FC17B8,0000000C), ref: 00F7D5E3
GetLastError.KERNEL32(?,00F7D4AB,00F48FDB,00FC17B8,0000000C), ref: 00F7D5ED
__dosmaperr.LIBCMT ref: 00F7D618

Strings

~z, xrefs: 00F7D5A7

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID: ~z
API String ID: 2583163307-3328201640
Opcode ID: afc37d59269b2b862d08ca6a6d72f75ac402de9340aa6063025987a33122d427
Instruction ID: 66e517f8acd28b7ddff31513d6734919a5c714cefbc54c3c1d3ab214755616de
Opcode Fuzzy Hash: afc37d59269b2b862d08ca6a6d72f75ac402de9340aa6063025987a33122d427
Instruction Fuzzy Hash: F9012B33E041341BD6293774AC46B7E7B6A8F82738F69411BF91C8B1D1DE649D81B292

Function 00EE1D10 Relevance: 6.3, APIs: 4, Instructions: 269COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 00EE1D4D
char_traits.LIBCPMTD ref: 00EE1ECD
char_traits.LIBCPMTD ref: 00EE1FD4
std::ios_base::width.LIBCPMTD ref: 00EE2008

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: char_traits$std::ios_base::width
String ID:
API String ID: 735177774-0
Opcode ID: fdf8da1dcd0518893f9a9998f691a096d413b456fe7557565a3e7e810fd489ad
Instruction ID: 219b3134d77ba9544ec57d17a205d583266ef4f1cb57cbd0d36b3248cfcf7e91
Opcode Fuzzy Hash: fdf8da1dcd0518893f9a9998f691a096d413b456fe7557565a3e7e810fd489ad
Instruction Fuzzy Hash: 1CC1E374A0025C9FDB14DFA9C891BEDBBB2BF48304F149159E909BB351CB34A981CF94

Function 00F12A60 Relevance: 6.2, APIs: 4, Instructions: 214COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F12AD7

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: bcfcfd16b5384de912fb38de9f24c6db6719e8f344608ad7f7488c3f14d1d10b
Instruction ID: f1493d5375ae1af445cea07b084f00dfae439ffbd17ba9d1352065fac00eeb8b
Opcode Fuzzy Hash: bcfcfd16b5384de912fb38de9f24c6db6719e8f344608ad7f7488c3f14d1d10b
Instruction Fuzzy Hash: C4714B72904248EFCB04DF94D945FDEBBB8FB08710F004A6AF911A7681DB38EA54DB91

Function 00EF3E30 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

std::locale::c_str.LIBCPMTD ref: 00EF3E8F
std::_Locinfo::_Locinfo.LIBCPMTD ref: 00EF3E98

Part of subcall function 00EEA270: std::_Lockit::_Lockit.LIBCPMT ref: 00EEA2A3
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2B5
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2C4
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2D3
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2E2
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2F1
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA300
Part of subcall function 00EEA270: std::bad_exception::bad_exception.LIBCMTD ref: 00EEA317
Part of subcall function 00EEA270: __CxxThrowException@8.LIBVCRUNTIME ref: 00EEA325
Part of subcall function 00EEA270: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00EEA332

ctype.LIBCPMTD ref: 00EF3EC2

Part of subcall function 00EE8700: Concurrency::details::GlobalCore::TopologyObject::TopologyObject.LIBCMTD ref: 00EE872D

std::_Locinfo::~_Locinfo.LIBCPMTD ref: 00EF3EFE

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Yarn$std::_$LocinfoLocinfo::_Topology$Concurrency::details::Core::Exception@8GlobalLocinfo::~_Locinfo_ctorLockitLockit::_ObjectObject::Throwctypestd::bad_exception::bad_exceptionstd::locale::c_str
String ID:
API String ID: 1157453502-0
Opcode ID: b59892f9bfae61d2e73b14e01e0d70202461122276936b43abf443b302eeb8ce
Instruction ID: 93692177556eb7c08a6a73fa7a64bc7755c4bb51c0bcc3bf69d5ba76d63f6fea
Opcode Fuzzy Hash: b59892f9bfae61d2e73b14e01e0d70202461122276936b43abf443b302eeb8ce
Instruction Fuzzy Hash: AA31D5B1D0420DDBDB04DF98C941BEEBBB1FB48314F208269E525BB390D7756A44CB91

Function 00F0899E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

operator!=.LIBCPMTD ref: 00F08A02

Part of subcall function 00F01E10: char_traits.LIBCPMTD ref: 00F01E5D

Part of subcall function 00F0F5A0: Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 00F0F5D8

operator!=.LIBCPMTD ref: 00F08CDB
__aulldiv.LIBCMT ref: 00F08E03

Strings

RSADecryptKey, xrefs: 00F08AD3
RSADecryptKey, xrefs: 00F08A19

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: operator!=$Base::ChoresConcurrency::details::GroupScheduleSegmentUnrealized__aulldivchar_traits
String ID: RSADecryptKey$RSADecryptKey
API String ID: 645171590-2986990275
Opcode ID: cd46b80e3aa98599e346f919a78b3465bd2598a38dee5dc8f83953ada2f910ed
Instruction ID: e44ac909212baa519adc2e8e975714bcd65e1d03e26ad10c07c522c4998623b1
Opcode Fuzzy Hash: cd46b80e3aa98599e346f919a78b3465bd2598a38dee5dc8f83953ada2f910ed
Instruction Fuzzy Hash: 9B517271C042AC9ADB25DB24CC41BEEB7B46F14340F1485E9A189B71C2EBB45F88EF61

Function 00F16CB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F16D68

Part of subcall function 00F63148: RaiseException.KERNEL32(?,?,?,00F4C9DF,?,00000000,?,?,?,?,?,?,00F4C9DF,?,00FBFECC), ref: 00F631A8

Strings

AuthenticatedEncryptionFilter, xrefs: 00F16D3E
AAD, xrefs: 00F16D18

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow
String ID: AAD$AuthenticatedEncryptionFilter
API String ID: 3976011213-396231977
Opcode ID: b8ddd2a2b59425d835f9288ebf1f602eca971be0add5b30c6f3e9f427e118e02
Instruction ID: 35301806d0ac288f8b001220f6394784b306ea7ecebcbea770007ea8ef88143f
Opcode Fuzzy Hash: b8ddd2a2b59425d835f9288ebf1f602eca971be0add5b30c6f3e9f427e118e02
Instruction Fuzzy Hash: 61319F72504209AFCB14DF90DC41FDEBBB8FF58710F000529F912A72A2DB75A954DBA1

Function 00EE3BF0 Relevance: 4.7, APIs: 3, Instructions: 241COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 00EE3D4B
char_traits.LIBCPMTD ref: 00EE3E40
std::ios_base::width.LIBCPMTD ref: 00EE3E74

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: char_traits$std::ios_base::width
String ID:
API String ID: 735177774-0
Opcode ID: 8b47971cf328909219cdf6944f558336e35e45655cc75a334b8eb950f30f6464
Instruction ID: 43538204e42916a2a68b7b405b6920b0d8d2861aa8c08ddce697714cd3fcf187
Opcode Fuzzy Hash: 8b47971cf328909219cdf6944f558336e35e45655cc75a334b8eb950f30f6464
Instruction Fuzzy Hash: 11B1E474A0024CDFCB04DFA5C895AEDBBB1FF48304F249159E956BB391DB34AA41CB90

Function 00F7DDD3 Relevance: 4.7, APIs: 3, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b70b12341573b59405140b340c36b0163756bea3eaacbd6143568752065971b5
Instruction ID: 7baf0e38be060da262a921042945c262f9c0bcde131038b4841bcbdd71d06e65
Opcode Fuzzy Hash: b70b12341573b59405140b340c36b0163756bea3eaacbd6143568752065971b5
Instruction Fuzzy Hash: 6351C471D0020AABDB119FA8CC45FEE7BB4AF55320F94805AF44DAB291D7359901FB62

Function 00F0E150 Relevance: 4.7, APIs: 3, Instructions: 175COMMON

Download Yara Rule

APIs

Part of subcall function 00F0DFB0: std::generic_category.LIBCPMTD ref: 00F0DFC0

std::_Is_slash_oper::operator.LIBCPMTD ref: 00F0E21E
___std_fs_create_directory@4.LIBCPMT ref: 00F0E2BC
std::make_error_code.LIBCPMTD ref: 00F0E329

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Is_slash_oper::operator___std_fs_create_directory@4std::_std::generic_categorystd::make_error_code
String ID:
API String ID: 2349977466-0
Opcode ID: 63bf26d8c3be850a7a35aa802dd50524256f64990677839b0fcff54f228bb8ea
Instruction ID: 8d2655b17997159016ebd63324c8330c4d9811ecc6254d4664411a2f724406f9
Opcode Fuzzy Hash: 63bf26d8c3be850a7a35aa802dd50524256f64990677839b0fcff54f228bb8ea
Instruction Fuzzy Hash: 8B7116B1D0025CAFCB04EFE9E891AEEBBF5BF48310F144529E505A7391DB34A905DB90

Function 00F8083E Relevance: 4.6, APIs: 3, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F808B1
_free.LIBCMT ref: 00F80907

Part of subcall function 00F806E3: _free.LIBCMT ref: 00F8073B
Part of subcall function 00F806E3: GetTimeZoneInformation.KERNELBASE(?,00000000,00000000,00000000,?,00FA721C), ref: 00F8074D
Part of subcall function 00F806E3: WideCharToMultiByte.KERNEL32(00000000,00000000,Eastern Standard Time,000000FF,00000000,0000003F,00000000,?,?), ref: 00F807C5
Part of subcall function 00F806E3: WideCharToMultiByte.KERNEL32(00000000,00000000,Eastern Summer Time,000000FF,?,0000003F,00000000,?), ref: 00F807F2

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 360501cd528859bdf62f896dbada0d8a39e3032cb1ae0c32b444ea2c1587069e
Instruction ID: 808028ef4cc94df5bfb407c4ff6d57011868685ec581613f9ecfd3a87b663c56
Opcode Fuzzy Hash: 360501cd528859bdf62f896dbada0d8a39e3032cb1ae0c32b444ea2c1587069e
Instruction Fuzzy Hash: B521FC72C042195BDB7176249C41FEE77689B82370F540396E854A3152EF748EC9BBD1

Function 00F7EFDA Relevance: 4.6, APIs: 3, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00F49005,00000000,00000002,00F49005,00000000,?,?,?,00F7F089,00000000,00000000,00F49005,00000002), ref: 00F7F013
GetLastError.KERNEL32(?,00F7F089,00000000,00000000,00F49005,00000002,?,00F6DEA1,?,00000000,00000000,00000001,?,00F49005,?,00F6DF56), ref: 00F7F01D
__dosmaperr.LIBCMT ref: 00F7F024

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: 76d059984a3f44d5bf81aa67c2983e7dd24a3aa79052b2b5ddef83f82380a539
Instruction ID: 316dc5656f7cfcecd1201410ecc47374a9f014ed6363cadded324c7af09f45d8
Opcode Fuzzy Hash: 76d059984a3f44d5bf81aa67c2983e7dd24a3aa79052b2b5ddef83f82380a539
Instruction Fuzzy Hash: D7019C33A10519ABCB059FA9DC05CBE7B2AEB85330B24424BF854C72D0EA70DC10B790

Function 00F6D281 Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00EFA17E,?,00EFA17E,00000000), ref: 00F6D289
GetLastError.KERNEL32(?,00EFA17E,00000000), ref: 00F6D293
__dosmaperr.LIBCMT ref: 00F6D29A

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: 94ea89c09e2cb9b2d375027f4a51e0320c6ca1af3d9e00ecd0edfc03f903b89e
Instruction ID: f14779ae3a37f0038a7c8cf142c48783ec57bd32915702e8e00801f7ce33c107
Opcode Fuzzy Hash: 94ea89c09e2cb9b2d375027f4a51e0320c6ca1af3d9e00ecd0edfc03f903b89e
Instruction Fuzzy Hash: 24D0123251460D67AB013BF6BC0892B3F5DFA857743540616F57CC51B0DE35C850A691

Function 00F18380 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 387COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F18789

Strings

FilterWithBufferedInput, xrefs: 00F18760

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: FilterWithBufferedInput
API String ID: 2005118841-4021797063
Opcode ID: 4ffdc28b79a82af2d19f0a926f52867dd6260d3685fca2b3fd928a532db51feb
Instruction ID: 9ed9a37993575674971fc78cadf4c8207006f149c5212eed9ecb039a46a8bfbd
Opcode Fuzzy Hash: 4ffdc28b79a82af2d19f0a926f52867dd6260d3685fca2b3fd928a532db51feb
Instruction Fuzzy Hash: FBF16D71A007099FCB24CFA8C984A9EBBF6FF88350F14462DE4469B644DB31F985DB90

Function 00F100B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

___std_fs_space@16.LIBCPMT ref: 00F100D5

Part of subcall function 00F49D99: GetDiskFreeSpaceExW.KERNELBASE(?,?,00000000,00F100DA,?,?,00F100DA,00000000,?,?,?), ref: 00F49DAA

Part of subcall function 00EF5CB0: std::make_error_code.LIBCPMTD ref: 00EF5CF4
Part of subcall function 00EF5CB0: __CxxThrowException@8.LIBVCRUNTIME ref: 00EF5D41

Strings

space, xrefs: 00F100EB

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: DiskException@8FreeSpaceThrow___std_fs_space@16std::make_error_code
String ID: space
API String ID: 3930776848-695386426
Opcode ID: b73da4f31409775cf9d46a83f46d6e7458de57ff2141c1ced0b2d4f9fa609357
Instruction ID: ec7fbba1a9b18deac04d143c37cc9d154c1c8e0913f2481b69f5da79879b8f4d
Opcode Fuzzy Hash: b73da4f31409775cf9d46a83f46d6e7458de57ff2141c1ced0b2d4f9fa609357
Instruction Fuzzy Hash: B511ACB5D04209EFCB08DF98D5819AEFBB4FF4C310B108659E919A7341DB34AA44CBA5

Function 00F0E0E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00F06A40: std::generic_category.LIBCPMTD ref: 00F06A50

Part of subcall function 00F0E150: std::_Is_slash_oper::operator.LIBCPMTD ref: 00F0E21E

Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 00F0E118

Part of subcall function 00F0D8D0: __CxxThrowException@8.LIBVCRUNTIME ref: 00F0D954

Strings

create_directories, xrefs: 00F0E12C

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Base::ChoresConcurrency::details::Exception@8GroupIs_slash_oper::operatorScheduleSegmentThrowUnrealizedstd::_std::generic_category
String ID: create_directories
API String ID: 3602585422-560696156
Opcode ID: 80b8120a91023a063805cd8792b334b73d5c0ec4502c33b17874d69a9ab44f81
Instruction ID: 440c300337f7dbfcf09eaaf814d0a4d55e8079363ed8052b1f078c49acad2eb4
Opcode Fuzzy Hash: 80b8120a91023a063805cd8792b334b73d5c0ec4502c33b17874d69a9ab44f81
Instruction Fuzzy Hash: 37F04F35D0010CBBCB14EBA4DD529EEB778AF14700F448598A9165B2C2EE34AB08E7A1

Function 00F7D235 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

_abort.LIBCMT ref: 00F7D286

Strings

SystemFunction036, xrefs: 00F7D246, 00F7D250

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: _abort
String ID: SystemFunction036
API String ID: 1888311480-2669272182
Opcode ID: 3ec2a8234036e9e81abcace3c16ef6c8715c5be2dcf4ad78a82f0b3d183cabeb
Instruction ID: 7120c801ea000a821566fa49d7864bc318437c08785eaee00310ac0d4e59d282
Opcode Fuzzy Hash: 3ec2a8234036e9e81abcace3c16ef6c8715c5be2dcf4ad78a82f0b3d183cabeb
Instruction Fuzzy Hash: 63F05530B0120CB78B206F258D03DAEBFA0CF00B60B0480A6FD1A97251CE708E00B2D7

Function 00EFF5E0 Relevance: 3.2, APIs: 2, Instructions: 194COMMON

Download Yara Rule

APIs

_Fgetc.LIBCPMTD ref: 00EFF673

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Fgetc
String ID:
API String ID: 1720979605-0
Opcode ID: 455fbf2e91e5aabf911afc1980dc267423061206b7bdbe8389de4da8cadfb738
Instruction ID: 71f3af495f4844be4ab6c1599fe2590916e5a966076b5e494af946f3b93c5a4c
Opcode Fuzzy Hash: 455fbf2e91e5aabf911afc1980dc267423061206b7bdbe8389de4da8cadfb738
Instruction Fuzzy Hash: 5A710B72D0014CDFCB14EFA8E891AFEB7B4AF54314F109229E616B7295EB30AD45CB90

Function 00EFF860 Relevance: 3.2, APIs: 2, Instructions: 194COMMON

Download Yara Rule

APIs

_Fgetc.LIBCPMTD ref: 00EFF8F3

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Fgetc
String ID:
API String ID: 1720979605-0
Opcode ID: db0b0fb12cdc7c7bbe48fdf9aa4a3ffabc4dc87bff4cd52d8856f7a6b407dc22
Instruction ID: 3c6840a54e2715ec09b740c08c3ff7ad249010d981a51d1b9bceb06ba7f84fcb
Opcode Fuzzy Hash: db0b0fb12cdc7c7bbe48fdf9aa4a3ffabc4dc87bff4cd52d8856f7a6b407dc22
Instruction Fuzzy Hash: F9714871D1015CABCB18EFE4E991AFEB7B4AF54314F105229E616B7292EB306E05CB50

Function 00EECB50 Relevance: 3.2, APIs: 2, Instructions: 164COMMON

Download Yara Rule

APIs

Part of subcall function 00EEAB60: std::ios_base::good.LIBCPMTD ref: 00EEABA4
Part of subcall function 00EEAB60: std::ios_base::good.LIBCPMTD ref: 00EEAC01

std::ios_base::getloc.LIBCPMTD ref: 00EECBD8

Part of subcall function 00EF9450: std::locale::locale.LIBCPMTD ref: 00EF946A

Part of subcall function 00EE6300: std::_Lockit::_Lockit.LIBCPMT ref: 00EE632D
Part of subcall function 00EE6300: std::locale::_Getfacet.LIBCPMTD ref: 00EE6355
Part of subcall function 00EE6300: std::_Lockit::~_Lockit.LIBCPMT ref: 00EE641D

std::locale::~locale.LIBCPMTD ref: 00EECC00

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Lockitstd::_std::ios_base::good$GetfacetLockit::_Lockit::~_std::ios_base::getlocstd::locale::_std::locale::localestd::locale::~locale
String ID:
API String ID: 581387798-0
Opcode ID: c7a9450dd54446368a394f74fc0bfa98526bd8cb71dd9913a25f46090ae8d722
Instruction ID: d1d2bf2d4b2c2ad1589e5459ee35e96aa847f74a3202cb9ab50bcdfacd60ebc6
Opcode Fuzzy Hash: c7a9450dd54446368a394f74fc0bfa98526bd8cb71dd9913a25f46090ae8d722
Instruction Fuzzy Hash: 5171F1B4D002489FCB08DF99D991AEEFBB1BF48314F249269E515BB391DB30A941CF60

Function 00F023B0 Relevance: 3.1, APIs: 2, Instructions: 111COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 00F0242A

Part of subcall function 00EF9450: std::locale::locale.LIBCPMTD ref: 00EF946A

Part of subcall function 00F05220: std::_Lockit::_Lockit.LIBCPMT ref: 00F0524D
Part of subcall function 00F05220: std::locale::_Getfacet.LIBCPMTD ref: 00F05275
Part of subcall function 00F05220: std::_Lockit::~_Lockit.LIBCPMT ref: 00F0533D

std::locale::~locale.LIBCPMTD ref: 00F0249C

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Lockitstd::_$GetfacetLockit::_Lockit::~_std::ios_base::getlocstd::locale::_std::locale::localestd::locale::~locale
String ID:
API String ID: 1936111737-0
Opcode ID: 9df260e4933eefc416e871fc2edaafaccce45dc11e5cc525ade01a3cc754c483
Instruction ID: 49f96a5e392d3bb82572216844ce850d2a3d8072528b39a907dc3f044a2685fb
Opcode Fuzzy Hash: 9df260e4933eefc416e871fc2edaafaccce45dc11e5cc525ade01a3cc754c483
Instruction Fuzzy Hash: F54102B5E00208AFCB04DF98D995AEEBBF5EF48300F208159E505BB391DB356E04DBA1

Function 00F01C3F Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 00F01BFC
ctype.LIBCPMTD ref: 00F01C2D
std::ios_base::width.LIBCPMTD ref: 00F01CA9

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: char_traitsctypestd::ios_base::width
String ID:
API String ID: 2148534577-0
Opcode ID: 1c5c1fa949507642637a5ac55fffc6af5f0820b55b3ef04ff3aea8e780bee766
Instruction ID: 2494dbde35451d709f066c7cfac404ef3e873c93b3a4f3948c38b777dae44b99
Opcode Fuzzy Hash: 1c5c1fa949507642637a5ac55fffc6af5f0820b55b3ef04ff3aea8e780bee766
Instruction Fuzzy Hash: 42312B75E00208DFDB04DF94C991BEDBBB2FF88314F109159E9066B395DB31A941EB90

Function 00F01C16 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 00F01BFC
ctype.LIBCPMTD ref: 00F01C2D
std::ios_base::width.LIBCPMTD ref: 00F01CA9

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: char_traitsctypestd::ios_base::width
String ID:
API String ID: 2148534577-0
Opcode ID: 891854510b1d68451f8be6d3565d6715344ace5948491dfb4dd7a23fb0fbec08
Instruction ID: 2494dbde35451d709f066c7cfac404ef3e873c93b3a4f3948c38b777dae44b99
Opcode Fuzzy Hash: 891854510b1d68451f8be6d3565d6715344ace5948491dfb4dd7a23fb0fbec08
Instruction Fuzzy Hash: 42312B75E00208DFDB04DF94C991BEDBBB2FF88314F109159E9066B395DB31A941EB90

Function 00F7D9EE Relevance: 3.1, APIs: 2, Instructions: 77fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNELBASE(7408458B,?,?,?,00000000,?,00F6DF7D,E0830C40,?,00F7DF2A,00F49005,00F6DF7D,?,00F6DF7D,00F6DF7D,00F49005), ref: 00F7DA89
GetLastError.KERNEL32(?,00F7DF2A,00F49005,00F6DF7D,?,00F6DF7D,00F6DF7D,00F49005,00F6DF7D,?,00FC17F8,00000014,00F6D57F,00000000,8304488B,00F49005), ref: 00F7DAB2

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 9fcc6f65ff0428f90b8fa7a6661c5c98418f7f5ce486e5c4a5fb4d2600d77009
Instruction ID: 8d1ba798c2c6d3e5dd7aa6795d19ce7514effd1e8bf2bd493bd51020dccd9aea
Opcode Fuzzy Hash: 9fcc6f65ff0428f90b8fa7a6661c5c98418f7f5ce486e5c4a5fb4d2600d77009
Instruction Fuzzy Hash: 7D21CE35A002199FDB15CF19CD80BE9B3F9FF48301F1044AAE94AD3252D774AE82DB60

Function 00F4901C Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

std::_Xfsopen.LIBCPMT ref: 00F48FC9
std::_Xfsopen.LIBCPMT ref: 00F48FE9

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Xfsopenstd::_
String ID:
API String ID: 2914972069-0
Opcode ID: 5fd760711497ba18b6ff248288de4e74c8fc52d0b3a92772dec83effb7234553
Instruction ID: 07e9316bb1d976826cf5c346be309bd34cdbb8840addd07dff87923219d8d46f
Opcode Fuzzy Hash: 5fd760711497ba18b6ff248288de4e74c8fc52d0b3a92772dec83effb7234553
Instruction Fuzzy Hash: C711A032F4421527DB2505689C02BBF3E879B417F0F184034FE4695199EEB9DC57B6D1

Function 00F7BA17 Relevance: 3.1, APIs: 2, Instructions: 67COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00F7BA63
GetFileType.KERNELBASE(00000000), ref: 00F7BA75

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 0d248f498102d9bbfa90d7f714cc4eb3b3c7e57bbbce549e6f0d7a70c9aac6cd
Instruction ID: b473377b102450ee084e7f513f43ec48fb1b758ab695c89513669c489dbbdf11
Opcode Fuzzy Hash: 0d248f498102d9bbfa90d7f714cc4eb3b3c7e57bbbce549e6f0d7a70c9aac6cd
Instruction Fuzzy Hash: C811937290874246E730AE3D8C887227A959B57330B38471BD9BA865F1C739DD81B242

Function 00F7C9CC Relevance: 3.1, APIs: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(00000000,?), ref: 00F7CA2C
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 00F7CA39

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: 913328ef1baf631b3d2110c04c14df7b07eb4ec17e942c55045747a743b310a7
Instruction ID: 267a45618ab94f3522fb2167c11c3f2d1b016647587e86385d3ad3c584eec383
Opcode Fuzzy Hash: 913328ef1baf631b3d2110c04c14df7b07eb4ec17e942c55045747a743b310a7
Instruction Fuzzy Hash: 2E113A33E0012D9FAB21CE1DEC6199A77A5AB80B70716C226FD1DAB244DA34DD01B7D2

Function 00EE2FA0 Relevance: 3.1, APIs: 2, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

_Min_value.LIBCPMTD ref: 00EE2FD7
_memcpy_s.LIBCPMTD ref: 00EE3000

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Min_value_memcpy_s
String ID:
API String ID: 987025274-0
Opcode ID: ee4d29d71be83b1b8f24faf267757a4d65b499c4ac26a4c53aebad6b7f5895f7
Instruction ID: eda4f2e8993fe8eeb72f081a7fc20d62d02c4f55a486bf93fc8db7c855cdccfb
Opcode Fuzzy Hash: ee4d29d71be83b1b8f24faf267757a4d65b499c4ac26a4c53aebad6b7f5895f7
Instruction Fuzzy Hash: 5A210A7160014DABCB04DFA9D895EEF77B9BF48304F109158FA19AB291D730EE51DBA0

Function 00F00200 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00F002EF

Part of subcall function 00F00350: char_traits.LIBCPMTD ref: 00F0042E

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: __fread_nolockchar_traits
String ID:
API String ID: 2781282191-0
Opcode ID: c548c18eadb1d477cc35eaeee2e954bb5f0b3f15899cd15cc27e2c56b382713d
Instruction ID: 16b01b11c67e16ff89643d4ee62e30c17bd5f17ad8ee3897ce3f9869d0b0764c
Opcode Fuzzy Hash: c548c18eadb1d477cc35eaeee2e954bb5f0b3f15899cd15cc27e2c56b382713d
Instruction Fuzzy Hash: D341A475D0024CEFCB04DF98C995BAEB7B1FB88310F10C569E92997291DB74AA54EF40

Function 00F07F4A Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNELBASE(?,?,?), ref: 00F08008
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F081F5

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Container_base12Container_base12::~_DriveTypestd::_
String ID:
API String ID: 563330359-0
Opcode ID: c2b7ccf106d7622343306ec6b4809d1c9d4a4aad675ecaf5f55c60e119ae79a1
Instruction ID: 9c128315566ec47d45514952f449ae14a3de42e1a9775333c66e711f44415f3d
Opcode Fuzzy Hash: c2b7ccf106d7622343306ec6b4809d1c9d4a4aad675ecaf5f55c60e119ae79a1
Instruction Fuzzy Hash: D241D271800269CBCB68DB54CD90BEEB7B1AF99304F1081D9D18A6B291DA706FD5EF80

Function 00EFE2D0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

Part of subcall function 00EEAB60: std::ios_base::good.LIBCPMTD ref: 00EEABA4
Part of subcall function 00EEAB60: std::ios_base::good.LIBCPMTD ref: 00EEAC01

char_traits.LIBCPMTD ref: 00EFE37E

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: std::ios_base::good$char_traits
String ID:
API String ID: 1812610724-0
Opcode ID: f3eb6433d42e521276c584a08309900caf4f192572293c57bc32ee7c1f1d586d
Instruction ID: ada3f53e3dc139a9520b8ed3576314bd216ad24ee916f9f1f97d1da640f503e0
Opcode Fuzzy Hash: f3eb6433d42e521276c584a08309900caf4f192572293c57bc32ee7c1f1d586d
Instruction Fuzzy Hash: 1741F5B1D0121C9FDB04DF95D991AEEBBF5FB48300F209269E502B7391DB35AA01CBA0

Function 00F05590 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00F055DE

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::
String ID:
API String ID: 3936482309-0
Opcode ID: 08d05784ceb3b23bd1a61bf72286d87c1392d94c1bbc9f21029e0a3822a96a64
Instruction ID: 2b4c2aab31583ed398e2bc19328795664ca00cdfb343eab1b15f7c843bf59b00
Opcode Fuzzy Hash: 08d05784ceb3b23bd1a61bf72286d87c1392d94c1bbc9f21029e0a3822a96a64
Instruction Fuzzy Hash: 3631F6B4A0021ADFDB04DF88CD95BAEB7B1FF88704F148A58E5216B396C775AD01DB90

Function 00F056B0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00F056F4

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::
String ID:
API String ID: 3936482309-0
Opcode ID: d453129fd425a8e92367856d37deff3c8f4a743dd05a3e1a13a0754bc5ff0f6b
Instruction ID: 72dd6115b3351e8bafbd41bfd7f6d7a8073d33bc1aa6dea6a2e7126a1ea0c3b8
Opcode Fuzzy Hash: d453129fd425a8e92367856d37deff3c8f4a743dd05a3e1a13a0754bc5ff0f6b
Instruction Fuzzy Hash: EC31E7B4A0021ADFDB04DF98CD91BAFB7B1FF88704F148559E525AB391C771A900DB90

Function 00F05970 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00F059B4

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::
String ID:
API String ID: 3936482309-0
Opcode ID: f2292f6e31471d4c6d6d52ca0efe2f048c2a314670a543129edffebbc10a5953
Instruction ID: 8b22310d5c9852cbd354bd7224d0c526d6e18b20b6827d4fc4e271c89972f3a7
Opcode Fuzzy Hash: f2292f6e31471d4c6d6d52ca0efe2f048c2a314670a543129edffebbc10a5953
Instruction Fuzzy Hash: D331E6B4A0425ADFDB04CF98C991BAEB7B1FF48704F108659E522AB391C775A900DB91

Function 00F05AE0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00F05B24

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::
String ID:
API String ID: 3936482309-0
Opcode ID: eecf306fa865de4da4df31ad09da268a3ac90aca9cb0aa2c46ef8c853dc6c691
Instruction ID: 2bae5733ed4b30e825149f06951fe16561d6b26c9a1cc93892061051c96fbbb2
Opcode Fuzzy Hash: eecf306fa865de4da4df31ad09da268a3ac90aca9cb0aa2c46ef8c853dc6c691
Instruction Fuzzy Hash: EA3105B4A0425ADFDB04CF98C991BAEB7B1FF89704F108658E522AB391C775AD00CB90

Function 00EE79A0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00EE79E4

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::
String ID:
API String ID: 3936482309-0
Opcode ID: 286afe6bae9fa1a64e2a07159080f233a531b997fa63c5d28e10c5ab41356731
Instruction ID: 623e07e6cb65a29eb4b2e6e3434da9e0e48d37f7ceef6d2ed52209b0c3c99007
Opcode Fuzzy Hash: 286afe6bae9fa1a64e2a07159080f233a531b997fa63c5d28e10c5ab41356731
Instruction Fuzzy Hash: 4631E6B4A0425ADFDB04CF98D991BAEB7B1FF48704F108659E526AB391D771AD00CB90

Function 00EE7AB0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00EE7AF4

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::
String ID:
API String ID: 3936482309-0
Opcode ID: 5426760d41f6dab3e0efbe81cb3b5de03a3b5559b222b6e086f165260522d00c
Instruction ID: 548dffc0aec77405da4c1d0618ffded5c59e4f24f5c68487f66d887c5544c01e
Opcode Fuzzy Hash: 5426760d41f6dab3e0efbe81cb3b5de03a3b5559b222b6e086f165260522d00c
Instruction Fuzzy Hash: 4131E6B4A0425ADFDB04DF98C991BAEBBB1FF89704F108659E516AB391C771AD00CB90

Function 00F6D8F4 Relevance: 1.6, APIs: 1, Instructions: 75COMMONLIBRARYCODE

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 00F6D9B9

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: CallFilterFunc@8
String ID:
API String ID: 4062629308-0
Opcode ID: 6b6c3dd501d43349d3a758951c68625936c4f95125eafbf5b43f4d37b090cb2b
Instruction ID: 0ae2ef18f6c7d5f2dc3b27bd95d6dfbebdb7bb574c4e85b6873407deb71bbb27
Opcode Fuzzy Hash: 6b6c3dd501d43349d3a758951c68625936c4f95125eafbf5b43f4d37b090cb2b
Instruction Fuzzy Hash: F121D471F106059AD718AB388D0777E3751AF86374F288359F4A59B2E2DB78C902F781

Function 00F6D76E Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 00F6D836

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: CallFilterFunc@8
String ID:
API String ID: 4062629308-0
Opcode ID: 5b49b79dd61ebd4c82c903d238b71c3526815858e468983ab3cac2e68a352d8f
Instruction ID: c218435d1a233b881bf393c89de1f59b9c395805abca4c7532a2bc5e396027eb
Opcode Fuzzy Hash: 5b49b79dd61ebd4c82c903d238b71c3526815858e468983ab3cac2e68a352d8f
Instruction Fuzzy Hash: 74212675F106155ACB18AB788D0777D3650AF86334F288359F8A19B2D2DB78CA02B792

