Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1545970
MD5:	fd89c359ab4ac38da6cf7fe6dabdb457
SHA1:	9c2a99beb692849ba3eb11d114334636df04f5ff
SHA256:	a19257d178d7f240c830b29e8bb55d9b6320dc1b56795e4fa90267419ed4070c
Tags:	exeuser-Bitsight
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses Microsoft's Enhanced Cryptographic Provider

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5592 cmdline: "C:\Users\user\Desktop\file.exe" MD5: FD89C359AB4AC38DA6CF7FE6DABDB457)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "109.172.94.66", "grabber_max_size": 1048576, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt", "build_name": "Install", "links": "", "port": 15666}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2400768323.0000012A21F60000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000000.00000003.2308893653.0000012A22260000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: file.exe PID: 5592	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: file.exe PID: 5592	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security
Process Memory Space: file.exe PID: 5592	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
0.3.file.exe.12a22260000.4.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.file.exe.12a22260000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.file.exe.12a22260000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.3.file.exe.12a22260000.4.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T11:10:07.468567+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.6	49719	TCP
2024-10-31T11:10:45.635342+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.6	49724	TCP

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T11:09:55.586930+0100	2049441	1	A Network Trojan was detected	192.168.2.6	49717	109.172.94.66	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T11:09:55.586930+0100	2050806	1	A Network Trojan was detected	192.168.2.6	49717	109.172.94.66	15666	TCP
2024-10-31T11:09:55.592027+0100	2050806	1	A Network Trojan was detected	192.168.2.6	49717	109.172.94.66	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T11:09:55.586930+0100	2050807	1	A Network Trojan was detected	192.168.2.6	49717	109.172.94.66	15666	TCP
2024-10-31T11:09:55.592027+0100	2050807	1	A Network Trojan was detected	192.168.2.6	49717	109.172.94.66	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.3.file.exe.12a22260000.4.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "109.172.94.66", "grabber_max_size": 1048576, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt", "build_name": "Install", "links": "", "port": 15666}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 13%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222D3B40 CryptUnprotectData,LocalFree,	0_2_0000012A222D3B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222D3E40 CryptProtectData,LocalFree,	0_2_0000012A222D3E40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22298060 CryptUnprotectData,LocalFree,	0_2_0000012A22298060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22337090 CryptUnprotectData,	0_2_0000012A22337090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22337098 CryptProtectData,	0_2_0000012A22337098

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.6:49718 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22297350 FindFirstFileW,FindNextFileW,	0_2_0000012A22297350
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A2231B6BC FindClose,FindFirstFileExW,GetLastError,	0_2_0000012A2231B6BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A2231B76C GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	0_2_0000012A2231B76C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22337100 FindFirstFileW,	0_2_0000012A22337100

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0000012A222E2D90 GetLogicalDriveStringsW,

0_2_0000012A222E2D90

Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.6:49717 -> 109.172.94.66:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.6:49717 -> 109.172.94.66:15666

Source: global traffic

TCP traffic: 192.168.2.6:49717 -> 109.172.94.66:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205

Source: Joe Sandbox View

ASN Name: SUMTEL-AS-RIPEMoscowRussiaRU SUMTEL-AS-RIPEMoscowRussiaRU

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic	Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.6:49717 -> 109.172.94.66:15666
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.6:49719
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.6:49724

Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66
Source: unknown	TCP traffic detected without corresponding DNS query: 109.172.94.66

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0000012A222E0CC0 InternetOpenA,InternetOpenUrlA,HttpQueryInfoW,HttpQueryInfoW,InternetQueryDataAvailable,InternetReadFile,InternetQueryDataAvailable,InternetCloseHandle,Concurrency::cancel_current_task,

0_2_0000012A222E0CC0

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: file.exe, 00000000.00000003.2399782046.0000012A241C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399692844.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399668740.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.a.0/sTy
Source: file.exe, 00000000.00000003.2328122373.0000012A241B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.a.0/sTyN
Source: file.exe, 00000000.00000003.2399782046.0000012A241C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399692844.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399668740.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c.0/ti
Source: file.exe, 00000000.00000003.2328122373.0000012A241B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c.0/tiA
Source: file.exe, 00000000.00000003.2399782046.0000012A241C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399692844.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399668740.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.hotosh
Source: file.exe, 00000000.00000003.2328122373.0000012A241B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.hotoshN
Source: file.exe, 00000000.00000003.2399782046.0000012A241C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399692844.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399668740.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adoraw-se
Source: file.exe, 00000000.00000003.2328122373.0000012A241B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adoraw-seN
Source: file.exe, 00000000.00000003.2399782046.0000012A241C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399692844.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399668740.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.photo/
Source: file.exe, 00000000.00000003.2328122373.0000012A241B1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.photo/N
Source: file.exe, 00000000.00000003.2330216176.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330422326.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.2400768323.0000012A21F60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: file.exe, 00000000.00000002.2400768323.0000012A21F60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/(
Source: file.exe, 00000000.00000002.2400768323.0000012A21F60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.orga
Source: file.exe, 00000000.00000003.2330216176.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330422326.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2330216176.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330422326.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2330216176.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330422326.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000003.2330216176.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330422326.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2330216176.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330422326.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2330216176.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330422326.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000003.2334175402.0000012A22188000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2334175402.0000012A22190000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2334891313.0000012A2444A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2335276853.0000012A22078000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: file.exe, 00000000.00000003.2334891313.0000012A24452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.2334891313.0000012A24452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000000.00000003.2330216176.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330422326.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2330216176.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330422326.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: file.exe, 00000000.00000003.2337982467.0000012A251A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2335627750.0000012A22055000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2334175402.0000012A22190000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2334891313.0000012A2444A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2335276853.0000012A22078000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000003.2334175402.0000012A22188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org#
Source: file.exe, 00000000.00000003.2334891313.0000012A24452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000003.2334891313.0000012A24452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: file.exe, 00000000.00000003.2334891313.0000012A24452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.6:49718 version: TLS 1.2

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0000012A222E1580 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,EnterCriticalSection,LeaveCriticalSection,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

0_2_0000012A222E1580

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222E6060 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,	0_2_0000012A222E6060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A223376D0 NtAllocateVirtualMemory,LdrEnumerateLoadedModules,	0_2_0000012A223376D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A223376C0 NtQuerySystemInformation,	0_2_0000012A223376C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222E5920 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,	0_2_0000012A222E5920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44DD190 RtlCreateUnicodeString,RtlCreateUnicodeString,AddVectoredExceptionHandler,HeapAlloc,NtGetContextThread,NtOpenSection,NtContinue,RtlFreeHeap,LoadLibraryExW,RemoveVectoredExceptionHandler,	0_2_00007FF7A44DD190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44EA200 RtlAdjustPrivilege,RtlAdjustPrivilege,NtRaiseHardError,NtRaiseHardError,	0_2_00007FF7A44EA200
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44DCE20 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,	0_2_00007FF7A44DCE20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44DC9F0 RtlCompareUnicodeString,NtContinue,NtQueryObject,NtContinue,RtlCompareUnicodeString,RtlCompareUnicodeString,NtContinue,HeapAlloc,NtGetContextThread,NtMapViewOfSection,NtContinue,RtlFreeHeap,NtMapViewOfSection,NtContinue,NtContinue,NtContinue,NtContinue,HeapAlloc,NtGetContextThread,NtClose,NtContinue,RtlFreeHeap,NtClose,NtContinue,NtContinue,NtContinue,NtContinue,NtContinue,	0_2_00007FF7A44DC9F0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222F8E40	0_2_0000012A222F8E40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222E8F60	0_2_0000012A222E8F60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222FEFBC	0_2_0000012A222FEFBC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222E0CC0	0_2_0000012A222E0CC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A2229CDE0	0_2_0000012A2229CDE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222C3210	0_2_0000012A222C3210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222E2240	0_2_0000012A222E2240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A223022FC	0_2_0000012A223022FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22297350	0_2_0000012A22297350
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A2229F060	0_2_0000012A2229F060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222E3040	0_2_0000012A222E3040
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22291130	0_2_0000012A22291130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A2231B76C	0_2_0000012A2231B76C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222A43F0	0_2_0000012A222A43F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222E0480	0_2_0000012A222E0480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222E8578	0_2_0000012A222E8578
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222E1580	0_2_0000012A222E1580
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222E3A60	0_2_0000012A222E3A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222EAAE0	0_2_0000012A222EAAE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22291820	0_2_0000012A22291820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222DA8F0	0_2_0000012A222DA8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A2229D930	0_2_0000012A2229D930
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A2229E9C0	0_2_0000012A2229E9C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22291E50	0_2_0000012A22291E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22299E39	0_2_0000012A22299E39
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A2230AE2C	0_2_0000012A2230AE2C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22305EC4	0_2_0000012A22305EC4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222D1EB0	0_2_0000012A222D1EB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222ACF20	0_2_0000012A222ACF20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222CEF60	0_2_0000012A222CEF60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A2231DF80	0_2_0000012A2231DF80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222CDFC0	0_2_0000012A222CDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222CEC30	0_2_0000012A222CEC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222FFC34	0_2_0000012A222FFC34
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222D0D50	0_2_0000012A222D0D50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222D6D60	0_2_0000012A222D6D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222F6D5C	0_2_0000012A222F6D5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222BCD2D	0_2_0000012A222BCD2D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222BB290	0_2_0000012A222BB290
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222922AE	0_2_0000012A222922AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222982B0	0_2_0000012A222982B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222CE2C0	0_2_0000012A222CE2C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222B7300	0_2_0000012A222B7300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A2229C300	0_2_0000012A2229C300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222D2360	0_2_0000012A222D2360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222F6344	0_2_0000012A222F6344
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A2230B398	0_2_0000012A2230B398
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22267010	0_2_0000012A22267010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22323010	0_2_0000012A22323010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222E6060	0_2_0000012A222E6060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A223000E4	0_2_0000012A223000E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222660C0	0_2_0000012A222660C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222F70EC	0_2_0000012A222F70EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222B0189	0_2_0000012A222B0189
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A223011E4	0_2_0000012A223011E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A2229B1E0	0_2_0000012A2229B1E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222ED60A	0_2_0000012A222ED60A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222F75F4	0_2_0000012A222F75F4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222CE5F0	0_2_0000012A222CE5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222CA660	0_2_0000012A222CA660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22306634	0_2_0000012A22306634
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222F263C	0_2_0000012A222F263C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222F6714	0_2_0000012A222F6714
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22300764	0_2_0000012A22300764
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222AE7A9	0_2_0000012A222AE7A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A223097C4	0_2_0000012A223097C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A2231E400	0_2_0000012A2231E400
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222E6460	0_2_0000012A222E6460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222D8490	0_2_0000012A222D8490
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22266480	0_2_0000012A22266480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222D4520	0_2_0000012A222D4520
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222F652C	0_2_0000012A222F652C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22302578	0_2_0000012A22302578
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222C65D0	0_2_0000012A222C65D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222FA5CC	0_2_0000012A222FA5CC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222DE9F3	0_2_0000012A222DE9F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22287A00	0_2_0000012A22287A00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222F4A50	0_2_0000012A222F4A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22302B00	0_2_0000012A22302B00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22307B08	0_2_0000012A22307B08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222F2B34	0_2_0000012A222F2B34
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222D1B80	0_2_0000012A222D1B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222D9BD0	0_2_0000012A222D9BD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222DC840	0_2_0000012A222DC840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222AC870	0_2_0000012A222AC870
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222CE910	0_2_0000012A222CE910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22266900	0_2_0000012A22266900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222DE9E3	0_2_0000012A222DE9E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222899B0	0_2_0000012A222899B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222869C0	0_2_0000012A222869C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44DD5E0	0_2_00007FF7A44DD5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A45216C0	0_2_00007FF7A45216C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44DD2E0	0_2_00007FF7A44DD2E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4522DD0	0_2_00007FF7A4522DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44F956C	0_2_00007FF7A44F956C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44EC558	0_2_00007FF7A44EC558
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4520540	0_2_00007FF7A4520540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44FD674	0_2_00007FF7A44FD674
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A450E777	0_2_00007FF7A450E777
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A454678C	0_2_00007FF7A454678C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44DC7E0	0_2_00007FF7A44DC7E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4510810	0_2_00007FF7A4510810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4514810	0_2_00007FF7A4514810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A45157F0	0_2_00007FF7A45157F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44F279C	0_2_00007FF7A44F279C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44FF87C	0_2_00007FF7A44FF87C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A45028E8	0_2_00007FF7A45028E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44EC8E8	0_2_00007FF7A44EC8E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A45048DC	0_2_00007FF7A45048DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44F08B4	0_2_00007FF7A44F08B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4518130	0_2_00007FF7A4518130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4525210	0_2_00007FF7A4525210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44F51A0	0_2_00007FF7A44F51A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A45292E0	0_2_00007FF7A45292E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A452E350	0_2_00007FF7A452E350
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A452A3F0	0_2_00007FF7A452A3F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44E2470	0_2_00007FF7A44E2470
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44DB420	0_2_00007FF7A44DB420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44FA514	0_2_00007FF7A44FA514
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44E9500	0_2_00007FF7A44E9500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44DC4B0	0_2_00007FF7A44DC4B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44F6D8C	0_2_00007FF7A44F6D8C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4539D70	0_2_00007FF7A4539D70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4515D20	0_2_00007FF7A4515D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A452CD30	0_2_00007FF7A452CD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44ECDF0	0_2_00007FF7A44ECDF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4500DAC	0_2_00007FF7A4500DAC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44D4DA0	0_2_00007FF7A44D4DA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4513DB0	0_2_00007FF7A4513DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44F8EEC	0_2_00007FF7A44F8EEC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A450DEC8	0_2_00007FF7A450DEC8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44EBEA0	0_2_00007FF7A44EBEA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4526FF0	0_2_00007FF7A4526FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4539070	0_2_00007FF7A4539070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4539050	0_2_00007FF7A4539050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4520100	0_2_00007FF7A4520100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A451C110	0_2_00007FF7A451C110
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44FF10C	0_2_00007FF7A44FF10C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A45050D4	0_2_00007FF7A45050D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A45450B0	0_2_00007FF7A45450B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44DC9F0	0_2_00007FF7A44DC9F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44DB9A0	0_2_00007FF7A44DB9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44F19D0	0_2_00007FF7A44F19D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4522A70	0_2_00007FF7A4522A70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44F8A3C	0_2_00007FF7A44F8A3C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44DAAB0	0_2_00007FF7A44DAAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44EBAD0	0_2_00007FF7A44EBAD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44E2B80	0_2_00007FF7A44E2B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44E5B80	0_2_00007FF7A44E5B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4513B70	0_2_00007FF7A4513B70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4516B36	0_2_00007FF7A4516B36
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44F4BB0	0_2_00007FF7A44F4BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A452BBB0	0_2_00007FF7A452BBB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44F2C94	0_2_00007FF7A44F2C94
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44E1C50	0_2_00007FF7A44E1C50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44EBCB8	0_2_00007FF7A44EBCB8