Function 00EFFBD0 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 00EFFC48

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: char_traits
String ID:
API String ID: 1158913984-0
Opcode ID: 791e7840058cbb655d30c5a680b0f1b1641291c2911fee6aee051276001582e7
Instruction ID: 9e2e6be3dbfd1b1d110308dad2602342cae8431e666859e584280b1347f29b68
Opcode Fuzzy Hash: 791e7840058cbb655d30c5a680b0f1b1641291c2911fee6aee051276001582e7
Instruction Fuzzy Hash: 6921C474E0011DAFCF08EFA4D9958FEB7B5AF48300B1095AAE916B7351DB30AE01CB94

Function 00EFFCA0 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 00EFFD1A

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: char_traits
String ID:
API String ID: 1158913984-0
Opcode ID: e8853f2f9be3cb7f789acd596697ab06f23a3572b91211c81f3cc70e2faad13f
Instruction ID: 8dd85b69785fff69dc7ad0895c4ddff2df9650f7fa6977a9e3d28d702b7d8831
Opcode Fuzzy Hash: e8853f2f9be3cb7f789acd596697ab06f23a3572b91211c81f3cc70e2faad13f
Instruction Fuzzy Hash: BF21DC78E0010DABCF08EFA4D5919FDB7B5EF58301B1091AAE91677351DB319E01CB95

Function 00F13EE0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F13F77

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 92e5f830bcf4c7756c48e0f767022c886ca6d80e1a096abf2727218b6f3527aa
Instruction ID: f65745c5a321f1cf2034aafb5b84f67c13ab5efc9b97f481b013c0b00cbc3e5f
Opcode Fuzzy Hash: 92e5f830bcf4c7756c48e0f767022c886ca6d80e1a096abf2727218b6f3527aa
Instruction Fuzzy Hash: F2117C75A00208AFCB14DF98C845E9EBBB8FB49710F10456AF906A7341DB34A904CBA0

Function 00EFD850 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00F4901C: std::_Xfsopen.LIBCPMT ref: 00F48FC9

std::locale::~locale.LIBCPMTD ref: 00EFD8EB

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Xfsopenstd::_std::locale::~locale
String ID:
API String ID: 1657636250-0
Opcode ID: 2efcf3ed75753e3f42e36769a88f49cdeb16a4e80dcd51905bb9827184caf261
Instruction ID: beca762a37638f4abf92d46a12491d95fd72534bf5c05be5cd60d384b0b4e407
Opcode Fuzzy Hash: 2efcf3ed75753e3f42e36769a88f49cdeb16a4e80dcd51905bb9827184caf261
Instruction Fuzzy Hash: C02108B1D1420D9FCB04DF98D941BAFB7B5BB48714F104629E525B7280E735AA00CBA1

Function 00EFD910 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00F4901C: std::_Xfsopen.LIBCPMT ref: 00F48FC9

std::locale::~locale.LIBCPMTD ref: 00EFD9AB

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Xfsopenstd::_std::locale::~locale
String ID:
API String ID: 1657636250-0
Opcode ID: e984de941d785fd0c86cf863ee2a5132cf71f0a07ff6fd6c42452b5d1b0f80f3
Instruction ID: e12a84b71764c0f5341658e56a2e469a4293416527613120439a2be3c0e1960c
Opcode Fuzzy Hash: e984de941d785fd0c86cf863ee2a5132cf71f0a07ff6fd6c42452b5d1b0f80f3
Instruction Fuzzy Hash: E72108B1E1420DDFCB04DF98DD41BAEB7B5AB48710F104629E525B7281D775AA00CB90

Function 00F0F8D0 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

std::locale::~locale.LIBCPMTD ref: 00F0F96B

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: std::locale::~locale
String ID:
API String ID: 1329985212-0
Opcode ID: c071af6d5c10f2538563bdd0ef2d12997f92b6f5ba8f27d72128bac7ae7e305d
Instruction ID: eac086eb2689beef1c2daa4b97e5e7748287d57f97f326a32329501d3764f344
Opcode Fuzzy Hash: c071af6d5c10f2538563bdd0ef2d12997f92b6f5ba8f27d72128bac7ae7e305d
Instruction Fuzzy Hash: 352108B1D14209AFCB14DFA8D941BAFB7B5BB48310F104629E525A72C0D7356A04DBA0

Function 00F0F990 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

std::locale::~locale.LIBCPMTD ref: 00F0FA2B

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: std::locale::~locale
String ID:
API String ID: 1329985212-0
Opcode ID: e3b59eee1b151ea4747ae2eaee18d1295e46528ac616c551d51bdf0bda4efc61
Instruction ID: 0d836caa4230b79e6266a421a18f979666914edb859578265121ca11edf498e5
Opcode Fuzzy Hash: e3b59eee1b151ea4747ae2eaee18d1295e46528ac616c551d51bdf0bda4efc61
Instruction Fuzzy Hash: A02108B1E1420DAFCB14DF98D942BAEB7B4AB48710F104629E525A72C1D735AA04DB90

Function 00F0ACF0 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

allocator.LIBCONCRTD ref: 00F0AD51

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: allocator
String ID:
API String ID: 3447690668-0
Opcode ID: bdedc7a03f6aa9fd2ea7f277986d854aa55750aeaf7996623d4788d2c3880a23
Instruction ID: 3a5ac73c4ff339e925a324d97e9e22de997b9d5af21443d4a7a511893f8b078b
Opcode Fuzzy Hash: bdedc7a03f6aa9fd2ea7f277986d854aa55750aeaf7996623d4788d2c3880a23
Instruction Fuzzy Hash: 8621887190560CEFDB44EFE4C9926BEBBB1AF95301F5051A9E6066B3A1DB301F00EB91

Function 00F7C6A6 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00F7C6E4

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: bfcf1beaa17ab89eadf90d9f98ad2bea5d4924be735fe77187ff1fe896bcc592
Instruction ID: f710c7825faa7cc8f28a0cc70eb97deb1b62acd75bc4b0d059c5f96f446f2df3
Opcode Fuzzy Hash: bfcf1beaa17ab89eadf90d9f98ad2bea5d4924be735fe77187ff1fe896bcc592
Instruction Fuzzy Hash: 9411187590420AAFCF15DF58E98199A7BF5EF48310F1044AAF809AB311DB31EA21DBA5

Function 00F7C72B Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00F7C769

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 98a2cafe1d67aed3213309e77201c0f6fe9edc897f67dd2364a519c555c5e9f0
Instruction ID: c6fe6f2fe385e65b7ae408cf73c2e548bcef007ee62ebe8fd1e17cbfec560ee4
Opcode Fuzzy Hash: 98a2cafe1d67aed3213309e77201c0f6fe9edc897f67dd2364a519c555c5e9f0
Instruction Fuzzy Hash: 9D111C75904109AFCB09DF58E94199B7BF5EF48310F10806AF808AB311DB31D9119BA5

Function 00EFF3C0 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 00EFF411

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: char_traits
String ID:
API String ID: 1158913984-0
Opcode ID: 89ae3686365d83640b3fc87629e3e6f98c3a2ebe1a696571d6a959fd5c1ad3da
Instruction ID: 0e9daae737f7011eec2913a3d8d4f27447ecf6a55df09f5e60e63abb116585d8
Opcode Fuzzy Hash: 89ae3686365d83640b3fc87629e3e6f98c3a2ebe1a696571d6a959fd5c1ad3da
Instruction Fuzzy Hash: 6911D674E0020DDBCB04DFA4D9459AEB7B5BF44304F5082A9EA15B7391EB359E01DF91

Function 00F10020 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 00F10079

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: char_traits
String ID:
API String ID: 1158913984-0
Opcode ID: 4bf88aa826dd00032cfcdf182ddfb84d632b1ef8ad059fcd0dd39ec09bd42dea
Instruction ID: bf197dfb97c80591b1762669312b93f551cc50520f5e7b4f2b80ae8afb7a14de
Opcode Fuzzy Hash: 4bf88aa826dd00032cfcdf182ddfb84d632b1ef8ad059fcd0dd39ec09bd42dea
Instruction Fuzzy Hash: 4F015B69D0024CEACF04EFE0D8126EEB375AF54300F1091A9D51577252EF754F84EB95

Function 00F6D44A Relevance: 1.5, APIs: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd4fb9f68159f36943d4daaf80d09b15bef42becb401c056c05956bd2abed4ac
Instruction ID: 908c4c450a86a7175183f322e731c05c5b1ca30504b5cffa5e8c1ff458cfea6b
Opcode Fuzzy Hash: dd4fb9f68159f36943d4daaf80d09b15bef42becb401c056c05956bd2abed4ac
Instruction Fuzzy Hash: 3EF0F932E01A1457C6217A2ADC0576A36589F93334F248316F465931D1DF7CFD01B6A2

Function 00F153E0 Relevance: 1.5, APIs: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F4A986: std::_Lockit::_Lockit.LIBCPMT ref: 00F4A9AF
Part of subcall function 00F4A986: std::_Lockit::~_Lockit.LIBCPMT ref: 00F4A9D7

__CxxThrowException@8.LIBVCRUNTIME ref: 00F15434

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Lockitstd::_$Exception@8Lockit::_Lockit::~_Throw
String ID:
API String ID: 2653793986-0
Opcode ID: 72f68937252f40c7ebd1a453524ec6b979ced88eb409cdbec0a52b8c6736f43b
Instruction ID: 14b69989c2262bd6635ef2df737f9c62f4b65ff77e49a78fb7d25a74b1ccda8f
Opcode Fuzzy Hash: 72f68937252f40c7ebd1a453524ec6b979ced88eb409cdbec0a52b8c6736f43b
Instruction Fuzzy Hash: 36E06556D0052163C510B2A57C53BDF7A984ED1B61F498439FD0C96123FB29E689B1E3

Function 00F7875B Relevance: 1.5, APIs: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F7B1AA: HeapAlloc.KERNEL32(00000008,?,00000000,?,00F7B10A,00000001,00000364,?,00F83CCB,?,00000004,00000000,?,?,?,00F7817F), ref: 00F7B1EB

_free.LIBCMT ref: 00F7877B

Part of subcall function 00F7B207: HeapFree.KERNEL32(00000000,00000000,?,00F84A0A,?,00000000,?,00000000,?,00F84CAE,?,00000007,?,?,00F850A9,?), ref: 00F7B21D
Part of subcall function 00F7B207: GetLastError.KERNEL32(?,?,00F84A0A,?,00000000,?,00000000,?,00F84CAE,?,00000007,?,?,00F850A9,?,?), ref: 00F7B22F

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Heap$AllocErrorFreeLast_free
String ID:
API String ID: 3091179305-0
Opcode ID: 86f03641f06ac30353d5a4458b9ad7f368cb759560191a10060ef70fb7166eb2
Instruction ID: 1fdc2141dec83aced0467d2a9bfb07c699f989bae8e5e5b324c2a5f14d8b1652
Opcode Fuzzy Hash: 86f03641f06ac30353d5a4458b9ad7f368cb759560191a10060ef70fb7166eb2
Instruction Fuzzy Hash: 96F03CB5A41205AFD310EF68D842B5ABBF4EB48710F208167ED18D7341EB71AA118BD2

Function 00F878CD Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F8790E

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 329ce3df4eef0b7397df4490b4f7364728a949e4a35911c298a13bba901cbc2b
Instruction ID: e6f3e24ba57bf5525fe9a3ec271a26af992bf92286979a7aee0dafdededf8697
Opcode Fuzzy Hash: 329ce3df4eef0b7397df4490b4f7364728a949e4a35911c298a13bba901cbc2b
Instruction Fuzzy Hash: 4DF03A33514109BBDF116E95DC02EDE3B6AEF89330F240156F92892060EB36CA21B7E1

Function 00F7F17C Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00F8172E,?,00000000,?,00F83CCB,?,00000004,00000000,?,?,?,00F7817F), ref: 00F7F1AE

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 657f7081dc8dccbf7173a3e83ed247978d2d1ae45cdb6d6702557270e0495559
Instruction ID: 0b89305f377d5741fa37f97d2139a77f4fadcfebc01cba7c5f2151a4633a41a8
Opcode Fuzzy Hash: 657f7081dc8dccbf7173a3e83ed247978d2d1ae45cdb6d6702557270e0495559
Instruction Fuzzy Hash: 43E0E532605611DAF7222761DC04B5B3649AB017B1FD58137EC8D960C0CBE8CC04B2E3

Function 00F4B796 Relevance: 1.5, APIs: 1, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F4C9DA

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 421d11b6fe5e127ff4f078b065c8b3d3bff1f6e79ac00e43c8cb3501e8cb17a4
Instruction ID: f029903800137a0ea7546ccb1eb200b59255ed0bc34afcc0f83b63382270b4a9
Opcode Fuzzy Hash: 421d11b6fe5e127ff4f078b065c8b3d3bff1f6e79ac00e43c8cb3501e8cb17a4
Instruction Fuzzy Hash: 64E0D83580070EBA8B40BA65EC45DAC3F6C5F00770B204231FD18950E2EF74D655B5C1

Function 00F8760C Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00F879E7,?,?,00000000,?,00F879E7,00000000,0000000C), ref: 00F87629

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6c6741ba590a78029bfbcbfcd1101a43e8ea764bb8ae1712dfc1bc6fbb7754c3
Instruction ID: 5516451f0329301657c3328f0c5bf98cc8840078582244f37eaebfa7cbc7e54f
Opcode Fuzzy Hash: 6c6741ba590a78029bfbcbfcd1101a43e8ea764bb8ae1712dfc1bc6fbb7754c3
Instruction Fuzzy Hash: 44D06C3200010DBBDF028F84EC06EDA3BAAFB48714F014000BA1856020C732E861AB90

Non-executed Functions

Function 00F379C0 Relevance: 30.2, APIs: 4, Strings: 13, Instructions: 441COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F37A82

Strings

EncodingLookupArray, xrefs: 00F37C4C
DecodingLookupArray, xrefs: 00F37ACC, 00F37BC1
Log2Base, xrefs: 00F37AE8, 00F37C68
BaseN_Encoder: Log2Base must be between 1 and 7 inclusive, xrefs: 00F37D30
Separator, xrefs: 00F37E8D
PaddingByte, xrefs: 00F37C91
GroupSize, xrefs: 00F37E09
BaseN_Decoder, xrefs: 00F37AED, 00F37B9B
Terminator, xrefs: 00F37EAD
BaseN_Encoder, xrefs: 00F37C6D
: missing required parameter ', xrefs: 00F37A2E, 00F37BA8
BaseN_Decoder: Log2Base must be between 1 and 7 inclusive, xrefs: 00F37B6D
Pad, xrefs: 00F37CAF

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: : missing required parameter '$BaseN_Decoder$BaseN_Decoder: Log2Base must be between 1 and 7 inclusive$BaseN_Encoder$BaseN_Encoder: Log2Base must be between 1 and 7 inclusive$DecodingLookupArray$EncodingLookupArray$GroupSize$Log2Base$Pad$PaddingByte$Separator$Terminator
API String ID: 2005118841-807858313
Opcode ID: c18279175b8f3cb82dc9146f8c6e4c8bee0225d7ca896aef5de9516ab17811ae
Instruction ID: c52c5dd84241baef999ece06697b240b41c05b4800d726d9eafd5f95d8e66d91
Opcode Fuzzy Hash: c18279175b8f3cb82dc9146f8c6e4c8bee0225d7ca896aef5de9516ab17811ae
Instruction Fuzzy Hash: CEE1D5B1A04209ABDF24EFA4CC45FDEBBF8FF44720F144159E415A7281DB74AA08DB91

Function 00EF9C50 Relevance: 28.4, APIs: 8, Strings: 8, Instructions: 428fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EE2400: _WChar_traits.LIBCPMTD ref: 00EE244D

FindFirstFileW.KERNEL32(00000000,?), ref: 00EF9CD2
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00EF9E02
FindNextFileW.KERNEL32(000000FF,?), ref: 00EFA3C3
FindClose.KERNEL32(000000FF), ref: 00EFA3D8

Part of subcall function 00EE1D10: char_traits.LIBCPMTD ref: 00EE1D4D

Strings

C:\Windows, xrefs: 00EF9EFE
.mammn, xrefs: 00EFA0B4
C:\System Volume Information, xrefs: 00EF9F11
READ.txt, xrefs: 00EFA0DC
r+b, xrefs: 00EF9F61
Failed to find first file in directory: , xrefs: 00EF9CEB
C:\Documents and Settings, xrefs: 00EF9F24
RSADecryptKey, xrefs: 00EF9F37

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Find$File$Char_traitsCloseContainer_base12Container_base12::~_FirstNextchar_traitsstd::_
String ID: .mammn$C:\Documents and Settings$C:\System Volume Information$C:\Windows$Failed to find first file in directory: $READ.txt$RSADecryptKey$r+b
API String ID: 3440245238-3649217578
Opcode ID: b05f73e464d1b31203c54656ba68a1949808c1804ce55e029f19cc3745d61563
Instruction ID: 21b65dc85a40bc4424486495ad74faf5ad06dd0563e9819acf97e84b4fd01b7c
Opcode Fuzzy Hash: b05f73e464d1b31203c54656ba68a1949808c1804ce55e029f19cc3745d61563
Instruction Fuzzy Hash: DE1257B1D0525C9BCB25EB64CC45BEDBBB8AB04300F5091E9E109B7292EB705F84DF52

Function 00F3A080 Relevance: 27.0, APIs: 6, Strings: 9, Instructions: 738COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F3A316

Strings

doesn't match the required length of , xrefs: 00F3A2C2
TF_SignerBase: this algorithm does not support message recovery or the key is too short, xrefs: 00F3A739
: this key is too short to encrypt any messages, xrefs: 00F3A50D
: ciphertext length of , xrefs: 00F3A2A0
exceeds the maximum of , xrefs: 00F3A5B2
TF_SignerBase: the recoverable message part is too long for the given key and algorithm, xrefs: 00F3A767
for this public key, xrefs: 00F3A5D4
: message length of , xrefs: 00F3A590
for this key, xrefs: 00F3A2E4

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: doesn't match the required length of $ exceeds the maximum of $ for this key$ for this public key$: ciphertext length of $: message length of $: this key is too short to encrypt any messages$TF_SignerBase: the recoverable message part is too long for the given key and algorithm$TF_SignerBase: this algorithm does not support message recovery or the key is too short
API String ID: 2005118841-3686900216
Opcode ID: 71a054193343a098ec2b8e65b2b673034c6056787304345bc4418d099d3d36bc
Instruction ID: c45a44d41f5b44937396f4924bd5a0c38d401d6269cd06969909a02c60978ec2
Opcode Fuzzy Hash: 71a054193343a098ec2b8e65b2b673034c6056787304345bc4418d099d3d36bc
Instruction Fuzzy Hash: 8B529E75A00249EFDF14DFA4C885BEEBBB9FF48310F148169F905A7251DB34AA04DBA1

Function 00EFC5B0 Relevance: 26.7, APIs: 8, Strings: 7, Instructions: 432filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00EE2400: _WChar_traits.LIBCPMTD ref: 00EE244D

FindFirstFileW.KERNEL32(00000000,?), ref: 00EFC63C
lstrcmpW.KERNEL32(?,00F97CB8), ref: 00EFCC3D
lstrcmpW.KERNEL32(?,00F97CBC), ref: 00EFCC53
FindNextFileW.KERNEL32(000000FF,?), ref: 00EFCC77
FindClose.KERNEL32(000000FF), ref: 00EFCC8C
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00EFCD63

Strings

C:\Windows, xrefs: 00EFC9E3
r+b, xrefs: 00EFC7B4
.v2, xrefs: 00EFC9F5
.mammn, xrefs: 00EFC9BF
C:\Documents and Settings, xrefs: 00EFC77A
C:\System Volume Information, xrefs: 00EFC758
C:\Windows, xrefs: 00EFC736

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Find$Filelstrcmp$Char_traitsCloseContainer_base12Container_base12::~_FirstNextstd::_
String ID: .mammn$.v2$C:\Documents and Settings$C:\System Volume Information$C:\Windows$C:\Windows$r+b
API String ID: 1709313857-3543874439
Opcode ID: ca046b36ff62ef8c442c08a3adb9220e0590e269105e8b6ae87295526d746a91
Instruction ID: 9ad8d5687c00b5ad073873d2f7264e32509a1a4e0dface395192b84a883d4b89
Opcode Fuzzy Hash: ca046b36ff62ef8c442c08a3adb9220e0590e269105e8b6ae87295526d746a91
Instruction Fuzzy Hash: EB125871D0429C9BCB25EB64CD95BEDBBB8AB45300F2091D9E109B7282DB705F84DF52

Function 00EFCE60 Relevance: 24.9, APIs: 9, Strings: 5, Instructions: 437fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00EE2400: _WChar_traits.LIBCPMTD ref: 00EE244D

FindFirstFileW.KERNEL32(00000000,?), ref: 00EFCEEC
operator!=.LIBCPMTD ref: 00EFD245
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00EFD451
FindNextFileW.KERNEL32(000000FF,?), ref: 00EFD511
FindClose.KERNEL32(000000FF), ref: 00EFD526
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00EFD569
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00EFD618

Strings

.mammn, xrefs: 00EFD21A
.v2, xrefs: 00EFD23C
C:\Windows, xrefs: 00EFD4C6
r+b, xrefs: 00EFCFF9
C:\Windows, xrefs: 00EFD260

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Find$Container_base12Container_base12::~_Filestd::_$Affinity::operator!=Char_traitsCloseConcurrency::details::FirstHardwareNextoperator!=
String ID: .mammn$.v2$C:\Windows$C:\Windows$r+b
API String ID: 3122537284-2568219276
Opcode ID: ff17a5436ca172e9afcfe8dfb0b39e4b308630e3f74c4c1560fe453bf51677c5
Instruction ID: 0cec2002deed4b2e5c4461e8459e7fab7b624859f2fda299a9b7ce07bcd4f77b
Opcode Fuzzy Hash: ff17a5436ca172e9afcfe8dfb0b39e4b308630e3f74c4c1560fe453bf51677c5
Instruction Fuzzy Hash: 93126670C0525C9BDB25EBA4CD55BEEBBB9AB44304F1081E9E109B7282DB705F88DF91

Function 00F08240 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 326fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F01EE0: _WChar_traits.LIBCPMTD ref: 00F01F23

Part of subcall function 00EE2400: _WChar_traits.LIBCPMTD ref: 00EE244D

FindFirstFileW.KERNEL32(00000000,?,?,?,0000000C), ref: 00F083D5
FindNextFileW.KERNEL32(000000FF,?,?,?,?,?,?,?,?,?,0000000C), ref: 00F08637
FindClose.KERNEL32(000000FF,?,?,?,?,?,?,?,?,0000000C), ref: 00F0864C
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00F0868F

Strings

\READ.txt, xrefs: 00F0854D
your Case id:, xrefs: 00F08308
Greetings,Your files have been encrypted, and your sensitive data has been exfiltrated. To unlock your files and prevent the rel, xrefs: 00F0827D
our Telegram. try to contact telegram for faster response:, xrefs: 00F082A7

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Find$Char_traitsFile$Affinity::operator!=CloseConcurrency::details::FirstHardwareNext
String ID: our Telegram. try to contact telegram for faster response:$your Case id:$Greetings,Your files have been encrypted, and your sensitive data has been exfiltrated. To unlock your files and prevent the rel$\READ.txt
API String ID: 2876803620-2489481340
Opcode ID: 0078befce5125850950598566ac18290c887d1e26307130d29aaa4dd0eab99a4
Instruction ID: 7aa8a8f39c4faa4f1a64a30dafa8d87f80c76ef36b83e78f404c1c8aa663df60
Opcode Fuzzy Hash: 0078befce5125850950598566ac18290c887d1e26307130d29aaa4dd0eab99a4
Instruction Fuzzy Hash: 47E14A71C0425CDBDB25DBA4CD41BEEBBB8AB54304F1081E9E149B7282EB745B48EF91

Function 00F46970 Relevance: 15.3, Strings: 12, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

Strings

enti, xrefs: 00F46B69
Hygo, xrefs: 00F46B70
ineI, xrefs: 00F46AC4
Genu, xrefs: 00F46AAC
uine, xrefs: 00F46B7C
Auth, xrefs: 00F46B59
aurH, xrefs: 00F46C32
cAMD, xrefs: 00F46B61
ntel, xrefs: 00F46AB8
nGen, xrefs: 00F46B88
Cent, xrefs: 00F46C1A
auls, xrefs: 00F46C26

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID: Auth$Cent$Genu$Hygo$auls$aurH$cAMD$enti$ineI$nGen$ntel$uine
API String ID: 0-2607262942
Opcode ID: 8b5adfa9de69f1c4df547c032743b1a73503e2c50c8c5c747556120f27effa0f
Instruction ID: 2439f1ef6d17c9a594ac4a0082730f45ba443e191e2f79cda57cdde915ba1279
Opcode Fuzzy Hash: 8b5adfa9de69f1c4df547c032743b1a73503e2c50c8c5c747556120f27effa0f
Instruction Fuzzy Hash: 5491F676A087858BDB29CF1885827A6BFE0EB66314F04C91EDCD6D3351C329D944EB43

Function 00F87F44 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00F8808A

Strings

1#IND, xrefs: 00F89282
1#QNAN, xrefs: 00F89290
1#INF, xrefs: 00F89297
1#SNAN, xrefs: 00F89289

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 8fdd2d2399ab21083bb4b991eb4444a4f7327e11924d44347b95104bc55641f3
Instruction ID: da3c4c4c164926c76c69886d5e8f022ba066b931035b157e3740a2edb27e3ed2
Opcode Fuzzy Hash: 8fdd2d2399ab21083bb4b991eb4444a4f7327e11924d44347b95104bc55641f3
Instruction Fuzzy Hash: 44C27F72E086298FDF25DE28DD447EAB3B5EB44354F5441EAD40DE7240EB78AE829F40

Function 00F860A9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,00F863C8,?,00000000), ref: 00F86142
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,00F863C8,?,00000000), ref: 00F8616B
GetACP.KERNEL32(?,?,00F863C8,?,00000000), ref: 00F86180

Strings

ACP, xrefs: 00F860C7
OCP, xrefs: 00F860FD

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 8691fd70eaac40e07c525def6cf4afa8a99d444311ed3826be420e909e8321af
Instruction ID: a191b1393bc878f024f777e7d4da30e3d4f8807fd22fde359cee949d93e29b1f
Opcode Fuzzy Hash: 8691fd70eaac40e07c525def6cf4afa8a99d444311ed3826be420e909e8321af
Instruction Fuzzy Hash: 2F21CF62F04505A6DB35AF54CD08BD7B3A6EB40F74B568424E90ADB223EB32DD41E390

Function 00F8627D Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F7B055: GetLastError.KERNEL32(?,00000000,00F751CC,?,?,00F48334,00000000,?,?,?,00FBFD70,?,?,?,?,string too long), ref: 00F7B059
Part of subcall function 00F7B055: _free.LIBCMT ref: 00F7B08C
Part of subcall function 00F7B055: SetLastError.KERNEL32(00000000,?,00FBFD70,?,?,?,?,string too long,?,00EE4385,?,?,?,00EF6AED,ij,?), ref: 00F7B0CD
Part of subcall function 00F7B055: _abort.LIBCMT ref: 00F7B0D3

Part of subcall function 00F7B055: _free.LIBCMT ref: 00F7B0B4
Part of subcall function 00F7B055: SetLastError.KERNEL32(00000000,?,00FBFD70,?,?,?,?,string too long,?,00EE4385,?,?,?,00EF6AED,ij,?), ref: 00F7B0C1

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 00F86389
IsValidCodePage.KERNEL32(00000000), ref: 00F863E4
IsValidLocale.KERNEL32(?,00000001), ref: 00F863F3
GetLocaleInfoW.KERNEL32(?,00001001,00F78D5B,00000040,?,00F78E7B,00000055,00000000,?,?,00000055,00000000), ref: 00F8643B
GetLocaleInfoW.KERNEL32(?,00001002,00F78DDB,00000040), ref: 00F8645A

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: 8bdd80adb4513dc22738cd3a7837271b8b04771ba2985a15b8208a4e8e6c1f75
Instruction ID: 723c09e01ca1c33640d41b67a521ae5eb8bebdeed9aaf6e9717c3242b546fa10
Opcode Fuzzy Hash: 8bdd80adb4513dc22738cd3a7837271b8b04771ba2985a15b8208a4e8e6c1f75
Instruction Fuzzy Hash: 72517072E00609ABEF10FFA5CC45BFE77B8AF05710F044469E915EB291EB749940AB61

Function 00F33040 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 263encryptionCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000010,F58088C3,7508FC30,?), ref: 00F33090
CryptReleaseContext.ADVAPI32(00000001,00000000,?,00000000,?,00F9DB08,00000002, operation failed with error ,0000001D,?,?,OS_Rng: ,00000008,?), ref: 00F333C0

Strings

operation failed with error , xrefs: 00F33118
OS_Rng: , xrefs: 00F330EA

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ContextCryptErrorLastRelease
String ID: operation failed with error $OS_Rng:
API String ID: 3299239745-700108173
Opcode ID: 8e8ca72311eb558d9c8d9669a5ee85b082f4bfdffc354229c52f078bb9a2e6c2
Instruction ID: 66c6abdc0517eff73c41955c37172d6fc530ff219fda69a74f43c99d0638fe00
Opcode Fuzzy Hash: 8e8ca72311eb558d9c8d9669a5ee85b082f4bfdffc354229c52f078bb9a2e6c2
Instruction Fuzzy Hash: 4CA1B471D00248CFEB14DF68CC89BADBBB1FF45314F148299E408AB292DB75AA84DB51

Function 00F85932 Relevance: 6.3, APIs: 4, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F7B055: GetLastError.KERNEL32(?,00000000,00F751CC,?,?,00F48334,00000000,?,?,?,00FBFD70,?,?,?,?,string too long), ref: 00F7B059
Part of subcall function 00F7B055: _free.LIBCMT ref: 00F7B08C
Part of subcall function 00F7B055: SetLastError.KERNEL32(00000000,?,00FBFD70,?,?,?,?,string too long,?,00EE4385,?,?,?,00EF6AED,ij,?), ref: 00F7B0CD
Part of subcall function 00F7B055: _abort.LIBCMT ref: 00F7B0D3

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00F78D62,?,?,?,?,00F787AF,?,00000000), ref: 00F85A14
_wcschr.LIBVCRUNTIME ref: 00F85AA4
_wcschr.LIBVCRUNTIME ref: 00F85AB2
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,00F78D62,00000000,00F78E82), ref: 00F85B64

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID:
API String ID: 4212172061-0
Opcode ID: f8752e4a1fe18d9da9327b35c4e8a2754fd2eda3918bf30ec01bbf918563e2c7
Instruction ID: 5786d1e7d1304b0b38666d89ce28b0c6644a15ba336f462ae57427b0a9be0515
Opcode Fuzzy Hash: f8752e4a1fe18d9da9327b35c4e8a2754fd2eda3918bf30ec01bbf918563e2c7
Instruction Fuzzy Hash: 1A61DC71A00B06ABD724BB74CC86FE773A8EF04B20F14456AF909D7181EB78D941A761

Function 00F396F0 Relevance: 5.9, APIs: 1, Strings: 2, Instructions: 628COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F39E2D

Strings

: block size of underlying block cipher is not 16, xrefs: 00F39DFE
TableSize, xrefs: 00F39788

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: : block size of underlying block cipher is not 16$TableSize
API String ID: 2005118841-2295039505
Opcode ID: 647b9418ea18c7b2cc57989be6bd4310baf1ea6292f1aaaea5ac2f1c21146270
Instruction ID: be21457857db294bec1e37a75b1a424aeb38caad89a2661cd15459fa1e06ebfe
Opcode Fuzzy Hash: 647b9418ea18c7b2cc57989be6bd4310baf1ea6292f1aaaea5ac2f1c21146270
Instruction Fuzzy Hash: 504234B1D042198FDB24CF69C845B9DFBB5BF88314F25826ED419A7352DBB0A981DF80

Function 00F33410 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00F334A0: CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00F3352A

CryptGenRandom.ADVAPI32(00000000,?,?,F58088C3), ref: 00F3344A
__CxxThrowException@8.LIBVCRUNTIME ref: 00F33499

Strings

CryptGenRandom, xrefs: 00F33470

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Crypt$ContextException@8RandomReleaseThrow
String ID: CryptGenRandom
API String ID: 1047471967-3616286655
Opcode ID: 8054fba83e896d1ad70dd60e8f087df1f7dd1c688c156e0329baa988e6861542
Instruction ID: 18ff83564ca869cc13272fa6171c7fff60e476bd2bdb87f5a717ce33bfbd9ad8
Opcode Fuzzy Hash: 8054fba83e896d1ad70dd60e8f087df1f7dd1c688c156e0329baa988e6861542
Instruction Fuzzy Hash: A101407190424CEFCB15EF95CC42FDEBBB8FB04720F40456AA811B7691DB78AA08DB91

Function 00F3AC00 Relevance: 4.9, APIs: 3, Instructions: 427COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F3ACCD

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: cfe6f8930eafb3074f738d5156c2b7f5242ca599021f0430d215063adc571712
Instruction ID: a14d7bccd3e0edf447fe016a89051c6df85c014544eb5b3fa070e790c020be79
Opcode Fuzzy Hash: cfe6f8930eafb3074f738d5156c2b7f5242ca599021f0430d215063adc571712
Instruction Fuzzy Hash: 38F16675A00209AFCB04DF69C885AAEBBF5FF88310F044569F919A7351DB35ED04DBA2

Function 00F85D30 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00F7B055: GetLastError.KERNEL32(?,00000000,00F751CC,?,?,00F48334,00000000,?,?,?,00FBFD70,?,?,?,?,string too long), ref: 00F7B059
Part of subcall function 00F7B055: _free.LIBCMT ref: 00F7B08C
Part of subcall function 00F7B055: SetLastError.KERNEL32(00000000,?,00FBFD70,?,?,?,?,string too long,?,00EE4385,?,?,?,00EF6AED,ij,?), ref: 00F7B0CD
Part of subcall function 00F7B055: _abort.LIBCMT ref: 00F7B0D3

Part of subcall function 00F7B055: _free.LIBCMT ref: 00F7B0B4
Part of subcall function 00F7B055: SetLastError.KERNEL32(00000000,?,00FBFD70,?,?,?,?,string too long,?,00EE4385,?,?,?,00EF6AED,ij,?), ref: 00F7B0C1

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F85D84
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F85DD5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F85E95

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ErrorInfoLastLocale$_free$_abort
String ID:
API String ID: 2829624132-0
Opcode ID: ac65748a48e215f1dee1b48bccdac6c821f0201ca7ed36e9fd28ddbb063dade9
Instruction ID: 9ecfc4aea93a22b9a2de3407ef1c3b36cc801edbfd9d2b7d380e98ccd411077f
Opcode Fuzzy Hash: ac65748a48e215f1dee1b48bccdac6c821f0201ca7ed36e9fd28ddbb063dade9
Instruction Fuzzy Hash: 6761A171914A079BDB28AF24CC86BFA77E8FF04B10F1440A9ED06C6585F778EA51EB50

Function 00F6C6AF Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00F6C7A7
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00F6C7B1
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00F6C7BE

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a0032180fe6b305f8acf3531a129a81a872a9abcac67def340b94ad5778fed5e
Instruction ID: b70b60a5d04ffaaa0bf2d6646ec1f7878e33fea9775a12083f03d2f0bd825501
Opcode Fuzzy Hash: a0032180fe6b305f8acf3531a129a81a872a9abcac67def340b94ad5778fed5e
Instruction Fuzzy Hash: 4231C47490121CABCB21DF64DC89B9CBBB4AF18710F5042DAE84CA7250E7349B859F85

Function 00F77781 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00F77757,00000000,00FC15D0,0000000C,00F778AE,00000000,00000002,00000000), ref: 00F777A2
TerminateProcess.KERNEL32(00000000,?,00F77757,00000000,00FC15D0,0000000C,00F778AE,00000000,00000002,00000000), ref: 00F777A9
ExitProcess.KERNEL32 ref: 00F777BB

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: d1ecd2197be65e62bf62ae69212694003aad530267a889b8733c95f12c7b2889
Instruction ID: ce45e4a7b10220145666fa8fa9b24bf191ead0f7f0bb3f1fc08bbf17f7503969
Opcode Fuzzy Hash: d1ecd2197be65e62bf62ae69212694003aad530267a889b8733c95f12c7b2889
Instruction Fuzzy Hash: B4E0B631524608AFDF127F64DD49E483B6AEF40791F518027F9098A132CB39ED82EB82

Function 00F36B50 Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 717COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F372B1

Strings

PK_MessageAccumulator: TruncatedFinal() should not be called, xrefs: 00F37288

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: PK_MessageAccumulator: TruncatedFinal() should not be called
API String ID: 2005118841-4199916868
Opcode ID: 6384b068f37f06eef49df42916394cd2df7b7202a1bff20c2cee9134a8ae9a53
Instruction ID: d7cd5aef82d8b35bfa7afe593664a6ffafdaa655e500cb35abc22a4bacd8299b
Opcode Fuzzy Hash: 6384b068f37f06eef49df42916394cd2df7b7202a1bff20c2cee9134a8ae9a53
Instruction Fuzzy Hash: 2042BD71A002489FCB14DF68C984BAEBBF5BF98320F154159F846AB352DB34ED44DB91

Function 00F35EA0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 529COMMON

Download Yara Rule

Strings

PK_MessageAccumulator: DigestSize() should not be called, xrefs: 00F36418

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID: PK_MessageAccumulator: DigestSize() should not be called
API String ID: 0-977735494
Opcode ID: 08c94ae76799c4865a620fbd180d8f4d9289b913d75968f585464a4e7d7c521e
Instruction ID: ce1492cdd41b8d11779fa9c03dc5c65db5196f63614ba1cdc6aec1a719753bd4
Opcode Fuzzy Hash: 08c94ae76799c4865a620fbd180d8f4d9289b913d75968f585464a4e7d7c521e
Instruction Fuzzy Hash: 91123871E00219DFCF14DF98C990AEEBBB5FF98320F158129E806AB355DB34A945DB90

Function 00F82D68 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

., xrefs: 00F82EFB

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 3c07cabdf53b9a53cedcf33111756d910bafef0ca6ef1670b9780434c2b3ffdc
Instruction ID: cf0fba64fc547d22ebbbf64ff143e3ca190bba0cb1139bf4a36070215a9b64a7
Opcode Fuzzy Hash: 3c07cabdf53b9a53cedcf33111756d910bafef0ca6ef1670b9780434c2b3ffdc
Instruction Fuzzy Hash: FF310572D002096FCB64AE78CC84EFB7BBDEB85314F0401A8F859D7251E630AE45EB50

Function 00F7CDEF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,00F787AF,?,00000000), ref: 00F7CE42

Strings

GetLocaleInfoEx, xrefs: 00F7CE00, 00F7CE0A

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: e065740ba3336c622deca3732929b95e57bc45e9c3e4951b7f4c25e2dd8b0df6
Instruction ID: 98f94d6bd8e82e2814ae1c57e2b0a8d5de01a96fae35eeaeb11aab831be4c122
Opcode Fuzzy Hash: e065740ba3336c622deca3732929b95e57bc45e9c3e4951b7f4c25e2dd8b0df6
Instruction Fuzzy Hash: BFF0F631A4021CBBCB115F61DC02F6E7F21EF44B50F04405AFC099A190CB71DA10B7D2

Function 00F7CE59 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000,00F73786), ref: 00F7CE98

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00F7CE6A, 00F7CE74

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Time$FileSystem
String ID: GetSystemTimePreciseAsFileTime
API String ID: 2086374402-595813830
Opcode ID: 284e4499a353a518ea52dd39c9b269b2dfdbf7e216f5c331710c56da6a96eadb
Instruction ID: 0a8be752fb19cf6a9cfb9787b469341df81f7e437377531e4dbcca89d08eea0d
Opcode Fuzzy Hash: 284e4499a353a518ea52dd39c9b269b2dfdbf7e216f5c331710c56da6a96eadb
Instruction Fuzzy Hash: 9DE0E572A05218AB86216B259C07E7EBF60DB45F90B44409BFD0997291DE30DE10B7E7

Function 00F72B60 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 847b9a98673826b77d559fe2e21b56f8e461c893bb1a179e5809b0ec17b5c86b
Instruction ID: b96ae493be11d6cd288c8e3bf66677c2a5cbdb4b95565d04927a875c8481141c
Opcode Fuzzy Hash: 847b9a98673826b77d559fe2e21b56f8e461c893bb1a179e5809b0ec17b5c86b
Instruction Fuzzy Hash: 23023D71E001199BDF54CFA9C8806ADF7F1FF88324F25816AD919E7384D731AA41DB91

Function 00F79C63 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00F79C5E,?,?,00000008,?,?,00F89CE1,00000000), ref: 00F79E90

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 1355cfc438b5ecbcb1ea34a518fa0f9674fb391102504b9994b790ddcf702fc9
Instruction ID: b1c187de064c134d3400f145167a471f015da069ce05cd44b35933aaf001717d
Opcode Fuzzy Hash: 1355cfc438b5ecbcb1ea34a518fa0f9674fb391102504b9994b790ddcf702fc9
Instruction Fuzzy Hash: 81B138325146098FDB25CF28C48ABA47BA0FF45364F25C65AE899CF2A1C375D982DB41

Function 00F85F80 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00F7B055: GetLastError.KERNEL32(?,00000000,00F751CC,?,?,00F48334,00000000,?,?,?,00FBFD70,?,?,?,?,string too long), ref: 00F7B059
Part of subcall function 00F7B055: _free.LIBCMT ref: 00F7B08C
Part of subcall function 00F7B055: SetLastError.KERNEL32(00000000,?,00FBFD70,?,?,?,?,string too long,?,00EE4385,?,?,?,00EF6AED,ij,?), ref: 00F7B0CD
Part of subcall function 00F7B055: _abort.LIBCMT ref: 00F7B0D3

Part of subcall function 00F7B055: _free.LIBCMT ref: 00F7B0B4
Part of subcall function 00F7B055: SetLastError.KERNEL32(00000000,?,00FBFD70,?,?,?,?,string too long,?,00EE4385,?,?,?,00EF6AED,ij,?), ref: 00F7B0C1

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F85FD4

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: 3f46fbd8a72b7e0d2ac4f1425a0e53842bd301bf4919bed6a1792770e9550daf
Instruction ID: f40be8785f9c155051085fbe4f03b1fa0e31b1a8d78f742b3f173ac7caaba128
Opcode Fuzzy Hash: 3f46fbd8a72b7e0d2ac4f1425a0e53842bd301bf4919bed6a1792770e9550daf
Instruction Fuzzy Hash: 3F21BE3290020AABDB29AB24DD46BFA77ACEF14325F10406AFD05D6181EB38ED40EB55

Function 00F85C04 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F7B055: GetLastError.KERNEL32(?,00000000,00F751CC,?,?,00F48334,00000000,?,?,?,00FBFD70,?,?,?,?,string too long), ref: 00F7B059
Part of subcall function 00F7B055: _free.LIBCMT ref: 00F7B08C
Part of subcall function 00F7B055: SetLastError.KERNEL32(00000000,?,00FBFD70,?,?,?,?,string too long,?,00EE4385,?,?,?,00EF6AED,ij,?), ref: 00F7B0CD
Part of subcall function 00F7B055: _abort.LIBCMT ref: 00F7B0D3

EnumSystemLocalesW.KERNEL32(00F85D30,00000001,00000000,?,00F78D5B,?,00F8635D,00000000,?,?,?), ref: 00F85C76

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: f355b18530d88c9f029558fcee5f7a3433f1f7ae490f41fd4798ac1dad49e7dc
Instruction ID: e30cee1f783f2fafed1659bf7f361260df84f552c61ed77ba92abbb215aae55d
Opcode Fuzzy Hash: f355b18530d88c9f029558fcee5f7a3433f1f7ae490f41fd4798ac1dad49e7dc
Instruction Fuzzy Hash: 03114C37604B055FDB18AF38C8916FABB91FF80768B54442DE94787A40D371B943DB40

Function 00F861B0 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00F7B055: GetLastError.KERNEL32(?,00000000,00F751CC,?,?,00F48334,00000000,?,?,?,00FBFD70,?,?,?,?,string too long), ref: 00F7B059
Part of subcall function 00F7B055: _free.LIBCMT ref: 00F7B08C
Part of subcall function 00F7B055: SetLastError.KERNEL32(00000000,?,00FBFD70,?,?,?,?,string too long,?,00EE4385,?,?,?,00EF6AED,ij,?), ref: 00F7B0CD
Part of subcall function 00F7B055: _abort.LIBCMT ref: 00F7B0D3

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00F85F4E,00000000,00000000,?), ref: 00F861DC

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: 2a90c3586abc0b6b4494553f4dd8ecf88bc29b5751000c002cc2869e083409d2
Instruction ID: c16a38d285d8f964f45e5445621ca39f9399e8ba7edac4e18a302d37f4142b1b
Opcode Fuzzy Hash: 2a90c3586abc0b6b4494553f4dd8ecf88bc29b5751000c002cc2869e083409d2
Instruction Fuzzy Hash: 4DF0F432A48516BBDF286A658C09BFB7768EB40B28F154469ED09E3141EA74FE01E7D0

Function 00F85C9F Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F7B055: GetLastError.KERNEL32(?,00000000,00F751CC,?,?,00F48334,00000000,?,?,?,00FBFD70,?,?,?,?,string too long), ref: 00F7B059
Part of subcall function 00F7B055: _free.LIBCMT ref: 00F7B08C
Part of subcall function 00F7B055: SetLastError.KERNEL32(00000000,?,00FBFD70,?,?,?,?,string too long,?,00EE4385,?,?,?,00EF6AED,ij,?), ref: 00F7B0CD
Part of subcall function 00F7B055: _abort.LIBCMT ref: 00F7B0D3

EnumSystemLocalesW.KERNEL32(00F85F80,00000001,00000000,?,00F78D5B,?,00F86321,00F78D5B,?,?,?,?,?,00F78D5B,?,?), ref: 00F85CEB

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 556b262ef174dab7135aa4c89103feec7009f52ba4461c4831b1082cdedb25e1
Instruction ID: 4cbb5b2efd5e778a2ec92826637a75e7457589532897f02739a8956c2b68bbb8
Opcode Fuzzy Hash: 556b262ef174dab7135aa4c89103feec7009f52ba4461c4831b1082cdedb25e1
Instruction Fuzzy Hash: 8FF02236300B041FDB146F39CC81BAA7B95EF81B68B44802DF9068B640D6B1DC02AB40

Function 00F7C906 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F750C1: EnterCriticalSection.KERNEL32(?,?,00F77EFA,?,00FC15F8,0000000C), ref: 00F750D0

EnumSystemLocalesW.KERNEL32(00F7C8C0,00000001,00FC1778,0000000C), ref: 00F7C93E

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: e3db1095337f9b82afb54991d86cb4146f41f0ed03f7322f0fc8400029c0798b
Instruction ID: 288792b8a1bfd02507be2eae0509a142dd7456d4f31dde49fc1d248291e35272
Opcode Fuzzy Hash: e3db1095337f9b82afb54991d86cb4146f41f0ed03f7322f0fc8400029c0798b
Instruction Fuzzy Hash: 2AF03C72A106049FD710EF68DD47F997BF0BB05750F00815AF814DB2A2CB788A45BB82

Function 00F85BB9 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F7B055: GetLastError.KERNEL32(?,00000000,00F751CC,?,?,00F48334,00000000,?,?,?,00FBFD70,?,?,?,?,string too long), ref: 00F7B059
Part of subcall function 00F7B055: _free.LIBCMT ref: 00F7B08C
Part of subcall function 00F7B055: SetLastError.KERNEL32(00000000,?,00FBFD70,?,?,?,?,string too long,?,00EE4385,?,?,?,00EF6AED,ij,?), ref: 00F7B0CD
Part of subcall function 00F7B055: _abort.LIBCMT ref: 00F7B0D3

EnumSystemLocalesW.KERNEL32(00F85B10,00000001,00000000,?,?,00F8637F,00F78D5B,?,?,?,?,?,00F78D5B,?,?,?), ref: 00F85BF0

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 68b72e6fcf78e50873bde6b70b662c8d06f73e821a86c69743cb3a0933a22511
Instruction ID: 6ca1c2025e1bacf91e517d35c020983f398ea0b3eca885ec29442437f9e707bf
Opcode Fuzzy Hash: 68b72e6fcf78e50873bde6b70b662c8d06f73e821a86c69743cb3a0933a22511
Instruction Fuzzy Hash: 00F0553630030857CB05AF35C805BAB7F90EFC2B60B864059EA098B250C6319842E790

Function 00F333D0 Relevance: 1.5, APIs: 1, Instructions: 18encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000), ref: 00F333E3

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: fb856cebe6d47eaae91c3f7558475d61bec1d3bcc1c3b35378aaffdbc928762e
Instruction ID: b6d15d4721ffeefbe0bf8f89b2c256d4b38b1766a23896e528a23c64286d20b6
Opcode Fuzzy Hash: fb856cebe6d47eaae91c3f7558475d61bec1d3bcc1c3b35378aaffdbc928762e
Instruction Fuzzy Hash: 92D02E72B0831113D3208B28AC89B4A7AC89F01B21F44881DB884E3281CBB8C844D3A0

Function 00F948A0 Relevance: 1.5, APIs: 1, Instructions: 17encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000), ref: 00F948B4

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: 226d059cb8efef63a18a7b29223cf0c502a8f1560c171d42e6bb96f7bdc41e62
Instruction ID: 0a080ab6d62b61840e228da3abe89f1e9504f19fb1bd48dd86ee2ae34c2309a8
Opcode Fuzzy Hash: 226d059cb8efef63a18a7b29223cf0c502a8f1560c171d42e6bb96f7bdc41e62
Instruction Fuzzy Hash: A7D05E72E0122457EB305F14BD4AF4637986F10B15F040408E900AB190C7B8AC05ABD9

Function 00F4CB52 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0006CB60,00F4C075), ref: 00F4CB57

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c26076bfba89063a80a8da36d16c14a24647c946c3f9715c2cacfa084b947d32
Instruction ID: 659eb9a94a7a675063a3be88901b3eff89630976c568de38ce6750a42ad8fd70
Opcode Fuzzy Hash: c26076bfba89063a80a8da36d16c14a24647c946c3f9715c2cacfa084b947d32
Instruction Fuzzy Hash:

Function 00F6F041 Relevance: 1.5, Strings: 1, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00F6F1B1

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 449ce9ef20334d625e26d90c78c87a4c5f2a974813b8bd9257bc816e2bcf5013
Instruction ID: bf00011dfa4a3c2fa073365e8ae287ecaaac61176fa7108bb88556280b5ba2c1
Opcode Fuzzy Hash: 449ce9ef20334d625e26d90c78c87a4c5f2a974813b8bd9257bc816e2bcf5013
Instruction Fuzzy Hash: 7B517962E04645A7DF388A78F9567BF33D59B173A0F18043AD882C7283D609DD4DB392

Function 00F46D00 Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

@, xrefs: 00F46EEF

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: daa1f35d984bcc30538ff2f04cd7e1155a5a41c40c4272343451ae44f8527725
Instruction ID: 6e9a7910d28b8df4b3d75ee404c6e8ddc63a6785d19aa45bc19b4306d27008b4
Opcode Fuzzy Hash: daa1f35d984bcc30538ff2f04cd7e1155a5a41c40c4272343451ae44f8527725
Instruction Fuzzy Hash: 5191753190C7858BE716CF2CC5017EAB7E1AFD9318F189718FDC866251F731AA859742

Function 00F83CF0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00F83CF0

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 68c85ec3ed84e8b58e246e0b0a7caf10e8f9641c64a98ef3349f9817e7fc51bf
Instruction ID: d67bb06b887adfca2771cf7f93057dd477d56e1b1dfce40a3c9208269f250ad2
Opcode Fuzzy Hash: 68c85ec3ed84e8b58e246e0b0a7caf10e8f9641c64a98ef3349f9817e7fc51bf
Instruction Fuzzy Hash: E8A012302001058F43004F307B0560935D866045803404015A009C6020D7244010A740

Function 00F2D440 Relevance: .7, Instructions: 747COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4514b6f59003d5f28bdb49d91739c27234b8c4444f88b811c9251ad225875717
Instruction ID: 4132e42d902c597504c048133d787d977ba3fa2594828267cb4eb46f8b0ed3b4
Opcode Fuzzy Hash: 4514b6f59003d5f28bdb49d91739c27234b8c4444f88b811c9251ad225875717
Instruction Fuzzy Hash: 0372E474D1425C9FCB08CFA8E5A2AEDBBF1EB4D310F14405AE552BB391CA35A941DF60

Function 00F737B0 Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89f48a2ecc37a1a55422dd6b2cf74bfa73202a51e44869468a06e3d6de9433ff
Instruction ID: 8553ca3dbad714c2ff93c59f6c4a9854798c99d21d22bfc26c4c0d13fde2b6a6
Opcode Fuzzy Hash: 89f48a2ecc37a1a55422dd6b2cf74bfa73202a51e44869468a06e3d6de9433ff
Instruction Fuzzy Hash: 72323762D68F054DD7239638CC22335A299AFB33D4F54D737F81AB4AA6EB29C5C36101

Function 00F817B9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6435e2ef1567dce011b3346103f189082fb5e07727ee6ac46861fffda721387e
Instruction ID: ab69a87b2e2412298f1b7250941497d550c5f391c881c998d062ebba9937da52
Opcode Fuzzy Hash: 6435e2ef1567dce011b3346103f189082fb5e07727ee6ac46861fffda721387e
Instruction Fuzzy Hash: 9C323762E29F054DD723A634CC22376A68CBFB73D4F15C727F815B59A6EB28C4836200

Function 00F38525 Relevance: .5, Instructions: 541COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54d582474d3703aa2b9cb095a5ffb3f188a50b9b9ae1b9387da8497778bac5be
Instruction ID: 88fb55ea986fc835fcd9723d9f618bf0c8d444ed2d064697bbd09a8f916d39c2
Opcode Fuzzy Hash: 54d582474d3703aa2b9cb095a5ffb3f188a50b9b9ae1b9387da8497778bac5be
Instruction Fuzzy Hash: 8252BF76D106199FDB14CFA8C981AAEB7F1FF4C314F5681A9D919AB302C634BA41CF90

Function 00F1C740 Relevance: .5, Instructions: 529COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600ffe6a644816df3f5b02fd1a0af55f0563e47301b2f226d4218cd1730eeb6c
Instruction ID: 6bf68527db4d92c953d1dbb3a6e8a6d636313c7f27d7ad77dc6105d470db131a
Opcode Fuzzy Hash: 600ffe6a644816df3f5b02fd1a0af55f0563e47301b2f226d4218cd1730eeb6c
Instruction Fuzzy Hash: 6E12FA717042118FDB48CF1DDCA574AB7E2EFC4318F0E8178A8498BB62D639DC958B86

Function 00F1D860 Relevance: .5, Instructions: 525COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08110c0e09ea0961ead174aee1735f221b7c8e19c526074062730efb4543f886
Instruction ID: d417ab0b73d6ef2c1b0c551f4cbd6317121ea9b5ab46a7bcefbc90127a067a95
Opcode Fuzzy Hash: 08110c0e09ea0961ead174aee1735f221b7c8e19c526074062730efb4543f886
Instruction Fuzzy Hash: 7F1249727083158BC708CE5DDC91759B7E2BBC8314F09453DA84ADB791EBB8ED498B82

Function 00F2DD89 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd5f119977bc71ebcdbc08e75bbf4eb60e19b83601550ccc189e511a475c391f
Instruction ID: 15d7da2b6b9ec63f29151b96fb9ed27d02ea80b57cbdc093ee319b527e9e705c
Opcode Fuzzy Hash: fd5f119977bc71ebcdbc08e75bbf4eb60e19b83601550ccc189e511a475c391f
Instruction Fuzzy Hash: C202A03280A2B49FDB92EF5EE8405AB73F4FF90355F43892ADD8163241D335EA099794

Function 00F2E85B Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be9403ea74edeab3d3633ed4694c560389695e4a38bf7a31a15e2d782f7856f0
Instruction ID: 4f2c54557ebe139612735deb9588496453a958627bc88da7294efa82c395de22
Opcode Fuzzy Hash: be9403ea74edeab3d3633ed4694c560389695e4a38bf7a31a15e2d782f7856f0
Instruction Fuzzy Hash: 95E11378A100588BC708CF58E5F49BDB7F1FB48315B25418DD486AB392C239AEA5FF60

Function 00F46690 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7aac278608e2e620d68b5247990a14ae7ca2f535a2a58af7a3a15ef63a66d3e
Instruction ID: f1dabbd71dc0d0ae5d86071c02076db3316227c9ec95f8c863aaf5a8a935be4f
Opcode Fuzzy Hash: e7aac278608e2e620d68b5247990a14ae7ca2f535a2a58af7a3a15ef63a66d3e
Instruction Fuzzy Hash: 2581E476B0421A8BD714CF1CC88066A7BA1EFC6354F59863DED46CB345EA30ED09E792

Function 00F63E43 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: aad3b8e0a7d56c0c60adde2f33ccae75f2b8f55ecb01bc18cc40f642e230f4e3
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: F7918473A090A349DB2D423A853413EFFF15A523B171A079EE4F2CB1D5EE25D668F620

Function 00F640FE Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: e4421f11b6e74527a3b94ba061655ee112911b427ec61b0747a9d849ab67cc1b
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 449184735080E34ADB2A567A847403EFFE15A533B131A079DE4F2CB1D1EE14AA64F620

Function 00F63B7C Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 08aec583f301ce9b92f9e45177d4c84cc50a0c4941153065c85b8ab4acff6605
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: F09152736080E34ADB2D4639857443EFFE19A923B131A079EE4F2CA1D5EE249764F620

Function 00F638D2 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 3ce7f0ff0dd60df282e6833a995e5e6c73ff8ed720eaa21a529de9874b98e5ae
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: A58163736090A309DB29867A857503EFFE25A923B131A079DD4F3CB1D5EE24D754FA20

Function 00F2DFAD Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35bd22f95dab943cb3221f365cd1ea733415a38271d1e5144e58f245e77465ab
Instruction ID: 65e0106c358f0fe72088e6905481dff473ae2c7cac02e9d042c383b0edcc75d8
Opcode Fuzzy Hash: 35bd22f95dab943cb3221f365cd1ea733415a38271d1e5144e58f245e77465ab
Instruction Fuzzy Hash: 38A153324192B49FDB52EF6ED8400AB73A5EF94355F43892FDCC167281C235EA08A795

Function 00F38C9F Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b712166386aa8c67017c73479d5a6b6bd2e7c504b4333dc3fcd8a0828dd31965
Instruction ID: f963d90c2d01f3837f7b9967cfc3b0f82d8591d085be97a5fcf86d3093c39faa
Opcode Fuzzy Hash: b712166386aa8c67017c73479d5a6b6bd2e7c504b4333dc3fcd8a0828dd31965
Instruction Fuzzy Hash: 1CC17375900215DFDB28CF98C494ABAB7B1FF4C318F5A81BED90A6F746CA306941CB90

Function 00F15650 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9334b3e7bc1a736629855850d90b8811e2b7170aef3660bb0d10393c6ae5cfae
Instruction ID: efaae857548368c49e952a58454d4f58fbbca2cece5ee0ff0290b14e4daeba63
Opcode Fuzzy Hash: 9334b3e7bc1a736629855850d90b8811e2b7170aef3660bb0d10393c6ae5cfae
Instruction Fuzzy Hash: 28918B31908789CBD710CF3CC5815AAF7E1BFD8358F549B1DE884A7252EB30AA899B41

Function 00F15450 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f41b8eaa5fc1b97b17ffe434c3eafa812a18ee46505a336580da0a0c627981
Instruction ID: 2a4ff29d6bc1d242c62d98faea9f36e8494305f35a600e59f68ddca902463725
Opcode Fuzzy Hash: 38f41b8eaa5fc1b97b17ffe434c3eafa812a18ee46505a336580da0a0c627981
Instruction Fuzzy Hash: 63511932C197598BCB01DF3D9541189F7D2BFE5618F498B1AEC9437212E730B9C89791

Function 00F2D097 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29b2fe6933637f894a9258c1e7d9c3dbcfb3fa006b45260a8c74cd50eb0c7182
Instruction ID: f69c1158c007cdcd592879000eecb2b6f90c18c8efd000f32a2451045a9991fb
Opcode Fuzzy Hash: 29b2fe6933637f894a9258c1e7d9c3dbcfb3fa006b45260a8c74cd50eb0c7182
Instruction Fuzzy Hash: 8B517372D1C4B810EB5D817E48723FDBEF29B85202F0E81FAD9A3A67D9C53953069B50

Function 00F47B50 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f97c9e1be1921e5ccc1fc23a4ce16eea01a05cc2b30bcfb4e6ea31390b1c6659
Instruction ID: 055eeb0b32f89d0864e65b83ce306bf403a89500dcb110ce50e8fc99f195a978
Opcode Fuzzy Hash: f97c9e1be1921e5ccc1fc23a4ce16eea01a05cc2b30bcfb4e6ea31390b1c6659
Instruction Fuzzy Hash: A3619D55C18FDC46E6039B3D88422E6B7A0BFFA259F18D706FDA476132EB21B6C56310

Function 00F2D0A4 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb5b0090faaf4947b7bf5da367f95305e7e9d47dca1f7b2460481acaa68c0d1f
Instruction ID: 5c37e21078391bf43ac1061e147e8722c9bf15fd75fedc64ad3d133bb365dea6
Opcode Fuzzy Hash: eb5b0090faaf4947b7bf5da367f95305e7e9d47dca1f7b2460481acaa68c0d1f
Instruction Fuzzy Hash: 47513171D1C4B814EB5D817E48B22FDBEF29B85202F0E81FAD9A3A67D9C53943069B50

Function 00F39026 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 556c10a076d04ae1265a22236cff2f674a38ef0859a82f9873e5f24db588611f
Instruction ID: 4f92de6e4bbfb57fabf37fe4a2bd740e3ebce401ac3ad2d27988933abbe69d03
Opcode Fuzzy Hash: 556c10a076d04ae1265a22236cff2f674a38ef0859a82f9873e5f24db588611f
Instruction Fuzzy Hash: 18513552648F6991D72A0B3DD4912F3E3D1AFD530AF01C70EEDE565647E732E208B690

Function 00F158F0 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429268e0d945208024015d5d37289875e398da387f10c2fe598760821bc4320b
Instruction ID: cb94ce453dbb4afbab741eba02b6f1b3263b2d0645edfaca3841f49ea79f35b4
Opcode Fuzzy Hash: 429268e0d945208024015d5d37289875e398da387f10c2fe598760821bc4320b
Instruction Fuzzy Hash: A951F132D08B99CBD711CF3CC5866A9B7A1BFE9348F198759D8842B117EB30B6C99340

Function 00F471A0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00422a93a3115c3ec3753f81e67c82a40054737c9f29c4022a5a2a21f98ad80d
Instruction ID: dad72559a9ef46594af336634f41f58eebfb5cbaa8adb0418660f2b9bd012942
Opcode Fuzzy Hash: 00422a93a3115c3ec3753f81e67c82a40054737c9f29c4022a5a2a21f98ad80d
Instruction Fuzzy Hash: C1511375A087018FD365CF28D491A56B7F0BF9D314B148A2EE89AD7610E730F645CF91

Function 00F47DF0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b58a1f775608062c41c78c3328d8d818cf102bd1145a8f44475bb82ac7e761cb
Instruction ID: 2f20d28d705a66922cd6bd2ebe6a8450287d13d23aeccc2f23db321a3084f3ab
Opcode Fuzzy Hash: b58a1f775608062c41c78c3328d8d818cf102bd1145a8f44475bb82ac7e761cb
Instruction Fuzzy Hash: D54160CAC39F9D06E513A73548821C1E690AFFB4AD224E387FC7475672E712B5E52320

Function 00F392B7 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29c9d7e43dfe805d176ee8a0da5108ee633dbb35ea7e4490e5854e383a146dea
Instruction ID: 5c559c23c3daccfcdd06f2303e277c52c94befd362a98d621b121a56d09ff10b
Opcode Fuzzy Hash: 29c9d7e43dfe805d176ee8a0da5108ee633dbb35ea7e4490e5854e383a146dea
Instruction Fuzzy Hash: F6314D67806F5991C717AB3D84072B3E3E2EFD4216F26C74DE9D662306FB35A348A210

Function 00F65170 Relevance: .1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: e20eeb6b8d53f66c7ca2eb0bbcd8b7356e16fe3c4f6cc14936708ffccdf6b773
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: E7112BB7A4198243D614863DC8B47BBA395EBC7B31F3D437AD052AB758D223A945B900

Function 00EE15F0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: __onexit
String ID:
API String ID: 1448380652-0
Opcode ID: 13f965cdc0bcbac755765876b480f2934b218d23c421f9c938d66ec82ded27b5
Instruction ID: fc69a7baad2797581c9d7e40e17a040e4d47e1c42ccab14cd7efa1a1a68b4608
Opcode Fuzzy Hash: 13f965cdc0bcbac755765876b480f2934b218d23c421f9c938d66ec82ded27b5
Instruction Fuzzy Hash: 0CF0E572A885889FD700DB84DE03F45FBA4E704B54F00826DE90587781DB3EA600A697

Function 00EE1590 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: __onexit
String ID:
API String ID: 1448380652-0
Opcode ID: 0d716a9c0cc25a843bdc8e9cba2083313c5c022f41f5f95e023b8e31f6551d0d
Instruction ID: 4684e0b4f64e086a055f4b04c941f1e930113da3c12ddb76a748b203a56afdeb
Opcode Fuzzy Hash: 0d716a9c0cc25a843bdc8e9cba2083313c5c022f41f5f95e023b8e31f6551d0d
Instruction Fuzzy Hash: 68F0E572988648EBD700EF44DD03F59BBA4E704B54F00826DEC1A83781DB3DA600A797