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0000012A22296EF0 appears 41 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0000012A22292280 appears 55 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0000012A2228DA30 appears 50 times

Source: classification engine

Classification label: mal100.troj.spyw.winEXE@1/0@1/2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222E78B0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,		0_2_0000012A222E78B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22337008 AdjustTokenPrivileges,		0_2_0000012A22337008

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0000012A2229E9C0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0000012A2229E9C0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0000012A222D0F97 CoCreateInstance,

0_2_0000012A222D0F97

Source: C:\Users\user\Desktop\file.exe

Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E6963A814A1EF

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 13%

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: file.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: file.exe

Static file information: File size 1937920 > 1048576

Source: file.exe

Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x148e00

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0000012A2229D930 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_0000012A2229D930

Source: file.exe

Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0000012A222D8020 ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,CreateMutexExA,ExitProcess,ReleaseMutex,CloseHandle,

0_2_0000012A222D8020

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22297350 FindFirstFileW,FindNextFileW,	0_2_0000012A22297350
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A2231B6BC FindClose,FindFirstFileExW,GetLastError,	0_2_0000012A2231B6BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A2231B76C GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	0_2_0000012A2231B76C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A22337100 FindFirstFileW,	0_2_0000012A22337100

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0000012A222E2D90 GetLogicalDriveStringsW,

0_2_0000012A222E2D90

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0000012A222F8CE0 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

0_2_0000012A222F8CE0

Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2400768323.0000012A21F8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000003.2329451640.0000012A21FDA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2400768323.0000012A21FC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: file.exe, 00000000.00000003.2331857309.0000012A22025000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node			graph_0-105728
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node			graph_0-105732

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0000012A222E6060 RtlAcquirePebLock,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,CoInitializeEx,lstrcpyW,lstrcatW,CoGetObject,lstrcpyW,lstrcatW,CoGetObject,CoUninitialize,

0_2_0000012A222E6060

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0000012A222F1688 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0000012A222F1688

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0000012A2231D6E0 GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_0000012A2231D6E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0000012A2229D930 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_0000012A2229D930

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0000012A22309084 GetProcessHeap,

0_2_0000012A22309084

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A223372E0 SetUnhandledExceptionFilter,	0_2_0000012A223372E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0000012A222F1688 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0000012A222F1688
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A45075E8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7A45075E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4507908 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7A4507908
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A44EE950 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7A44EE950
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF7A4507AEC SetUnhandledExceptionFilter,	0_2_00007FF7A4507AEC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0000012A222D6D60 ShellExecuteW,

0_2_0000012A222D6D60

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF7A45068D0 cpuid

0_2_00007FF7A45068D0

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoEx,FormatMessageA,	0_2_0000012A2231B330
Source: C:\Users\user\Desktop\file.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_0000012A223080AC
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_0000012A222FD620
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_0000012A223087AC
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_0000012A223083F8
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_0000012A223084C8
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_0000012A22308560
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0000012A22308AE0
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_0000012A222FDB64
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0000012A22308904
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_0000012A223089B4
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7A450169C
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7A450176C
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF7A4501804
Source: C:\Users\user\Desktop\file.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF7A4501350
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00007FF7A44FC468
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF7A4501D84
Source: C:\Users\user\Desktop\file.exe	Code function: EnumSystemLocalesW,	0_2_00007FF7A44FC114
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00007FF7A4501A50
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF7A4501BA8
Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoW,	0_2_00007FF7A4501C58

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0000012A222F83E0 GetSystemTimeAsFileTime,

0_2_0000012A222F83E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0000012A222E1B60 GetUserNameW,

0_2_0000012A222E1B60

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0000012A223022FC _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_0000012A223022FC

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: file.exe PID: 5592, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.3.file.exe.12a22260000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.12a22260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.12a22260000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.12a22260000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2400768323.0000012A21F60000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2308893653.0000012A22260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5592, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2400768323.0000012A21F60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum\wallets
Source: file.exe, 00000000.00000002.2400768323.0000012A21F60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\config
Source: file.exe, 00000000.00000002.2400768323.0000012A21FC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: KHg2NCkgWzIzLjAxXQpNb3ppbGxhIEZpcmVmb3ggKHg2NCBlbi1VUykgWzExOC4wLjFdCk1vemlsbGEgTWFpbnRlbmFuY2UgU2VydmljZSBbMTE4LjAuMV0KTWljcm9zb2Z0IE9mZmljZSBQcm9mZXNzaW9uYWwgUGx1cyAyMDE5IC0gZW4tdXMgWzE2LjAuMTY4MjcuMjAxMzBdCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMjIgWDY0IEFkZGl0aW9uYWwgUnVudGltZSAtIDE0LjM2LjMyNTMyIFsxNC4zNi4zMjUzMl0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBMaWNlbnNpbmcgQ29tcG9uZW50IFsxNi4wLjE2ODI3LjIwMTMwXQpPZmZpY2UgMTYgQ2xpY2stdG8tUnVuIEV4dGVuc2liaWxpdHkgQ29tcG9uZW50IDY0LWJpdCBSZWdpc3RyYXRpb24gWzE2LjAuMTY4MjcuMjAwNTZdCkFkb2JlIEFjcm9iYXQgKDY0LWJpdCkgWzIzLjAwNi4yMDMyMF0KTWljcm9zb2Z0IFZpc3VhbCBDKysgMjAyMiBYNjQgTWluaW11bSBSdW50aW1lIC0gMTQuMzYuMzI1MzIgWzE0LjM2LjMyNTMyXQpHb29nbGUgQ2hyb21lIFsxMTcuMC41OTM4LjEzNF0KTWljcm9zb2Z0IEVkZ2UgWzExNy4wLjIwNDUuNTVdCk1pY3Jvc29mdCBFZGdlIFVwZGF0ZSBbMS4zLjE3Ny4xMV0KTWljcm9zb2Z0IEVkZ2UgV2ViVmlldzIgUnVudGltZSBbMTE3LjAuMjA0NS40N10KSmF2YSBBdXRvIFVwZGF0ZXIgWzIuOC4zODEuOV0KSmF2YSA4IFVwZGF0ZSAzODEgWzguMC4zODEwLjldCk1pY3Jvc29mdCBWaXN1YWwgQysrIDIwMTUtMjAyMiBSZWRpc3RyaWJ1dGFibGUgKHg2NCkgLSAxNC4zNi4zMjUzMiBbMTQuMzYuMzI1MzIuMF0KT2ZmaWNlIDE2IENsaWNrLXRvLVJ1biBFeHRlbnNpYmlsaXR5IENvbXBvbmVudCBbMTYuMC4xNjgyNy4yMDEzMF0K
Source: file.exe, 00000000.00000002.2400768323.0000012A21F60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.2400768323.0000012A21F60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: file.exe, 00000000.00000002.2400768323.0000012A21F60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 5592, type: MEMORYSTR

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: file.exe PID: 5592, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.3.file.exe.12a22260000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.12a22260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.12a22260000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.12a22260000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2400768323.0000012A21F60000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2308893653.0000012A22260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5592, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Access Token Manipulation	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Screen Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Email Collection	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Obfuscated Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Account Discovery	Distributed Component Object Model	2 Data from Local System	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	34 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	13%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://api.ipify.org/	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ns.adobe.hotosh	file.exe, 00000000.00000003.2399782046.0000012A241C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399692844.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399668740.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2330216176.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330422326.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2330216176.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330422326.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ns.adobe.c.0/ti	file.exe, 00000000.00000003.2399782046.0000012A241C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399692844.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399668740.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ns.adoraw-se	file.exe, 00000000.00000003.2399782046.0000012A241C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399692844.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399668740.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ns.photo/N	file.exe, 00000000.00000003.2328122373.0000012A241B1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ns.photo/	file.exe, 00000000.00000003.2399782046.0000012A241C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399692844.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399668740.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2330216176.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330422326.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ns.a.0/sTy	file.exe, 00000000.00000003.2399782046.0000012A241C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399692844.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2399668740.0000012A241C0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2330216176.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330422326.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2330216176.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330422326.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ns.adobe.hotoshN	file.exe, 00000000.00000003.2328122373.0000012A241B1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2330216176.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330422326.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000003.2334891313.0000012A24452000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org/(	file.exe, 00000000.00000002.2400768323.0000012A21F60000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ns.adoraw-seN	file.exe, 00000000.00000003.2328122373.0000012A241B1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2330216176.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330422326.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	file.exe, 00000000.00000003.2334891313.0000012A24452000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ns.a.0/sTyN	file.exe, 00000000.00000003.2328122373.0000012A241B1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2330216176.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330422326.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org	file.exe, 00000000.00000003.2334175402.0000012A22188000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2334175402.0000012A22190000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2334891313.0000012A2444A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2335276853.0000012A22078000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2330216176.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2330422326.0000012A21E50000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ns.adobe.c.0/tiA	file.exe, 00000000.00000003.2328122373.0000012A241B1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://api.ipify.orga	file.exe, 00000000.00000002.2400768323.0000012A21F60000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
109.172.94.66	unknown	Russian Federation		41691	SUMTEL-AS-RIPEMoscowRussiaRU	true
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545970
Start date and time:	2024-10-31 11:08:37 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.winEXE@1/0@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 104 Number of non-executed functions: 118
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	#Uad6c#Ub9e4 #Uc8fc#Ubb38 658749 #Ubc0f 658752..exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	https://www.canva.com/design/DAGVD7_HMvQ/PFkDB3TDx6Ru4nNALhSqqQ/view?utm_content=DAGVD7_HMvQ&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.26.13.205
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	https://schiller.life/	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	SecuriteInfo.com.Win32.PWSX-gen.31738.17793.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Biocon-In-Service Agreement.pdf	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	skuld3.exe	Get hash	malicious	Skuld Stealer	Browse	104.26.13.205
	Shipping documents 00039984849900044800.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	z1Transaction_ID_REF2418_cmd.bat	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s599af221dbfd41b9a607812ebc66d2cf&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0VpSHltbG45MjdsQnBnZUJMcnhtMHM4QjRNbHFPTTJWd0ZlQTFNLWNhZ0lnRkE_ZT1aak8wczY&wd=target%28Sezione%20senza%20titolo.one%7C99ad2a4b-5ecc-495f-9ce8-040ac62eb8f2%2F%5BExternal%5D%20-%20Invoice%20%27s%208808-%7C9e6e973e-3cda-429a-a28f-c51dc242e5b1%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	104.21.14.84
	Quotation.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.96.3
	PROFORMA FATURA pdf.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse	104.17.25.14
	clipper.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Invoices.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse	104.17.25.14
	FERRO FAB INV.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	#Uad6c#Ub9e4 #Uc8fc#Ubb38 658749 #Ubc0f 658752..exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://invite.bublup.com/q6fU7gLtMrfS	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
SUMTEL-AS-RIPEMoscowRussiaRU	sh4.elf	Get hash	malicious	Unknown	Browse	87.117.138.145
	yakuza.i686.elf	Get hash	malicious	Unknown	Browse	178.130.55.72
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	109.172.60.44
	BwqqVoHR71.exe	Get hash	malicious	GO Backdoor	Browse	109.172.88.38
	antispam_connect1.exe	Get hash	malicious	GO Backdoor	Browse	109.172.88.38
	na.elf	Get hash	malicious	Mirai, Moobot	Browse	89.221.206.246
	wa_3rd_party_host_32.exe	Get hash	malicious	GO Backdoor	Browse	109.172.88.38
	uyTCVR3mBl.elf	Get hash	malicious	Unknown	Browse	89.221.225.163
	mtTw7o41OC.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	109.172.114.38
	FpiUD4nYpj.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	109.172.114.212

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Quotation.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	SecuriteInfo.com.BackDoor.AgentTeslaNET.20.28177.5145.exe	Get hash	malicious	DarkCloud	Browse	104.26.12.205
	nOrden_de_Compra___0001245.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.26.12.205
	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse	104.26.12.205
	b4s45TboUL.exe	Get hash	malicious	Stealc, Vidar	Browse	104.26.12.205
	rCommercialoffer_Technicaloffer_pdf.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.26.12.205
	Justificante de pago.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.26.12.205
	rPO-000172483.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.26.12.205
	rPO-000172483.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.26.12.205
	Ppto.24265.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.26.12.205