Function 00F692E8 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 155COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getBasicDataType.LIBVCRUNTIME ref: 00F6931F
DName::operator=.LIBVCRUNTIME ref: 00F69330
DName::operator+=.LIBCMT ref: 00F6933E
UnDecorator::getPtrRefType.LIBCMT ref: 00F69370
operator+.LIBVCRUNTIME ref: 00F69391
UnDecorator::getDataIndirectType.LIBVCRUNTIME ref: 00F693EE
UnDecorator::getBasicDataType.LIBVCRUNTIME ref: 00F693F7
UnDecorator::getPtrRefDataType.LIBVCRUNTIME ref: 00F6940F
UnDecorator::getFunctionIndirectType.LIBVCRUNTIME ref: 00F69422
UnDecorator::getScopedName.LIBVCRUNTIME ref: 00F6944B
operator+.LIBVCRUNTIME ref: 00F6946C
DName::DName.LIBVCRUNTIME ref: 00F6947E
DName::operator=.LIBVCRUNTIME ref: 00F694A9
DName::operator+=.LIBCMT ref: 00F694B7

Strings

volatile, xrefs: 00F69328, 00F694A1
std::nullptr_t, xrefs: 00F69479
std::nullptr_t , xrefs: 00F69464

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Decorator::get$Type$Data$BasicIndirectNameName::operator+=Name::operator=operator+$FunctionName::Scoped
String ID: std::nullptr_t$std::nullptr_t $volatile
API String ID: 2882286118-294867888
Opcode ID: 956ac58e244eb2da9e19f38651d78a2d1b7caf74b2443c3dfe7d4b4dd0b182ec
Instruction ID: ab692b1588cfa8866959c5276b34c5ca81dbbf6b240cd7fb492f2e5ebeae1cf4
Opcode Fuzzy Hash: 956ac58e244eb2da9e19f38651d78a2d1b7caf74b2443c3dfe7d4b4dd0b182ec
Instruction Fuzzy Hash: 9351A375808208EECB11DF68CD86DE97FBCEB41714F548155F40997262EBB6DA42FB40

Function 00F4BA60 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00F4BA60

Part of subcall function 00F4BA87: InitializeCriticalSectionAndSpinCount.KERNEL32(00FCB794,00000FA0,F58088C3,?,?,?,?,00F8C8E0,000000FF), ref: 00F4BAB6
Part of subcall function 00F4BA87: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,00F8C8E0,000000FF), ref: 00F4BAC1
Part of subcall function 00F4BA87: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,00F8C8E0,000000FF), ref: 00F4BAD2
Part of subcall function 00F4BA87: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00F4BAE8
Part of subcall function 00F4BA87: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00F4BAF6
Part of subcall function 00F4BA87: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00F4BB04
Part of subcall function 00F4BA87: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00F4BB2F
Part of subcall function 00F4BA87: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00F4BB3A

___scrt_fastfail.LIBCMT ref: 00F4BA81

Part of subcall function 00F4BA41: __onexit.LIBCMT ref: 00F4BA47

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 00F4BABC
InitializeConditionVariable, xrefs: 00F4BAE2
kernel32.dll, xrefs: 00F4BACD
SleepConditionVariableCS, xrefs: 00F4BAEE
WakeAllConditionVariable, xrefs: 00F4BAFC

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: d12dc858e35a71977d16aaca0f1b5e8302f35dc43f3540350185beceea64d42c
Instruction ID: c80195e81beffe68b44ef7a6a5f468cdf8548a528da0d1ece28e727e5c587115
Opcode Fuzzy Hash: d12dc858e35a71977d16aaca0f1b5e8302f35dc43f3540350185beceea64d42c
Instruction Fuzzy Hash: 9D210132A4470AABC3116BB4AD17F5A7B98EF85F61F00052AFD0593295DF78C80077A5

Function 00F75240 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F752B0
_free.LIBCMT ref: 00F752C6
_free.LIBCMT ref: 00F752D7
_free.LIBCMT ref: 00F752E8
_free.LIBCMT ref: 00F752FF
GetCPInfo.KERNEL32(?,?), ref: 00F75347

Part of subcall function 00F810FB: _free.LIBCMT ref: 00F81166

_free.LIBCMT ref: 00F754F3
_free.LIBCMT ref: 00F75506
_free.LIBCMT ref: 00F75514
_free.LIBCMT ref: 00F7551F
_free.LIBCMT ref: 00F75561
_free.LIBCMT ref: 00F75569
_free.LIBCMT ref: 00F75571
_free.LIBCMT ref: 00F75579
_free.LIBCMT ref: 00F75587

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: e7a7ad4b6c02acdec709e8312608ae28fedd5d6b44ac911610ae364b02d16a05
Instruction ID: d99377e69b2f3db66127dc9b420dbc4d684ddd99eb2921b1a0c81529631f7222
Opcode Fuzzy Hash: e7a7ad4b6c02acdec709e8312608ae28fedd5d6b44ac911610ae364b02d16a05
Instruction Fuzzy Hash: C8B1FE71D006059FDB21DF68C881BEEBBF5BF08704F04806EF499A7252D7B5A841EB61

Function 00EF34A0 Relevance: 21.4, APIs: 11, Strings: 1, Instructions: 399COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 00EF3571
_strcspn.LIBCMT ref: 00EF35C1
std::ios_base::getloc.LIBCPMTD ref: 00EF35D6
std::locale::~locale.LIBCPMTD ref: 00EF360A
ctype.LIBCPMTD ref: 00EF3648
std::ios_base::getloc.LIBCPMTD ref: 00EF3657
std::locale::~locale.LIBCPMTD ref: 00EF368E
numpunct.LIBCPMTD ref: 00EF369A
numpunct.LIBCPMTD ref: 00EF36A6
numpunct.LIBCPMTD ref: 00EF36BA
std::ios_base::width.LIBCPMTD ref: 00EF393E

Strings

@, xrefs: 00EF37D3

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: numpunct$_strcspnstd::ios_base::getlocstd::locale::~locale$ctypestd::ios_base::width
String ID: @
API String ID: 4041577309-2766056989
Opcode ID: 42ec44590f8b6bfca1a2f6dc3aac57c60cbf27c9f684802eb12753dc23461ccc
Instruction ID: 88d09c90ee482d832ae5515685922bdb02cc20f004324b790023f4382218656e
Opcode Fuzzy Hash: 42ec44590f8b6bfca1a2f6dc3aac57c60cbf27c9f684802eb12753dc23461ccc
Instruction Fuzzy Hash: 4F024BB190024C9FCB18DFA8C991BEEBBB5BF48304F14815DE519AB295DB34AE45CF90

Function 00F84F11 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00F84F55

Part of subcall function 00F8428D: _free.LIBCMT ref: 00F842AA
Part of subcall function 00F8428D: _free.LIBCMT ref: 00F842BC
Part of subcall function 00F8428D: _free.LIBCMT ref: 00F842CE
Part of subcall function 00F8428D: _free.LIBCMT ref: 00F842E0
Part of subcall function 00F8428D: _free.LIBCMT ref: 00F842F2
Part of subcall function 00F8428D: _free.LIBCMT ref: 00F84304
Part of subcall function 00F8428D: _free.LIBCMT ref: 00F84316
Part of subcall function 00F8428D: _free.LIBCMT ref: 00F84328
Part of subcall function 00F8428D: _free.LIBCMT ref: 00F8433A
Part of subcall function 00F8428D: _free.LIBCMT ref: 00F8434C
Part of subcall function 00F8428D: _free.LIBCMT ref: 00F8435E
Part of subcall function 00F8428D: _free.LIBCMT ref: 00F84370
Part of subcall function 00F8428D: _free.LIBCMT ref: 00F84382

_free.LIBCMT ref: 00F84F4A

Part of subcall function 00F7B207: HeapFree.KERNEL32(00000000,00000000,?,00F84A0A,?,00000000,?,00000000,?,00F84CAE,?,00000007,?,?,00F850A9,?), ref: 00F7B21D
Part of subcall function 00F7B207: GetLastError.KERNEL32(?,?,00F84A0A,?,00000000,?,00000000,?,00F84CAE,?,00000007,?,?,00F850A9,?,?), ref: 00F7B22F

_free.LIBCMT ref: 00F84F6C
_free.LIBCMT ref: 00F84F81
_free.LIBCMT ref: 00F84F8C
_free.LIBCMT ref: 00F84FAE
_free.LIBCMT ref: 00F84FC1
_free.LIBCMT ref: 00F84FCF
_free.LIBCMT ref: 00F84FDA
_free.LIBCMT ref: 00F85012
_free.LIBCMT ref: 00F85019
_free.LIBCMT ref: 00F85036
_free.LIBCMT ref: 00F8504E

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: b45f2d46e7cb9c167aa42e9bb9acee72d62627231ca39cbcb677163810622dd9
Instruction ID: 4c8e993060e63ebd606fa48fc847dcf0f437ec0dd76d3aff16ea32f68d78154c
Opcode Fuzzy Hash: b45f2d46e7cb9c167aa42e9bb9acee72d62627231ca39cbcb677163810622dd9
Instruction Fuzzy Hash: 75316D31A046069FDB21BA78DC45FAA7BE9EF01320F14842AF569D7162DF39BC40EB51

Function 00F84390 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F843D8
_free.LIBCMT ref: 00F843FC
_free.LIBCMT ref: 00F84409
_free.LIBCMT ref: 00F8442E
_free.LIBCMT ref: 00F8443B
_free.LIBCMT ref: 00F84444
_free.LIBCMT ref: 00F84722
_free.LIBCMT ref: 00F8472A

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ee8262b433abc60228f1ab24dbc233c9a5525e1b22ff3d3bc0f308cdaffc2554
Instruction ID: f88e6b6e1fe8edfddf03bb7ffe7af3d67eeee093737cb45fb235a06130fba243
Opcode Fuzzy Hash: ee8262b433abc60228f1ab24dbc233c9a5525e1b22ff3d3bc0f308cdaffc2554
Instruction Fuzzy Hash: 36C12572D40205AFDB20EBA8CC42FEEB7FCAB09710F154165FA44FB282D674A941EB50

Function 00F3F0A0 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 179COMMON

Download Yara Rule

APIs

Part of subcall function 00F3D3E0: ___std_type_info_name.LIBVCRUNTIME ref: 00F3D49E
Part of subcall function 00F3D3E0: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00F3D4D6
Part of subcall function 00F3D3E0: ___std_type_info_name.LIBVCRUNTIME ref: 00F3D509

Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00F3F169
___std_type_info_name.LIBVCRUNTIME ref: 00F3F134

Part of subcall function 00F63085: ___unDName.LIBVCRUNTIME ref: 00F630B1

___std_type_info_name.LIBVCRUNTIME ref: 00F3F19E

Strings

ModPrime2PrivateExponent, xrefs: 00F3F2B0
PrivateExponent, xrefs: 00F3F2E6
MultiplicativeInverseOfPrime2ModPrime1, xrefs: 00F3F295
Prime2, xrefs: 00F3F304
ModPrime1PrivateExponent, xrefs: 00F3F2CB
ThisObject:, xrefs: 00F3F144, 00F3F17B
Prime1, xrefs: 00F3F322

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ___std_type_info_name$Concurrency::task_continuation_context::task_continuation_context$Name___un
String ID: ModPrime1PrivateExponent$ModPrime2PrivateExponent$MultiplicativeInverseOfPrime2ModPrime1$Prime1$Prime2$PrivateExponent$ThisObject:
API String ID: 4072483069-4091968653
Opcode ID: a11a066dc90280b1a9990fac42921e657e18e00310f33bd69f85eb5ae8076a2d
Instruction ID: eeb5c3d33cfb5fc6949ae5c4c8515574916a05bf1d9409e3710dd030ebbf521b
Opcode Fuzzy Hash: a11a066dc90280b1a9990fac42921e657e18e00310f33bd69f85eb5ae8076a2d
Instruction Fuzzy Hash: 4261E170904741ABC711EF34CC06B9BBBF5AF81324F004A29F5955B291EB75E948EB92

Function 00F7359C Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(FC45C6FF,00000000,?,000000FF,00000000,00000000,?,?,?,?,00F094EA,?,00000050,%d-%m-%Y %H:%M:%S,?), ref: 00F735F4
GetLastError.KERNEL32(?,?,?,00F094EA,?,00000050,%d-%m-%Y %H:%M:%S,?,?,?,?,?,?,?,00000080,00000004), ref: 00F73601
__dosmaperr.LIBCMT ref: 00F73608
MultiByteToWideChar.KERNEL32(?,00000000,?,000000FF,00000000,?,?,?,?,?,00F094EA,?,00000050,%d-%m-%Y %H:%M:%S,?), ref: 00F73634
GetLastError.KERNEL32(?,?,?,?,00F094EA,?,00000050,%d-%m-%Y %H:%M:%S,?,?,?,?,?,?,?,00000080), ref: 00F7363E
__dosmaperr.LIBCMT ref: 00F73645
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,?,00000050,00000000,00000000,?,?,?,?,?,?,?,00F094EA), ref: 00F73688
GetLastError.KERNEL32(?,?,?,?,?,?,?,00F094EA,?,00000050,%d-%m-%Y %H:%M:%S,?), ref: 00F73692
__dosmaperr.LIBCMT ref: 00F73699
_free.LIBCMT ref: 00F736A5
_free.LIBCMT ref: 00F736AC

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
String ID:
API String ID: 2441525078-0
Opcode ID: 699da68e42429211ebb43079ffee3331917ed0e4917eb11b2ad7ea9ca059bb90
Instruction ID: c55d98c547fef9d51bedd915a403908545d16b62fc9c8d4c79e3f7ad862dd381
Opcode Fuzzy Hash: 699da68e42429211ebb43079ffee3331917ed0e4917eb11b2ad7ea9ca059bb90
Instruction Fuzzy Hash: EC31917290460ABFDF126FA4CC45DAF3F68EF05720B14811AF85896261DB35CE10FBA2

Function 00EFAFA0 Relevance: 16.2, APIs: 4, Strings: 5, Instructions: 479COMMON

Download Yara Rule

APIs

Part of subcall function 00EE2400: _WChar_traits.LIBCPMTD ref: 00EE244D

__fread_nolock.LIBCMT ref: 00EFB1F3

Part of subcall function 00F6FA12: MoveFileExW.KERNEL32(0000000C,00FC1530,00000002,?,00FC1530,0000000C,00EE3B23,00EF71FE,?,00000001), ref: 00F6FA1F
Part of subcall function 00F6FA12: GetLastError.KERNEL32(?,00FC1530,0000000C,00EE3B23,00EF71FE,?,00000001,?,?,?,?,?,?,?,00EF716A), ref: 00F6FA29
Part of subcall function 00F6FA12: __dosmaperr.LIBCMT ref: 00F6FA30

Part of subcall function 00EE79A0: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00EE79E4

std::ios_base::good.LIBCPMTD ref: 00EFB620
std::bad_exception::~bad_exception.LIBCMTD ref: 00EFB6D1
std::bad_exception::~bad_exception.LIBCMTD ref: 00EFB71C

Strings

r+b, xrefs: 00EFB1A3
, xrefs: 00EFB2A5
.Mail-[, xrefs: 00EFAFF5
]ID-[, xrefs: 00EFB053
].mammn, xrefs: 00EFB0B4

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ProcessorVirtualstd::bad_exception::~bad_exception$Char_traitsConcurrency::ErrorFileLastMoveRootRoot::__dosmaperr__fread_nolockstd::ios_base::good
String ID: $.Mail-[$].mammn$]ID-[$r+b
API String ID: 1605907291-2690886246
Opcode ID: 9c34ba73cb08c9e3e52eb873c883c23fc1f4a66f7180249a3158c1b0c8842dc6
Instruction ID: d12301a33fda6061de5771cd16ccd9e74aecadfe7b543ea75a3b2ed6fc1b0b60
Opcode Fuzzy Hash: 9c34ba73cb08c9e3e52eb873c883c23fc1f4a66f7180249a3158c1b0c8842dc6
Instruction Fuzzy Hash: 76323770D002AC9BDB24DB64CC92BEDB7BAAF55304F1441E9E10977282EB746B88DF51

Function 00EF4B80 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 352COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 00EF4C3B
std::locale::~locale.LIBCPMTD ref: 00EF4C6C
ctype.LIBCPMTD ref: 00EF4CA7
std::ios_base::getloc.LIBCPMTD ref: 00EF4CB6
std::locale::~locale.LIBCPMTD ref: 00EF4CE1
numpunct.LIBCPMTD ref: 00EF4CED
numpunct.LIBCPMTD ref: 00EF4D1B
std::ios_base::width.LIBCPMTD ref: 00EF4F54

Strings

@, xrefs: 00EF4DE9

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: numpunctstd::ios_base::getlocstd::locale::~locale$ctypestd::ios_base::width
String ID: @
API String ID: 2775636304-2766056989
Opcode ID: 8740f7325f40e07777ad4e930ffab986d7f29126788b7d560a97363c1897b952
Instruction ID: 48e8c14be862c79dd4d8d1f0b7c09b7c80d2b0165af988119a6ee0fc3103ed13
Opcode Fuzzy Hash: 8740f7325f40e07777ad4e930ffab986d7f29126788b7d560a97363c1897b952
Instruction Fuzzy Hash: 27E13AB1A0024C9FDB14DF98C991BEEBBF5BF48304F149159F619AB291DB34AE41CB90

Function 00F35120 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 151COMMON

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 00F3524E
std::ios_base::failure::failure.LIBCPMTD ref: 00F3525B
__CxxThrowException@8.LIBVCRUNTIME ref: 00F35269
std::make_error_code.LIBCPMTD ref: 00F35290
std::ios_base::failure::failure.LIBCPMTD ref: 00F3529D
__CxxThrowException@8.LIBVCRUNTIME ref: 00F352AB

Strings

ios_base::badbit set, xrefs: 00F35232, 00F3525A, 00F35273, 00F3529C
ios_base::failbit set, xrefs: 00F3523B, 00F3527D
ios_base::eofbit set, xrefs: 00F35240, 00F35282

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throwstd::ios_base::failure::failurestd::make_error_code
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1223328998-1866435925
Opcode ID: ae363dccd79c3d5332ba2763f5ccaf801ce3e87f1629eb07f0e6e1155b5bd22e
Instruction ID: 7fea9213f35736f18cd7e89892d33ff017c1071c572fb00fda197dc537600a24
Opcode Fuzzy Hash: ae363dccd79c3d5332ba2763f5ccaf801ce3e87f1629eb07f0e6e1155b5bd22e
Instruction Fuzzy Hash: 8B51BF32A006089FDB10DFA5C985F9AB7F4FF44728F188169F9159B292D775ED01DB80

Function 00F34F80 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 141COMMON

Download Yara Rule

APIs

std::make_error_code.LIBCPMTD ref: 00F350BB
std::ios_base::failure::failure.LIBCPMTD ref: 00F350C8
__CxxThrowException@8.LIBVCRUNTIME ref: 00F350D6
std::make_error_code.LIBCPMTD ref: 00F350FD
std::ios_base::failure::failure.LIBCPMTD ref: 00F3510A
__CxxThrowException@8.LIBVCRUNTIME ref: 00F35118

Strings

ios_base::badbit set, xrefs: 00F3509F, 00F350C7, 00F350E0, 00F35109
ios_base::failbit set, xrefs: 00F350A8, 00F350EA
ios_base::eofbit set, xrefs: 00F350AD, 00F350EF

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throwstd::ios_base::failure::failurestd::make_error_code
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1223328998-1866435925
Opcode ID: 1156c5745db4e08d7392fda0e99c4a95b65dcbda21c2800d2deb5da2a48b7aa8
Instruction ID: 8afc702421c308cf5c863f52473dc35acf1cda1dac09ffc2ac86da7a9adbaf10
Opcode Fuzzy Hash: 1156c5745db4e08d7392fda0e99c4a95b65dcbda21c2800d2deb5da2a48b7aa8
Instruction Fuzzy Hash: 0751D072A006099FDB04DF68C981F99B7F4FF44328F188169E916AB692D736E901DBD0

Function 00F61500 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 119threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 00F61519

Part of subcall function 00F61811: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,00F61225), ref: 00F61821

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00F6152E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F6153D
__CxxThrowException@8.LIBVCRUNTIME ref: 00F6154B
Concurrency::details::FreeVirtualProcessorRoot::Affinitize.LIBCONCRT ref: 00F615D0
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F61610
__CxxThrowException@8.LIBVCRUNTIME ref: 00F6161E

Strings

switchState, xrefs: 00F61535
pContext, xrefs: 00F61608

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Concurrency::details::$Exception@8FreeProcessorRoot::ThrowVirtualstd::invalid_argument::invalid_argument$AffinitizeExecutionIdleObjectProxy::ResetSingleSuspendThreadWait
String ID: pContext$switchState
API String ID: 3151764488-2660820399
Opcode ID: 33c26e3314e56f5b75828ca06a0c00fc28053c5c56fd9801f6e482be487bd80b
Instruction ID: 7469a5c6f9678d68bf5f7790bc8c5ee817b1abf4e1a31fec617c63746dde904f
Opcode Fuzzy Hash: 33c26e3314e56f5b75828ca06a0c00fc28053c5c56fd9801f6e482be487bd80b
Instruction Fuzzy Hash: AE31A436E00214AFCF05EF64CD81A6DB7B5BF84720B284469E91397252DB74EE01EB91

Function 00F55FE0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00F56002
GetCurrentProcess.KERNEL32(000000FF,00000000), ref: 00F5600C
DuplicateHandle.KERNEL32(00000000), ref: 00F56013
SafeRWList.LIBCONCRT ref: 00F56032

Part of subcall function 00F53F57: __EH_prolog3.LIBCMT ref: 00F53F5E
Part of subcall function 00F53F57: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00F53F68
Part of subcall function 00F53F57: List.LIBCMT ref: 00F53F72

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F56044
GetLastError.KERNEL32 ref: 00F56053
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00F56069
__CxxThrowException@8.LIBVCRUNTIME ref: 00F56077

Strings

eventObject, xrefs: 00F5603C

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: CurrentListProcess$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateErrorException@8H_prolog3HandleLastLock::_ReaderSafeThrowWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 3870774015-1680012138
Opcode ID: 640de72cb870d970a2c05ed43dd7e8f9735282d51805625bfc1fe97f2b5e76c0
Instruction ID: eedc18993901adebeee54e4bafab3c584f1191ac2874fadcfd5fee554ccdc000
Opcode Fuzzy Hash: 640de72cb870d970a2c05ed43dd7e8f9735282d51805625bfc1fe97f2b5e76c0
Instruction Fuzzy Hash: EA11E571A00209EACB14EBA4DC49FAE77BCAB00712F604526BA16D70E1DF74DA08E761

Function 00F7AF61 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F7AF75

Part of subcall function 00F7B207: HeapFree.KERNEL32(00000000,00000000,?,00F84A0A,?,00000000,?,00000000,?,00F84CAE,?,00000007,?,?,00F850A9,?), ref: 00F7B21D
Part of subcall function 00F7B207: GetLastError.KERNEL32(?,?,00F84A0A,?,00000000,?,00000000,?,00F84CAE,?,00000007,?,?,00F850A9,?,?), ref: 00F7B22F

_free.LIBCMT ref: 00F7AF81
_free.LIBCMT ref: 00F7AF8C
_free.LIBCMT ref: 00F7AF97
_free.LIBCMT ref: 00F7AFA2
_free.LIBCMT ref: 00F7AFAD
_free.LIBCMT ref: 00F7AFB8
_free.LIBCMT ref: 00F7AFC3
_free.LIBCMT ref: 00F7AFCE
_free.LIBCMT ref: 00F7AFDC

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 047dc0d91a7a821d29bb2f763931ded3b869a5130b3b840266d232201bbb07af
Instruction ID: 23029da6400dbab680acd86582abd87fa902a79a47bc8fd51462b41c72aa93f6
Opcode Fuzzy Hash: 047dc0d91a7a821d29bb2f763931ded3b869a5130b3b840266d232201bbb07af
Instruction Fuzzy Hash: BA119675501148EFCB06EF94CC42DED3B65EF05354B4180A6F91C8B532DB35EA50EB82

Function 00F47330 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 131COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00F4736A
GetLastError.KERNEL32(0000000A), ref: 00F47395
__CxxThrowException@8.LIBVCRUNTIME ref: 00F473D6

Strings

Timer: QueryPerformanceCounter failed with error , xrefs: 00F473B0
Timer: QueryPerformanceFrequency failed with error , xrefs: 00F4749B

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: CounterErrorException@8LastPerformanceQueryThrow
String ID: Timer: QueryPerformanceCounter failed with error $Timer: QueryPerformanceFrequency failed with error
API String ID: 651023626-2136607233
Opcode ID: 053398f018e0d308ea99bdd31423beab52019b3bb519179eac163cee23833610
Instruction ID: a83a384fb2849cb62905dc708d56421858e94533bcc8584adae3424b384e4a30
Opcode Fuzzy Hash: 053398f018e0d308ea99bdd31423beab52019b3bb519179eac163cee23833610
Instruction Fuzzy Hash: AA415CB5E4430CEFDB10EFA4DD46F9EBBB8FB08710F104219E915A7292DB74A504AB91

Function 00F67018 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBVCRUNTIME ref: 00F67038

Part of subcall function 00F66F22: Replicator::operator[].LIBVCRUNTIME ref: 00F66F8E
Part of subcall function 00F66F22: DName::operator+=.LIBVCRUNTIME ref: 00F66F96

DName::operator+.LIBCMT ref: 00F6708F
DName::DName.LIBVCRUNTIME ref: 00F670D8

Strings

..., xrefs: 00F670BB
<ellipsis>, xrefs: 00F670C2, 00F670C7
,<ellipsis>, xrefs: 00F67083, 00F67088
,..., xrefs: 00F6707C
void, xrefs: 00F670D0

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 834187326-2211150622
Opcode ID: 2780f7c22ec22603358b350d4f85f02558ae0cad97ae30689c318001ce4725c1
Instruction ID: a589a1ec2d3bea2a633869ee8fd7b7e4018e65ff16bec80baa1c21a6a0f6be92
Opcode Fuzzy Hash: 2780f7c22ec22603358b350d4f85f02558ae0cad97ae30689c318001ce4725c1
Instruction Fuzzy Hash: 41218EB8A0420CAFCB04DF1CD992FA57BE4EB46369F104154E845DB262CB75E941BB60

Function 00F67293 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBVCRUNTIME ref: 00F6729B
DName::DName.LIBVCRUNTIME ref: 00F672A5

Part of subcall function 00F65BBD: DName::doPchar.LIBVCRUNTIME ref: 00F65BE4

UnDecorator::getScopedName.LIBVCRUNTIME ref: 00F672E4
DName::operator+=.LIBVCRUNTIME ref: 00F672EE
DName::operator+=.LIBCMT ref: 00F672FD
DName::operator+=.LIBCMT ref: 00F67309
DName::operator+=.LIBCMT ref: 00F67316

Strings

void, xrefs: 00F672F5

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID: void
API String ID: 1480779885-3531332078
Opcode ID: 5274a4b219e82467679c632205aa18c17736c2d6b45adce2e52ccbcb68eb6081
Instruction ID: d126a19ad5a154a35efa7ccf45b8d2dd8d8b8beb762766e9efd3777276dd3761
Opcode Fuzzy Hash: 5274a4b219e82467679c632205aa18c17736c2d6b45adce2e52ccbcb68eb6081
Instruction Fuzzy Hash: 7D118271904208AEDB09FF64C996BAD7B74AB51714F104098E4029B392CB74EA45FB50

Function 00F8392C Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00F83953
_free.LIBCMT ref: 00F839BE
_free.LIBCMT ref: 00F839E4
_free.LIBCMT ref: 00F83A0D
_free.LIBCMT ref: 00F83A45
_free.LIBCMT ref: 00F83A76
_free.LIBCMT ref: 00F83AB7
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 00F83B38
_free.LIBCMT ref: 00F83B51

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: b9291dfa881c83fd8a72de5bc0cc1fdd0af2402b93aa282e3fc90329145ba52f
Instruction ID: 11dce6bccca458fa043ba26bf2ef1ca3a8ff87166bd516462260565fcfa285fa
Opcode Fuzzy Hash: b9291dfa881c83fd8a72de5bc0cc1fdd0af2402b93aa282e3fc90329145ba52f
Instruction Fuzzy Hash: F2613771D04314AFDB25BFB48C42BBD7BA5AF02B30F04416EE989972A1D7798A04F791

Function 00F18F70 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F19118
__CxxThrowException@8.LIBVCRUNTIME ref: 00F1914D
__CxxThrowException@8.LIBVCRUNTIME ref: 00F1917D

Strings

ProcessData, xrefs: 00F1912F
: message length exceeds maximum, xrefs: 00F190E9
setting key and IV, xrefs: 00F1912A
ProcessData was called after footer input has started, xrefs: 00F1915F

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: : message length exceeds maximum$ProcessData$ProcessData was called after footer input has started$setting key and IV
API String ID: 2005118841-3396553112
Opcode ID: d995d239fba6a3ff2269897068b62b29775b9ead918db00380cc113c83e1b4f1
Instruction ID: eef1c6d15130728eedb6c419851c3f272fcc09e8b1330a83d2d7549bb3fd308a
Opcode Fuzzy Hash: d995d239fba6a3ff2269897068b62b29775b9ead918db00380cc113c83e1b4f1
Instruction Fuzzy Hash: CA618B75A0024AEFCB14DFA4C985EEEB7B8FF48304F004119E90A97352DB74AA59DF90

Function 00F0C770 Relevance: 12.4, APIs: 8, Instructions: 388COMMON

Download Yara Rule

APIs

Part of subcall function 00F05360: std::_Lockit::_Lockit.LIBCPMT ref: 00F0538D
Part of subcall function 00F05360: std::locale::_Getfacet.LIBCPMTD ref: 00F053B5
Part of subcall function 00F05360: std::_Lockit::~_Lockit.LIBCPMT ref: 00F0547D

numpunct.LIBCPMTD ref: 00F0C7B2
numpunct.LIBCPMTD ref: 00F0C7D3
ctype.LIBCPMTD ref: 00F0C82E
operator!=.LIBCPMTD ref: 00F0C841
operator!=.LIBCPMTD ref: 00F0C928
operator!=.LIBCPMTD ref: 00F0C96F
operator!=.LIBCPMTD ref: 00F0CA6D
_Find_elem.LIBCPMTD ref: 00F0CA90

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: operator!=$Lockitnumpunctstd::_$Find_elemGetfacetLockit::_Lockit::~_ctypestd::locale::_
String ID:
API String ID: 191028527-0
Opcode ID: ce411b3ad4f1014168736cd594f2e89d0f6c02e192086e46f23d4ea003de5ce8
Instruction ID: 55d0bfc0116955581edf59dfecea35467834252138f78de123687b06839df88c
Opcode Fuzzy Hash: ce411b3ad4f1014168736cd594f2e89d0f6c02e192086e46f23d4ea003de5ce8
Instruction Fuzzy Hash: 94F18F71E042988FDF18DFA8C8917EEBBB1AF51304F24825DE45A6B2C2DB355D44EB90

Function 00F09F0A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 137COMMON

Download Yara Rule

APIs

operator!=.LIBCPMTD ref: 00F09F6E
operator!=.LIBCPMTD ref: 00F09F8D
operator!=.LIBCPMTD ref: 00F09FAC

Part of subcall function 00F01E10: char_traits.LIBCPMTD ref: 00F01E5D

Part of subcall function 00F0F5A0: Concurrency::details::ScheduleGroupSegmentBase::HasUnrealizedChores.LIBCMTD ref: 00F0F5D8

std::bad_exception::~bad_exception.LIBCMTD ref: 00F0A367
std::bad_exception::~bad_exception.LIBCMTD ref: 00F0A41B
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F0A439
_Smanip.LIBCPMTD ref: 00F0A870
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F0A8E7

Strings

C:\, xrefs: 00F09F81
RSADecryptKey\KEY.DAT, xrefs: 00F0A081
I:\, xrefs: 00F09FA0
\RSADecryptKey\KEY.DAT, xrefs: 00F09FC3

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: operator!=$Container_base12Container_base12::~_std::_std::bad_exception::~bad_exception$Base::ChoresConcurrency::details::GroupScheduleSegmentSmanipUnrealizedchar_traits
String ID: C:\$I:\$RSADecryptKey\KEY.DAT$\RSADecryptKey\KEY.DAT
API String ID: 1183160274-233014975
Opcode ID: 4bb4d359132cca42e4f0a30e5319732fcd5e96eecf5d46cf6da61123317658f6
Instruction ID: 076dbec5ef46ff35790eb4fa32488a186212e714bb686c15ea63f38f80afcb0c
Opcode Fuzzy Hash: 4bb4d359132cca42e4f0a30e5319732fcd5e96eecf5d46cf6da61123317658f6
Instruction Fuzzy Hash: 19518271D042AC9ADB25DB64CC41BEEB7B46F25300F0441EDE24976182EBB45F88EF52

Function 00EE6080 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EE60AD

Part of subcall function 00EED050: std::_Lockit::_Lockit.LIBCPMT ref: 00EED070
Part of subcall function 00EED050: std::_Lockit::~_Lockit.LIBCPMT ref: 00EED09A

std::locale::_Getfacet.LIBCPMTD ref: 00EE60D5
std::bad_alloc::bad_alloc.LIBCMTD ref: 00EE6110
__CxxThrowException@8.LIBVCRUNTIME ref: 00EE611E
std::_Lockit::~_Lockit.LIBCPMT ref: 00EE619D

Strings

hdz, xrefs: 00EE60B9, 00EE616E

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8GetfacetThrowstd::bad_alloc::bad_allocstd::locale::_
String ID: hdz
API String ID: 3299565587-147092747
Opcode ID: bfc89c20c627e6612c08bee4754cf96c75a27065186c2294d6a359324f926e97
Instruction ID: 08b6e7553b23e52b8742176e0794fc8e0dd8accfda5fe714791d785b5bbb494f
Opcode Fuzzy Hash: bfc89c20c627e6612c08bee4754cf96c75a27065186c2294d6a359324f926e97
Instruction Fuzzy Hash: D7410974D0024DDFCB04DFA5C992AEEB7B0AF58710F108169E92677291DB346A05DBA1

Function 00F65797 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 00F657EA
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00F65803
FindVITargetTypeInstance.LIBVCRUNTIME ref: 00F6580A
PMDtoOffset.LIBCMT ref: 00F65829

Strings

Bad dynamic_cast!, xrefs: 00F6586B

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: e7015350a906b62f4f92f39d706a04f9666d3ecf506acfaf8e4680fb211b1a36
Instruction ID: ce0504bae7c151a4a900ae9448d7e10a50ddd30e67fe7cb114869a200d23cab7
Opcode Fuzzy Hash: e7015350a906b62f4f92f39d706a04f9666d3ecf506acfaf8e4680fb211b1a36
Instruction Fuzzy Hash: 9C21F672A00A05EFCB14DFB8CD46AAE77B5EB85F20F108219F911B7681DB35E901B791

Function 00F13A40 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F13BE3
__CxxThrowException@8.LIBVCRUNTIME ref: 00F13C23
__CxxThrowException@8.LIBVCRUNTIME ref: 00F13DC1

Strings

PK_DefaultDecryptionFilter: ciphertext too long, xrefs: 00F13BBA
: invalid ciphertext, xrefs: 00F13BF7
PK_DefaultEncryptionFilter: plaintext too long, xrefs: 00F13D98

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: : invalid ciphertext$PK_DefaultDecryptionFilter: ciphertext too long$PK_DefaultEncryptionFilter: plaintext too long
API String ID: 2005118841-2902848663
Opcode ID: 47de1b85cc260bbabd7044810928952c9618b8429f202965633689a4f7089a46
Instruction ID: 7935eed357649264eefcb47d20440bc27875f749425b0bbce785df568a84a3a0
Opcode Fuzzy Hash: 47de1b85cc260bbabd7044810928952c9618b8429f202965633689a4f7089a46
Instruction Fuzzy Hash: 7DB19F71A007099FCB24DFA5C885BEABBF5FF48710F10452CE446A7291EB75EA48EB50

Function 00F8AC0B Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(0079FE38,0079FE38,?,7FFFFFFF,?,?,00F8AEE4,0079FE38,0079FE38,?,0079FE38,?,?,?,?,0079FE38), ref: 00F8ACB7
MultiByteToWideChar.KERNEL32(0079FE38,00000009,0079FE38,0079FE38,00000000,00000000,?,00F8AEE4,0079FE38,0079FE38,?,0079FE38,?,?,?,?), ref: 00F8AD3A
MultiByteToWideChar.KERNEL32(0079FE38,00000001,0079FE38,0079FE38,00000000,00F8AEE4,?,00F8AEE4,0079FE38,0079FE38,?,0079FE38,?,?,?,?), ref: 00F8ADCD
MultiByteToWideChar.KERNEL32(0079FE38,00000009,0079FE38,0079FE38,00000000,00000000,?,00F8AEE4,0079FE38,0079FE38,?,0079FE38,?,?,?,?), ref: 00F8ADE4

Part of subcall function 00F7F17C: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00F8172E,?,00000000,?,00F83CCB,?,00000004,00000000,?,?,?,00F7817F), ref: 00F7F1AE

MultiByteToWideChar.KERNEL32(0079FE38,00000001,0079FE38,0079FE38,00000000,0079FE38,?,00F8AEE4,0079FE38,0079FE38,?,0079FE38,?,?,?,?), ref: 00F8AE60
__freea.LIBCMT ref: 00F8AE8B
__freea.LIBCMT ref: 00F8AE97

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: 9c14a724a1eaedfade402e3a946c59fb5f7849d62605193c4398f52e948aff10
Instruction ID: 71b8a6cd432e3caa080f49ff18e4b2870ffcb842bf2e2d55c5278070002e0c00
Opcode Fuzzy Hash: 9c14a724a1eaedfade402e3a946c59fb5f7849d62605193c4398f52e948aff10
Instruction Fuzzy Hash: 2491C472E002169BEB21AF65CC85EEE7BB5EF09720F18455BE905E7140E735DC40E7A2

Function 00F0F090 Relevance: 10.7, APIs: 7, Instructions: 213COMMON

Download Yara Rule

APIs

std::locale::~locale.LIBCPMTD ref: 00F0F11F
numpunct.LIBCPMTD ref: 00F0F141
numpunct.LIBCPMTD ref: 00F0F182
std::ios_base::getloc.LIBCPMTD ref: 00F0F0EE

Part of subcall function 00EF9450: std::locale::locale.LIBCPMTD ref: 00EF946A

Part of subcall function 00F05360: std::_Lockit::_Lockit.LIBCPMT ref: 00F0538D
Part of subcall function 00F05360: std::locale::_Getfacet.LIBCPMTD ref: 00F053B5
Part of subcall function 00F05360: std::_Lockit::~_Lockit.LIBCPMT ref: 00F0547D

std::ios_base::getloc.LIBCPMTD ref: 00F0F218
std::locale::~locale.LIBCPMTD ref: 00F0F280
__Stolx.LIBCPMT ref: 00F0F2BA

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Lockitnumpunctstd::_std::ios_base::getlocstd::locale::~locale$GetfacetLockit::_Lockit::~_Stolxstd::locale::_std::locale::locale
String ID:
API String ID: 1366767378-0
Opcode ID: ac66ebb127095592acf906f0744484a80913895691ccef15e4238df43144a2ef
Instruction ID: 57c8f1af707d6675e62c8859360de00baf7a3c22fd9311d4059f9b2dc7c4aff5
Opcode Fuzzy Hash: ac66ebb127095592acf906f0744484a80913895691ccef15e4238df43144a2ef
Instruction Fuzzy Hash: 84A14A75D0024CDFDB14DFA4C851BEDB7B5BF48300F1082A9E419AB291DB749A49DF50

Function 00F847C0 Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F8482F
_free.LIBCMT ref: 00F8483D
_free.LIBCMT ref: 00F8496B
_free.LIBCMT ref: 00F84976

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 8eb1747bb527e7d4c11f302cbb4c0a5fe2dc181c6b7d6ecb7575a893add6ad3b
Instruction ID: 24ecbfd5ae1bf3c2a2b92d2caa20ceeaecf5dd59d2f6254415b43a3ec11ff8e1
Opcode Fuzzy Hash: 8eb1747bb527e7d4c11f302cbb4c0a5fe2dc181c6b7d6ecb7575a893add6ad3b
Instruction Fuzzy Hash: 2861A571D04246AFDB20EF68CC42BEEBBF4EB45720F14416AE954EB292D770AD41EB50

Function 00EF8420 Relevance: 10.7, APIs: 7, Instructions: 195COMMON

Download Yara Rule

APIs

std::ios_base::getloc.LIBCPMTD ref: 00EF84AC
std::locale::~locale.LIBCPMTD ref: 00EF84DA
numpunct.LIBCPMTD ref: 00EF8500
shared_ptr.LIBCMTD ref: 00EF850F

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: numpunctshared_ptrstd::ios_base::getlocstd::locale::~locale
String ID:
API String ID: 165846242-0
Opcode ID: 21327866bdf8762b5545b888c14107243b67232101f0af7a3f71f524666f0062
Instruction ID: 013f68ed90796c8fe73bf1f2a1baca584352dfe0b20a87322857f9d9e2172f5d
Opcode Fuzzy Hash: 21327866bdf8762b5545b888c14107243b67232101f0af7a3f71f524666f0062
Instruction Fuzzy Hash: 4981D9B290014CAFCB14DFA8D991AEEBBF5BF48310F109119F619BB291DB34A945DF90

Function 00EFDC10 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 00EFDC35
_WChar_traits.LIBCPMTD ref: 00EFDC48

Strings

, xrefs: 00EFDD10

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Char_traitschar_traits
String ID:
API String ID: 2830450730-3916222277
Opcode ID: f11d6f0433731a0e21d6a43da585f852be890614ea2d6469c41e0bef5b14cbf1
Instruction ID: 19d7284a70fe0f31f03fd4d37f4cca1893f648ee541c6f5602848ae9a6466f10
Opcode Fuzzy Hash: f11d6f0433731a0e21d6a43da585f852be890614ea2d6469c41e0bef5b14cbf1
Instruction Fuzzy Hash: 4A515C75D1410CABCF14EFE4E8919FEBBBAAF58304F106119F601BB251EB329984CB91

Function 00F7D758 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00F6DF7D,E0830C40,?,?,?,?,?,?,00F7DECD,00F49005,00F6DF7D,?,00F6DF7D,00F6DF7D,00F49005), ref: 00F7D79A
__fassign.LIBCMT ref: 00F7D815
__fassign.LIBCMT ref: 00F7D830
WideCharToMultiByte.KERNEL32(?,00000000,00F6DF7D,00000001,?,00000005,00000000,00000000), ref: 00F7D856
WriteFile.KERNEL32(?,?,00000000,00F7DECD,00000000,?,?,?,?,?,?,?,?,?,00F7DECD,00F49005), ref: 00F7D875
WriteFile.KERNEL32(?,00F49005,00000001,00F7DECD,00000000,?,?,?,?,?,?,?,?,?,00F7DECD,00F49005), ref: 00F7D8AE

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 0a9c49ff2270c9c8c0d04a8fa38efef5bf8126f02a7473372f0560368649e69a
Instruction ID: 59d2b3d0aa1d663310d6dc8e8e24e3305f4801d21beb75b6650d20f3b1aeedb3
Opcode Fuzzy Hash: 0a9c49ff2270c9c8c0d04a8fa38efef5bf8126f02a7473372f0560368649e69a
Instruction Fuzzy Hash: C35191B1E002499FDB10CFA8DC85BEEBBB4EF09310F14815BE959E7291D7709941DB62

Function 00F3F370 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 110COMMON

Download Yara Rule

APIs

Part of subcall function 00F3D5D0: ___std_type_info_name.LIBVCRUNTIME ref: 00F3D68E
Part of subcall function 00F3D5D0: Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00F3D6C6
Part of subcall function 00F3D5D0: ___std_type_info_name.LIBVCRUNTIME ref: 00F3D6F9

Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00F3F3F6
___std_type_info_name.LIBVCRUNTIME ref: 00F3F3C1

Part of subcall function 00F63085: ___unDName.LIBVCRUNTIME ref: 00F630B1

___std_type_info_name.LIBVCRUNTIME ref: 00F3F427

Strings

ThisObject:, xrefs: 00F3F3D1, 00F3F408
Modulus, xrefs: 00F3F4C0
PublicExponent, xrefs: 00F3F4A5

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ___std_type_info_name$Concurrency::task_continuation_context::task_continuation_context$Name___un
String ID: Modulus$PublicExponent$ThisObject:
API String ID: 4072483069-1616987064
Opcode ID: d6769db00089783ca0e184b766f653f9934e049329d154dcc31fd8868cecbebc
Instruction ID: 6e121dc01232adf097a0826854b5a1ed4d5681f02b8ad2f754a6de928be12cb1
Opcode Fuzzy Hash: d6769db00089783ca0e184b766f653f9934e049329d154dcc31fd8868cecbebc
Instruction Fuzzy Hash: 0D411731908341ABCB11AF34CC42B5BBBE1AF95328F04465DF88867292D776D90CD792

Function 00F8A611 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4aa2c89b414b7d394b39b2ea7876dd58bbb5410bdabc0c151eb61f4278b9735
Instruction ID: 98990461362da5a7986cd5a737ebf80123dd9767164e79773e9a4c7816b4d556
Opcode Fuzzy Hash: e4aa2c89b414b7d394b39b2ea7876dd58bbb5410bdabc0c151eb61f4278b9735
Instruction Fuzzy Hash: B711E732905215AFFB213F769C08EBF3B58EF86B70B144526F895D7161EA39C800B7A1

Function 00F06950 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

std::_Cnd_initX.LIBCPMTD ref: 00F06982

Part of subcall function 00F0B070: __Cnd_init.LIBCPMT ref: 00F0B077
Part of subcall function 00F0B070: std::_Check_C_return.LIBCPMTD ref: 00F0B080

std::_Auto_cnd::_Auto_cnd.LIBCPMTD ref: 00F0699E
std::_Cnd_waitX.LIBCPMTD ref: 00F069B3

Part of subcall function 00F0D500: __Mtx_init.LIBCPMT ref: 00F0D50B
Part of subcall function 00F0D500: std::_Check_C_return.LIBCPMTD ref: 00F0D514

std::_Auto_cnd::_Auto_cnd.LIBCPMTD ref: 00F069CF
std::_Cnd_initX.LIBCPMTD ref: 00F069E6

Part of subcall function 00EF5220: std::_Check_C_return.LIBCPMTD ref: 00EF5230

std::_Auto_cnd::~_Auto_cnd.LIBCPMTD ref: 00F06A05
std::_Auto_cnd::~_Auto_cnd.LIBCPMTD ref: 00F06A14

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: std::_$Auto_cnd$C_returnCheck_Cnd_init$Auto_cnd::_Auto_cnd::~_$Cnd_waitMtx_init
String ID:
API String ID: 1028754979-0
Opcode ID: 5be14acc1dfa84908394117006446101ed6285e0bb48df3f8d38605524a69443
Instruction ID: 312e0c0a88b01f76249049f7925481245485295ffd9e993697a3ff596cbb31d7
Opcode Fuzzy Hash: 5be14acc1dfa84908394117006446101ed6285e0bb48df3f8d38605524a69443
Instruction Fuzzy Hash: 7D216075D001089BDB04EB98CD42BEEB7F4AF18704F5441A8E902772D2DB39AE05DBA0

Function 00F84C95 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F849DC: _free.LIBCMT ref: 00F84A05

_free.LIBCMT ref: 00F84CE3

Part of subcall function 00F7B207: HeapFree.KERNEL32(00000000,00000000,?,00F84A0A,?,00000000,?,00000000,?,00F84CAE,?,00000007,?,?,00F850A9,?), ref: 00F7B21D
Part of subcall function 00F7B207: GetLastError.KERNEL32(?,?,00F84A0A,?,00000000,?,00000000,?,00F84CAE,?,00000007,?,?,00F850A9,?,?), ref: 00F7B22F

_free.LIBCMT ref: 00F84CEE
_free.LIBCMT ref: 00F84CF9
_free.LIBCMT ref: 00F84D4D
_free.LIBCMT ref: 00F84D58
_free.LIBCMT ref: 00F84D63
_free.LIBCMT ref: 00F84D6E

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 799c8d95349627b7683f864eafde8b1f1602b40e217374dd2b23754633b6644b
Instruction ID: 229d639d8daeeb9015dd3469f6fe4a38e43cb10265958501d2829df694368a4d
Opcode Fuzzy Hash: 799c8d95349627b7683f864eafde8b1f1602b40e217374dd2b23754633b6644b
Instruction Fuzzy Hash: 78115E71941B04AAD631BBB0CC07FDB7B9CAF01750F404916F2ADA6063DB7DB524A791

Function 00F4EADF Relevance: 10.6, APIs: 7, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,00F4D153,?,?,?,00000000), ref: 00F4EAED
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,00F4D153,?,?,?,00000000), ref: 00F4EAF3
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,00F4D153,?,?,?,00000000), ref: 00F4EB20
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,00F4D153,?,?,?,00000000), ref: 00F4EB2A
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,00F4D153,?,?,?,00000000), ref: 00F4EB3C
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00F4EB52
__CxxThrowException@8.LIBVCRUNTIME ref: 00F4EB60

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID:
API String ID: 4227777306-0
Opcode ID: cd807b299af7c8b04f526cf661885ef6f70c6e086c468b8297d3e3d367f86d97
Instruction ID: 9e57e4eb9c6b16c1ae6754a4b7d133433ba721b70deb10164b39bff631844415
Opcode Fuzzy Hash: cd807b299af7c8b04f526cf661885ef6f70c6e086c468b8297d3e3d367f86d97
Instruction Fuzzy Hash: 55016731A00115A7C721BB65ED1AFAF7F78FF80B61B504416F906D6061DB74E904B7A1

Function 00F79468 Relevance: 9.3, APIs: 6, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F7B055: GetLastError.KERNEL32(?,00000000,00F751CC,?,?,00F48334,00000000,?,?,?,00FBFD70,?,?,?,?,string too long), ref: 00F7B059
Part of subcall function 00F7B055: _free.LIBCMT ref: 00F7B08C
Part of subcall function 00F7B055: SetLastError.KERNEL32(00000000,?,00FBFD70,?,?,?,?,string too long,?,00EE4385,?,?,?,00EF6AED,ij,?), ref: 00F7B0CD
Part of subcall function 00F7B055: _abort.LIBCMT ref: 00F7B0D3

_memcmp.LIBVCRUNTIME ref: 00F79712
_free.LIBCMT ref: 00F79783
_free.LIBCMT ref: 00F7979C
_free.LIBCMT ref: 00F797CE
_free.LIBCMT ref: 00F797D7
_free.LIBCMT ref: 00F797E3

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID:
API String ID: 1679612858-0
Opcode ID: 8320933e67dd0fb92c4abeb224ef352cbfb9a59eab5d537130e193f61f1e4bb4
Instruction ID: 2fc001aea5056f0651d7d25f6c80b9b8e5fb8a5289361e0fd068b0e2c6583206
Opcode Fuzzy Hash: 8320933e67dd0fb92c4abeb224ef352cbfb9a59eab5d537130e193f61f1e4bb4
Instruction Fuzzy Hash: 36B148759052299FDB24DF18C885BADB7B4FF09314F5485AAE80DA7360E770AE80DF41

Function 00F80C3D Relevance: 9.2, APIs: 6, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00F6F450,00F6F450,?,?,?,00F80E8E,00000001,00000001,0EE85006), ref: 00F80C97
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00F80E8E,00000001,00000001,0EE85006,?,?,?), ref: 00F80D1D
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,0EE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00F80E17
__freea.LIBCMT ref: 00F80E24

Part of subcall function 00F7F17C: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00F8172E,?,00000000,?,00F83CCB,?,00000004,00000000,?,?,?,00F7817F), ref: 00F7F1AE

__freea.LIBCMT ref: 00F80E2D
__freea.LIBCMT ref: 00F80E52

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 56ca9662f086f075c1f457d4d80a3908a578089a1c64e03b77e5b40dfdb6f05c
Instruction ID: 34c2fae86d2bdbb21fa86efa41b78290cb0a294f4f67e9709d22e1d57f3fc730
Opcode Fuzzy Hash: 56ca9662f086f075c1f457d4d80a3908a578089a1c64e03b77e5b40dfdb6f05c
Instruction Fuzzy Hash: 9151D572A00216AFEB65AF64CC81EFF7BA9EB44760F554629FD04D6140EF34DC44A790

Function 00F45300 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 439COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F45627

Strings

Max, xrefs: 00F45533
RandomNumberType, xrefs: 00F4549E
Min, xrefs: 00F45543
invalid bit length, xrefs: 00F455FE

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: Max$Min$RandomNumberType$invalid bit length
API String ID: 2005118841-2498579642
Opcode ID: f846b4c6e622047e476bd76161bd2ad12fe093f5a536b1d229c2e240f47bbf58
Instruction ID: 3138ffc8c7dd477d3038e3bd50466a89b8b9094a8d753374bb29332d1583775b
Opcode Fuzzy Hash: f846b4c6e622047e476bd76161bd2ad12fe093f5a536b1d229c2e240f47bbf58
Instruction Fuzzy Hash: 0602B171D0164CEFDF04DFA4C841BDEBBB5AF58314F148169F805A7242DB789A48EBA2

Function 00EF32F0 Relevance: 9.1, APIs: 6, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d20e6a5bbf805484a9c6a14a0f02e87289d634b1221e28b0fd8ed1872c607dd
Instruction ID: 5dc20601e5c8beed887f6c3cf33c2c6eb895f335e834c0d2063893c62170f084
Opcode Fuzzy Hash: 3d20e6a5bbf805484a9c6a14a0f02e87289d634b1221e28b0fd8ed1872c607dd
Instruction Fuzzy Hash: 2741A47020412C67DB29DF1DD495A7D37E2EBC5348F00E028FAA9EF2C6DA34DA4193A4

Function 00F05220 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F0524D

Part of subcall function 00EED050: std::_Lockit::_Lockit.LIBCPMT ref: 00EED070
Part of subcall function 00EED050: std::_Lockit::~_Lockit.LIBCPMT ref: 00EED09A

std::locale::_Getfacet.LIBCPMTD ref: 00F05275
std::bad_alloc::bad_alloc.LIBCMTD ref: 00F052B0
__CxxThrowException@8.LIBVCRUNTIME ref: 00F052BE
std::_Lockit::~_Lockit.LIBCPMT ref: 00F0533D

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8GetfacetThrowstd::bad_alloc::bad_allocstd::locale::_
String ID:
API String ID: 3299565587-0
Opcode ID: 1387cc3cd76751ae5fbed02c264822ba57b44686ae21cea99bd5fd0714185fb7
Instruction ID: 7bf206538dd8e9659a0eeba5a6569d5ffddf83f49da6472c11025d5f2180164e
Opcode Fuzzy Hash: 1387cc3cd76751ae5fbed02c264822ba57b44686ae21cea99bd5fd0714185fb7
Instruction Fuzzy Hash: 04412970D0060DDFCB04DFA4D991AEEB7B0BF48710F104269E92277291DB746A05DFA1

Function 00F05360 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F0538D

Part of subcall function 00EED050: std::_Lockit::_Lockit.LIBCPMT ref: 00EED070
Part of subcall function 00EED050: std::_Lockit::~_Lockit.LIBCPMT ref: 00EED09A

std::locale::_Getfacet.LIBCPMTD ref: 00F053B5
std::bad_alloc::bad_alloc.LIBCMTD ref: 00F053F0
__CxxThrowException@8.LIBVCRUNTIME ref: 00F053FE
std::_Lockit::~_Lockit.LIBCPMT ref: 00F0547D

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8GetfacetThrowstd::bad_alloc::bad_allocstd::locale::_
String ID:
API String ID: 3299565587-0
Opcode ID: babfb94a8590e4c6773d500200312ba6449758699ed02bdf99f8e35a1be01438
Instruction ID: f853059abc6fc6a0fd58fc7aa66162476ae909c6f7947805e252d31a7c207732
Opcode Fuzzy Hash: babfb94a8590e4c6773d500200312ba6449758699ed02bdf99f8e35a1be01438
Instruction Fuzzy Hash: CA410975D0060DDFCB04DFA4D991AEEB7B0EF48710F104269E92277291DB746A05DFA1

Function 00EE5E00 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EE5E2D

Part of subcall function 00EED050: std::_Lockit::_Lockit.LIBCPMT ref: 00EED070
Part of subcall function 00EED050: std::_Lockit::~_Lockit.LIBCPMT ref: 00EED09A

std::locale::_Getfacet.LIBCPMTD ref: 00EE5E55
std::bad_alloc::bad_alloc.LIBCMTD ref: 00EE5E90
__CxxThrowException@8.LIBVCRUNTIME ref: 00EE5E9E
std::_Lockit::~_Lockit.LIBCPMT ref: 00EE5F1D

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8GetfacetThrowstd::bad_alloc::bad_allocstd::locale::_
String ID:
API String ID: 3299565587-0
Opcode ID: f71beaf418fe5f564c5122920ac91b80fbaaa1d073d40ab2655ad15d5c931a22
Instruction ID: 0db367b8ee385e107ea5b3e43edde1e801b1a4b31c5d83231c8ff46c7c03a3be
Opcode Fuzzy Hash: f71beaf418fe5f564c5122920ac91b80fbaaa1d073d40ab2655ad15d5c931a22
Instruction Fuzzy Hash: 0C411A71D0024DDFCB04DFA5C992AEEB7B0FF48714F104269E922B7291DB356A05DBA1

Function 00EE5F40 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EE5F6D

Part of subcall function 00EED050: std::_Lockit::_Lockit.LIBCPMT ref: 00EED070
Part of subcall function 00EED050: std::_Lockit::~_Lockit.LIBCPMT ref: 00EED09A

std::locale::_Getfacet.LIBCPMTD ref: 00EE5F95
std::bad_alloc::bad_alloc.LIBCMTD ref: 00EE5FD0
__CxxThrowException@8.LIBVCRUNTIME ref: 00EE5FDE
std::_Lockit::~_Lockit.LIBCPMT ref: 00EE605D

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8GetfacetThrowstd::bad_alloc::bad_allocstd::locale::_
String ID:
API String ID: 3299565587-0
Opcode ID: 1cea0520b86667f3829da6adbd681621f5b6b32c1dfa30cea0323f9f7372d7a8
Instruction ID: 6885f8c99502e321c20d79f181aa0c90109c7b83f31d8c74e000074e59522267
Opcode Fuzzy Hash: 1cea0520b86667f3829da6adbd681621f5b6b32c1dfa30cea0323f9f7372d7a8
Instruction Fuzzy Hash: 23412970D0024DDFCB04DFA4C992AEEB7B0BF48310F104169E922B7291DB346E05DBA1

Function 00EE61C0 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EE61ED

Part of subcall function 00EED050: std::_Lockit::_Lockit.LIBCPMT ref: 00EED070
Part of subcall function 00EED050: std::_Lockit::~_Lockit.LIBCPMT ref: 00EED09A

std::locale::_Getfacet.LIBCPMTD ref: 00EE6215
std::bad_alloc::bad_alloc.LIBCMTD ref: 00EE6250
__CxxThrowException@8.LIBVCRUNTIME ref: 00EE625E
std::_Lockit::~_Lockit.LIBCPMT ref: 00EE62DD

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8GetfacetThrowstd::bad_alloc::bad_allocstd::locale::_
String ID:
API String ID: 3299565587-0
Opcode ID: c9f8c0ddcec01e95b6467ebdfec1dfe029546ffee6e514ab5798394f8a313390
Instruction ID: a9083e5e0b319e19af90084b54402bfb187f1561b677017223d9d9132413b9cc
Opcode Fuzzy Hash: c9f8c0ddcec01e95b6467ebdfec1dfe029546ffee6e514ab5798394f8a313390
Instruction Fuzzy Hash: C7414C70D0024DDFCB04EFA5C992AEEB7B0FF48710F108269E92277291DB346A05DBA1

Function 00EE6440 Relevance: 9.1, APIs: 6, Instructions: 95COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EE646D

Part of subcall function 00EED050: std::_Lockit::_Lockit.LIBCPMT ref: 00EED070
Part of subcall function 00EED050: std::_Lockit::~_Lockit.LIBCPMT ref: 00EED09A

std::locale::_Getfacet.LIBCPMTD ref: 00EE6495
std::bad_alloc::bad_alloc.LIBCMTD ref: 00EE64D0
__CxxThrowException@8.LIBVCRUNTIME ref: 00EE64DE
std::_Lockit::~_Lockit.LIBCPMT ref: 00EE655D

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Exception@8GetfacetThrowstd::bad_alloc::bad_allocstd::locale::_
String ID:
API String ID: 3299565587-0
Opcode ID: 3ab61b2a9623354103d74e0dee2faf59341395bff46370b21e28809896d70d02
Instruction ID: 5b97555d55f37032d87c0f1467a5192398eb8c5eebba682bcc25983e80c8256e
Opcode Fuzzy Hash: 3ab61b2a9623354103d74e0dee2faf59341395bff46370b21e28809896d70d02
Instruction Fuzzy Hash: 1A411B71D0024DDFCB04DFA4C992AEEB7B0FF58710F104269E92277291DB38AA05DBA1

Function 00EF14F0 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

delete.LIBCONCRTD ref: 00EF1582

Part of subcall function 00F4BC0A: EnterCriticalSection.KERNEL32(00FCB794,?,?,?,00F33571,00FCAEB8,F58088C3,?,?,?,00000000,00F913CF,000000FF,?,00F3362C,00000001), ref: 00F4BC15
Part of subcall function 00F4BC0A: LeaveCriticalSection.KERNEL32(00FCB794,?,00F33571,00FCAEB8,F58088C3,?,?,?,00000000,00F913CF,000000FF,?,00F3362C,00000001), ref: 00F4BC52

Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::_Scoped_lock.LIBCMTD ref: 00EF15A0
delete.LIBCONCRTD ref: 00EF15BD
SafeRWList.LIBCONCRTD ref: 00EF15DB

Part of subcall function 00EEAA60: std::_Mutex_base::_Mutex_base.LIBCONCRTD ref: 00EEAA6C

Part of subcall function 00F4BA41: __onexit.LIBCMT ref: 00F4BA47

Part of subcall function 00F4BBC0: EnterCriticalSection.KERNEL32(00FCB794,?,?,00F3359F,00FCAEB8,00F948A0,00000001), ref: 00F4BBCA
Part of subcall function 00F4BBC0: LeaveCriticalSection.KERNEL32(00FCB794,?,00F3359F,00FCAEB8,00F948A0,00000001), ref: 00F4BBFD

Part of subcall function 00EED670: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00EED68F

Part of subcall function 00EFF2E0: std::locale::_Locimp::_Addfac.LIBCPMTD ref: 00EFF2F2

delete.LIBCONCRTD ref: 00EF1602
SafeRWList.LIBCONCRTD ref: 00EF161A

Part of subcall function 00EEBB70: std::_Mutex_base::~_Mutex_base.LIBCONCRTD ref: 00EEBB9B

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Critical$Section$delete$EnterLeaveListMutex_baseProcessorSafeVirtualstd::_$AddfacConcurrency::Concurrency::details::_Locimp::_Lock::_Mutex_base::_Mutex_base::~_ReentrantRootRoot::Scoped_lockScoped_lock::___onexitstd::locale::_
String ID:
API String ID: 2240771013-0
Opcode ID: bfb451b51ca9f34942e915d7955777c653982f3b6b19bd170da9c222ca184541
Instruction ID: ae5fd65240e399552f51c7129d780ef73abab9e70d1f4b6202c58d2c5847c0a4
Opcode Fuzzy Hash: bfb451b51ca9f34942e915d7955777c653982f3b6b19bd170da9c222ca184541
Instruction Fuzzy Hash: 23316170E0420EDBDB04DBA4D957BBEB7B0EB44714F10016DE516772C2DB745904AB56

Function 00F6B18A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F6B181,00F65362,00F8B676,00000008,00F8B9F3,?,?,?,?,00F6066E,?,?,F58088C3), ref: 00F6B198
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F6B1A6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F6B1BF
SetLastError.KERNEL32(00000000,?,00F6B181,00F65362,00F8B676,00000008,00F8B9F3,?,?,?,?,00F6066E,?,?,F58088C3), ref: 00F6B211

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e03798cc39b833132b4237618f750fa0339b1411a770dac78ff52859c4ef29b6
Instruction ID: 4bd483c1cab84fb4287b23b04436c2c0f37bdc881351adf77669b34a4ded1976
Opcode Fuzzy Hash: e03798cc39b833132b4237618f750fa0339b1411a770dac78ff52859c4ef29b6
Instruction Fuzzy Hash: 9A01D43291821A6EA62527B57CAA97B3B94EB027F4724433AF190C60E1EF174D60B284

Function 00F7B055 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00F751CC,?,?,00F48334,00000000,?,?,?,00FBFD70,?,?,?,?,string too long), ref: 00F7B059
_free.LIBCMT ref: 00F7B08C
_free.LIBCMT ref: 00F7B0B4
SetLastError.KERNEL32(00000000,?,00FBFD70,?,?,?,?,string too long,?,00EE4385,?,?,?,00EF6AED,ij,?), ref: 00F7B0C1
SetLastError.KERNEL32(00000000,?,00FBFD70,?,?,?,?,string too long,?,00EE4385,?,?,?,00EF6AED,ij,?), ref: 00F7B0CD
_abort.LIBCMT ref: 00F7B0D3

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 56f9c0aa181bafb09c393e863b74e54f0a4fb078ae976a4dc7f38c18a36a119c
Instruction ID: 3b2cc5b1e908834952e4968ae52d3075a2b1e006f33ca00cad9214741491104f
Opcode Fuzzy Hash: 56f9c0aa181bafb09c393e863b74e54f0a4fb078ae976a4dc7f38c18a36a119c
Instruction Fuzzy Hash: AAF0A932500A0566C2323734AD0EF6F39559FC2B70B21C017F53C931A2EF2888017193

Function 00F14310 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 274COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F1463F

Strings

: message length , xrefs: 00F1440E
: footer length , xrefs: 00F144DB
: header length , xrefs: 00F145D0
exceeds the maximum of , xrefs: 00F14436, 00F144FD, 00F145F8

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: exceeds the maximum of $: footer length $: header length $: message length
API String ID: 2005118841-976070898
Opcode ID: 8e48eb2e39053c63c3317e584619dc9f47fc9229738a915606c1090847de807f
Instruction ID: d1ee8239d4ca9e6495235700010a94f19768ac5a7286ce078608badea5fac7fb
Opcode Fuzzy Hash: 8e48eb2e39053c63c3317e584619dc9f47fc9229738a915606c1090847de807f
Instruction Fuzzy Hash: 95A16F75A0028CAFDB21DFA4CC85FDEBBECAF58300F144459F945E7242DA74AA449BA1

Function 00F14780 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 174COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F148B6

Strings

: IV length , xrefs: 00F1484D, 00F14907
exceeds the maximum of , xrefs: 00F14875
is less than the minimum of , xrefs: 00F1492F