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.9131202226603605
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'937'920 bytes
MD5:	fd89c359ab4ac38da6cf7fe6dabdb457
SHA1:	9c2a99beb692849ba3eb11d114334636df04f5ff
SHA256:	a19257d178d7f240c830b29e8bb55d9b6320dc1b56795e4fa90267419ed4070c
SHA512:	27e63d09f31a33bbaeae48bb64c3802623a20352657e218b04c0378e88a1b090629c85a09cce6f56a417abb12c1dc6f5cc8b7456c9c58bf05ffd33a0e2eb5904
SSDEEP:	24576:mH7eZ9qb3yhIK20e6yaftS/h0lhSMXlEnuxl6XjxIp/jZKUSd5gnU+ZpdF:S7eZu3y+wsuxgXjCtj5Sd5Grn
TLSH:	AC95CF67F94434FAE83091348DA7076BA33BB441876187DB5698362A5E53BD02F3BF48
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......t...0...0...0...............<...x...........o....... .......8...............<.......'.......5...0.......$...$...$.`.1...$...1..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x1400375d4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x671BD104 [Fri Oct 25 17:10:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	b747ef4e0e7f8f3178c8471e453f4b5f

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F0494D5AFD4h
dec eax
add esp, 28h
jmp 00007F0494D5A79Fh
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [00050AF7h]
dec eax
mov ecx, ebx
call dword ptr [00050AE6h]
call dword ptr [00050A58h]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [00050ADCh]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [00050AD0h]
test eax, eax
je 00007F0494D5A929h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [0019C0CEh]
call 00007F0494D5AAEEh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [0019C1B5h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [0019C145h], eax
dec eax
mov eax, dword ptr [0019C19Eh]
dec eax
mov dword ptr [0019C00Fh], eax
dec eax
mov eax, dword ptr [esp+40h]
dec eax
mov dword ptr [0019C113h], eax
mov dword ptr [0019BFE9h], C0000409h
mov dword ptr [0019BFE3h], 00000001h
mov dword ptr [0019BFEDh], 00000001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1d0034	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1dc000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x1d5000	0x5964	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1dd000	0x1eb4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1c4c90	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1c4d00	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1c4b50	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x88000	0x3b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8629c	0x86400	533170075dada125e4df006d984c4596	False	0.515928698207635	data	6.523847644421667	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x88000	0x148cde	0x148e00	0beb3fa0e7ade7713727b8def3bb4f9e	False	0.6084982836849107	data	6.832328378432915	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1d1000	0x390c	0x1e00	5f28058a9e2c02cd2ebfa105aba2e6b5	False	0.18138020833333332	data	3.709621146255121	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x1d5000	0x5964	0x5a00	3597e95df5d4ec5a41fd8a11d049b4f6	False	0.49053819444444446	data	5.822333171427356	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x1db000	0x15c	0x200	36a456dd95baf0d7ac9f08a622399347	False	0.400390625	data	3.296204586134003	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x1dc000	0x1e0	0x200	91f1bb59b414c9eaf8ca19c8e69d2965	False	0.533203125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1dd000	0x1eb4	0x2000	9d98248e7ab3e09e0dea40168f7cf982	False	0.6422119140625	data	6.409576570710691	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x1dc060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

VirtualFree, VirtualAlloc, GetModuleHandleW, LoadLibraryA, ReadFile, WriteFile, CreateFileW, UnmapViewOfFile, CloseHandle, CreateFileMappingW, MapViewOfFile, GetProcAddress, GetCurrentProcess, VirtualQuery, RemoveVectoredExceptionHandler, MultiByteToWideChar, LoadLibraryW, AddVectoredExceptionHandler, WideCharToMultiByte, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetLastError, SetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, HeapAlloc, HeapFree, GetCurrentThreadId, GetStdHandle, GetFileType, GetStartupInfoW, RaiseException, GetFileSizeEx, SetFilePointerEx, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, InitializeCriticalSectionAndSpinCount, GetSystemTimeAsFileTime, FreeLibrary, LoadLibraryExW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, ReadConsoleW, HeapReAlloc, HeapSize, GetProcessHeap, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetStringTypeW, ExitProcess, GetModuleHandleExW, SetStdHandle, GetModuleFileNameW, WriteConsoleW, QueryPerformanceCounter, GetCurrentProcessId, InitializeSListHead, RtlUnwindEx, RtlUnwind, RtlPcToFileHeader, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, VirtualProtect, VirtualQueryEx, ReadProcessMemory, WriteProcessMemory, GetSystemInfo, InitializeCriticalSection, FindClose, FindFirstFileExW, FindNextFileW, InitializeSRWLock, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryAcquireSRWLockExclusive, InitializeCriticalSectionEx, DecodePointer, LCMapStringEx, CreateEventW

ntdll.dll

NtRaiseHardError, NtMapViewOfSection, RtlCreateUnicodeString, NtOpenSection, NtQueryObject, NtContinue, NtUnmapViewOfSection, RtlFreeHeap, NtClose, RtlAdjustPrivilege, RtlAllocateHeap, NtGetContextThread, RtlCompareUnicodeString, NtCreateSection

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T11:09:55.586930+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.6	49717	109.172.94.66	15666	TCP
2024-10-31T11:09:55.586930+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.6	49717	109.172.94.66	15666	TCP
2024-10-31T11:09:55.586930+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.6	49717	109.172.94.66	15666	TCP
2024-10-31T11:09:55.592027+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.6	49717	109.172.94.66	15666	TCP
2024-10-31T11:09:55.592027+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.6	49717	109.172.94.66	15666	TCP
2024-10-31T11:10:07.468567+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.6	49719	TCP
2024-10-31T11:10:45.635342+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.6	49724	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 11:09:50.367592096 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:50.373773098 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:50.373888969 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:50.980947971 CET	49718	443	192.168.2.6	104.26.12.205
Oct 31, 2024 11:09:50.981056929 CET	443	49718	104.26.12.205	192.168.2.6
Oct 31, 2024 11:09:50.981221914 CET	49718	443	192.168.2.6	104.26.12.205
Oct 31, 2024 11:09:50.990537882 CET	49718	443	192.168.2.6	104.26.12.205
Oct 31, 2024 11:09:50.990566969 CET	443	49718	104.26.12.205	192.168.2.6
Oct 31, 2024 11:09:51.624218941 CET	443	49718	104.26.12.205	192.168.2.6
Oct 31, 2024 11:09:51.624298096 CET	49718	443	192.168.2.6	104.26.12.205
Oct 31, 2024 11:09:51.706485033 CET	49718	443	192.168.2.6	104.26.12.205
Oct 31, 2024 11:09:51.706509113 CET	443	49718	104.26.12.205	192.168.2.6
Oct 31, 2024 11:09:51.706916094 CET	443	49718	104.26.12.205	192.168.2.6
Oct 31, 2024 11:09:51.706965923 CET	49718	443	192.168.2.6	104.26.12.205
Oct 31, 2024 11:09:51.708926916 CET	49718	443	192.168.2.6	104.26.12.205
Oct 31, 2024 11:09:51.755321980 CET	443	49718	104.26.12.205	192.168.2.6
Oct 31, 2024 11:09:51.889919043 CET	443	49718	104.26.12.205	192.168.2.6
Oct 31, 2024 11:09:51.889978886 CET	443	49718	104.26.12.205	192.168.2.6
Oct 31, 2024 11:09:51.890008926 CET	49718	443	192.168.2.6	104.26.12.205
Oct 31, 2024 11:09:51.890055895 CET	49718	443	192.168.2.6	104.26.12.205
Oct 31, 2024 11:09:51.911125898 CET	49718	443	192.168.2.6	104.26.12.205
Oct 31, 2024 11:09:51.911145926 CET	443	49718	104.26.12.205	192.168.2.6
Oct 31, 2024 11:09:55.586930037 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.591922045 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.591943979 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.591965914 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.591979027 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.591990948 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.592026949 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.592041016 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.592071056 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.592082977 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.592089891 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.592097044 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.592111111 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.592123032 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.592158079 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.592166901 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.592197895 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.596910954 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.596971989 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.596980095 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.596986055 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.596997976 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.597013950 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.597013950 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.597027063 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.597032070 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.597057104 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.597074032 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.637362957 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.637581110 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.689229965 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.689354897 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.737231970 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.737349987 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.789151907 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.789339066 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.841262102 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.841438055 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.889173985 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.889339924 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.939790964 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.939951897 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:55.986650944 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:55.986804962 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:56.037189007 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:56.037264109 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:56.085182905 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:56.085251093 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:56.134612083 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:56.134788036 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:56.182636023 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:56.182787895 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:56.229147911 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:56.229398966 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:56.277483940 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:56.277751923 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:56.325288057 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:56.325366974 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:56.373330116 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:56.373460054 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:56.425209045 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:56.425333023 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:56.477134943 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:56.477202892 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:56.709542990 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:56.709635973 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:56.714526892 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:56.714602947 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:56.761104107 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:56.761209965 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:56.813162088 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:56.813288927 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:56.861154079 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:56.861267090 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:56.909171104 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:56.909274101 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:56.957227945 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:56.957427025 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.005597115 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.005665064 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.053107977 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.053206921 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.101352930 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.101488113 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.149168015 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.149245024 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.201143026 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.201216936 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.249150038 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.249207020 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.297209024 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.297291994 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.349123001 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.349237919 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.397177935 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.397289991 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.445178986 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.445281029 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.497133017 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.497231007 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.545165062 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.545324087 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.597203970 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.597268105 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.645184040 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.645271063 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.697123051 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.697194099 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.745156050 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.745260000 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.793230057 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.793298960 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.845124960 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.845315933 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.893167019 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.893285990 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.941190004 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.941416979 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:57.990497112 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:57.990581989 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:58.037149906 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:58.037246943 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:58.089195013 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:58.089366913 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:58.137173891 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:58.137259960 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:58.189166069 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:58.189364910 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:58.241101027 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:58.241168976 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:58.293140888 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:58.293210983 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:58.345088959 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:58.345153093 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:58.397156000 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:58.397232056 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:58.445139885 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:58.445321083 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:58.493129969 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:58.493395090 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:58.541125059 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:58.541218996 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:58.589072943 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:58.589268923 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:58.637166023 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:58.637279987 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:58.685162067 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:58.685257912 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:58.733144999 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:58.733303070 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:58.781207085 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:58.781383038 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:58.829283953 CET	15666	49717	109.172.94.66	192.168.2.6
Oct 31, 2024 11:09:58.829457045 CET	49717	15666	192.168.2.6	109.172.94.66
Oct 31, 2024 11:09:58.856662989 CET	15666	49717	109.172.94.66	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 11:09:50.968107939 CET	55004	53	192.168.2.6	1.1.1.1
Oct 31, 2024 11:09:50.975121021 CET	53	55004	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 11:09:50.968107939 CET	192.168.2.6	1.1.1.1	0xa346	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 11:09:50.975121021 CET	1.1.1.1	192.168.2.6	0xa346	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Oct 31, 2024 11:09:50.975121021 CET	1.1.1.1	192.168.2.6	0xa346	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Oct 31, 2024 11:09:50.975121021 CET	1.1.1.1	192.168.2.6	0xa346	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49718	104.26.12.205	443	5592	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:09:51 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2024-10-31 10:09:51 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:09:51 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8db2da1a9ac76b48-DFW
2024-10-31 10:09:51 UTC	14	IN	Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 37 Data Ascii: 173.254.250.77

Target ID:	0
Start time:	06:09:48
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7ff7a44d0000
File size:	1'937'920 bytes
MD5 hash:	FD89C359AB4AC38DA6CF7FE6DABDB457
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.2400768323.0000012A21F60000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000000.00000003.2308893653.0000012A22260000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	0.1%
Signature Coverage:	21.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	99

Executed Functions

Function 0000012A222E1580 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 0000012A222E15C1
GetSystemMetrics.USER32 ref: 0000012A222E15CF
GetSystemMetrics.USER32 ref: 0000012A222E15DD
GetSystemMetrics.USER32 ref: 0000012A222E15EB
GetDC.USER32 ref: 0000012A222E15F5
GetDeviceCaps.GDI32 ref: 0000012A222E160B
GetDeviceCaps.GDI32 ref: 0000012A222E161B
CreateCompatibleDC.GDI32 ref: 0000012A222E1628
CreateCompatibleBitmap.GDI32 ref: 0000012A222E1640
SelectObject.GDI32 ref: 0000012A222E1656
BitBlt.GDI32 ref: 0000012A222E168C
SHCreateMemStream.SHLWAPI ref: 0000012A222E16C2
SelectObject.GDI32 ref: 0000012A222E16D8
DeleteDC.GDI32 ref: 0000012A222E16E1
ReleaseDC.USER32 ref: 0000012A222E16EC
DeleteObject.GDI32 ref: 0000012A222E16F5
EnterCriticalSection.KERNEL32 ref: 0000012A222E17EC
LeaveCriticalSection.KERNEL32 ref: 0000012A222E17FE
IStream_Size.SHLWAPI ref: 0000012A222E1835
IStream_Reset.SHLWAPI ref: 0000012A222E1846
IStream_Read.SHLWAPI ref: 0000012A222E18CB
SelectObject.GDI32 ref: 0000012A222E1925
DeleteDC.GDI32 ref: 0000012A222E192E
ReleaseDC.USER32 ref: 0000012A222E193B
DeleteObject.GDI32 ref: 0000012A222E1944

Strings

, xrefs: 0000012A222E1661

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Object$DeleteMetricsSystem$CreateSelectStream_$CapsCompatibleCriticalDeviceReleaseSection$BitmapEnterLeaveReadResetSizeStream
String ID:
API String ID: 3214587331-3916222277
Opcode ID: 4dab6f610966923f5f08f4c6809860ec5b656492cac62730b413cd5653605d09
Instruction ID: 50420d88fb9df754d54271a2fab9b255aef313b680d472d8284d07ccbbec770e
Opcode Fuzzy Hash: 4dab6f610966923f5f08f4c6809860ec5b656492cac62730b413cd5653605d09
Instruction Fuzzy Hash: 6AB14B72218BC0C6E764DB21E9543EAB3A5FB89B80F809515DA8E43B69DF3CC594CB41

Function 00007FF7A45216C0 Relevance: 43.1, APIs: 9, Strings: 15, Instructions: 1071
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A45229E9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A45229EF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A45229F5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A45229FB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A4522A01
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A4522A07
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A4522A0D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A4522A13
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A4522A19

Strings

m_trampolineSz: , xrefs: 00007FF7A45223EA
Trampoline Jmp Tbl:, xrefs: 00007FF7A45225CA
m_trampoline: , xrefs: 00007FF7A4522346
m_fnAddress: , xrefs: 00007FF7A452174A, 00007FF7A45217B4
Chosen detour scheme: , xrefs: 00007FF7A4521E6A
ions, xrefs: 00007FF7A4521CDD
UNKNOWN, xrefs: 00007FF7A4521E3C
Hook size: , xrefs: 00007FF7A4522776
failed, xrefs: 00007FF7A4521D7F
Trampoline:, xrefs: 00007FF7A45224BD
Hook instructions: , xrefs: 00007FF7A4522680
one, xrefs: 00007FF7A4522170
Prologue to overwrite:, xrefs: 00007FF7A45221F1
Prologue offset: , xrefs: 00007FF7A4522808
Original function:, xrefs: 00007FF7A4521A1F

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: one$Chosen detour scheme: $Hook instructions: $Hook size: $Original function:$Prologue offset: $Prologue to overwrite:$Trampoline Jmp Tbl:$Trampoline:$UNKNOWN$failed$ions$m_fnAddress: $m_trampoline: $m_trampolineSz:
API String ID: 3668304517-2571529286
Opcode ID: e9dbe00d73e84b1aca2443e17e93a3ca6c7ad34fe5a1861fc059e8d427c4ce65
Instruction ID: 1e2b4ad231fbd25e085c9c9a55777fd512b5b2b9b3a6a0641651668d609170c7
Opcode Fuzzy Hash: e9dbe00d73e84b1aca2443e17e93a3ca6c7ad34fe5a1861fc059e8d427c4ce65
Instruction Fuzzy Hash: 95B2B722A19BC285EB25EF35D8803EDA361FB95748F815232DA4D476BADF7DD284C310

Function 00007FF7A4522A70 Relevance: 36.3, APIs: 12, Strings: 8, Instructions: 1303COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A4522DA9
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7A4522DAF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A4522DB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A4522DBB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A4524095
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A452409B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A45240A1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A45240A7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A45240AD

Strings

Instructions needing translation:, xrefs: 00007FF7A45233BB
Instructions needing entry:, xrefs: 00007FF7A4522F7C
jmp, xrefs: 00007FF7A4522AD4
Instructions needing relocation:, xrefs: 00007FF7A45230DE
m_fnAddress: , xrefs: 00007FF7A4522DDE
Trampoline address: , xrefs: 00007FF7A45234CD
Jmp To Prol:, xrefs: 00007FF7A4523CBE
Original function:, xrefs: 00007FF7A4522DDC

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: Instructions needing entry:$Instructions needing relocation:$Instructions needing translation:$Jmp To Prol:$Original function:$Trampoline address: $jmp$m_fnAddress:
API String ID: 3936042273-1617887432
Opcode ID: 3d68b8c13095499e7d1417a9f59e822c48b32e0256936b09caf975b3caee107a
Instruction ID: ded8bc898de153399b3bd01a8235c59b18f1e4d6dec4aa6debc51a5de7793159
Opcode Fuzzy Hash: 3d68b8c13095499e7d1417a9f59e822c48b32e0256936b09caf975b3caee107a
Instruction Fuzzy Hash: 19D2AE62B06BC189EB20EF76C8843ED6761EB45798F814632DA5D47BBADF39D184C310

Function 00007FF7A4522DD0 Relevance: 28.9, APIs: 9, Strings: 7, Instructions: 929COMMON

Download Yara Rule

Strings

Instructions needing translation:, xrefs: 00007FF7A45233BB
Instructions needing entry:, xrefs: 00007FF7A4522F7C
Instructions needing relocation:, xrefs: 00007FF7A45230DE
m_fnAddress: , xrefs: 00007FF7A4522DDE
Trampoline address: , xrefs: 00007FF7A45234CD
Jmp To Prol:, xrefs: 00007FF7A4523CBE
Original function:, xrefs: 00007FF7A4522DDC

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID:
String ID: Instructions needing entry:$Instructions needing relocation:$Instructions needing translation:$Jmp To Prol:$Original function:$Trampoline address: $m_fnAddress:
API String ID: 0-38338247
Opcode ID: 5f9d8bd3000f98a24d57cace3f9ead234bd4430d37e80bb3e30a2259914e6365
Instruction ID: 10563ea2c5473ecbdaf50d6937669c29d3b94ad9f3d822d1938347bb3fffb863
Opcode Fuzzy Hash: 5f9d8bd3000f98a24d57cace3f9ead234bd4430d37e80bb3e30a2259914e6365
Instruction Fuzzy Hash: 3892B762A06BC189EB20EF36C4843ED6761FB45798F954232DA5D47BBADF39D284C310

Function 0000012A2231B76C Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32 ref: 0000012A2231B819
GetLastError.KERNEL32 ref: 0000012A2231B823
FindFirstFileW.KERNEL32 ref: 0000012A2231B83A
GetLastError.KERNEL32 ref: 0000012A2231B846
FindClose.KERNEL32 ref: 0000012A2231B854
__std_fs_open_handle.LIBCPMT ref: 0000012A2231B8E7
CloseHandle.KERNEL32 ref: 0000012A2231B8FD
CloseHandle.KERNEL32 ref: 0000012A2231BA70

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: bfb389c9a219f6e3a5f4b256f69d65311ef631e076c0c695385b0534e1d94cbf
Instruction ID: 490a13a9e63ce1f997bfc94e0fc31cad1834e3fb38b2c7f65aa7914a4528e75b
Opcode Fuzzy Hash: bfb389c9a219f6e3a5f4b256f69d65311ef631e076c0c695385b0534e1d94cbf
Instruction Fuzzy Hash: B391B832300A41C7E7744F29A9147D923A2EF49BB0F9453B4DDBA47BD8DB38C9618742

Function 00007FF7A44DD190 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 76
memorynativelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUnicodeString.NTDLL ref: 00007FF7A44DD1AE
RtlCreateUnicodeString.NTDLL ref: 00007FF7A44DD1C2

Part of subcall function 00007FF7A44DCE20: NtCreateSection.NTDLL ref: 00007FF7A44DCF4A
Part of subcall function 00007FF7A44DCE20: NtMapViewOfSection.NTDLL ref: 00007FF7A44DCF97

AddVectoredExceptionHandler.KERNEL32 ref: 00007FF7A44DD1F2
HeapAlloc.KERNEL32 ref: 00007FF7A44DD21D
NtGetContextThread.NTDLL ref: 00007FF7A44DD23C
NtContinue.NTDLL ref: 00007FF7A44DD25A
RtlFreeHeap.NTDLL ref: 00007FF7A44DD276
LoadLibraryExW.KERNEL32 ref: 00007FF7A44DD283
RemoveVectoredExceptionHandler.KERNEL32 ref: 00007FF7A44DD28F

Strings

amsi.dll, xrefs: 00007FF7A44DD27C
\KnownDlls32, xrefs: 00007FF7A44DD1B4
0, xrefs: 00007FF7A44DD29A
\KnownDlls, xrefs: 00007FF7A44DD1A0

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: Create$ExceptionHandlerHeapSectionStringUnicodeVectored$AllocContextContinueFreeLibraryLoadRemoveThreadView
String ID: 0$\KnownDlls$\KnownDlls32$amsi.dll
API String ID: 1981842930-977567376
Opcode ID: 9c790d99df23076ebf768e20d2f9b2e0eb95e492711a48b1e21ed87df4eb97b9
Instruction ID: da25c97fb1f094ea97a323a245dcb8ad06722a8e3936685407f9d2d4c14f2499
Opcode Fuzzy Hash: 9c790d99df23076ebf768e20d2f9b2e0eb95e492711a48b1e21ed87df4eb97b9
Instruction Fuzzy Hash: 4F315E61A1BA0282EE44AF57E894274A361BF88B84F8A6130D91D473B4DF3EE449C321

Function 0000012A222E3A60 Relevance: 22.6, APIs: 3, Strings: 9, Instructions: 1618COMMON

Download Yara Rule

APIs

Part of subcall function 0000012A222E2610: GetCurrentHwProfileW.ADVAPI32 ref: 0000012A222E264A

Part of subcall function 0000012A222E1F50: EnumDisplayDevicesW.USER32 ref: 0000012A222E205D

Part of subcall function 0000012A222E1E80: RegGetValueA.ADVAPI32 ref: 0000012A222E1EE7

Part of subcall function 0000012A222E1B60: GetUserNameW.ADVAPI32 ref: 0000012A222E1BA5

Part of subcall function 0000012A222E1C00: GetComputerNameW.KERNEL32 ref: 0000012A222E1C45

GlobalMemoryStatusEx.KERNEL32 ref: 0000012A222E4226
wcsftime.LIBCMT ref: 0000012A222E4A9F
GetModuleFileNameA.KERNEL32 ref: 0000012A222E4C61

Strings

system, xrefs: 0000012A222E3E6C, 0000012A222E3F7C, 0000012A222E4092, 0000012A222E4184, 0000012A222E42BF, 0000012A222E43C1, 0000012A222E44C4, 0000012A222E4667, 0000012A222E4887, 0000012A222E4B33, 0000012A222E4D0F, 0000012A222E4F5A, 0000012A222E5112, 0000012A222E52D3, 0000012A222E5392
%d-%m-%Y, %H:%M:%S, xrefs: 0000012A222E4A8C
time, xrefs: 0000012A222E4B87
computer_name, xrefs: 0000012A222E4417
cpu, xrefs: 0000012A222E40E6
ram, xrefs: 0000012A222E4313
timezone, xrefs: 0000012A222E4FAE
gpu, xrefs: 0000012A222E3FD0
user_name, xrefs: 0000012A222E3EC0

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Name$ComputerCurrentDevicesDisplayEnumFileGlobalMemoryModuleProfileStatusUserValuewcsftime
String ID: %d-%m-%Y, %H:%M:%S$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 4154315062-1182675529
Opcode ID: b0fc1e9b86479d0e0064e517d1c08c8a9ae56ce5783af5bf41c0a921e4151486
Instruction ID: 776cb89c34f7a8dc565647d21592a92e539be3a2d8d42f0ebf75ce0d6f0dbff9
Opcode Fuzzy Hash: b0fc1e9b86479d0e0064e517d1c08c8a9ae56ce5783af5bf41c0a921e4151486
Instruction Fuzzy Hash: 62036C72615BC5CAEB208F34D8403DD77A5FB89758F909216EA8C17BA9EF74C2A4C701

Function 0000012A2229D930 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 864
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 0000012A2229DA0D
GetProcAddress.KERNEL32 ref: 0000012A2229DB0B
GetProcAddress.KERNEL32 ref: 0000012A2229DBCF
GetProcAddress.KERNEL32 ref: 0000012A2229DC4A
GetProcAddress.KERNEL32 ref: 0000012A2229DCCF
GetProcAddress.KERNEL32 ref: 0000012A2229DD4A
GetProcAddress.KERNEL32 ref: 0000012A2229DDCF
FreeLibrary.KERNEL32 ref: 0000012A2229E8F8

Strings

system, xrefs: 0000012A2229E6FB
cannot use push_back() with , xrefs: 0000012A2229E94A
vault, xrefs: 0000012A2229E74F

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: cannot use push_back() with $system$vault
API String ID: 2449869053-1741236777
Opcode ID: 6e2e07a9f2fee44293878625a083391820c32ca6be03ba8098f77741882e2de2
Instruction ID: d3e0b05432b03e2ebd9d0f90ee20dc3a7fc520f12e3e9716f908bc87e9bd71ba
Opcode Fuzzy Hash: 6e2e07a9f2fee44293878625a083391820c32ca6be03ba8098f77741882e2de2
Instruction Fuzzy Hash: 5D923A32205BC4CAEB618F29E9403DDB3A4FB89798F604216EB9C5BB99DF35C654C701

Function 00007FF7A44DD5E0 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A44DD903
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A44DD909
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7A44DD915
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A44DD91B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A44DD921
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A44DDA23
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A44DDA29

Strings

2-by, xrefs: 00007FF7A44DD6B7
nd 3, xrefs: 00007FF7A44DD6AF
te k, xrefs: 00007FF7A44DD6BF
expa, xrefs: 00007FF7A44DD73A

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID: 2-by$expa$nd 3$te k
API String ID: 3936042273-3581043453
Opcode ID: 21a0941023e9b7a214e712558d3cbfc8f9520702bdbaf05cfd265808015e4b1d
Instruction ID: d62311f5a11f9c9812028568d2886e087c3ff02604b377857b3d5a0d85119872
Opcode Fuzzy Hash: 21a0941023e9b7a214e712558d3cbfc8f9520702bdbaf05cfd265808015e4b1d
Instruction Fuzzy Hash: BDD1E772A1AB8185EB40DF66E48026DB3A5FB88794F514635EAAC07BBDDF3DD480C710

Function 0000012A222D8020 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 256
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000012A222DB120: GetCurrentProcess.KERNEL32 ref: 0000012A222DB15B
Part of subcall function 0000012A222DB120: OpenProcessToken.ADVAPI32 ref: 0000012A222DB16C
Part of subcall function 0000012A222DB120: GetTokenInformation.ADVAPI32 ref: 0000012A222DB1A4