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: exceeds the maximum of $ is less than the minimum of $: IV length
API String ID: 2005118841-1273958906
Opcode ID: 75284e8f2ca2eef58f3d57f4d21ad9eb87bfbea51373d24201b8ea55753f0c0e
Instruction ID: f53a4eae2da44da5f9f786f2613f38db180a564b1694fab960d89476b7de1c76
Opcode Fuzzy Hash: 75284e8f2ca2eef58f3d57f4d21ad9eb87bfbea51373d24201b8ea55753f0c0e
Instruction Fuzzy Hash: FB517075A01358ABDB11EBA4CC49FDEBBFCAF19300F104599F509E3242DB749B449BA1

Function 00F172F0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 173COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F174CC

Strings

StreamTransformationFilter: W3C_PADDING cannot be used with , xrefs: 00F173B0
BlockPaddingScheme, xrefs: 00F17346
StreamTransformationFilter: ONE_AND_ZEROS_PADDING cannot be used with , xrefs: 00F173E9
StreamTransformationFilter: PKCS_PADDING cannot be used with , xrefs: 00F174A8

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: BlockPaddingScheme$StreamTransformationFilter: ONE_AND_ZEROS_PADDING cannot be used with $StreamTransformationFilter: PKCS_PADDING cannot be used with $StreamTransformationFilter: W3C_PADDING cannot be used with
API String ID: 2005118841-406985018
Opcode ID: f40d1ab3f3b033e7f8bd17a74109c7aaa5853a3a410fc8d167e44ae4fdb8d2de
Instruction ID: 0f3b4761049da7998e231e11eaa8266941ee188cd5399cb5c6ca2a86d6561699
Opcode Fuzzy Hash: f40d1ab3f3b033e7f8bd17a74109c7aaa5853a3a410fc8d167e44ae4fdb8d2de
Instruction Fuzzy Hash: 15518975A04319EBDB10EF64C884FDABBB4BF49710F004599E809A7291DB31AE84EB91

Function 00F3D5D0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

___std_type_info_name.LIBVCRUNTIME ref: 00F3D68E
Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00F3D6C6
___std_type_info_name.LIBVCRUNTIME ref: 00F3D6F9

Strings

ThisPointer:, xrefs: 00F3D69D, 00F3D6DB
ValueNames, xrefs: 00F3D5E1

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ___std_type_info_name$Concurrency::task_continuation_context::task_continuation_context
String ID: ThisPointer:$ValueNames
API String ID: 219333310-2375088429
Opcode ID: ad90c2c981fefff19a933261a3186ea47cba908470be509a6bbfd124168e816f
Instruction ID: 09629929755d783f28cca0b9a14d5a35eeb09eca9ced0be7a8e7c215bcaf4437
Opcode Fuzzy Hash: ad90c2c981fefff19a933261a3186ea47cba908470be509a6bbfd124168e816f
Instruction Fuzzy Hash: 135156307043419BC7209F24AD82F23BBE6AF55768F04495CF9D987242D763ED18E762

Function 00F3D3E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

___std_type_info_name.LIBVCRUNTIME ref: 00F3D49E
Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00F3D4D6
___std_type_info_name.LIBVCRUNTIME ref: 00F3D509

Strings

ThisPointer:, xrefs: 00F3D4AD, 00F3D4EB
ValueNames, xrefs: 00F3D3F1

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ___std_type_info_name$Concurrency::task_continuation_context::task_continuation_context
String ID: ThisPointer:$ValueNames
API String ID: 219333310-2375088429
Opcode ID: 668da8eadea5d1c3781ed2f8a004edea0edaf652605f487e60b0ef9e4880606c
Instruction ID: 77e6681d6ec9892e5f12208bc020a4d59dee574ca43801e5746db7f71c509073
Opcode Fuzzy Hash: 668da8eadea5d1c3781ed2f8a004edea0edaf652605f487e60b0ef9e4880606c
Instruction Fuzzy Hash: FB5104316043419BCB20DF24ED82E67BBE5AF55728F08496CF98987242D773ED08E752

Function 00EE4F80 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00EFC240: _Max_value.LIBCPMTD ref: 00EFC276
Part of subcall function 00EFC240: _Min_value.LIBCPMTD ref: 00EFC29C

allocator.LIBCONCRTD ref: 00EE4FFB
allocator.LIBCONCRTD ref: 00EE506D
construct.LIBCPMTD ref: 00EE50AD

Strings

g, xrefs: 00EE4FAF, 00EE4FBC, 00EE5084, 00EE5042, 00EE5045, 00EE5087
g, xrefs: 00EE507C, 00EE503A, 00EE503D, 00EE507F

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: allocator$Max_valueMin_valueconstruct
String ID: g$g
API String ID: 3172100163-1725961578
Opcode ID: 430a3ca184d7a4b8921b0db79d0fb125aa6787fb52e6057ae23070c1d813c1a5
Instruction ID: 25cd816967c7a97697d9f54eb2cda89345a5059667d80fb0a8112b0c01d1c8a9
Opcode Fuzzy Hash: 430a3ca184d7a4b8921b0db79d0fb125aa6787fb52e6057ae23070c1d813c1a5
Instruction Fuzzy Hash: 8D4193B5E0010DAFCB48DFA9D8919EEB7B5FF88300F109559E919B7355DB30AA00CBA1

Function 00F77901 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\12.exe,00000104), ref: 00F77941
_free.LIBCMT ref: 00F77A0C
_free.LIBCMT ref: 00F77A16

Strings

C:\Users\user\Desktop\12.exe, xrefs: 00F77938, 00F7793F, 00F7796E, 00F779A6
0&y, xrefs: 00F77947

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: _free$FileModuleName
String ID: 0&y$C:\Users\user\Desktop\12.exe
API String ID: 2506810119-3740557232
Opcode ID: e02a668051a7d32a63032687aab5dc96003a98770e95114d019a619a53d2c78e
Instruction ID: 64371120531210a7b92f0f83a3bb64a977e22784ba42710400bdff435959e5a6
Opcode Fuzzy Hash: e02a668051a7d32a63032687aab5dc96003a98770e95114d019a619a53d2c78e
Instruction Fuzzy Hash: 4F31B571E15318AFEB21EB998C82E9EBBBCEB85710F10806BE54897211D7744E40FB51

Function 00EF5600 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

std::ios_base::good.LIBCPMTD ref: 00EF5662
std::ios_base::good.LIBCPMTD ref: 00EF56DF
Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00EF5718

Strings

", ", xrefs: 00EF56ED
: ", xrefs: 00EF56B6

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: std::ios_base::good$Concurrency::task_continuation_context::task_continuation_context
String ID: ", "$: "
API String ID: 926726489-747220369
Opcode ID: 13958f328627751fd02e34a8c1e2146d58d33eb420547423a42ecfa6f8d38cc5
Instruction ID: 639db09cc1c6ebd40c3d8788a2e849b34f8d6c407bd5255e33c1240eabc503d5
Opcode Fuzzy Hash: 13958f328627751fd02e34a8c1e2146d58d33eb420547423a42ecfa6f8d38cc5
Instruction Fuzzy Hash: 65415E7281019CDACB04EF95CC52BEEB7B8FF14314F445129E506B7292EF716A49CBA1

Function 00EE4BB0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 00EFC2C0: _Max_value.LIBCPMTD ref: 00EFC2F6
Part of subcall function 00EFC2C0: _Min_value.LIBCPMTD ref: 00EFC31C

allocator.LIBCONCRTD ref: 00EE4C2B
allocator.LIBCPMTD ref: 00EE4C95
construct.LIBCPMTD ref: 00EE4CCD

Strings

, xrefs: 00EE4CB0, 00EE4C7F
, xrefs: 00EE4BCE, 00EE4BF5, 00EE4C33, 00EE4C3B, 00EE4C44, 00EE4CA8, 00EE4CBC, 00EE4C62, 00EE4C9A, 00EE4CAB, 00EE4CBF

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: allocator$Max_valueMin_valueconstruct
String ID: $
API String ID: 3172100163-1760928858
Opcode ID: b8e0be31b8087a0ffcdb6de0668deb06480539e3c479bc678c5b9e3c7063dff7
Instruction ID: bbbc83b657762f4390b6a54be2fd841ef1d089ba59a299ff7332697618c692f5
Opcode Fuzzy Hash: b8e0be31b8087a0ffcdb6de0668deb06480539e3c479bc678c5b9e3c7063dff7
Instruction Fuzzy Hash: 6041A5B5E0010DAFCB48DFA9D8918EEB7F5FF88300B109569E516B7355DB30AA00CBA5

Function 00EE4E40 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 00EFC240: _Max_value.LIBCPMTD ref: 00EFC276
Part of subcall function 00EFC240: _Min_value.LIBCPMTD ref: 00EFC29C

allocator.LIBCONCRTD ref: 00EE4EBB
allocator.LIBCONCRTD ref: 00EE4F25
construct.LIBCPMTD ref: 00EE4F5D

Strings

[, xrefs: 00EE4E5E, 00EE4E85, 00EE4EC3, 00EE4ECB, 00EE4ED4, 00EE4F38, 00EE4F4C, 00EE4EF2, 00EE4F2A, 00EE4F3B, 00EE4F4F
[, xrefs: 00EE4F40, 00EE4F0F

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: allocator$Max_valueMin_valueconstruct
String ID: [$[
API String ID: 3172100163-1962798049
Opcode ID: 730ac209ee0b95bb9531eacdbd9a8e8fb5366f68cb19901ca7f31ab5906be03f
Instruction ID: 7d310cfeffc811c702695ae180fe8d873b0a2b1412c94d96fe42edfd2bd1a7eb
Opcode Fuzzy Hash: 730ac209ee0b95bb9531eacdbd9a8e8fb5366f68cb19901ca7f31ab5906be03f
Instruction Fuzzy Hash: 9841A4B5E0010DAFCB48DFA9D8918EEB7B5FF88300B109569E515B7351DB30AA40CBA5

Function 00EE4260 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00EFC2C0: _Max_value.LIBCPMTD ref: 00EFC2F6
Part of subcall function 00EFC2C0: _Min_value.LIBCPMTD ref: 00EFC31C

allocator.LIBCONCRTD ref: 00EE42C6
allocator.LIBCPMTD ref: 00EE431B
construct.LIBCPMTD ref: 00EE433F

Strings

rl, xrefs: 00EE4273, 00EE4285, 00EE429D, 00EE42A8, 00EE4347
rl, xrefs: 00EE42E8, 00EE42EB

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: allocator$Max_valueMin_valueconstruct
String ID: rl$rl
API String ID: 3172100163-3070577822
Opcode ID: c88047d102682267f49f8083c735ce57e6cee6c21af769bcd8cb747b3976cbb2
Instruction ID: e5e6e91c7bb18e5bd68bec4dce2a70c3ac3957d7b59a8819a71331da81bfbbe5
Opcode Fuzzy Hash: c88047d102682267f49f8083c735ce57e6cee6c21af769bcd8cb747b3976cbb2
Instruction Fuzzy Hash: 0131CAB5E1010DAFCB44EFA9D8929AEB7B5FF88300B10956DE915A7351DB30AA40CB91

Function 00EE4360 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00EFC240: _Max_value.LIBCPMTD ref: 00EFC276
Part of subcall function 00EFC240: _Min_value.LIBCPMTD ref: 00EFC29C

allocator.LIBCONCRTD ref: 00EE43C6
allocator.LIBCONCRTD ref: 00EE441B
construct.LIBCPMTD ref: 00EE443F

Strings

j, xrefs: 00EE43E8, 00EE43EB
j, xrefs: 00EE4373, 00EE4385, 00EE439D, 00EE43A8, 00EE4447

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: allocator$Max_valueMin_valueconstruct
String ID: j$j
API String ID: 3172100163-170249305
Opcode ID: df4ec9ed16b69307a72f4966651edb83cc9d0b053e3b2c88a5664d43e89cdfed
Instruction ID: 549fd082ba2ec324f70be22cec1e9de26c229c85ff805b22e494c79b0bb050f4
Opcode Fuzzy Hash: df4ec9ed16b69307a72f4966651edb83cc9d0b053e3b2c88a5664d43e89cdfed
Instruction Fuzzy Hash: CF31CCB5E1010DEFCB44DFA9D8919AEB7B5FF48300B10956DE915B7391DB30AA40CB91

Function 00F341CE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00EF7130: std::ios_base::clear.LIBCPMTD ref: 00EF7165

std::make_error_code.LIBCPMTD ref: 00F34211

Part of subcall function 00EFC200: std::generic_category.LIBCPMTD ref: 00EFC203
Part of subcall function 00EFC200: _Smanip.LIBCPMTD ref: 00EFC210

std::ios_base::failure::failure.LIBCPMTD ref: 00F34222
__CxxThrowException@8.LIBVCRUNTIME ref: 00F34206

Part of subcall function 00F63148: RaiseException.KERNEL32(?,?,?,00F4C9DF,?,00000000,?,?,?,?,?,?,00F4C9DF,?,00FBFECC), ref: 00F631A8

__CxxThrowException@8.LIBVCRUNTIME ref: 00F34230
__CxxThrowException@8.LIBVCRUNTIME ref: 00F342CD
__CxxThrowException@8.LIBVCRUNTIME ref: 00F342E3

Strings

ios_base::badbit set, xrefs: 00F3421D

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaiseSmanipstd::generic_categorystd::ios_base::clearstd::ios_base::failure::failurestd::make_error_code
String ID: ios_base::badbit set
API String ID: 2251910535-3882152299
Opcode ID: c535579ea59d9369c9186faa89d7a633e0a7bb82d456df7cc0e2df3a47a9af76
Instruction ID: ce809b6d47a5cb012c8d85d1fd17ca4fe4e752d5fc5d8e0074f38fb0e8461574
Opcode Fuzzy Hash: c535579ea59d9369c9186faa89d7a633e0a7bb82d456df7cc0e2df3a47a9af76
Instruction Fuzzy Hash: F021BE31A40708AFDB14EFA8DD42FAAB3B4FF05710F044659F911A7682DB74B900CB91

Function 00EF3D40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

std::locale::c_str.LIBCPMTD ref: 00EF3D9F
std::_Locinfo::_Locinfo.LIBCPMTD ref: 00EF3DA8

Part of subcall function 00EEA270: std::_Lockit::_Lockit.LIBCPMT ref: 00EEA2A3
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2B5
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2C4
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2D3
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2E2
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2F1
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA300
Part of subcall function 00EEA270: std::bad_exception::bad_exception.LIBCMTD ref: 00EEA317
Part of subcall function 00EEA270: __CxxThrowException@8.LIBVCRUNTIME ref: 00EEA325
Part of subcall function 00EEA270: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00EEA332

ctype.LIBCPMTD ref: 00EF3DD2

Part of subcall function 00EE8560: std::bad_exception::bad_exception.LIBCMTD ref: 00EE858D

std::_Locinfo::~_Locinfo.LIBCPMTD ref: 00EF3E0E

Strings

Eb, xrefs: 00EF3DE3

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Yarn$std::_$LocinfoLocinfo::_std::bad_exception::bad_exception$Exception@8Locinfo::~_Locinfo_ctorLockitLockit::_Throwctypestd::locale::c_str
String ID: Eb
API String ID: 1422144976-3006133623
Opcode ID: e8cd48879c7cd0d9e40f6bfd3718d132793c6aad63d15ba3d044a3feddefb08a
Instruction ID: 1cd52f58a83019d9e8ccb335e11dc8adaaaedf8be1a24c972eb7b292ea85cf7a
Opcode Fuzzy Hash: e8cd48879c7cd0d9e40f6bfd3718d132793c6aad63d15ba3d044a3feddefb08a
Instruction Fuzzy Hash: 5F31F4B0D0420DDFDB14DF98C942BAEBBB0FB48314F208269E525BB390D775AA44CB91

Function 00F49667 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00F496C1
GetFileInformationByHandle.KERNEL32(?,?), ref: 00F496D1
GetLastError.KERNEL32 ref: 00F496E5

Strings

GetFileInformationByHandleEx, xrefs: 00F49685
kernel32.dll, xrefs: 00F4968A

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ErrorLast$FileHandleInformation
String ID: GetFileInformationByHandleEx$kernel32.dll
API String ID: 514658993-1782754588
Opcode ID: f7254dfd6f52b1d536ee68e2735750152c43585ac363f24e6369eeae7ce2cfce
Instruction ID: 5ea842f2bb818259ae981a7356bf1743460c08429af10f1fb093cde354e3d266
Opcode Fuzzy Hash: f7254dfd6f52b1d536ee68e2735750152c43585ac363f24e6369eeae7ce2cfce
Instruction Fuzzy Hash: C9110075B04209AFDB00DF65DD86EAFBFB8BB09B10B514026E905D7250DB74D901ABA1

Function 00F2C4FD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

ios_base::badbit set, xrefs: 00F2C598, 00F2C5C0

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID: ios_base::badbit set
API String ID: 0-3882152299
Opcode ID: 9e55171ab634a88c0acab01f33ecd8183ed15010f5804e36c2daaf87918ca726
Instruction ID: acca9e88e5e29db092fe040bc1250b958dbfaef54e3d2a806934199f7a947033
Opcode Fuzzy Hash: 9e55171ab634a88c0acab01f33ecd8183ed15010f5804e36c2daaf87918ca726
Instruction Fuzzy Hash: F3F06271A00604AFEB04EB54EC87F6C33A4AB04714F594069F206EB292C775F900DB95

Function 00F77806 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00F777B7,00000000,?,00F77757,00000000,00FC15D0,0000000C,00F778AE,00000000,00000002), ref: 00F77826
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F77839
FreeLibrary.KERNEL32(00000000,?,?,?,00F777B7,00000000,?,00F77757,00000000,00FC15D0,0000000C,00F778AE,00000000,00000002), ref: 00F7785C

Strings

CorExitProcess, xrefs: 00F77831
mscoree.dll, xrefs: 00F7781F

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ed495ed14ca0050582e055d35dadfccc95d6dbe0936c347c990f57433d5f2a26
Instruction ID: 8b08df2c06ef25c894d505b4cfe6f58d1caae5f0501765c84e839b20ef62deea
Opcode Fuzzy Hash: ed495ed14ca0050582e055d35dadfccc95d6dbe0936c347c990f57433d5f2a26
Instruction Fuzzy Hash: 5BF0A430A1020CBBCB115B91DC09B9EBFB4EF04B11F1040AAB809A6160CF308E40EB92

Function 00F597A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 00F597B4
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 00F597D8
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F597EB
__CxxThrowException@8.LIBVCRUNTIME ref: 00F597F9

Strings

pScheduler, xrefs: 00F597E3

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentException@8Manager::Proxy::RemoveSchedulerThreadThrowstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 3657713681-923244539
Opcode ID: 64e65754774db1a5cb40850be23395270841be46cfbadad30a9dfc8ba2b4a01a
Instruction ID: 014072389f788be1c6c32c9e50354a7c76a65daea46aee65d389646ca3075f5b
Opcode Fuzzy Hash: 64e65754774db1a5cb40850be23395270841be46cfbadad30a9dfc8ba2b4a01a
Instruction Fuzzy Hash: 1DF02B35900504E7C718EA10EC52D9EB7649F85B21310452AAD0613142DFB4EA0AE6D1

Function 00F74652 Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c6537e0b59727bab86850a177ab85699f0e6754ecd6ad60b3c5748a0a1076fb
Instruction ID: 6a7dc5804085852cc38b6e8e7afcd12dc7d35ed6c07e8a2b6f01746bb866200b
Opcode Fuzzy Hash: 8c6537e0b59727bab86850a177ab85699f0e6754ecd6ad60b3c5748a0a1076fb
Instruction Fuzzy Hash: 3171C431E0025ADBDB218F95CC44ABFBBB5EF46360F14822BE45967290D770AD41E7A3

Function 00F780F2 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F78164
_free.LIBCMT ref: 00F78184

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: fb485845ae884c7dd375c52415696604a94f8f9424f6574e58f00b2b0a8f0d37
Instruction ID: 8686dffd37985d0f0cd91376f05b133557591abdf24fdcc48a47b3e20237d49a
Opcode Fuzzy Hash: fb485845ae884c7dd375c52415696604a94f8f9424f6574e58f00b2b0a8f0d37
Instruction Fuzzy Hash: BC41F332E002049FCB10DF78CC85A6DB7F5EF85724F5585AAE919EB251DB70AE02EB41

Function 00EFDE50 Relevance: 7.6, APIs: 5, Instructions: 111COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 00EFDE90
char_traits.LIBCPMTD ref: 00EFDEC5
char_traits.LIBCPMTD ref: 00EFDEE0
char_traits.LIBCPMTD ref: 00EFDF0B

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: char_traits
String ID:
API String ID: 1158913984-0
Opcode ID: db92f29e8dc85207a10dcd2f62dcb5b7af1225133f1c30f3f7292ecab69c9db1
Instruction ID: 51f4a1d86584f82fd9b0b5599f06603509d921f4882691c4f139495664480bac
Opcode Fuzzy Hash: db92f29e8dc85207a10dcd2f62dcb5b7af1225133f1c30f3f7292ecab69c9db1
Instruction Fuzzy Hash: 604153B6D0411DABCF04EBA4DC919FE7BB6AF60304F049169E6067B242EF319A45CB91

Function 00EFDFB0 Relevance: 7.6, APIs: 5, Instructions: 111COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 00EFDFF1
char_traits.LIBCPMTD ref: 00EFE027
_WChar_traits.LIBCPMTD ref: 00EFE042
char_traits.LIBCPMTD ref: 00EFE06E

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: char_traits$Char_traits
String ID:
API String ID: 2319263282-0
Opcode ID: 4de5aa97fe6521210d2a6efb3011edd1880264afad6e2766fd29117350dfee28
Instruction ID: 487619e6ce8d0b64c72d2bea27ed57ca954f231337b0fca83b8b89c8e48a5d93
Opcode Fuzzy Hash: 4de5aa97fe6521210d2a6efb3011edd1880264afad6e2766fd29117350dfee28
Instruction Fuzzy Hash: 5D416279D0010CAACF04EBA0D8919FE77B5AF90304F54A16AEA157B352EF31AE04CB91

Function 00F577C0 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00F577E5

Part of subcall function 00F4D54A: _SpinWait.LIBCONCRT ref: 00F4D562

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00F577F9
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00F5782B
List.LIBCMT ref: 00F578AE
List.LIBCMT ref: 00F578BD

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: ff50538196e31ad48777ca6d9ed29fa0df5b52237d0741d0d4a47883a077467e
Instruction ID: 830e09c0f6f3a95dc892c9d02cba6894b1703961092fcc2e9d07633b9452e8fb
Opcode Fuzzy Hash: ff50538196e31ad48777ca6d9ed29fa0df5b52237d0741d0d4a47883a077467e
Instruction Fuzzy Hash: 8C317772D09715DBCB14EFA4E9416ECBBB1BF0431AB28006ADE0137242CB746908EBA0

Function 00F0F7B0 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

Concurrency::details::VirtualProcessor::IsAvailable.LIBCMTD ref: 00F0F7BC
std::_Throw_Cpp_error.LIBCPMT ref: 00F0F7CA

Part of subcall function 00F495C6: std::generic_category.LIBCPMTD ref: 00F495D7
Part of subcall function 00F495C6: std::system_error::system_error.LIBCPMT ref: 00F495E7
Part of subcall function 00F495C6: __CxxThrowException@8.LIBVCRUNTIME ref: 00F495F5

std::_Throw_Cpp_error.LIBCPMT ref: 00F0F7F5
std::_Throw_Cpp_error.LIBCPMT ref: 00F0F838
std::_Throw_Cpp_error.LIBCPMT ref: 00F0F85A

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$AvailableConcurrency::details::Exception@8Processor::ThrowVirtualstd::generic_categorystd::system_error::system_error
String ID:
API String ID: 272441680-0
Opcode ID: 324499b0c2d967cbd9662792196b2673cf69da478bc2950ee8c9c10342896fa2
Instruction ID: 33f67ee909126f2cc4470e739f4faafd6614c8087f3c6cdd485d7ed3d595560d
Opcode Fuzzy Hash: 324499b0c2d967cbd9662792196b2673cf69da478bc2950ee8c9c10342896fa2
Instruction Fuzzy Hash: A521CCB5E042096BDB10DBA1DC42BAFBBB45F04300F0440B8E945AB3C2E775DA49E792

Function 00F838A9 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00F838B2
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F838D5

Part of subcall function 00F7F17C: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00F8172E,?,00000000,?,00F83CCB,?,00000004,00000000,?,?,?,00F7817F), ref: 00F7F1AE

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00F838FB
_free.LIBCMT ref: 00F8390E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F8391D

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: ae33e2555d6e06914673649132cf1a04222e6dd9d052da329e3c824aaa2396ff
Instruction ID: 57e122ae600800e94604865d1e6b6ac4a0f7d740a2bab0678583c1f8657f9bea
Opcode Fuzzy Hash: ae33e2555d6e06914673649132cf1a04222e6dd9d052da329e3c824aaa2396ff
Instruction Fuzzy Hash: 260179739016157B67222B665C8CCBF796EDAC6FA03154129F904D2121DBA4CE01A7B0

Function 00F7B0D9 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00F6C967,00F8174C,?,00F83CCB,?,00000004,00000000,?,?,?,00F7817F,?,00000000), ref: 00F7B0DE
_free.LIBCMT ref: 00F7B113
_free.LIBCMT ref: 00F7B13A
SetLastError.KERNEL32(00000000,?,?,?,?,?,?), ref: 00F7B147
SetLastError.KERNEL32(00000000,?,?,?,?,?,?), ref: 00F7B150

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: b70fed6d9896f701d63a63e71f3ed51a15546f51b381da313e43a1e163798fb1
Instruction ID: 09330802c2957364b40f341d80bcef5417584f37b5a92d3e164ee4cd99e32509
Opcode Fuzzy Hash: b70fed6d9896f701d63a63e71f3ed51a15546f51b381da313e43a1e163798fb1
Instruction Fuzzy Hash: 33012D33600A052783132B346D5AF6B3669DFC3B70761C02BF41D922A2EFBC880171A3

Function 00F073E0 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Auto_cnd::_Auto_cnd.LIBCPMTD ref: 00F0741F
std::_Auto_cnd::_Auto_cnd.LIBCPMTD ref: 00F07438
std::_Cnd_initX.LIBCPMTD ref: 00F07444

Part of subcall function 00EF5240: __Mtx_unlock.LIBCPMT ref: 00EF5247
Part of subcall function 00EF5240: std::_Check_C_return.LIBCPMTD ref: 00EF5250

std::_Auto_cnd::~_Auto_cnd.LIBCPMTD ref: 00F0744F
std::_Auto_cnd::~_Auto_cnd.LIBCPMTD ref: 00F07457

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: std::_$Auto_cnd$Auto_cnd::_Auto_cnd::~_$C_returnCheck_Cnd_initMtx_unlock
String ID:
API String ID: 2679331167-0
Opcode ID: da6bc5393b7a8227182e5e10b19d344df984cccda52226d9cccef8f1adebaa5c
Instruction ID: 0ae51b91ecc1c567f6b83a7ecd45e0e34d0fb8284f3870cb2b04a9d7c8486477
Opcode Fuzzy Hash: da6bc5393b7a8227182e5e10b19d344df984cccda52226d9cccef8f1adebaa5c
Instruction Fuzzy Hash: 6D113C759101089BCB04EB94CD92EEEF7B4FB08700F404669E916A72D1DF35AE04DB90

Function 00F1166B Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F1168E
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F1169A
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F116A6
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F116D0
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F116EB

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Container_base12Container_base12::~_std::_
String ID:
API String ID: 1531518832-0
Opcode ID: ad1f7342b2850b9cb8fa2a928d15d1cbb5815063f3f0441e4b2539a2e9d06cea
Instruction ID: 10690b5b6097d4ca72a813b37ef184362fcc904060d576fb20cda303561052c9
Opcode Fuzzy Hash: ad1f7342b2850b9cb8fa2a928d15d1cbb5815063f3f0441e4b2539a2e9d06cea
Instruction Fuzzy Hash: 9511073080928DDADB15EBA4D9557EEBBB0AF21304F6040E8D0466B1D3DB742F49EB92

Function 00F11676 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F1168E
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F1169A
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F116A6
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F116D0
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00F116EB

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Container_base12Container_base12::~_std::_
String ID:
API String ID: 1531518832-0
Opcode ID: 41da91c4660b14c1a410623407a4f698f632bcff28e1037c7e192f103a49e27f
Instruction ID: f07c51915254d581eae5eb46585594c78a0ef2e676ccd4dfa20c99796f5f4f6a
Opcode Fuzzy Hash: 41da91c4660b14c1a410623407a4f698f632bcff28e1037c7e192f103a49e27f
Instruction Fuzzy Hash: 4D11073080928DDADB15EBA4D9557EEBBB0AF21304F6040E8D0466B1D3DB742F49EB92

Function 00F54126 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F4EE2A: TlsGetValue.KERNEL32(?,?,00F4D175,00F4F362,00000000,?,00F4D153,?,?,?,00000000,?,00000000), ref: 00F4EE30

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 00F54150

Part of subcall function 00F5DAA6: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00F5DACD
Part of subcall function 00F5DAA6: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00F5DAE6
Part of subcall function 00F5DAA6: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00F5DB5C
Part of subcall function 00F5DAA6: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 00F5DB64

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 00F5415E
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 00F54168
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 00F54172
__CxxThrowException@8.LIBVCRUNTIME ref: 00F54190

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredException@8ExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceThrowValueVirtualWork
String ID:
API String ID: 4266703842-0
Opcode ID: 2d0845a556e57eafd22006f6889eef68e5fe1edb2fb4e24621f57dd387a6f6d1
Instruction ID: 95db660e19ff1405b224599efd6537112052559af3d083290fbc02b2ee6bd904
Opcode Fuzzy Hash: 2d0845a556e57eafd22006f6889eef68e5fe1edb2fb4e24621f57dd387a6f6d1
Instruction Fuzzy Hash: 0DF08131A00918A7CB15B7359C12D5EB7799FD1B21B000129FE0043256DF6CAE4EBBC1

Function 00F8474C Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F84764

Part of subcall function 00F7B207: HeapFree.KERNEL32(00000000,00000000,?,00F84A0A,?,00000000,?,00000000,?,00F84CAE,?,00000007,?,?,00F850A9,?), ref: 00F7B21D
Part of subcall function 00F7B207: GetLastError.KERNEL32(?,?,00F84A0A,?,00000000,?,00000000,?,00F84CAE,?,00000007,?,?,00F850A9,?,?), ref: 00F7B22F

_free.LIBCMT ref: 00F84776
_free.LIBCMT ref: 00F84788
_free.LIBCMT ref: 00F8479A
_free.LIBCMT ref: 00F847AC

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4badd1bd577e3567cf65b702eded6c771cc4119ce1f0c011713f0eef2780c23a
Instruction ID: 1f8bfa6964941f2a0f3a77a8d790e343782c2cb66b4391c1cfa138550f548f02
Opcode Fuzzy Hash: 4badd1bd577e3567cf65b702eded6c771cc4119ce1f0c011713f0eef2780c23a
Instruction Fuzzy Hash: 0AF096329022546BCA20FB64FDC7D9E77DDEA02764394880AF069D7521C734FC80B765

Function 00F493C0 Relevance: 7.5, APIs: 5, Instructions: 39timeCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4D6E4
Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 00F4D704

Part of subcall function 00F4CF5C: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00F4CF7E
Part of subcall function 00F4CF5C: Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00F4CF9F

Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00F4D717
Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 00F4D723
Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 00F4D72C

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Concurrency::details::$LockQueue$Concurrency::critical_section::_NodeNode::Timer$Acquire_lockAsyncBase::ContextCurrentDerefH_prolog3LibraryLoadRegisterSchedulerSwitch_to_active
String ID:
API String ID: 1236927926-0
Opcode ID: bd171ffaa4332ddf3c78c00a8ad48515f6a1a9c169d865524123661f2a6ae990
Instruction ID: 084cc5dbc05c0d9a8aa19ef355a6ba8e566e4cce1a1a79823a85cefdff910870
Opcode Fuzzy Hash: bd171ffaa4332ddf3c78c00a8ad48515f6a1a9c169d865524123661f2a6ae990
Instruction Fuzzy Hash: D7F0E97160130567DF547EB44C82ABD3ED65F843A0B184139FD129B3C2DE798E0172E4

Function 00F78370 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F7838E

Part of subcall function 00F7B207: HeapFree.KERNEL32(00000000,00000000,?,00F84A0A,?,00000000,?,00000000,?,00F84CAE,?,00000007,?,?,00F850A9,?), ref: 00F7B21D
Part of subcall function 00F7B207: GetLastError.KERNEL32(?,?,00F84A0A,?,00000000,?,00000000,?,00F84CAE,?,00000007,?,?,00F850A9,?,?), ref: 00F7B22F

_free.LIBCMT ref: 00F783A0
_free.LIBCMT ref: 00F783B3
_free.LIBCMT ref: 00F783C4
_free.LIBCMT ref: 00F783D5

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 04926541f0e0fd7c15ed067b4c9a507c4947efad2183c9d349b635cd8e57c52b
Instruction ID: 8eeadfd5dd0a5520433ce00baf70b18367f834292286d162d7260a6b7487ad69
Opcode Fuzzy Hash: 04926541f0e0fd7c15ed067b4c9a507c4947efad2183c9d349b635cd8e57c52b
Instruction Fuzzy Hash: B2F0D0759012189BC6527F64EE43DA83B60E706764701850BF46857372C7350955FFC2