ExitProcess.KERNEL32 ref: 0000012A222D807E
OpenMutexA.KERNEL32 ref: 0000012A222D81A3
ExitProcess.KERNEL32 ref: 0000012A222D81B3
CreateMutexA.KERNEL32 ref: 0000012A222D81D8
ExitProcess.KERNEL32 ref: 0000012A222D8201

Part of subcall function 0000012A222DB510: GetModuleFileNameW.KERNEL32 ref: 0000012A222DB55A

Part of subcall function 0000012A222E6460: CoInitializeEx.OLE32 ref: 0000012A222E64C5

Strings

SeImpersonatePrivilege, xrefs: 0000012A222D8091
SeDebugPrivilege, xrefs: 0000012A222D8085

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Process$Exit$MutexOpenToken$CreateCurrentFileInformationInitializeModuleName
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 470559343-3768118664
Opcode ID: 5bfe8b4ff8cb12200b578da41a32964f312533269f6f1a5465e22c97128ba6be
Instruction ID: cb1415fb26a3ab6dad6902cf8320c79ca63f49cc0341b363f64d76498da6a3da
Opcode Fuzzy Hash: 5bfe8b4ff8cb12200b578da41a32964f312533269f6f1a5465e22c97128ba6be
Instruction Fuzzy Hash: 35B18F72618BC4C3FB20AB25E5453DEA361FF85B90FD04615EA9D02ADADF39C4618703

Function 0000012A223022FC Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 0000012A22302341

Part of subcall function 0000012A223019AC: _invalid_parameter_noinfo.LIBCMT ref: 0000012A223019C0

Part of subcall function 0000012A222FCF0C: HeapFree.KERNEL32 ref: 0000012A222FCF22
Part of subcall function 0000012A222FCF0C: GetLastError.KERNEL32 ref: 0000012A222FCF2C

Part of subcall function 0000012A2230AD20: _invalid_parameter_noinfo.LIBCMT ref: 0000012A2230AC6B

_get_daylight.LIBCMT ref: 0000012A22302330

Part of subcall function 0000012A22301A0C: _invalid_parameter_noinfo.LIBCMT ref: 0000012A22301A20

_get_daylight.LIBCMT ref: 0000012A223025A6
_get_daylight.LIBCMT ref: 0000012A223025B7
_get_daylight.LIBCMT ref: 0000012A223025C8
GetTimeZoneInformation.KERNEL32 ref: 0000012A223025EF

Strings

Eastern Summer Time, xrefs: 0000012A223026AD
Eastern Standard Time, xrefs: 0000012A22302695

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 355007559-239921721
Opcode ID: defc81dd178baeee3c1f504e259458a631c953d5ab932f891df2dba57eb76214
Instruction ID: 3b93cc2f1e1b4a854a331ef67a29da8d1efc928ad3a12228a65b06f132327a24
Opcode Fuzzy Hash: defc81dd178baeee3c1f504e259458a631c953d5ab932f891df2dba57eb76214
Instruction Fuzzy Hash: 8AD1E236700240C7EB20EF26DA903F96761FF84B94FC48066EE4947E96DB78C561C752

Function 0000012A222E0CC0 Relevance: 13.9, APIs: 9, Instructions: 377
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET ref: 0000012A222E0EF2

Part of subcall function 0000012A2230E0F0: EnterCriticalSection.KERNEL32 ref: 0000012A2230E100

InternetOpenUrlA.WININET ref: 0000012A222E0F62
HttpQueryInfoW.WININET ref: 0000012A222E0FBA
HttpQueryInfoW.WININET ref: 0000012A222E1043
InternetQueryDataAvailable.WININET ref: 0000012A222E1081
InternetReadFile.WININET ref: 0000012A222E113B
InternetQueryDataAvailable.WININET ref: 0000012A222E1201
InternetCloseHandle.WININET ref: 0000012A222E12A1
Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222E12E1

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Internet$Query$AvailableDataHttpInfoOpen$CloseConcurrency::cancel_current_taskCriticalEnterFileHandleReadSection
String ID:
API String ID: 2604747929-0
Opcode ID: e517db0fb651db5436af6df4f979562fea453bd9bc19156b50025d2dfa7992eb
Instruction ID: fe1984d76ee631eb8040b0b0f930b556d2826c29aa96a49e92293d48a50eaf34
Opcode Fuzzy Hash: e517db0fb651db5436af6df4f979562fea453bd9bc19156b50025d2dfa7992eb
Instruction Fuzzy Hash: 64028B32A24B94CAFB00CB65E84039D77B4FB89B98F505215EE8967B98DF78D1A0C741

Function 0000012A222DA8F0 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 452
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32 ref: 0000012A222DAB0F
SetFilePointer.KERNEL32 ref: 0000012A222DABC2
ReadFile.KERNEL32 ref: 0000012A222DABF1

Strings

ios_base::badbit set, xrefs: 0000012A222DB09D, 0000012A222DB0C5
exists, xrefs: 0000012A222DB076
ios_base::eofbit set, xrefs: 0000012A222DB0D8
ios_base::failbit set, xrefs: 0000012A222DB0D1

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: File$PointerReadSize
String ID: exists$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 404940565-15404121
Opcode ID: 8652130efd06543b05f548970cc15bfa8e2b8338d0320ff005fd526271369eb0
Instruction ID: 25953491ec723ae8bfaee2def9e36333f186f2eb8bcbe5e7ef79f576d03352cc
Opcode Fuzzy Hash: 8652130efd06543b05f548970cc15bfa8e2b8338d0320ff005fd526271369eb0
Instruction Fuzzy Hash: 06321532210BC4CAEB20CF28D9907D977A1FB85748F808226DA9D57BA9EF75C664C741

Function 0000012A222FEFBC Relevance: 10.8, APIs: 7, Instructions: 286
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000012A222FF3EE

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6d25242549210a63874b3e96cc79b7b8578da90fd26c010f8beb87c2b24ef639
Instruction ID: 94c44b61eece0db235a3f2cab0317a8c14b60f7d1d8266a460c6b80d69b3323e
Opcode Fuzzy Hash: 6d25242549210a63874b3e96cc79b7b8578da90fd26c010f8beb87c2b24ef639
Instruction Fuzzy Hash: 7DC1BE32208689D7E7619B15D4443EEB7A0FF81B94FD90205EA4A077E5DFBAC874CB42

Function 0000012A22302578 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 0000012A223025A6

Part of subcall function 0000012A22301A0C: _invalid_parameter_noinfo.LIBCMT ref: 0000012A22301A20

_get_daylight.LIBCMT ref: 0000012A223025B7

Part of subcall function 0000012A223019AC: _invalid_parameter_noinfo.LIBCMT ref: 0000012A223019C0

_get_daylight.LIBCMT ref: 0000012A223025C8

Part of subcall function 0000012A223019DC: _invalid_parameter_noinfo.LIBCMT ref: 0000012A223019F0

Part of subcall function 0000012A222FCF0C: HeapFree.KERNEL32 ref: 0000012A222FCF22
Part of subcall function 0000012A222FCF0C: GetLastError.KERNEL32 ref: 0000012A222FCF2C

GetTimeZoneInformation.KERNEL32 ref: 0000012A223025EF

Strings

Eastern Summer Time, xrefs: 0000012A223026AD
Eastern Standard Time, xrefs: 0000012A22302695

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 50dad400a73da4412d17c3e8f11a4ce80100cfd78b71fab77d5edecb707deabd
Instruction ID: 5c05581b2d9a1391d36562716ced64bbf738d7fbf1f4fd612284e23b270a4970
Opcode Fuzzy Hash: 50dad400a73da4412d17c3e8f11a4ce80100cfd78b71fab77d5edecb707deabd
Instruction Fuzzy Hash: 51519132600640C7E720DF36EB807E9B761FF48784FC05166EA4943BA6DB78C561CB92

Function 0000012A22297350 Relevance: 9.5, APIs: 2, Strings: 3, Instructions: 716fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 0000012A2229742F
FindNextFileW.KERNEL32 ref: 0000012A22297C14

Strings

filename, xrefs: 0000012A22297A0A
exists, xrefs: 0000012A22298044
content, xrefs: 0000012A22297AFF

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: content$exists$filename
API String ID: 1690352074-1949714836
Opcode ID: 7f83578d0ba7e7100aa6dc0130177d254dbd3165f29da129d5a945093790c849
Instruction ID: 15d60ea758b1c131a5c778b41ee5c47649d9467f88aedb4146b544b173c3e0c7
Opcode Fuzzy Hash: 7f83578d0ba7e7100aa6dc0130177d254dbd3165f29da129d5a945093790c849
Instruction Fuzzy Hash: 3762B272258BC0D2EB20DF24E5843DEB361FB89794FD05615EA9C43AA9DF39C5A0CB01

Function 0000012A222F8E40 Relevance: 9.2, APIs: 6, Instructions: 224COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000012A222F8E62
_get_daylight.LIBCMT ref: 0000012A222F8EC2
_get_daylight.LIBCMT ref: 0000012A222F8ED3
_get_daylight.LIBCMT ref: 0000012A222F8EE4
_isindst.LIBCMT ref: 0000012A222F8F35
_isindst.LIBCMT ref: 0000012A222F8F88

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: c344a62bfee50d7b7fbbc143855967662656a4f3c5d66f4e064aeb2ebf8cc7c4
Instruction ID: 51de6a6297417df77cca83b21a819074902326d784c12ab81fcf6c8c5ad1cb42
Opcode Fuzzy Hash: c344a62bfee50d7b7fbbc143855967662656a4f3c5d66f4e064aeb2ebf8cc7c4
Instruction Fuzzy Hash: 0F81FAB3700345CBEB688F25C9413EDB3A5EB54B88F849125EA098B799FB39D561CF01

Function 0000012A222EAAE0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 408COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 0000012A222EAC90
__std_exception_destroy.LIBVCRUNTIME ref: 0000012A222EAC9E
__std_exception_destroy.LIBVCRUNTIME ref: 0000012A222EAF2D
__std_exception_destroy.LIBVCRUNTIME ref: 0000012A222EAF3B

Strings

value, xrefs: 0000012A222EABB6, 0000012A222EAE5D

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: ce9996d02ce806c0521b0410ab71ad6ae1a65e1f6731ee89ff774000a8b068c9
Instruction ID: e2bed97a62c0b2294f4f92a0c9e494728550745c7590e937b98bcb36ef105676
Opcode Fuzzy Hash: ce9996d02ce806c0521b0410ab71ad6ae1a65e1f6731ee89ff774000a8b068c9
Instruction Fuzzy Hash: A402AD72624BC4C6FB00CB78D4803DDA7A5FB867A4F905301FA9D12AEADF69D1A5C701

Function 0000012A2229E9C0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 324processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0000012A2229EA08
Process32FirstW.KERNEL32 ref: 0000012A2229EA4A
Process32NextW.KERNEL32 ref: 0000012A2229EC49
CloseHandle.KERNEL32 ref: 0000012A2229EEBB

Strings

[PID: , xrefs: 0000012A2229EA84

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: 056f2a4151be0f4e82cac594c76125a87521ccb099f5dcd248b582c8fc8f1d20
Instruction ID: 04f566d3c893766aeb9da326456a5b7ec4a133b64553a6c4ff6c0a5beefa8155
Opcode Fuzzy Hash: 056f2a4151be0f4e82cac594c76125a87521ccb099f5dcd248b582c8fc8f1d20
Instruction Fuzzy Hash: D0E1B272614BC0C6EB25CF25E9903DDB7A5FB897A8F904215EA9D07B99DF38C290C701

Function 00007FF7A44DCE20 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 00007FF7A44DCF4A
NtMapViewOfSection.NTDLL ref: 00007FF7A44DCF97
NtMapViewOfSection.NTDLL ref: 00007FF7A44DCFE1
NtUnmapViewOfSection.NTDLL ref: 00007FF7A44DD01E

Strings

@, xrefs: 00007FF7A44DCF42

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: Section$View$CreateUnmap
String ID: @
API String ID: 3892452295-2766056989
Opcode ID: cff147bf67fabab3ad981c1573a0e41cdafc437f2ea82112878411de19518375
Instruction ID: c7e9f25570a18bcee4d431b1e4b29dfb582a71f3c3f73ca5b85fc824a801cd66
Opcode Fuzzy Hash: cff147bf67fabab3ad981c1573a0e41cdafc437f2ea82112878411de19518375
Instruction Fuzzy Hash: 4461807260AB41CAEB50DF61E8902A977E4FB48788F810635DE4D53B68DF3AD154C760

Function 0000012A222E78B0 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0000012A222E78FA
OpenProcessToken.ADVAPI32 ref: 0000012A222E790B
LookupPrivilegeValueW.ADVAPI32 ref: 0000012A222E7929
AdjustTokenPrivileges.ADVAPI32 ref: 0000012A222E796F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000012A222D8091), ref: 0000012A222E798D

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: fbf7b0cc3bc22610d5552f091d41485e4fe28e08ce852d67ae269c7227012baa
Instruction ID: 4b5b5a84952ffe7b23fd28d1a8ac2c2df77f0d7baf549bbc41e56ea9425b0c02
Opcode Fuzzy Hash: fbf7b0cc3bc22610d5552f091d41485e4fe28e08ce852d67ae269c7227012baa
Instruction Fuzzy Hash: A5215132218B84C3E720CF22F5402DAB3A4FB88B90F955125EBCA57B58DF7DD5518B40

Function 0000012A222C3210 Relevance: 6.8, Strings: 5, Instructions: 571COMMON

Download Yara Rule

Strings

directory_iterator::directory_iterator, xrefs: 0000012A222C3FCA, 0000012A222C5623
prefs.js, xrefs: 0000012A222C4748
cannot use push_back() with , xrefs: 0000012A222C3F79
exists, xrefs: 0000012A222C31F4, 0000012A222C560C
status, xrefs: 0000012A222C3FB8, 0000012A222C3FDA, 0000012A222C4002, 0000012A222C402A

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: cannot use push_back() with $directory_iterator::directory_iterator$exists$prefs.js$status
API String ID: 0-2713369562
Opcode ID: 1d6bba3b50d441fb4bdf3a69060370037fcd60f4954262f8879855b9889ef394
Instruction ID: 9b6fe6fc74e6fa951d28115d0fef6309be755b0c9801e16fb71c7bb05ed9f64e
Opcode Fuzzy Hash: 1d6bba3b50d441fb4bdf3a69060370037fcd60f4954262f8879855b9889ef394
Instruction Fuzzy Hash: 8B527B32619BC4C6EB719B14E8813DAB3A4FBC9780F904625DACC53B69EF79C164CB41

Function 0000012A222E0480 Relevance: 6.4, APIs: 4, Instructions: 431networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 0000012A222E065E
recv.WS2_32 ref: 0000012A222E0B79
closesocket.WS2_32 ref: 0000012A222E0B8B
WSACleanup.WS2_32 ref: 0000012A222E0B91

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: 63df05e03726391c15bd1c825f2cae3a5063d2c053fa10481967e31f21d6abc3
Instruction ID: 68ea36c56bea2b90d5dbe9f15381f6d84ddad22ab7093c770c2e36c57e4cef42
Opcode Fuzzy Hash: 63df05e03726391c15bd1c825f2cae3a5063d2c053fa10481967e31f21d6abc3
Instruction Fuzzy Hash: A912D472618BC4C2FB208B29E5443DEA765FBC9790FD05601EA9C13AEADF79C195CB01

Function 0000012A2229CDE0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 668COMMON

Download Yara Rule

APIs

CredEnumerateA.ADVAPI32 ref: 0000012A2229CE42
CredFree.ADVAPI32 ref: 0000012A2229D854

Strings

cannot use push_back() with , xrefs: 0000012A2229D8A0

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Cred$EnumerateFree
String ID: cannot use push_back() with
API String ID: 3403564193-4122110429
Opcode ID: aaf3abb4d69eaebfd4e29ed56c1d1a173ba05c9775e8997a0052f56f092d3c84
Instruction ID: 980225d4590520249392a41c28b32027f6ab40dc41bc5101ae4d2bde638c3a1c
Opcode Fuzzy Hash: aaf3abb4d69eaebfd4e29ed56c1d1a173ba05c9775e8997a0052f56f092d3c84
Instruction Fuzzy Hash: 41626C72604BC4CAEB209F65E8803DD77A1FB89798F905315EAAC07B99DF79C294C701

Function 00007FF7A44DD2E0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 208COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A44DD54A
__std_exception_copy.LIBVCRUNTIME ref: 00007FF7A44DD5B8

Strings

1.3.1.zlib-ng, xrefs: 00007FF7A44DD34B

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: __std_exception_copy_invalid_parameter_noinfo_noreturn
String ID: 1.3.1.zlib-ng
API String ID: 1109970293-992988628
Opcode ID: 1b3990169c6edc83ac0ae0c85f07acfaa4477e0da266bc5dde884a8e722b1ebf
Instruction ID: a73638f0acb8b7ddf5dcd7b24679d18432d46430aef3f92947949d3820b8889a
Opcode Fuzzy Hash: 1b3990169c6edc83ac0ae0c85f07acfaa4477e0da266bc5dde884a8e722b1ebf
Instruction Fuzzy Hash: FF81B662F16B8199EB50EF72D4802ED73A1FB84748F815232EA4C57BB9EE38E554C350

Function 0000012A222E3040 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32 ref: 0000012A222E3386

Strings

[UTC, xrefs: 0000012A222E3353

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: [UTC
API String ID: 565725191-1715286942
Opcode ID: cbcfeccc56f0404e1d7aa4c25a4bf5f24f5c1e198b83cc6711815d20937e9379
Instruction ID: 7a5da71b61903a6b1bd6409a1b02b470bdbc1c080cdc08825d9dc0173ce84b20
Opcode Fuzzy Hash: cbcfeccc56f0404e1d7aa4c25a4bf5f24f5c1e198b83cc6711815d20937e9379
Instruction Fuzzy Hash: DE910832629FC48AD7A18F29E88169EB3B4F798784F506219FECD57B18EB74C154C740

Function 00007FF7A44EA200 Relevance: 3.1, APIs: 2, Instructions: 103nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A44EA9A0: GetModuleHandleW.KERNEL32 ref: 00007FF7A44EA9CB
Part of subcall function 00007FF7A44EA9A0: GetProcAddress.KERNEL32 ref: 00007FF7A44EA9DE

RtlAdjustPrivilege.NTDLL ref: 00007FF7A44EA287
NtRaiseHardError.NTDLL ref: 00007FF7A44EA2F2

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: AddressAdjustErrorHandleHardModulePrivilegeProcRaise
String ID:
API String ID: 2798384791-0
Opcode ID: ceea57dc161494e54f7f068002607a0d3dec399256df02af62d747f42aa3fe15
Instruction ID: acdb46881f77427d32e59d1ad9a20a42d5d2f3ee8341fb8fb8c147b273c4844a
Opcode Fuzzy Hash: ceea57dc161494e54f7f068002607a0d3dec399256df02af62d747f42aa3fe15
Instruction Fuzzy Hash: AC51362162A98695E750FF22D8D17EDA321FF94344FC21432E10D865B9EE7DD709C710

Function 0000012A222D3B40 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 0000012A222D3B98
LocalFree.KERNEL32 ref: 0000012A222D3C2A

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 1f152763ec19e619bfc368bf77117f477a0b79e9407e037414c49aea0ab6e5f4
Instruction ID: aac5be5ee5ef5c1843de3bfaae8e7cf8c8f980a5b1ec564a04f72c7f931f5abe
Opcode Fuzzy Hash: 1f152763ec19e619bfc368bf77117f477a0b79e9407e037414c49aea0ab6e5f4
Instruction Fuzzy Hash: 54415733614B80CAE3208F74E5403ED77A4FB5878CF444629EB8916E8ADB79C6A4C754

Function 0000012A222E2D90 Relevance: 1.7, APIs: 1, Instructions: 160COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 0000012A222E2E01

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 6505a69286372a5ab8e33a0820798ad6f93d0af771eb6d079aa7cc5a7919cd7b
Instruction ID: 588f750af3a9c75ab42cb2f07dd1070a3dcf156b984b6fcbed0133f89dcd9e2a
Opcode Fuzzy Hash: 6505a69286372a5ab8e33a0820798ad6f93d0af771eb6d079aa7cc5a7919cd7b
Instruction Fuzzy Hash: 51719032A18B84C2E710CF24E88039EB7B5FB94798F505305EB9813AA9DF79E1E1D741

Function 0000012A222E1B60 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 0000012A222E1BA5

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 974e4f322e43ef909849fbc456c3f4976db81938fc0d4d45dcd05a562f6cf0af
Instruction ID: 5defabe655bdc206f3396883f7607ce368ced4639667c1c4d9dfadc64730075b
Opcode Fuzzy Hash: 974e4f322e43ef909849fbc456c3f4976db81938fc0d4d45dcd05a562f6cf0af
Instruction Fuzzy Hash: 2D018432218780C3E720CF25E9403DAB3A4FB98788F840125E68D42A59DFBDC1A4CB41

Function 0000012A222E2240 Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

cores, xrefs: 0000012A222E2476

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: cores
API String ID: 0-2370456839
Opcode ID: e88b2472b0c57332bfaaeb7ce4e37d2262cc194edfaa7cfbbdc60ecf2a80a8d1
Instruction ID: 58580f109fcdb2b2853c741e5a48684b2e1bdab7cc13f820996441964c3d908d
Opcode Fuzzy Hash: e88b2472b0c57332bfaaeb7ce4e37d2262cc194edfaa7cfbbdc60ecf2a80a8d1
Instruction Fuzzy Hash: CBB1B072F10B848BFB00CBB8C4413DC7772EB95798FA05315EE5927A9ADBB491A5C380

Function 0000012A222E8F60 Relevance: 1.5, Strings: 1, Instructions: 212COMMON

Download Yara Rule

Strings

\u%04x, xrefs: 0000012A222E9156

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: \u%04x
API String ID: 0-2916071157
Opcode ID: a77369d2fed5f591b56bbed92216145abb483a752ea1b525985359735ec1b52a
Instruction ID: 82e0d91bf5b7c9f47d29fc088c06d1a9b2332402670073d706ed3d9df79dc668
Opcode Fuzzy Hash: a77369d2fed5f591b56bbed92216145abb483a752ea1b525985359735ec1b52a
Instruction Fuzzy Hash: 85810D32604A84C2FB24CB29D5947EDA765FB85B80FC48022DF4E17BA1DF3AD565D302

Function 0000012A222E8578 Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

": , xrefs: 0000012A222E8655, 0000012A222E86F5

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ":
API String ID: 0-3662656813
Opcode ID: 8780d4b3705763dbab8654373f79912a9912a420cb17ae45beabce1fe27159eb
Instruction ID: 143a9c695552ed5c59d7a14946f1291d0390afd6c0cf18975ce6e3bd6d44e50a
Opcode Fuzzy Hash: 8780d4b3705763dbab8654373f79912a9912a420cb17ae45beabce1fe27159eb
Instruction Fuzzy Hash: 04911476204A45C2EB20DF26D19469DA761FB89FC8F859002DF8E07B64CF3AC169D702

Function 0000012A222A43F0 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 0000012A222A4479

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 0-1713319389
Opcode ID: 4091bbf8c5fdb6ace85941fe286125e043e6b1916b0a3ae4a93e98e2058045e7
Instruction ID: 299d222f16579c73626bc6c636c53a764276abe7b65cf587d60f991630132dbd
Opcode Fuzzy Hash: 4091bbf8c5fdb6ace85941fe286125e043e6b1916b0a3ae4a93e98e2058045e7
Instruction Fuzzy Hash: 4641B5735196E08AD706CB3984113BDBFB1D366B88F5CC152DBD487B4AD62DC216C711

Function 0000012A2229F060 Relevance: .7, Instructions: 716COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2d2a2498fac0e677833bd73f0523b636586b84c3ae837d9d29cc0f69bcd838
Instruction ID: 0ce99a9b19b5de74641756c1f98ffc1695ac4a94fb2e3e5cc0fd86e77a4d7a6c
Opcode Fuzzy Hash: bf2d2a2498fac0e677833bd73f0523b636586b84c3ae837d9d29cc0f69bcd838
Instruction Fuzzy Hash: FB724C72614BC48AEB70CF29E8413DDB3A5F789798F904315EA9C56B99EF38C294C740

Function 0000012A22291130 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 997d7e9e3a15c337bd95107d19d059e3dc99556fb15464e2b0a9eb7a83a3403b
Instruction ID: 325e42e13ba11e464731fdc1b59fcf75670e76bb150c497ec8e96519085ba2b0
Opcode Fuzzy Hash: 997d7e9e3a15c337bd95107d19d059e3dc99556fb15464e2b0a9eb7a83a3403b
Instruction Fuzzy Hash: 33F15072A14F888AEB208B69E44139DB7B4F78D7A8F505315EEDC57B99EB78C190C700

Function 0000012A22291820 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01d53682921f948a3754c58c32b249c4381a35c6db4954a5339c3c6bdf7cacc5
Instruction ID: fc43bbd337b1f1aad28e90709a1c61c08ffefb463ce632b6a8d1116fe9da63da
Opcode Fuzzy Hash: 01d53682921f948a3754c58c32b249c4381a35c6db4954a5339c3c6bdf7cacc5
Instruction Fuzzy Hash: E1F15032615F888AEB208B69E44139DB7B4F78C7A8F505315EEDC57B99EB78C190C700

Function 0000012A222DA4D0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 192
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000012A222DA250: InitializeCriticalSectionEx.KERNEL32 ref: 0000012A222DA2A1
Part of subcall function 0000012A222DA250: GetLastError.KERNEL32 ref: 0000012A222DA2AB

EnterCriticalSection.KERNEL32 ref: 0000012A222DA511
GdiplusStartup.GDIPLUS ref: 0000012A222DA538
LeaveCriticalSection.KERNEL32 ref: 0000012A222DA546
LeaveCriticalSection.KERNEL32 ref: 0000012A222DA574
GdipGetImageEncodersSize.GDIPLUS ref: 0000012A222DA582
GdipGetImageEncoders.GDIPLUS ref: 0000012A222DA616
GdipCreateBitmapFromScan0.GDIPLUS ref: 0000012A222DA6DA
GdipSaveImageToStream.GDIPLUS ref: 0000012A222DA6F8
GdipDisposeImage.GDIPLUS ref: 0000012A222DA75D
GdipDisposeImage.GDIPLUS ref: 0000012A222DA771

Strings

&, xrefs: 0000012A222DA6D4

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream
String ID: &
API String ID: 1703174404-3042966939
Opcode ID: 8835fc14b8c0fd5262807f6dd3a58a869a1510dc22799758eb5ac62de40f1462
Instruction ID: b81d59bffc04082733730acdfbdaabfafd15833549c81566589fd2558f7fb7b1
Opcode Fuzzy Hash: 8835fc14b8c0fd5262807f6dd3a58a869a1510dc22799758eb5ac62de40f1462
Instruction Fuzzy Hash: 9C91A432200B84CBEB20CF35D950BDC77A4FB54B98F959215EA0947B98DF39C5A5C381