Function 00F59642 Relevance: 7.5, APIs: 5, Instructions: 30threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::CurrentSubscriptionLevel.LIBCONCRT ref: 00F5964C

Part of subcall function 00F4FD8D: __EH_prolog3.LIBCMT ref: 00F4FD94

Concurrency::details::SchedulerProxy::DecrementFixedCoreCount.LIBCONCRT ref: 00F5967D
GetCurrentThread.KERNEL32 ref: 00F59686
Concurrency::details::SchedulerProxy::DecrementCoreSubscription.LIBCONCRT ref: 00F59699
Concurrency::details::SchedulerProxy::DestroyExecutionResource.LIBCONCRT ref: 00F596A2

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$CoreCurrentDecrementResourceSubscription$CountDestroyExecutionFixedH_prolog3LevelManager::Thread
String ID:
API String ID: 1830408045-0
Opcode ID: 1dd99b0574e88d8c80bc2756a718e676eae4d9df325b6e78eb4b60bb091460b4
Instruction ID: 427ad593396de453fb984e8fc87a51f1da0caaeb601365e360b6d0744a558e49
Opcode Fuzzy Hash: 1dd99b0574e88d8c80bc2756a718e676eae4d9df325b6e78eb4b60bb091460b4
Instruction Fuzzy Hash: 07F082322005009B8629EF20ED2087A77B6AFD4711358061DEE4746651CF25A81EFB22

Function 00F76EF2 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00F770A4
__freea.LIBCMT ref: 00F770C2

Strings

am/pm, xrefs: 00F77125
a/p, xrefs: 00F77189

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: __freea
String ID: a/p$am/pm
API String ID: 240046367-3206640213
Opcode ID: ece473d7aaf03b8729bbf0378a833955b6f34956eebbddc500e61ca60c74b907
Instruction ID: 340da8f84f692d58de39d336d95fac114ed91c189e7e8572e38afee44e31a086
Opcode Fuzzy Hash: ece473d7aaf03b8729bbf0378a833955b6f34956eebbddc500e61ca60c74b907
Instruction Fuzzy Hash: 0BD1F332D283069ACB24AF68C855BBAB7B1FF05320F24C15BE94D9B251D3759D40FB92

Function 00F3C390 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F3C577

Strings

0, xrefs: 00F3C656
0, xrefs: 00F3C5BF
RoundUpToMultipleOf: integer overflow, xrefs: 00F3C551

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: 0$0$RoundUpToMultipleOf: integer overflow
API String ID: 2005118841-3133548746
Opcode ID: c300a378371e566c803b1f1edde408ccbf87238fe848b1779fd7946bd1409294
Instruction ID: ab15d871f64365b7e7fd2423a9c123adf1f558fbbf61c0c50d77c050b2555f03
Opcode Fuzzy Hash: c300a378371e566c803b1f1edde408ccbf87238fe848b1779fd7946bd1409294
Instruction Fuzzy Hash: D4C1AF71E002089FDB24DFA8CC95FEEBBB4EF14710F10416DE51AA7282DB74A949CB91

Function 00F151C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 169COMMON

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 00F15249
__cftoe.LIBCMT ref: 00F152C3
__CxxThrowException@8.LIBVCRUNTIME ref: 00F153C9

Strings

StringNarrow: wcstombs_s() call failed with error , xrefs: 00F152E9, 00F153A5

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: __cftoe$Exception@8Throw
String ID: StringNarrow: wcstombs_s() call failed with error
API String ID: 3925382403-1818402112
Opcode ID: 6b1cd3e4219be012a1468eb6f2a4db9462d8f36371c236f6334a5df60573cc98
Instruction ID: bb2999f3587fa915340b12490a1d383a2a986ee8e2c1e76fd21e32a47a2e2582
Opcode Fuzzy Hash: 6b1cd3e4219be012a1468eb6f2a4db9462d8f36371c236f6334a5df60573cc98
Instruction Fuzzy Hash: 6A519971D00249DBDF20DFA4C845BEEBBB8BB44710F54415AE501B7282DBB4AA88DBA1

Function 00F82BD8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 00F82C27
_free.LIBCMT ref: 00F82D44

Part of subcall function 00F6C8A6: IsProcessorFeaturePresent.KERNEL32(00000017,00F6C878,00000000,?,00000004,00000000,?,?,?,?,00F6C885,00000000,00000000,00000000,00000000,00000000), ref: 00F6C8A8
Part of subcall function 00F6C8A6: GetCurrentProcess.KERNEL32(C0000417), ref: 00F6C8CA
Part of subcall function 00F6C8A6: TerminateProcess.KERNEL32(00000000), ref: 00F6C8D1

Strings

., xrefs: 00F82EFB
*?, xrefs: 00F82C1B

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
String ID: *?$.
API String ID: 2812119850-3972193922
Opcode ID: b8a42de4a16cc4a74f3b77593d76e3490dbc9165ca0609ffc063dc11bd4b6620
Instruction ID: 9483447c012a64f244e2e859a2ad6afc9d86b6c6b89e288f4c744c07376dd735
Opcode Fuzzy Hash: b8a42de4a16cc4a74f3b77593d76e3490dbc9165ca0609ffc063dc11bd4b6620
Instruction Fuzzy Hash: A6517372E001099FDF14EFA8CC81AFDBBB5FF59320F24416AE854E7351E675AA01AB50

Function 00F14D30 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 160COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F14E94

Strings

HashTransformation: can't truncate a , xrefs: 00F14E32
byte digest to , xrefs: 00F14E3D
bytes, xrefs: 00F14E65

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: byte digest to $ bytes$HashTransformation: can't truncate a
API String ID: 2005118841-1139078987
Opcode ID: ba7d80627e278f52b422df8df86e6058c73d99043ac71819046abff2942f0746
Instruction ID: a26c837a8b7510e36ed1bb06bd78045cbd26a608a5fd95fd453f7b0c3ec8524c
Opcode Fuzzy Hash: ba7d80627e278f52b422df8df86e6058c73d99043ac71819046abff2942f0746
Instruction Fuzzy Hash: 3951BF72D00258AFDB10DF95CC45FDEBBB8FB49710F0041AAF908A7381DA749A049BA1

Function 00F11EA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F11F3D
__CxxThrowException@8.LIBVCRUNTIME ref: 00F11F6B

Strings

Cryptographic algorithms are disabled after a power-up self test failed., xrefs: 00F11F42
Cryptographic algorithms are disabled before the power-up self tests are performed., xrefs: 00F11F14

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: Cryptographic algorithms are disabled after a power-up self test failed.$Cryptographic algorithms are disabled before the power-up self tests are performed.
API String ID: 2005118841-3345525433
Opcode ID: 81b665c4e793fa9654d0776a753073f8f72f284352a5364b8d2f895eaebb3739
Instruction ID: fe80ad1759eb178441997270bd934aa187b68fd9c3feb151a2193d503075ebb6
Opcode Fuzzy Hash: 81b665c4e793fa9654d0776a753073f8f72f284352a5364b8d2f895eaebb3739
Instruction Fuzzy Hash: F7417371900249ABDB10DFA5CC42BDAB7F8FF05720F04462AE811A3641EB74AA44DBA0

Function 00F14980 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F14A6D

Strings

HashTransformation: can't truncate a , xrefs: 00F14A0B
byte digest to , xrefs: 00F14A16
bytes, xrefs: 00F14A3E

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: byte digest to $ bytes$HashTransformation: can't truncate a
API String ID: 2005118841-1139078987
Opcode ID: 645380d256355e3a9231c52a60ca2e36605361a7e8020071a654e969e1b43a43
Instruction ID: df782bb63ec71529285b6a577eecf4db3c7c42d296743de7d24da679934f8b2c
Opcode Fuzzy Hash: 645380d256355e3a9231c52a60ca2e36605361a7e8020071a654e969e1b43a43
Instruction Fuzzy Hash: B2319275A04258ABDB10EBA4CC45FCEBBFCEF49710F14416AF505E7282DB74AA0497A1

Function 00F17680 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F1772F

Strings

FilterWithBufferedInput: invalid buffer size, xrefs: 00F17706
TruncatedDigestSize, xrefs: 00F17779
PutMessage, xrefs: 00F17756

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: FilterWithBufferedInput: invalid buffer size$PutMessage$TruncatedDigestSize
API String ID: 2005118841-3547780871
Opcode ID: 587e5daf4a2db7f3ad2a4db478a72b5f399199acec4f88a62b0b135dc870d00d
Instruction ID: 6c478bb331656f318dbf6887660ce34efbce877af2b3aec08ce29f098cd57f55
Opcode Fuzzy Hash: 587e5daf4a2db7f3ad2a4db478a72b5f399199acec4f88a62b0b135dc870d00d
Instruction Fuzzy Hash: 3D31AF71604249AFCB14DF59C895EDABBF8FF49760F10462AF41997680DB30E909CBA1

Function 00EF2850 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

_Min_value.LIBCPMTD ref: 00EF28E4
allocator.LIBCONCRTD ref: 00EF28FB
construct.LIBCPMTD ref: 00EF2918

Strings

~, xrefs: 00EF2907, 00EF2940, 00EF2949, 00EF2899, 00EF28A5, 00EF28AE, 00EF289C, 00EF290A

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Min_valueallocatorconstruct
String ID: ~
API String ID: 3465976222-2493274609
Opcode ID: f4327397545a749a16d1aa053947306b274f9e35d6ad00eb5f4b087a49b6a937
Instruction ID: 6cd86469443c7e2e7795c50e9e6f6d20287bd90ddbf217dc555d2d24d4b2b7e7
Opcode Fuzzy Hash: f4327397545a749a16d1aa053947306b274f9e35d6ad00eb5f4b087a49b6a937
Instruction Fuzzy Hash: 1931B9B5D0020D9FCB44DFA9D8929EEB7F5BF48300F109569E516B7352DB31AA00CBA5

Function 00F6B17C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00F7B0D8,?,?,?,string too long,?,00EE4385,?,?,?,00EF6AED,ij,?,?), ref: 00F7583C
GetLastError.KERNEL32(00FC1570,00000010,00000003,00F7B0D8,?,?,?,string too long,?,00EE4385,?,?,?,00EF6AED,ij,?), ref: 00F75883
ExitThread.KERNEL32 ref: 00F7588A

Strings

w}, xrefs: 00F7587C

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ErrorExitFeatureLastPresentProcessorThread
String ID: w}
API String ID: 3213686812-1622563160
Opcode ID: 58ecc19e1be2d538ee0b3f730f620a9790c74aba111ff4eea8eb3c992635e3b9
Instruction ID: e170883e6955c946a6d271dc4fc37aeb931ed8591acbb5c218d7a5820d04e0ec
Opcode Fuzzy Hash: 58ecc19e1be2d538ee0b3f730f620a9790c74aba111ff4eea8eb3c992635e3b9
Instruction Fuzzy Hash: 8AF0A760A8070A77FA2237B05C1FBA936492F51F61F58441ABE4DAE0D3DFD8C541B2A3

Function 00F52500 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F52530
__CxxThrowException@8.LIBVCRUNTIME ref: 00F5253E

Strings

pScheduler, xrefs: 00F52528
version, xrefs: 00F52515

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 1687795959-3154422776
Opcode ID: 8726f724bc2f8ed7d5aa121a57b11c19c151726bafef111729f90ff15eb2ae78
Instruction ID: bb3eda99b01e3a4fdb7ead90092e6566680244f4ee58586f021aae6188b79810
Opcode Fuzzy Hash: 8726f724bc2f8ed7d5aa121a57b11c19c151726bafef111729f90ff15eb2ae78
Instruction Fuzzy Hash: 91E04F60D00208B6CB55FA90DC1AFCD3BA49B12745F4482217D01110D2D7B8D7CDEA82

Function 00F60F40 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::DestroyVirtualProcessorRoot.LIBCONCRT ref: 00F60F72
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F60F84
__CxxThrowException@8.LIBVCRUNTIME ref: 00F60F92

Strings

pScheduler, xrefs: 00F60F7C

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Concurrency::details::DestroyException@8ProcessorProxy::RootSchedulerThrowVirtualstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 1381464787-923244539
Opcode ID: 301e934ae8e83b6567851e8ce0ffb1529968395dc69d2a758a0acb6b59dd8bf4
Instruction ID: 2f6b2ef137359b18dd1436134b0bf9fa22150aa5fcae45bf76d8c0ea09db9102
Opcode Fuzzy Hash: 301e934ae8e83b6567851e8ce0ffb1529968395dc69d2a758a0acb6b59dd8bf4
Instruction Fuzzy Hash: 06F0A731A00204ABC728FB54DC52D9F77789F45700750452DB80257592DF68EA46F786

Function 00F5AFE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 00F5B002
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F5B015
__CxxThrowException@8.LIBVCRUNTIME ref: 00F5B023

Strings

pContext, xrefs: 00F5B00D

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Concurrency::details::Exception@8FreeIdleProxyProxy::ReturnThreadThrowstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 1990795212-2046700901
Opcode ID: d953c4341e09b32a07b3b22861411619b17f4d29f54da76f23142a6dee5575c7
Instruction ID: 9dc0412a25407b86ddc6a391c033754bd235f35b27faaf8dbae7d27e707ac4be
Opcode Fuzzy Hash: d953c4341e09b32a07b3b22861411619b17f4d29f54da76f23142a6dee5575c7
Instruction Fuzzy Hash: 2FE09B35F0010867CA04F765DC15D5E7BA95FC5B107044155ED1193241DFB4EA059AD1

Function 00F7F2DA Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00F7F365
__alldvrm.LIBCMT ref: 00F7F566
__alldvrm.LIBCMT ref: 00F7F588

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 4ca78e11cf294b3b2d14d721adefea74b05be274ade9bb73dfcb4a664288b0c4
Instruction ID: c11b8265fde756a82e23802b56078db66af10862c8430d1d256a4b8f8ebe55be
Opcode Fuzzy Hash: 4ca78e11cf294b3b2d14d721adefea74b05be274ade9bb73dfcb4a664288b0c4
Instruction Fuzzy Hash: 67A15C72D043869FDB11CF58C8817AEBBE5EF55320F18817FD5899B281C2388945E752

Function 00F8A6D8 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F8A807

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 55271c1468cb6ac7e88ac1bb57005905656487907342bac1147e0bba1e92e6aa
Instruction ID: dad0e778565dabf9c9904f70be26d050c0f0098a1e3e256881f6e37cb09a3773
Opcode Fuzzy Hash: 55271c1468cb6ac7e88ac1bb57005905656487907342bac1147e0bba1e92e6aa
Instruction Fuzzy Hash: 9441E531E005006AFB217B798C86BFE3AB5EF45B70F148167F498D6291EB784941B3A3

Function 00F7FF9D Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffcffd4628487df0536086eb531177fe6a5b6c73d78b86c3f0773d5b32c9e09f
Instruction ID: f0801e2e6e8ca73049cc8a444125c9ad8d64382508946e39971dd987bd8c2b68
Opcode Fuzzy Hash: ffcffd4628487df0536086eb531177fe6a5b6c73d78b86c3f0773d5b32c9e09f
Instruction Fuzzy Hash: 8E414072A00704AFD724BF78CC01BEA7BE8EB49720F10862AF155DB3C1DB759904A780

Function 00F812AD Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,0000007F,00FA62D8,00000000,00000000,8B56FF8B,00F787AF,?,00000000,00000001,00FA62D8,0000007F,?,8B56FF8B,00000001), ref: 00F812FA
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F81383
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00F81395
__freea.LIBCMT ref: 00F8139E

Part of subcall function 00F7F17C: RtlAllocateHeap.NTDLL(00000000,?,00000004,?,00F8172E,?,00000000,?,00F83CCB,?,00000004,00000000,?,?,?,00F7817F), ref: 00F7F1AE

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: bf0a2d7f9f4a6cb4dc5262e466b9506bdf2da7d93106f8224da9b62726137473
Instruction ID: 0a4ad71cb2f7bb085bc04567f73b00b06706abbb58f7f0b5eee6a4b79895e664
Opcode Fuzzy Hash: bf0a2d7f9f4a6cb4dc5262e466b9506bdf2da7d93106f8224da9b62726137473
Instruction Fuzzy Hash: BF31B232A0020AABDF259F65CC86EEE7BA9FB00710F044229FC04D7151E735CD55EB90

Function 00EFEF30 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fec547b8266444ee1ee5e9e1ea84f777429c2c3ab41cb3b2ed813755835111f
Instruction ID: be2cc1b7b5d63d1b7c47463717d09b27e3515f5a8d2e4d9e39266320e2c84fbe
Opcode Fuzzy Hash: 7fec547b8266444ee1ee5e9e1ea84f777429c2c3ab41cb3b2ed813755835111f
Instruction Fuzzy Hash: 3D31B8B5E0010CEFCB08DF94D9919AEB7F6BF88304B2055A9E505BB352DB31AE41DB91

Function 00F602C0 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000), ref: 00F6030A
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00F602F2

Part of subcall function 00F5806C: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00F5808D

__CxxThrowException@8.LIBVCRUNTIME ref: 00F6033B
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00F60373

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Context$Event$Base::Concurrency::details::$ThrowTrace$Exception@8
String ID:
API String ID: 2630251706-0
Opcode ID: 2d3dcd6fadd25722fca88f68766253a761bc7c65f793b7286f8cd119bcc1f2e7
Instruction ID: 789065cc803db52a39f7600a843ae72ecfa8793589747e2701066ecd0375e8bf
Opcode Fuzzy Hash: 2d3dcd6fadd25722fca88f68766253a761bc7c65f793b7286f8cd119bcc1f2e7
Instruction Fuzzy Hash: 5C112B35700204ABCF10AB65DC86E6E7B68EF48771B1000A5FE069B3D2CFB4DD05EA90

Function 00EFD438 Relevance: 6.1, APIs: 4, Instructions: 80fileCOMMON

Download Yara Rule

APIs

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00EFD451
FindNextFileW.KERNEL32(000000FF,?), ref: 00EFD511
FindClose.KERNEL32(000000FF), ref: 00EFD526
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00EFD569

Part of subcall function 00EFCE60: FindFirstFileW.KERNEL32(00000000,?), ref: 00EFCEEC

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Find$File$Affinity::operator!=CloseConcurrency::details::Container_base12Container_base12::~_FirstHardwareNextstd::_
String ID:
API String ID: 339435691-0
Opcode ID: 084d305f13d0ec58eeb5f2988f4ce7903eb1d8373eb3e6264ed45af8f63a3d45
Instruction ID: cb6a039407f560b5049044cd7974ed72697835412d60f15deb308a4319f0b986
Opcode Fuzzy Hash: 084d305f13d0ec58eeb5f2988f4ce7903eb1d8373eb3e6264ed45af8f63a3d45
Instruction Fuzzy Hash: F1316D71C0424DDBCB15EBA4CD46AFEBBB9AF54304F5090D9A219B7192EB301B48DF91

Function 00F4A508 Relevance: 6.1, APIs: 4, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00F4A560
__Xtime_diff_to_millis2.LIBCPMT ref: 00F4A57A
_xtime_get.LIBCPMT ref: 00F4A59D
__Xtime_diff_to_millis2.LIBCPMT ref: 00F4A5A9

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: fa5f165dccfe631c77a85a3bb37341925897d766f65fad93444da150e09a7c73
Instruction ID: ab04de48e2842f13a28e3a857d13da89f54b4ce81b07a2a60aef8c9b1ca294a9
Opcode Fuzzy Hash: fa5f165dccfe631c77a85a3bb37341925897d766f65fad93444da150e09a7c73
Instruction Fuzzy Hash: 13214A75E0011D9FDF00EFA8DD829BEBBB8AF08714F044059FD01A7261DB74AD02ABA1

Function 00EFD443 Relevance: 6.1, APIs: 4, Instructions: 79fileCOMMON

Download Yara Rule

APIs

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00EFD451
FindNextFileW.KERNEL32(000000FF,?), ref: 00EFD511
FindClose.KERNEL32(000000FF), ref: 00EFD526
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00EFD569

Part of subcall function 00EFCE60: FindFirstFileW.KERNEL32(00000000,?), ref: 00EFCEEC

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Find$File$Affinity::operator!=CloseConcurrency::details::Container_base12Container_base12::~_FirstHardwareNextstd::_
String ID:
API String ID: 339435691-0
Opcode ID: e32d03f86cba9cb6da8424e65d93f539a07975625ca1743d8baa0d0ef78341d3
Instruction ID: 5453008b428b6d021e899e17a013300d66e6402c9826e0fc7832eedd0a2f6872
Opcode Fuzzy Hash: e32d03f86cba9cb6da8424e65d93f539a07975625ca1743d8baa0d0ef78341d3
Instruction Fuzzy Hash: 62317C71C0424DDBCB15EBA4CD46AFEBBB9AF54304F5090D9A219B7192EB301B48DF91

Function 00F0B470 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

std::locale::c_str.LIBCPMTD ref: 00F0B4D9
std::_Locinfo::_Locinfo.LIBCPMTD ref: 00F0B4E2

Part of subcall function 00EEA270: std::_Lockit::_Lockit.LIBCPMT ref: 00EEA2A3
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2B5
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2C4
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2D3
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2E2
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2F1
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA300
Part of subcall function 00EEA270: std::bad_exception::bad_exception.LIBCMTD ref: 00EEA317
Part of subcall function 00EEA270: __CxxThrowException@8.LIBVCRUNTIME ref: 00EEA325
Part of subcall function 00EEA270: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00EEA332

numpunct.LIBCPMTD ref: 00F0B50E

Part of subcall function 00F05E20: Concurrency::details::GlobalCore::TopologyObject::TopologyObject.LIBCMTD ref: 00F05E4D

std::_Locinfo::~_Locinfo.LIBCPMTD ref: 00F0B54A

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Yarn$std::_$LocinfoLocinfo::_Topology$Concurrency::details::Core::Exception@8GlobalLocinfo::~_Locinfo_ctorLockitLockit::_ObjectObject::Thrownumpunctstd::bad_exception::bad_exceptionstd::locale::c_str
String ID:
API String ID: 2130324186-0
Opcode ID: a1e4f3daf7f912b8a40f29c2931646050ceeeaff80aec4113614c10424925605
Instruction ID: 6d19e48bbf63f6406bedf0b4abd0e7b769edf2374f4de6e410bb6c81c4845b9e
Opcode Fuzzy Hash: a1e4f3daf7f912b8a40f29c2931646050ceeeaff80aec4113614c10424925605
Instruction Fuzzy Hash: CD3118B0D00209DBDB04DF98C842BEEBBB1FB48714F248269E4157B3D4D7756A04DB91

Function 00EF3F20 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

std::locale::c_str.LIBCPMTD ref: 00EF3F89
std::_Locinfo::_Locinfo.LIBCPMTD ref: 00EF3F92

Part of subcall function 00EEA270: std::_Lockit::_Lockit.LIBCPMT ref: 00EEA2A3
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2B5
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2C4
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2D3
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2E2
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2F1
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA300
Part of subcall function 00EEA270: std::bad_exception::bad_exception.LIBCMTD ref: 00EEA317
Part of subcall function 00EEA270: __CxxThrowException@8.LIBVCRUNTIME ref: 00EEA325
Part of subcall function 00EEA270: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00EEA332

numpunct.LIBCPMTD ref: 00EF3FBE

Part of subcall function 00EE8770: Concurrency::details::GlobalCore::TopologyObject::TopologyObject.LIBCMTD ref: 00EE879D

std::_Locinfo::~_Locinfo.LIBCPMTD ref: 00EF3FFA

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Yarn$std::_$LocinfoLocinfo::_Topology$Concurrency::details::Core::Exception@8GlobalLocinfo::~_Locinfo_ctorLockitLockit::_ObjectObject::Thrownumpunctstd::bad_exception::bad_exceptionstd::locale::c_str
String ID:
API String ID: 2130324186-0
Opcode ID: 55916ccba2ede033d3664a567f802eff4348aecba69bc66a1470f917a13a1244
Instruction ID: a18a2fa633ef4733f1760bd833c701f8a47b5e24254bc02c2707247e6696a450
Opcode Fuzzy Hash: 55916ccba2ede033d3664a567f802eff4348aecba69bc66a1470f917a13a1244
Instruction Fuzzy Hash: 1931E871E0420DDBDB04DFA4C942BEEBBB1FB44714F204269E5257B390DB755A44CB91

Function 00F0B380 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

std::locale::c_str.LIBCPMTD ref: 00F0B3DF
std::_Locinfo::_Locinfo.LIBCPMTD ref: 00F0B3E8

Part of subcall function 00EEA270: std::_Lockit::_Lockit.LIBCPMT ref: 00EEA2A3
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2B5
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2C4
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2D3
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2E2
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2F1
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA300
Part of subcall function 00EEA270: std::bad_exception::bad_exception.LIBCMTD ref: 00EEA317
Part of subcall function 00EEA270: __CxxThrowException@8.LIBVCRUNTIME ref: 00EEA325
Part of subcall function 00EEA270: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00EEA332

ctype.LIBCPMTD ref: 00F0B412

Part of subcall function 00F05DB0: Concurrency::details::GlobalCore::TopologyObject::TopologyObject.LIBCMTD ref: 00F05DDD

std::_Locinfo::~_Locinfo.LIBCPMTD ref: 00F0B44E

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Yarn$std::_$LocinfoLocinfo::_Topology$Concurrency::details::Core::Exception@8GlobalLocinfo::~_Locinfo_ctorLockitLockit::_ObjectObject::Throwctypestd::bad_exception::bad_exceptionstd::locale::c_str
String ID:
API String ID: 1157453502-0
Opcode ID: e003fbb200a9e6d59ba3e5b5fc160c5de64ee07b4b3684d3a9060f3f8ddb78d3
Instruction ID: 03275b63a0874344d8eba3929f8905c9d281de56b2d33578a3cc75a0fcd59334
Opcode Fuzzy Hash: e003fbb200a9e6d59ba3e5b5fc160c5de64ee07b4b3684d3a9060f3f8ddb78d3
Instruction Fuzzy Hash: 1831F2B0D04209DBDB04CF98D845BAEBBB0FB48320F208269E425AB391D7756A04DB95

Function 00EF3A70 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

std::locale::c_str.LIBCPMTD ref: 00EF3ACF
std::_Locinfo::_Locinfo.LIBCPMTD ref: 00EF3AD8

Part of subcall function 00EEA270: std::_Lockit::_Lockit.LIBCPMT ref: 00EEA2A3
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2B5
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2C4
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2D3
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2E2
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2F1
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA300
Part of subcall function 00EEA270: std::bad_exception::bad_exception.LIBCMTD ref: 00EEA317
Part of subcall function 00EEA270: __CxxThrowException@8.LIBVCRUNTIME ref: 00EEA325
Part of subcall function 00EEA270: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00EEA332

ctype.LIBCPMTD ref: 00EF3B02

Part of subcall function 00EE8410: std::bad_exception::bad_exception.LIBCMTD ref: 00EE843D

std::_Locinfo::~_Locinfo.LIBCPMTD ref: 00EF3B3E

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Yarn$std::_$LocinfoLocinfo::_std::bad_exception::bad_exception$Exception@8Locinfo::~_Locinfo_ctorLockitLockit::_Throwctypestd::locale::c_str
String ID:
API String ID: 1422144976-0
Opcode ID: 81ceccfb8ef556c547d1be68d01ba1bbad5ea6dc966851e733e3ac509a8b6ea1
Instruction ID: d6aa681b135508c782c268a894a8dd3e2274225d651ba97c4a697df80afaaa81
Opcode Fuzzy Hash: 81ceccfb8ef556c547d1be68d01ba1bbad5ea6dc966851e733e3ac509a8b6ea1
Instruction Fuzzy Hash: D931F5B0D0420DDBDB14DF98C955BEEBBB0FB48314F208269E4297B390D7756A04CB91

Function 00EF3B60 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

std::locale::c_str.LIBCPMTD ref: 00EF3BBF
std::_Locinfo::_Locinfo.LIBCPMTD ref: 00EF3BC8

Part of subcall function 00EEA270: std::_Lockit::_Lockit.LIBCPMT ref: 00EEA2A3
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2B5
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2C4
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2D3
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2E2
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2F1
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA300
Part of subcall function 00EEA270: std::bad_exception::bad_exception.LIBCMTD ref: 00EEA317
Part of subcall function 00EEA270: __CxxThrowException@8.LIBVCRUNTIME ref: 00EEA325
Part of subcall function 00EEA270: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00EEA332

ctype.LIBCPMTD ref: 00EF3BF2

Part of subcall function 00EE8480: std::bad_exception::bad_exception.LIBCMTD ref: 00EE84AD

std::_Locinfo::~_Locinfo.LIBCPMTD ref: 00EF3C2E

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Yarn$std::_$LocinfoLocinfo::_std::bad_exception::bad_exception$Exception@8Locinfo::~_Locinfo_ctorLockitLockit::_Throwctypestd::locale::c_str
String ID:
API String ID: 1422144976-0
Opcode ID: 26e0b6c6a17ab5482757356a7c651c53e6ef0014fd1add214509c1a87f338543
Instruction ID: 2607ecf543798a8546228f797c2374c3d60e4b6f33afd0a96ba8a578a944912f
Opcode Fuzzy Hash: 26e0b6c6a17ab5482757356a7c651c53e6ef0014fd1add214509c1a87f338543
Instruction Fuzzy Hash: 3C31F6B1D0424DDBDB04CF98D945BEEBBB0FB48314F208269E5257B390D7756A40CB91

Function 00EF3C50 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

std::locale::c_str.LIBCPMTD ref: 00EF3CAF
std::_Locinfo::_Locinfo.LIBCPMTD ref: 00EF3CB8

Part of subcall function 00EEA270: std::_Lockit::_Lockit.LIBCPMT ref: 00EEA2A3
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2B5
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2C4
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2D3
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2E2
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA2F1
Part of subcall function 00EEA270: _Yarn.LIBCPMTD ref: 00EEA300
Part of subcall function 00EEA270: std::bad_exception::bad_exception.LIBCMTD ref: 00EEA317
Part of subcall function 00EEA270: __CxxThrowException@8.LIBVCRUNTIME ref: 00EEA325
Part of subcall function 00EEA270: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00EEA332

ctype.LIBCPMTD ref: 00EF3CE2

Part of subcall function 00EE84F0: std::bad_exception::bad_exception.LIBCMTD ref: 00EE851D
Part of subcall function 00EE84F0: ctype.LIBCPMTD ref: 00EE8539

std::_Locinfo::~_Locinfo.LIBCPMTD ref: 00EF3D1E

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Yarn$std::_$LocinfoLocinfo::_ctypestd::bad_exception::bad_exception$Exception@8Locinfo::~_Locinfo_ctorLockitLockit::_Throwstd::locale::c_str
String ID:
API String ID: 1516229762-0
Opcode ID: 14dd076b6bc1ca5d8e359dbf6ebff4aac34f250100c736c43c2c0ced6b0effe7
Instruction ID: 487b4b7402cae20e25c71db7de0c9cbbf6f3a6a7ae840fc48651b0a90036e18f
Opcode Fuzzy Hash: 14dd076b6bc1ca5d8e359dbf6ebff4aac34f250100c736c43c2c0ced6b0effe7
Instruction Fuzzy Hash: 2531F5B0D0420DDBDB14CF98D942BEEBBB0FB48314F208269E9257B390D775AA44CB91

Function 00EFEB50 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

fpos.LIBCPMTD ref: 00EFEB66
fpos.LIBCPMTD ref: 00EFEBA7
fpos.LIBCPMTD ref: 00EFEBB8
fpos.LIBCPMTD ref: 00EFEBE9

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: fpos
String ID:
API String ID: 1083263101-0
Opcode ID: 2940f14d879cae719aad962084223604116b83c4b1bcb981bee6cb6489dae3e4
Instruction ID: c52c1e6efffcf35f2cba71abe9f4b38153c042a6a09160e9e046794c88082c87
Opcode Fuzzy Hash: 2940f14d879cae719aad962084223604116b83c4b1bcb981bee6cb6489dae3e4
Instruction Fuzzy Hash: 1E21ED75A1010D9FCB18DF99D891DBEB7B5BF48310F508659EA166B3A1EB30A900CB90

Function 00EFEC10 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

fpos.LIBCPMTD ref: 00EFEC26
fpos.LIBCPMTD ref: 00EFEC67
fpos.LIBCPMTD ref: 00EFEC78
fpos.LIBCPMTD ref: 00EFECA9

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: fpos
String ID:
API String ID: 1083263101-0
Opcode ID: 014eca1b517fdd09a2c35a507b61ead8ad0c116645a131cf4b5e2b16a66a6c0f
Instruction ID: 107730c83ca52eff0f17e434e7988122277d19c8e13858539cb21a8313e86578
Opcode Fuzzy Hash: 014eca1b517fdd09a2c35a507b61ead8ad0c116645a131cf4b5e2b16a66a6c0f
Instruction Fuzzy Hash: 4B21FF75A1010DAFCB14DF99D891DFEB7B5BF48310F108659FA196B3A1EB31A900CB90

Function 00F77D82 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81ac45cd1b64f169521f26da034f0fd29de495c90cef56b7de6384695798fd2
Instruction ID: add2ea0ba17b53442f1b9882e996d113f3c2bc6c327a3d38f073fe710346ee49
Opcode Fuzzy Hash: a81ac45cd1b64f169521f26da034f0fd29de495c90cef56b7de6384695798fd2
Instruction Fuzzy Hash: 8901D4B26193167EE62136786CC1F3B360CDF81774B208327F039511D5EB648C006162