Function 0000012A222DB650 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 286
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000012A222E12F0: GetUserGeoID.KERNEL32 ref: 0000012A222E1315
Part of subcall function 0000012A222E12F0: GetGeoInfoA.KERNEL32 ref: 0000012A222E132D
Part of subcall function 0000012A222E12F0: GetGeoInfoA.KERNEL32 ref: 0000012A222E137D

WSAStartup.WS2_32 ref: 0000012A222DB76E
socket.WS2_32 ref: 0000012A222DB78B
htons.WS2_32 ref: 0000012A222DB7B1
inet_pton.WS2_32 ref: 0000012A222DB8A6
connect.WS2_32 ref: 0000012A222DB8C0
closesocket.WS2_32 ref: 0000012A222DB8E3
WSACleanup.WS2_32 ref: 0000012A222DB8E9

Strings

system, xrefs: 0000012A222DB6DB
geo, xrefs: 0000012A222DB71B

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: geo$system
API String ID: 213021568-2364779556
Opcode ID: 9d9450ace9319d5de9fa58b6aa4a63dd30cedaeb8901d28fd54cab01527caeae
Instruction ID: cb95994edf0d37dd489d79e9c6762509691e1f5cc2a98a37afeeced5b27c21be
Opcode Fuzzy Hash: 9d9450ace9319d5de9fa58b6aa4a63dd30cedaeb8901d28fd54cab01527caeae
Instruction Fuzzy Hash: F4C1CB72B10B84C6FB108F69D5543DCB372EB49BA4FC05212DA6927BE9DE39C5A6C301

Function 0000012A223236A8 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000012A22323288: _invalid_parameter_noinfo.LIBCMT ref: 0000012A223232C9
Part of subcall function 0000012A22323288: _invalid_parameter_noinfo.LIBCMT ref: 0000012A22323349
Part of subcall function 0000012A22323288: _invalid_parameter_noinfo.LIBCMT ref: 0000012A2232339D
Part of subcall function 0000012A22323288: _get_daylight.LIBCMT ref: 0000012A223233F5

CreateFileW.KERNEL32 ref: 0000012A223237AE
CreateFileW.KERNEL32 ref: 0000012A223237FE
GetLastError.KERNEL32 ref: 0000012A2232382E
GetFileType.KERNEL32 ref: 0000012A22323843
GetLastError.KERNEL32 ref: 0000012A2232384D
CloseHandle.KERNEL32 ref: 0000012A22323880
CloseHandle.KERNEL32 ref: 0000012A223239E4
CreateFileW.KERNEL32 ref: 0000012A22323A19
GetLastError.KERNEL32 ref: 0000012A22323A28

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type_get_daylight
String ID:
API String ID: 1330151763-0
Opcode ID: 490799599c57ad564ab0fcf16f8555b356a9328dbb73e8c96f5ba99975714cec
Instruction ID: 12d9b4842f5907216585b5ce32763695cb59e1c04236112b2ad8725371c461f7
Opcode Fuzzy Hash: 490799599c57ad564ab0fcf16f8555b356a9328dbb73e8c96f5ba99975714cec
Instruction Fuzzy Hash: B1C1DC37724A40C6EB20CFA8D5902EC3771FB49BA8F815355DE2A9B794CB38C566C341

Function 00007FF7A45269E0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 53
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00007FF7A4526A17
LoadLibraryA.KERNEL32 ref: 00007FF7A4526A6F
GetProcAddress.KERNEL32 ref: 00007FF7A4526A84
GetCurrentProcess.KERNEL32 ref: 00007FF7A4526A8D
VirtualAlloc2.KERNELBASE ref: 00007FF7A4526ABB

Strings

kernelbase.dll, xrefs: 00007FF7A4526A59
VirtualAlloc2, xrefs: 00007FF7A4526A7A

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: AddressAlloc2CurrentInfoLibraryLoadProcProcessSystemVirtual
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 3240720159-1188699709
Opcode ID: 135b3590b98399b5718114b168c3f2947e099dc2b06234d8dc59709f703b486a
Instruction ID: 1142fc076e6b36a6bc290e747a31d943c66be463bb9404a69f3a928a09894cb6
Opcode Fuzzy Hash: 135b3590b98399b5718114b168c3f2947e099dc2b06234d8dc59709f703b486a
Instruction Fuzzy Hash: 27212822A09B8182EB10CF16F484369B7A0FB99B80F954235EB8D43B64DF7DD595CB10

Function 00007FF7A44EA9A0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF7A44EA9CB
GetProcAddress.KERNEL32 ref: 00007FF7A44EA9DE

Strings

HeapAlloc, xrefs: 00007FF7A44EA9D4
HeapAlloc offset (relative to kernel32.dll): 0x, xrefs: 00007FF7A44EA9ED
kernel32.dll, xrefs: 00007FF7A44EA9C4
Failed to get address of HeapAlloc., xrefs: 00007FF7A44EAA52

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Failed to get address of HeapAlloc.$HeapAlloc$HeapAlloc offset (relative to kernel32.dll): 0x$kernel32.dll
API String ID: 1646373207-1114591187
Opcode ID: 6d5182da63a6ef1320b777ed2abb5481cd8ef6387fd2fe5c03388905ac86d248
Instruction ID: 2d0b67804035e602e4b0e45ba69e165ee4d19a0dd4f894f752fa599e06b16311
Opcode Fuzzy Hash: 6d5182da63a6ef1320b777ed2abb5481cd8ef6387fd2fe5c03388905ac86d248
Instruction Fuzzy Hash: 6E31A321A0AA4290EA10FF13E8D51F9A361BF947C4FC25432E90E477BADE3EE505C360

Function 00007FF7A451F8C0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 59COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A451F970

Strings

2, xrefs: 00007FF7A451FF3D
*, xrefs: 00007FF7A451FFCA
/, xrefs: 00007FF7A451FFD3
?, xrefs: 00007FF7A451FF46
ange, xrefs: 00007FF7A451FCF2

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: *$/$2$?$ange
API String ID: 3668304517-891152793
Opcode ID: 7833f418a5f044f9cf3d01c58cc070a8254b89cc81cd3f6a52e4e638c0e16de4
Instruction ID: 44789ddace4fb38b8a9d8a817ddf75cc934607e16a99bb171a787726bc6b7436
Opcode Fuzzy Hash: 7833f418a5f044f9cf3d01c58cc070a8254b89cc81cd3f6a52e4e638c0e16de4
Instruction Fuzzy Hash: 11110673B1678692EE44BF56E49136CA2A0AB48BC4F588536DB8C0BB65DF2CD4908300

Function 0000012A222DA330 Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 0000012A222DA373
EnterCriticalSection.KERNEL32 ref: 0000012A222DA385
EnterCriticalSection.KERNEL32 ref: 0000012A222DA395
GdiplusShutdown.GDIPLUS ref: 0000012A222DA3A3
LeaveCriticalSection.KERNEL32 ref: 0000012A222DA3B0
LeaveCriticalSection.KERNEL32 ref: 0000012A222DA3BA

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 9312ee92e43017e15c80159da1815fefed654e82bb603727025027d9faa898aa
Instruction ID: 9c9913ac63fe819141e3e845952e31d2f23d20f47d6618a4e87efacba15de416
Opcode Fuzzy Hash: 9312ee92e43017e15c80159da1815fefed654e82bb603727025027d9faa898aa
Instruction Fuzzy Hash: AD118C32111B40C2EB608F25E8402887374FB48FA4FA88215EA6E476A4CF39C9A7C381

Function 00007FF7A4519DA0 Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7A4519DC3
ReadProcessMemory.KERNEL32 ref: 00007FF7A4519DEC
GetLastError.KERNEL32 ref: 00007FF7A4519E00
VirtualQueryEx.KERNEL32 ref: 00007FF7A4519E1E
ReadProcessMemory.KERNEL32 ref: 00007FF7A4519E4D

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: Process$MemoryRead$CurrentErrorLastQueryVirtual
String ID:
API String ID: 2584129402-0
Opcode ID: 709e32109f8befe5390051b0e604ec33ee2c8b657ed6020e9be8583112b791ac
Instruction ID: 05951db75f89468e47ac999caa6dd0ac1d9c6774b2834cf4272d6dda9da23e16
Opcode Fuzzy Hash: 709e32109f8befe5390051b0e604ec33ee2c8b657ed6020e9be8583112b791ac
Instruction Fuzzy Hash: 3C212835A09B4182EB60AF12E88476AA3A5FB55FC0F894531EA5C43B74CF3ED552C621

Function 00007FF7A451ED00 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 199COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A451F011
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A451F017

Strings

-> , xrefs: 00007FF7A451EF4A
]: , xrefs: 00007FF7A451EE1D

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: -> $]:
API String ID: 3668304517-2558318465
Opcode ID: c0c6e1fc448afd9c2289b3938244600ddd4260ac214fbdc89c71152151cfc35b
Instruction ID: 8667cb9784b854678414f81bd0e025d99d890d998e4721e11026e71e8c5e6a61
Opcode Fuzzy Hash: c0c6e1fc448afd9c2289b3938244600ddd4260ac214fbdc89c71152151cfc35b
Instruction Fuzzy Hash: 4291BD7260AA8585EF40EF2AD0C03ADA761FB84B84F919532EA5E477B9DF39D481C350

Function 00007FF7A44DD070 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A44EA9A0: GetModuleHandleW.KERNEL32 ref: 00007FF7A44EA9CB
Part of subcall function 00007FF7A44EA9A0: GetProcAddress.KERNEL32 ref: 00007FF7A44EA9DE

RtlCreateUnicodeString.NTDLL ref: 00007FF7A44DD0A8
VirtualFree.KERNELBASE ref: 00007FF7A44DD156

Strings

BSJB, xrefs: 00007FF7A44DD136
amsi.dll, xrefs: 00007FF7A44DD090

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: AddressCreateFreeHandleModuleProcStringUnicodeVirtual
String ID: BSJB$amsi.dll
API String ID: 1968330574-2235497149
Opcode ID: 9b5676883d8a9942b5cd96bf72043d3b837f298f51a0c570be86945f3d351979
Instruction ID: 6ed42b51044465ca550fd359d9989438024c82c2c2cd9a4e64534d3fea08c745
Opcode Fuzzy Hash: 9b5676883d8a9942b5cd96bf72043d3b837f298f51a0c570be86945f3d351979
Instruction Fuzzy Hash: A031A261B0BA4785FE90AF02E48023DE3A1EF85B81F8A4431CA0D0777CDE7EE5418320

Function 00007FF7A451F9F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7A451FA52
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A451FA58

Strings

*, xrefs: 00007FF7A451FFCA
/, xrefs: 00007FF7A451FFD3

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: *$/
API String ID: 73155330-2426586843
Opcode ID: 5757b1e5df8bb840e9e5f55dd987a1bb8213efa484ea007226ec6a1f8d228222
Instruction ID: c9401f3066bca1818029e56735a13f6c439d1fb8b1c086cccf5f6031002db13b
Opcode Fuzzy Hash: 5757b1e5df8bb840e9e5f55dd987a1bb8213efa484ea007226ec6a1f8d228222
Instruction Fuzzy Hash: 42E06D42F0734745ED5CBA9A80DA77881A09F857A0ED10B32E23C077FAEE1D64814351

Function 00007FF7A452C220 Relevance: 6.1, APIs: 4, Instructions: 149COMMON

Download Yara Rule

APIs

_Mtx_unlock.LIBCPMT ref: 00007FF7A452C36D
std::_Throw_Cpp_error.LIBCPMT ref: 00007FF7A452C38C
std::_Throw_Cpp_error.LIBCPMT ref: 00007FF7A452C397
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A452C3DB

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$Mtx_unlock_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3824905759-0
Opcode ID: 85c23642dd593b1c173b42692d77ae3c0872ba970f94a2eaa9afa85847818624
Instruction ID: 0cc015134c87c56ed98dc1fbc0eef5b4df8924baee396ad9db8947abdd7749d9
Opcode Fuzzy Hash: 85c23642dd593b1c173b42692d77ae3c0872ba970f94a2eaa9afa85847818624
Instruction Fuzzy Hash: 9751F832609741C2EB25AF27D48016DA391EB8AFA4F594532DA4E877B5CE2DD841CB10

Function 00007FF7A4527DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7A4527F0E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A4527F14

Strings

nop, xrefs: 00007FF7A4528484

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: nop
API String ID: 73155330-258488684
Opcode ID: 57ea590dd3f509f37e8be66ab5de10c067b1786fa4ac7f8625bc5c7994107ae5
Instruction ID: 80909b097bcdaece633da41e871e46d219a4dc7c4ddb2b1825b4be70e909443c
Opcode Fuzzy Hash: 57ea590dd3f509f37e8be66ab5de10c067b1786fa4ac7f8625bc5c7994107ae5
Instruction Fuzzy Hash: F231D462B1B78680E954EF16E08427DF255EB44BE0F950632DA6D43BF9DF3DE4918320

Function 00007FF7A44FC6BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringEx.KERNEL32 ref: 00007FF7A44FC759
LCMapStringW.KERNEL32 ref: 00007FF7A44FC78D

Strings

LCMapStringEx, xrefs: 00007FF7A44FC6D8, 00007FF7A44FC6E9

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 21bec28f4c4cf7e498effb9ef9ad3ab1c5fa99225fccc5c96c3468d83e1adf15
Instruction ID: bc894477157bb40ad65f048406aa5c33905d20214b0f55ffeda1db7eebd16ca2
Opcode Fuzzy Hash: 21bec28f4c4cf7e498effb9ef9ad3ab1c5fa99225fccc5c96c3468d83e1adf15
Instruction Fuzzy Hash: 7B212C36609B8186D764DF16B4802AAB7A5FB89BC0F944136EE8D43B69DF3CD4548B40

Function 0000012A222E1E80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegGetValueA.ADVAPI32 ref: 0000012A222E1EE7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0000012A222E1ED9
ProductName, xrefs: 0000012A222E1ED2