Function 00F4FC22 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::LoadLibraryAndCreateThread.LIBCONCRT ref: 00F4FC3B

Part of subcall function 00F4EF9D: ___crtGetTimeFormatEx.LIBCMT ref: 00F4EFB3
Part of subcall function 00F4EF9D: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 00F4EFD2

GetLastError.KERNEL32 ref: 00F4FC57
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00F4FC6D
__CxxThrowException@8.LIBVCRUNTIME ref: 00F4FC7B

Part of subcall function 00F4ED72: SetThreadPriority.KERNEL32(?,?), ref: 00F4ED7E

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Concurrency::details::LibraryLoadThread$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorException@8FormatLastPriorityReferenceThrowTime___crt
String ID:
API String ID: 1674182817-0
Opcode ID: b1c95dae58cf92c515ba1a8b9cc8d88947404cc759d0a757a274e5d790d0a3e5
Instruction ID: cfdec35421ec2819d2761411f7d4343783d0f68a4742768b52149823f01feaf5
Opcode Fuzzy Hash: b1c95dae58cf92c515ba1a8b9cc8d88947404cc759d0a757a274e5d790d0a3e5
Instruction Fuzzy Hash: 09F0A7B1D403297AE720B7755D07FBB3E9CAB01750F50082ABD45E6082EDA9E40462B5

Function 00F6B479 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00F6B493

Part of subcall function 00F6B3E0: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00F6B40F
Part of subcall function 00F6B3E0: ___AdjustPointer.LIBCMT ref: 00F6B42A

_UnwindNestedFrames.LIBCMT ref: 00F6B4A8
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00F6B4B9
CallCatchBlock.LIBVCRUNTIME ref: 00F6B4E1

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: d58634da3e734018c52a7c6b7b39953d9d403735a9096aa41e010e61aa0dc9b3
Instruction ID: dfa4db1214dfa9368c58382234be6ea0bb18bc627876441ffc711610e8f7e3ea
Opcode Fuzzy Hash: d58634da3e734018c52a7c6b7b39953d9d403735a9096aa41e010e61aa0dc9b3
Instruction Fuzzy Hash: D3014032500109BBCF119E95CC42DEF3B7DEF88754F044004FE0896122DB36E9A1EBA0

Function 00F7CA68 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,00F7CA0F,00000000,00000000,00000000,00000000,?,00F7CD3B,00000006,FlsSetValue), ref: 00F7CA9A
GetLastError.KERNEL32(?,00F7CA0F,00000000,00000000,00000000,00000000,?,00F7CD3B,00000006,FlsSetValue,00FA6B80,FlsSetValue,00000000,00000364,?,00F7B127), ref: 00F7CAA6
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00F7CA0F,00000000,00000000,00000000,00000000,?,00F7CD3B,00000006,FlsSetValue,00FA6B80,FlsSetValue,00000000), ref: 00F7CAB4

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 5ef1cd16805d1a57a9f5291c6f4512bf90cd1dfe3bc1aac33373975fc6316abc
Instruction ID: 53dc1c87694e6a8eb6a11dc928d859cf16194f67c92e929df4303fedd5bd32bf
Opcode Fuzzy Hash: 5ef1cd16805d1a57a9f5291c6f4512bf90cd1dfe3bc1aac33373975fc6316abc
Instruction Fuzzy Hash: C001D433A0162EABD722DB689C54B573B98EB05BB2728412BF90AD3140D624D801E7E1

Function 00F62E35 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00F62E4F
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 00F62E63
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00F62E7B
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00F62E93

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: 0bcfc0b340291fcbe34dfbc81162e43a5ece5e105f1087a9ff9ae7cba2b57d5e
Instruction ID: 6a8afa904afa2ff8bfa60739b3e6f675789872d2aeb4661808027f5c68741f83
Opcode Fuzzy Hash: 0bcfc0b340291fcbe34dfbc81162e43a5ece5e105f1087a9ff9ae7cba2b57d5e
Instruction Fuzzy Hash: BC01F932700915A7CF56EEA5CC51AEF7799AFA4760F000066FD15AB281DA36ED10B6E0

Function 00F4A5F0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4E1E6
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00F4E1F9

Part of subcall function 00F4D06B: Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 00F4D07E
Part of subcall function 00F4D06B: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00F4D088

Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 00F4E212
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00F4E258

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Concurrency::details::Concurrency::details::_LockLock::_Node::QueueScoped_lock$Acquire_lockConcurrency::critical_section::_EventH_prolog3NodeReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter
String ID:
API String ID: 1424302493-0
Opcode ID: edb54e4ee5ca978a6761ddd9cd4857f826ec54097b116038c11b28f05b9afd31
Instruction ID: 579e2d5cc690f6b441b4a9ad4d14d617ff846609c2f32790ab7d7240f7c36c2e
Opcode Fuzzy Hash: edb54e4ee5ca978a6761ddd9cd4857f826ec54097b116038c11b28f05b9afd31
Instruction Fuzzy Hash: E901B575D011218BDF15ABA4C9447BDBB76BFC8710F190054DC116B346DBB8AE05EB91

Function 00F4BBC0 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00FCB794,?,?,00F3359F,00FCAEB8,00F948A0,00000001), ref: 00F4BBCA
LeaveCriticalSection.KERNEL32(00FCB794,?,00F3359F,00FCAEB8,00F948A0,00000001), ref: 00F4BBFD
SetEvent.KERNEL32(00000000,00FCAEB8,00F948A0,00000001), ref: 00F4BC8B
ResetEvent.KERNEL32 ref: 00F4BC97

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: CriticalEventSection$EnterLeaveReset
String ID:
API String ID: 3553466030-0
Opcode ID: 70bbf25277538a6df5c7e3a67edd1d915793d7c9b0629f328572aab37a8d2b57
Instruction ID: 46b49c33b133eaaeccf3f548f9594ab4a43868b99a2c986639ea38ffae9c661c
Opcode Fuzzy Hash: 70bbf25277538a6df5c7e3a67edd1d915793d7c9b0629f328572aab37a8d2b57
Instruction Fuzzy Hash: B6012C35A04529DFCB059F14EE5BD997BA8FF89B41B05805AED0297320CB309900AF94

Function 00F58819 Relevance: 6.0, APIs: 4, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00F5884B
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00F5885B
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00F5886B
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00F5887F

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Compare_exchange_acquire_4std::_
String ID:
API String ID: 3973403980-0
Opcode ID: 0afb5701640ffc842da03f69a85d025ba205578d75e5f186f253663f98ddd670
Instruction ID: 671560650af4e73cf650c408f4623d9b72213a61c6530edf1dc3d7d6897da641
Opcode Fuzzy Hash: 0afb5701640ffc842da03f69a85d025ba205578d75e5f186f253663f98ddd670
Instruction Fuzzy Hash: 1501BB77400109BBCF119E54DC0299D3B66EF553A3B588515FE18A4531DB32C67AFB41

Function 00F4ECDE Relevance: 6.0, APIs: 4, Instructions: 29registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegisterWaitForSingleObject.KERNEL32(?,00000000,00F60140,000000A4,000000FF,0000000C), ref: 00F4ECF5
GetLastError.KERNEL32(?,?,?,?,00F54E00,?,?,?,?,00000000,?,00000000), ref: 00F4ED04
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00F4ED1A
__CxxThrowException@8.LIBVCRUNTIME ref: 00F4ED28

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastObjectRegisterSingleThrowWait
String ID:
API String ID: 3803302727-0
Opcode ID: 22ecc54a98718448af2a9880e652dcb94aca9405fed7c76864410bc4212b0cf8
Instruction ID: 53d3c3d7bd696e6c7517fe0af10b5ae1aef2a3aa6e256d7a9d984b0e0cb06bd4
Opcode Fuzzy Hash: 22ecc54a98718448af2a9880e652dcb94aca9405fed7c76864410bc4212b0cf8
Instruction Fuzzy Hash: 7EF0307190020EFBCF01EFA4DD0AFAF7B787B04710F604615B911E60A1DA35DA14A761

Function 00F4EA03 Relevance: 6.0, APIs: 4, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCreateEventExW.LIBCPMT ref: 00F4EA19
GetLastError.KERNEL32(?,?,?,?,?,00F4D153), ref: 00F4EA27
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00F4EA3D
__CxxThrowException@8.LIBVCRUNTIME ref: 00F4EA4B

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorEventException@8LastThrow___crt
String ID:
API String ID: 200240550-0
Opcode ID: a61da376bb2ca847e3ea73d2f88eb70ce51f9ed363cda5812fe577044f85aba8
Instruction ID: e651d4aa19cec0e0f86a557ff2727d151cbcccb0f900450cd56e3a8e641fa59b
Opcode Fuzzy Hash: a61da376bb2ca847e3ea73d2f88eb70ce51f9ed363cda5812fe577044f85aba8
Instruction Fuzzy Hash: 0AE086A1E4031AAAE710B7B59D07F7B3EAC7B00B40F840865BD15E51D3FE6CEA0462A5

Function 00F55B43 Relevance: 6.0, APIs: 4, Instructions: 26memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F4EDDF: TlsAlloc.KERNEL32(?,00F4D153), ref: 00F4EDE5

TlsAlloc.KERNEL32(?,00F4D153), ref: 00F605A2
GetLastError.KERNEL32 ref: 00F605B4
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00F605CA
__CxxThrowException@8.LIBVCRUNTIME ref: 00F605D8

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Alloc$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3735082963-0
Opcode ID: 02838ae9af5487ee04d08a49934713654a6461f73716c316c1aa85cb8c7bf09b
Instruction ID: 8736ac0d55218ea310d706c7dca0e1aeea9b2f06c6f7c4c446ce3f3da205e77a
Opcode Fuzzy Hash: 02838ae9af5487ee04d08a49934713654a6461f73716c316c1aa85cb8c7bf09b
Instruction Fuzzy Hash: 7AE01B7480031D97C704BB745D17F7B3A787604754B640E15B416D21B2EF38D915BB65

Function 00F4EC1A Relevance: 6.0, APIs: 4, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetNumaHighestNodeNumber.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,00F4D153), ref: 00F4EC24
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,00F4D153), ref: 00F4EC33
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00F4EC49
__CxxThrowException@8.LIBVCRUNTIME ref: 00F4EC57

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8HighestLastNodeNumaNumberThrow
String ID:
API String ID: 3016159387-0
Opcode ID: cd63d33e6b81e1703c8acb560f372417c8a4ce979b3144788d20808399c26bac
Instruction ID: 7d7f9a8e78ac8500d4aa0cd20e4cacdd5430eef1c15a31c4f5862ff790c99cdc
Opcode Fuzzy Hash: cd63d33e6b81e1703c8acb560f372417c8a4ce979b3144788d20808399c26bac
Instruction Fuzzy Hash: ABE04F70E0020EE7CB00FBB49E4AFAF76BC6B00B04B500465A501E2051EE68EA08A7A5

Function 00F4ED72 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

SetThreadPriority.KERNEL32(?,?), ref: 00F4ED7E
GetLastError.KERNEL32 ref: 00F4ED8A
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00F4EDA0
__CxxThrowException@8.LIBVCRUNTIME ref: 00F4EDAE

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastPriorityThreadThrow
String ID:
API String ID: 4286982218-0
Opcode ID: 7ab89ad02badde7a4f5d5e5b90c7553966cd2914a7716983ee2d5bb1f054f1bd
Instruction ID: f9c94594f98afd6fe81e28b9fa23e84bcb6648a7122bb1e472c43f8d2a5e8024
Opcode Fuzzy Hash: 7ab89ad02badde7a4f5d5e5b90c7553966cd2914a7716983ee2d5bb1f054f1bd
Instruction Fuzzy Hash: 0BE04F7090011AB7CB01BB71DC06FBA3A787B00740B404815B951D10A2DA39D514A794

Function 00F4EE38 Relevance: 6.0, APIs: 4, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,00000000,00F54177,00000000,?,?,00F4D153,?,?,?,00000000,?,00000000), ref: 00F4EE44
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 00F4EE50
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00F4EE66
__CxxThrowException@8.LIBVCRUNTIME ref: 00F4EE74

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrowValue
String ID:
API String ID: 1964976909-0
Opcode ID: 4133e7ca205f4f65e4c60915271b330ac850c8ce1b236f52a69e6bb6c33f0f07
Instruction ID: 8aa00c7b6cba9e9288943896f168709d70684aa8ef4bd005438d2c73b9655688
Opcode Fuzzy Hash: 4133e7ca205f4f65e4c60915271b330ac850c8ce1b236f52a69e6bb6c33f0f07
Instruction Fuzzy Hash: 08E0863090021AE7CB01BFB0DC06FBA3B6C7F00B40F404815B815D10A2DE39D514B7A4

Function 00F4EDDF Relevance: 6.0, APIs: 4, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,00F4D153), ref: 00F4EDE5
GetLastError.KERNEL32 ref: 00F4EDF2
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00F4EE08
__CxxThrowException@8.LIBVCRUNTIME ref: 00F4EE16

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: AllocConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3103352999-0
Opcode ID: 8f24bdcd7e976e46bb979e0c15f1fb0b2663a59d3870cc79756124a8261fa6de
Instruction ID: 3d746eed90b89c22426d0fae02badce77bf548fdb7d5d80db111a676ccfdde57
Opcode Fuzzy Hash: 8f24bdcd7e976e46bb979e0c15f1fb0b2663a59d3870cc79756124a8261fa6de
Instruction Fuzzy Hash: 37E01270D0022A978700FBB49D0AFBA3A687A00724F900E15F426D10E2EE68D419A7E5

Function 00F75F1D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00F75FAD

Strings

pow, xrefs: 00F75F85, 00F75FA2

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: fc575933a48d9a4b826dd1b5c96b0579643bf36ada9385edfb10adf9d795787b
Instruction ID: a5b184ee73203a706d82a03d3c5ce7d7be646acf38333fe2ebf4a91d534edc58
Opcode Fuzzy Hash: fc575933a48d9a4b826dd1b5c96b0579643bf36ada9385edfb10adf9d795787b
Instruction Fuzzy Hash: 4D516E71D08A0597CB117B14CD013ED3794DB40B60F20CD5BE49A862EAEB359C95BB47

Function 00F199D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

0, xrefs: 00F19A89

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ef79a77f82df5b81391f8737d968a26479d127df1af2bb54805a18de91f68206
Instruction ID: f71763b6c55f6665911c07d68d23c453a9e15a0aa2c773f12b5ce73252cf432b
Opcode Fuzzy Hash: ef79a77f82df5b81391f8737d968a26479d127df1af2bb54805a18de91f68206
Instruction Fuzzy Hash: EA51BF71D042598BDF14CFA8C8917EEBBB5FF88314F108219E855B7281D7B8AA85DB90

Function 00F165C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F1672D

Strings

StreamTransformationFilter: please use AuthenticatedEncryptionFilter and AuthenticatedDecryptionFilter for AuthenticatedSymmetricCipher, xrefs: 00F16707
BlockPaddingScheme, xrefs: 00F166BD

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: BlockPaddingScheme$StreamTransformationFilter: please use AuthenticatedEncryptionFilter and AuthenticatedDecryptionFilter for AuthenticatedSymmetricCipher
API String ID: 2005118841-3582606076
Opcode ID: a92c3a7412745e5e2c2f09406e09c17a506662c004e10927dd94956d3d755294
Instruction ID: 87cf4b761b79ca9a5abbbac18c343ae2c6c984559827b0a77a7b55d0db9ec349
Opcode Fuzzy Hash: a92c3a7412745e5e2c2f09406e09c17a506662c004e10927dd94956d3d755294
Instruction Fuzzy Hash: FD41ADB0A00749EFDB04DFA8C845B9DBBF4FF49714F10415AE811AB392DBB5AA04DB91

Function 00F658D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00F65903
__IsNonwritableInCurrentImage.LIBCMT ref: 00F659BC

Strings

csm, xrefs: 00F659A6

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 087f2dabeea2a9bb7e75bdd02ed2699e3c11bbe5c0527f471e5131567a244694
Instruction ID: 9732ca08725aa039a94e740077f9720cb908f18ec854da2fb633d0b993f51bf4
Opcode Fuzzy Hash: 087f2dabeea2a9bb7e75bdd02ed2699e3c11bbe5c0527f471e5131567a244694
Instruction Fuzzy Hash: D141D030E00609EBCF00DF68CC85AAEBBB4AF45B38F148155E854AB392D735DA05EB90

Function 00EF2C30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 00EF2C9D
codecvt.LIBCPMTD ref: 00EF2CD9

Strings

, xrefs: 00EF2CB3

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: char_traitscodecvt
String ID:
API String ID: 1910604377-3916222277
Opcode ID: 6b50e6bac75003f867868def2231c8cb945ec3f5c48e75274ac3c577a1f4ffd2
Instruction ID: 2cb3ea0c4f0df070bd7d7a042764a17ab977edbba737b8c1f8b25b3f03c56bd0
Opcode Fuzzy Hash: 6b50e6bac75003f867868def2231c8cb945ec3f5c48e75274ac3c577a1f4ffd2
Instruction Fuzzy Hash: 5C413370D0121CAFCB08CFA4D895AEDBBB5BF48304F14A05DEA06BB295DB31A946DB50

Function 00EF2D60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

char_traits.LIBCPMTD ref: 00EF2DD1
codecvt.LIBCPMTD ref: 00EF2E0D

Strings

, xrefs: 00EF2DE7

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: char_traitscodecvt
String ID:
API String ID: 1910604377-3916222277
Opcode ID: bad16d2c2507ceb75cb5f6871203de844d7d3e41b1b1dc4d0878b41878cd026b
Instruction ID: ee2d8dc5ea9e8b020d69e718f4ed9409aa539bdb614390bc5b01393517b4a325
Opcode Fuzzy Hash: bad16d2c2507ceb75cb5f6871203de844d7d3e41b1b1dc4d0878b41878cd026b
Instruction Fuzzy Hash: 00412475D1420DEBCF19DFA4D894AEEB7B5BF48304F24615EE602BB241DB30A905DB90

Function 00F18830 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F1892B

Strings

StringStore: missing InputBuffer argument, xrefs: 00F18905
InputBuffer, xrefs: 00F18891

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: InputBuffer$StringStore: missing InputBuffer argument
API String ID: 2005118841-2380213735
Opcode ID: 2619582d266febf0652f34f492f0b27fbea5fd341b43fd23e8a920c0a3f294b6
Instruction ID: cd3786159205b2864525d2bae0499705094d4c011d6181fe9867bbe095b870ed
Opcode Fuzzy Hash: 2619582d266febf0652f34f492f0b27fbea5fd341b43fd23e8a920c0a3f294b6
Instruction Fuzzy Hash: B0317C71A00348DFDB10DF98C895BDEBBF4EF49710F108169E415AB381DB75AA08DB91

Function 00F172EA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F174CC

Strings

StreamTransformationFilter: W3C_PADDING cannot be used with , xrefs: 00F173B0
BlockPaddingScheme, xrefs: 00F17346

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: BlockPaddingScheme$StreamTransformationFilter: W3C_PADDING cannot be used with
API String ID: 2005118841-4002109100
Opcode ID: 647e7ed8ed13460a6d764e054c3f84630a5b531f171537f49f473f237577c543
Instruction ID: 4b3284f4b5bfa5d4de17533da639dafbb21d30b0fef6498d114929d2e08081b1
Opcode Fuzzy Hash: 647e7ed8ed13460a6d764e054c3f84630a5b531f171537f49f473f237577c543
Instruction Fuzzy Hash: 65218B71D04219EBDB10EF54CD81FDABBB8FB09710F0045A5E819A7650D730AE88EBA1

Function 00F191A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F19274

Strings

Resynchronize, xrefs: 00F19256
key is set, xrefs: 00F19251

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: Resynchronize$key is set
API String ID: 2005118841-370131452
Opcode ID: 69d5963a94b304a0e55ff8fcabca0f20ca16ff7d439de257ad470c80fad4330c
Instruction ID: 2e9adb2d8544b12e6534d50145f531b225b5399a5ea0fe0ac1e87262a52c0b52
Opcode Fuzzy Hash: 69d5963a94b304a0e55ff8fcabca0f20ca16ff7d439de257ad470c80fad4330c
Instruction Fuzzy Hash: 76317AB160060ABFDB00DF51C989BAAFBB8FF48714F004519E81557A80CBB9E528DF90

Function 00F85791 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00F859EC,?,00000050,?,?,?,?,?), ref: 00F8586C

Strings

ACP, xrefs: 00F857AF
OCP, xrefs: 00F857E5

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: d932a31beddd07e59858c09836a26540660a436bc22808305d963a449d4982e1
Instruction ID: dc8269d0a1852d4da7e94d694a0ce12a61d98cbce71b1a93b9c7728021fa2745
Opcode Fuzzy Hash: d932a31beddd07e59858c09836a26540660a436bc22808305d963a449d4982e1
Instruction Fuzzy Hash: 2F21A162E40904A7DB24AA64C901BDB739AAF50F71F968526E90AD7204E732DD00E390

Function 00F067D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 00F0682C
_DebugHeapAllocator.LIBCPMTD ref: 00F06848

Strings

RSA, xrefs: 00F06828

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: AllocatorDebugHeap
String ID: RSA
API String ID: 571936431-3431517
Opcode ID: b57af730f5bf208ad4947cb8dfaa140d79fb32a10e96d263ab3cc78c9c6bb1f9
Instruction ID: 8165d9a4e601231ba982ff06879f97f8bf14cd04c66383aab122975e8c1e119e
Opcode Fuzzy Hash: b57af730f5bf208ad4947cb8dfaa140d79fb32a10e96d263ab3cc78c9c6bb1f9
Instruction Fuzzy Hash: B63119B0A04249DFDF04CF88C991BAEBBB5FF48308F148158E815AB392C775AE41DB94

Function 00F16B80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F16C27

Part of subcall function 00F63148: RaiseException.KERNEL32(?,?,?,00F4C9DF,?,00000000,?,?,?,?,?,?,00F4C9DF,?,00FBFECC), ref: 00F631A8

Strings

AuthenticatedEncryptionFilter, xrefs: 00F16BFD
AAD, xrefs: 00F16BDF

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow
String ID: AAD$AuthenticatedEncryptionFilter
API String ID: 3976011213-396231977
Opcode ID: 8c93e3ad37d542cd417b7e33fd1a54c9928f0eeed56d0e721eda26fc6e906246
Instruction ID: 1a68358f3501292c6a7703032c6457746d71f0cb15031ca6e3ef65a6705fd589
Opcode Fuzzy Hash: 8c93e3ad37d542cd417b7e33fd1a54c9928f0eeed56d0e721eda26fc6e906246
Instruction Fuzzy Hash: A921A131A04208EFCB14DF94C885FEAB7B8FF44720F104569E816EB281DF74A944DB91

Function 00F175B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00F17656

Strings

OutputBuffer, xrefs: 00F175E7
ArraySink: missing OutputBuffer argument, xrefs: 00F1762D

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throw
String ID: ArraySink: missing OutputBuffer argument$OutputBuffer
API String ID: 2005118841-3781944848
Opcode ID: 01b932ade22ce154aeab6731c7285e94d1a2e88f3356415fd19c27b4516d7d6b
Instruction ID: 3994a14059e7f9d466b1184c62d3cc49bd32ec3665560e42b263cb070fcd35a4
Opcode Fuzzy Hash: 01b932ade22ce154aeab6731c7285e94d1a2e88f3356415fd19c27b4516d7d6b
Instruction Fuzzy Hash: D9216F71904249AFCB10EF98C841FDEBBF4FB48710F00452AF415AB290DB74A948DB51

Function 00EF1CC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMTD ref: 00EF1D32
__CxxThrowException@8.LIBVCRUNTIME ref: 00EF1D40

Part of subcall function 00F63148: RaiseException.KERNEL32(?,?,?,00F4C9DF,?,00000000,?,?,?,?,?,?,00F4C9DF,?,00FBFECC), ref: 00F631A8

Strings

CryptoMaterial: this object contains invalid values, xrefs: 00EF1D17

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::bad_exception::bad_exception
String ID: CryptoMaterial: this object contains invalid values
API String ID: 1843230569-887990677
Opcode ID: dde8c86d253c327d67e2fa3da60ece4f8ecccc5f6a2189aa546820b81eb5008c
Instruction ID: e9dd7807c2b132fa8ffbb8648aa1c1b0fe4a7fea2030307953ca4ca685151ca5
Opcode Fuzzy Hash: dde8c86d253c327d67e2fa3da60ece4f8ecccc5f6a2189aa546820b81eb5008c
Instruction Fuzzy Hash: 0E116A7190024DEFCB04DF95C981EEEB7B4FF48710F108269E916A7290EB30AA04CB91

Function 00EF0610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00EF067C

Part of subcall function 00F63148: RaiseException.KERNEL32(?,?,?,00F4C9DF,?,00000000,?,?,?,?,?,?,00F4C9DF,?,00FBFECC), ref: 00F631A8

Strings

StringSink: OutputStringPointer not specified, xrefs: 00EF0653
OutputStringPointer, xrefs: 00EF063F

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow
String ID: OutputStringPointer$StringSink: OutputStringPointer not specified
API String ID: 3976011213-1331214609
Opcode ID: 441d4bf9e70d63ca1deb7a4a06571a724e0d53116960918e56eeeade26a0dcac
Instruction ID: 580158a3f322c784deca0f6ebcd347111befc78fb5547b2c1d164b25fabe9090
Opcode Fuzzy Hash: 441d4bf9e70d63ca1deb7a4a06571a724e0d53116960918e56eeeade26a0dcac
Instruction Fuzzy Hash: 8D015EB194424CABDB04EF95CC42BEEB7B8EB05720F40562DF411B72C1DB75AA04DB55

Function 00EFC2C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_Max_value.LIBCPMTD ref: 00EFC2F6
_Min_value.LIBCPMTD ref: 00EFC31C

Strings

{B, xrefs: 00EFC326

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Max_valueMin_value
String ID: {B
API String ID: 3846992165-219045038
Opcode ID: b0fdf1d6e2fdef04c1c42680ebfd2c7a52a79a7c4ee7d5784edec907ee55c28f
Instruction ID: 6882fc76ba604d17c28969b6c4aacec4adff1194ed93265e603e5d1f2df0c163
Opcode Fuzzy Hash: b0fdf1d6e2fdef04c1c42680ebfd2c7a52a79a7c4ee7d5784edec907ee55c28f
Instruction Fuzzy Hash: 5A01ECB5D0020D9FCB04EFE5E9829EEBBF4AF18300F504569E606B7251EA34A7149B91

Function 00EFC240 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_Max_value.LIBCPMTD ref: 00EFC276
_Min_value.LIBCPMTD ref: 00EFC29C

Strings

{C, xrefs: 00EFC2A6

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Max_valueMin_value
String ID: {C
API String ID: 3846992165-3048356811
Opcode ID: 88884c5c52f6973c645adce0e2eba848cc19d1ae90202ef0418c05aded0ad30d
Instruction ID: 9fbef7386e1a337e4977b601af132b97453c2ae519a771a3e12427898c8d0210
Opcode Fuzzy Hash: 88884c5c52f6973c645adce0e2eba848cc19d1ae90202ef0418c05aded0ad30d
Instruction Fuzzy Hash: 5E01E1B5D0020D9FCB04EFE5D9429EEBBF4AF18300F504569E605B7251EA3567049B91

Function 00F5A3A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F5A3E8
__CxxThrowException@8.LIBVCRUNTIME ref: 00F5A3F6

Strings

pContext, xrefs: 00F5A3E0

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 1687795959-2046700901
Opcode ID: 84fbc5e05583fa488aff50826da48164b6c62e7da195cc15d5cd5da8c1e6cd11
Instruction ID: 7e53715c231656939178fc610519f3bf8dceb0d0c1709c778a42e3a081ca0327
Opcode Fuzzy Hash: 84fbc5e05583fa488aff50826da48164b6c62e7da195cc15d5cd5da8c1e6cd11
Instruction Fuzzy Hash: 89F0E939B00119ABCB04ABA9DC44C5EBBA89F85BA030000A6FD02D7351DB74ED059BD1

Function 00F8B660 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00F8B667

Part of subcall function 00F8B335: __EH_prolog3.LIBCMT ref: 00F8B33C

Strings

MOC, xrefs: 00F8B68A
RCC, xrefs: 00F8B699

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: H_prolog3H_prolog3_catch
String ID: MOC$RCC
API String ID: 1882928916-2084237596
Opcode ID: 1f40a30a0865d44bec3114cd571018c6fea47ae9f599332f321fe034befc4ba1
Instruction ID: 48a50df424f66e5bcf40cd207fdf177b3d6d856b0e7214539ef5c66050e32d25
Opcode Fuzzy Hash: 1f40a30a0865d44bec3114cd571018c6fea47ae9f599332f321fe034befc4ba1
Instruction Fuzzy Hash: 0FF04931904214DFDB12BB64C80299C3B61AF06F80F5950A1F854AB321EBBDAF41AFA1

Function 00F6AADD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 00F6AB0E
DName::DName.LIBVCRUNTIME ref: 00F6AB1A

Strings

{flat}, xrefs: 00F6AB04

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: NameName::
String ID: {flat}
API String ID: 1333004437-2606204563
Opcode ID: 659196f95a8db6a9b50084a4a63fc1fade755f2ac50be5e5dfcb06e40b1aa99d
Instruction ID: a9bd64737e100a69518b5f29f6f2603e50b0da71bedde8dd0cb4d2aa3439efb2
Opcode Fuzzy Hash: 659196f95a8db6a9b50084a4a63fc1fade755f2ac50be5e5dfcb06e40b1aa99d
Instruction Fuzzy Hash: EBF0657560024C9FD701DF58E5A6FE53BE19B81765F048045E90D4F292CBB8D880EB91

Function 00F65851 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 00F6585D
__CxxThrowException@8.LIBVCRUNTIME ref: 00F65884

Part of subcall function 00F63148: RaiseException.KERNEL32(?,?,?,00F4C9DF,?,00000000,?,?,?,?,?,?,00F4C9DF,?,00FBFECC), ref: 00F631A8

Strings

Access violation - no RTTI data!, xrefs: 00F65854

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::__non_rtti_object::__construct_from_string_literal
String ID: Access violation - no RTTI data!
API String ID: 2053020834-2158758863
Opcode ID: afcb0f6ea5474399a224bf4ae1f905937058d6306ed7a67db9c7071555d4d508
Instruction ID: 73cd205203447647ae5893b35b79613f33a0516923318fedb8a3e5f6620f569d
Opcode Fuzzy Hash: afcb0f6ea5474399a224bf4ae1f905937058d6306ed7a67db9c7071555d4d508
Instruction Fuzzy Hash: 74C01272C0420CAADB04E6E08D47DDD73AC9A09B10F600446F61073442EE6AFB146761

Function 00F5DDC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00F5DDDF
__CxxThrowException@8.LIBVCRUNTIME ref: 00F5DDED

Strings

pThreadProxy, xrefs: 00F5DDD7

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pThreadProxy
API String ID: 1687795959-3651400591
Opcode ID: 12e8783c56e1d4b57920eba26445d81cd249da8b5dc86696149d70af46643ac8
Instruction ID: 40f736d13d796bab2d62eb790b5ec01001bc8b957f9c7b2c27d17d578ebb52dd
Opcode Fuzzy Hash: 12e8783c56e1d4b57920eba26445d81cd249da8b5dc86696149d70af46643ac8
Instruction Fuzzy Hash: 93D05E71E0020C6ACB00FBA5DC07E8E77B85B04744F0041756E12A6082EEB4E609DA91

Function 00F78690 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 00F78690
GetCommandLineW.KERNEL32 ref: 00F7869B

Strings

0&y, xrefs: 00F78696

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: CommandLine
String ID: 0&y
API String ID: 3253501508-825062974
Opcode ID: 860d7b809ff9aeee79f3bc40f55b417569a2c12b535190095abca85f64785e3e
Instruction ID: 946f00be4aa03b8c856d36779ef84dfb0cdccd4e180afef3dc6a1001703138c6
Opcode Fuzzy Hash: 860d7b809ff9aeee79f3bc40f55b417569a2c12b535190095abca85f64785e3e
Instruction Fuzzy Hash: 51B0927C80160D8FC7418FB0BD1F6083BA0B309A02780605FD805C3328D7360084FF00

Function 00F743D6 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,?,00000000,00000000,00000000,00000000,00F8C280,00F8C280,00000000,00000000,00000000,?), ref: 00F7446C
GetLastError.KERNEL32(?,00F8C280), ref: 00F7447A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00F8C280), ref: 00F744D5

Memory Dump Source

Source File: 00000000.00000002.3267175834.0000000000EE1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000000.00000002.3267158518.0000000000EE0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267259670.0000000000F95000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267295342.0000000000FC3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267311658.0000000000FC4000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267323838.0000000000FC5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267342497.0000000000FC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FC9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267357785.0000000000FCB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3267383584.0000000000FCD000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ee0000_12.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 859cb78c668bb7ab467a72327e7f7719a0b470040b625fc7c27a742fe209e403
Instruction ID: 3e59536d797af55eece5c246b933aaf2a8ae25af5da1a53283e7d0506eccb57d
Opcode Fuzzy Hash: 859cb78c668bb7ab467a72327e7f7719a0b470040b625fc7c27a742fe209e403
Instruction Fuzzy Hash: 8741D531A00216AFDF31CF65D8447BA7BA5AF01724F19826EF89D9B1A1D730AD01F752