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: adf216c2d1b5f5292331595630b64b33fa050b190fc1c5e17533aec2785cb7d3
Instruction ID: 276d3dd783a69d35d070b003d4938b29940207b5424c77f7f0ad4cc322c054a0
Opcode Fuzzy Hash: adf216c2d1b5f5292331595630b64b33fa050b190fc1c5e17533aec2785cb7d3
Instruction Fuzzy Hash: 07116032608B84C3EB208F25F5413DAB3A4FB89788F905215EB9807B58DFBDD165CB41

Function 0000012A222E080E Relevance: 4.7, APIs: 3, Instructions: 186networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 0000012A222E0B79
closesocket.WS2_32 ref: 0000012A222E0B8B
WSACleanup.WS2_32 ref: 0000012A222E0B91

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketrecv
String ID:
API String ID: 3447645871-0
Opcode ID: bd7be30a7f1799e68acf7d0b86d7fb193574b9ebb99d8fe27394200c1a9bf58a
Instruction ID: 05916d8054f2e5455474afacaea063e2b1676bfe1d354583f3ecaa5795b6f1b3
Opcode Fuzzy Hash: bd7be30a7f1799e68acf7d0b86d7fb193574b9ebb99d8fe27394200c1a9bf58a
Instruction Fuzzy Hash: 8491A273614BC4C2FB208B28E5443DEA321FB99BA0F905305EAAC13ADADF79D195C701

Function 0000012A222E2AF1 Relevance: 4.7, APIs: 3, Instructions: 163registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000012A222E2B09
RegEnumKeyExA.ADVAPI32 ref: 0000012A222E2B4E
RegCloseKey.ADVAPI32 ref: 0000012A222E2D44

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: 8b0f990bc395fd6dc660a203d8fa75fcc4052e589b1305530a692d2154eadef8
Instruction ID: b7b2a6947d2a5ad6582d654104c7e8cb603aaede7fc2faf362ca52186d13bb9f
Opcode Fuzzy Hash: 8b0f990bc395fd6dc660a203d8fa75fcc4052e589b1305530a692d2154eadef8
Instruction Fuzzy Hash: 3771B072604B84C6FB208B65E4443DDB761FB857A8FA05305EBA903AE9DF79D0E0D701

Function 0000012A222E2A80 Relevance: 4.6, APIs: 3, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000012A222E2B09
RegEnumKeyExA.ADVAPI32 ref: 0000012A222E2B4E

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: EnumOpen
String ID:
API String ID: 3231578192-0
Opcode ID: c7e0896dc62b5111255344d6421dc052eacbf7dc8729ac6d9f67dcb814477fac
Instruction ID: 688aafddb5dc81c328462b7afd209d8d8fd38caacf78c95f113333f7cd549258
Opcode Fuzzy Hash: c7e0896dc62b5111255344d6421dc052eacbf7dc8729ac6d9f67dcb814477fac
Instruction Fuzzy Hash: 28317E32600B84C6F720CFA5E8407DEB7A4FB84798FA01215EE9917A98DF79C1A2C700

Function 0000012A222F03B4 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000012A222F03DB

Part of subcall function 0000012A222F0370: _invalid_parameter_noinfo.LIBCMT ref: 0000012A222F0387

_invalid_parameter_noinfo.LIBCMT ref: 0000012A222F0488
_local_unwind.LIBVCRUNTIME ref: 0000012A222F0499

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo$_local_unwind
String ID:
API String ID: 1677304287-0
Opcode ID: 2d0cb57732f71c7861a18988631ea2dcdbba9467b0616a14b128760128b0135d
Instruction ID: c24e1c044dd6a8cad6e8a025378fea63cb75f94c6dc6195911da246cea41f446
Opcode Fuzzy Hash: 2d0cb57732f71c7861a18988631ea2dcdbba9467b0616a14b128760128b0135d
Instruction Fuzzy Hash: C521B132624644C3EB54DF15E5913EDB360FFA5B94FD40211EA4A4B3EADA3AC674CB02

Function 0000012A222E27BB Relevance: 4.6, APIs: 3, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000012A222E27D7
RegQueryValueExA.ADVAPI32 ref: 0000012A222E2816
RegCloseKey.ADVAPI32 ref: 0000012A222E28B4

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 872066cfa414fe7bb540fbca7bb9d61572fbd2ad052d8c9c386e734c2b059875
Instruction ID: 98706ecbf8e0ee0f970cc398032ef5e5f1fd964d01339e7615ed023266665afc
Opcode Fuzzy Hash: 872066cfa414fe7bb540fbca7bb9d61572fbd2ad052d8c9c386e734c2b059875
Instruction Fuzzy Hash: 6B21D172624B84C2FF60CB25E48039AA361FBC57D4F905211FA9E02AA9DF7CD194CB01

Function 0000012A222E12F0 Relevance: 4.6, APIs: 3, Instructions: 50COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32 ref: 0000012A222E1315
GetGeoInfoA.KERNEL32 ref: 0000012A222E132D
GetGeoInfoA.KERNEL32 ref: 0000012A222E137D

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: f0b6ba3127188870d9ca77e4cdfddb0e206f65f9be5dd170d7b6ddfbdcbbc9f0
Instruction ID: 5a6b0a5b221fec89d97471983b75c6debcdd959e6de5216ab08891556fc6e132
Opcode Fuzzy Hash: f0b6ba3127188870d9ca77e4cdfddb0e206f65f9be5dd170d7b6ddfbdcbbc9f0
Instruction Fuzzy Hash: 1311A932624B80C7E7248F61E51079EB3A1FB80B88F445224EB8503B59DB78D5A08B81

Function 0000012A222DB120 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0000012A222DB15B
OpenProcessToken.ADVAPI32 ref: 0000012A222DB16C
GetTokenInformation.ADVAPI32 ref: 0000012A222DB1A4

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ProcessToken$CurrentInformationOpen
String ID:
API String ID: 2743777493-0
Opcode ID: d270990935d05291609a27100eb666b5b0fbef0ab6ff9c34a914c4aa256aee9f
Instruction ID: 670f8cb4b6437c60684ce16ceea9f1eb69de2fa277d700276d425b599404248c
Opcode Fuzzy Hash: d270990935d05291609a27100eb666b5b0fbef0ab6ff9c34a914c4aa256aee9f
Instruction Fuzzy Hash: 0F111932218B84C7EB50CF25F95078AB3B0FB84B84F849125EB8947B68DF38D565CB81

Function 0000012A223043AC Relevance: 4.5, APIs: 3, Instructions: 15COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0000012A223043BD
TerminateProcess.KERNEL32 ref: 0000012A223043C8
ExitProcess.KERNEL32 ref: 0000012A223043D7

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 8eb0a8c4b131ff86e2201643d666c16c7870ab94c2bf69e596262afad84de1cc
Instruction ID: d1502fffefc6a204e3e399a876522f6250b00cb6e30e7f4a92c9bfc98957aed1
Opcode Fuzzy Hash: 8eb0a8c4b131ff86e2201643d666c16c7870ab94c2bf69e596262afad84de1cc
Instruction Fuzzy Hash: E6D05E31700704C3EB283B712A853D802211F48710F8038F89A0302B97CD28C73A4252

Function 00007FF7A44FE6A8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF7A44FE6EA

Strings

, xrefs: 00007FF7A44FE72D

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 63545288c66b989caff988c434e2d7c824b75562c9fdf6ba729794544d33f0a2
Instruction ID: 0a8ee37bb5d2c17ea637baddc40fc43800d077f22693e10fb4ad56832e7e594d
Opcode Fuzzy Hash: 63545288c66b989caff988c434e2d7c824b75562c9fdf6ba729794544d33f0a2
Instruction Fuzzy Hash: 3F5191336196C18AE7609F29E0843ADB7E0F748744FA44139D78D47A6ACB7DD545CB10

Function 0000012A222A7940 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222A7A99

Strings

cannot use operator[] with a numeric argument with , xrefs: 0000012A222A7E69

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: cannot use operator[] with a numeric argument with
API String ID: 118556049-485864652
Opcode ID: 76e878a8cbdf53bf16af9fbe5f66f5f2444970966a37d33a13eb1dc8dec6a7f2
Instruction ID: 8010bbf3af90554a98c3c1a0f95d39ef65c627d02253def438f1cc9af679dceb
Opcode Fuzzy Hash: 76e878a8cbdf53bf16af9fbe5f66f5f2444970966a37d33a13eb1dc8dec6a7f2
Instruction Fuzzy Hash: 8E312931301780D6EF189B16A9043DCB355EB08BE4F984B219E7E0BBC6DA3DC162C305

Function 0000012A222E2610 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32 ref: 0000012A222E264A

Strings

Unknown, xrefs: 0000012A222E2705

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: 6a83a43f42730fcae9654220d959d4fa80d2f195579dfbfa5350164919b9b0a1
Instruction ID: dd2edc377c17760437ab3c5499cb64dd4598cc3b8726e2dcb1d4eb781fa990aa
Opcode Fuzzy Hash: 6a83a43f42730fcae9654220d959d4fa80d2f195579dfbfa5350164919b9b0a1
Instruction Fuzzy Hash: CC318F32628BC4C2E720CF25E5403DAB760FBD9784F945215FBC902A4ADB7DD695CB00

Function 00007FF7A452C3F0 Relevance: 3.2, APIs: 2, Instructions: 239COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 00007FF7A452C707
std::_Throw_Cpp_error.LIBCPMT ref: 00007FF7A452C712

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: 8d981a2b687dd6fb6908578d696d44363a810d7faa09f8be86248f85abcd1766
Instruction ID: 8fadd22e46658fc3d3c2f3b00a75c7471c7c2271a4f46e265be9cf363fc6215a
Opcode Fuzzy Hash: 8d981a2b687dd6fb6908578d696d44363a810d7faa09f8be86248f85abcd1766
Instruction Fuzzy Hash: 4491F13270AA8482DA61EF1AD584139F3A5FB4ABD0F9A8032DB4D8B775CE3DD541C750

Function 00007FF7A44FEC34 Relevance: 3.2, APIs: 2, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A44FE590: GetOEMCP.KERNEL32(00000001,00000000,00000000,00007FF7A44F7382), ref: 00007FF7A44FE5BA

IsValidCodePage.KERNEL32(00000001,00000000,00000000,00007FF7A44F7382), ref: 00007FF7A44FECA1
GetCPInfo.KERNEL32 ref: 00007FF7A44FECED

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: b63d76eddae2a0a97ce201a85222819806dbafa7b60a15d64306885bfb31fd4f
Instruction ID: b145473c23499ce0ca946eb43500ce48fa5dcb3eb5d97e652781b20054f6fd15
Opcode Fuzzy Hash: b63d76eddae2a0a97ce201a85222819806dbafa7b60a15d64306885bfb31fd4f
Instruction Fuzzy Hash: 7981E563A0A68285F7A4EF2FA084179F7E1EB44F41FA64131D64E076B8DE3EE545C321

Function 00007FF7A44D3FC0 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7A44D41AF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A44D41B5

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: c56f5070215b4a8c3bc90f6c3f877a7df53a7c979c2cbbb1f7e44ea1bf05212d
Instruction ID: 477d0657fff79f8078ef287f81f44c96bf9f49b01cbdcdca7ded3773f5fcd1ff
Opcode Fuzzy Hash: c56f5070215b4a8c3bc90f6c3f877a7df53a7c979c2cbbb1f7e44ea1bf05212d
Instruction Fuzzy Hash: 01519D32A0AB4685EF55AF2AC49426C73A1EB49FA4FA64631CE5D033B9DE3ED441C350

Function 0000012A222D8216 Relevance: 3.1, APIs: 2, Instructions: 132synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0000012A2229E9C0: CreateToolhelp32Snapshot.KERNEL32 ref: 0000012A2229EA08
Part of subcall function 0000012A2229E9C0: Process32FirstW.KERNEL32 ref: 0000012A2229EA4A

Part of subcall function 0000012A2229CDE0: CredEnumerateA.ADVAPI32 ref: 0000012A2229CE42

Part of subcall function 0000012A222E2D90: GetLogicalDriveStringsW.KERNEL32 ref: 0000012A222E2E01

ReleaseMutex.KERNEL32 ref: 0000012A222D83C7
CloseHandle.KERNEL32 ref: 0000012A222D83D0

Part of subcall function 0000012A22297350: FindFirstFileW.KERNEL32 ref: 0000012A2229742F

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: First$CloseCreateCredDriveEnumerateFileFindHandleLogicalMutexProcess32ReleaseSnapshotStringsToolhelp32
String ID:
API String ID: 1242419452-0
Opcode ID: 1e0f50bf5a324b057639862f6b0c36e0d8dc654b571791b36985718e8e267fc5
Instruction ID: 96a9c5aece35e622d80784b1056ed4585bed1ab469be1f29495ee3230f4a9385
Opcode Fuzzy Hash: 1e0f50bf5a324b057639862f6b0c36e0d8dc654b571791b36985718e8e267fc5
Instruction Fuzzy Hash: 3951D1726547C4C3FF60AB25E5453DDE311EF85BA0FD44211EAAC16ADBDE6AC4A28303

Function 0000012A222D824A Relevance: 3.1, APIs: 2, Instructions: 121synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0000012A222E2D90: GetLogicalDriveStringsW.KERNEL32 ref: 0000012A222E2E01

ReleaseMutex.KERNEL32 ref: 0000012A222D83C7
CloseHandle.KERNEL32 ref: 0000012A222D83D0

Part of subcall function 0000012A22297350: FindFirstFileW.KERNEL32 ref: 0000012A2229742F

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: CloseDriveFileFindFirstHandleLogicalMutexReleaseStrings
String ID:
API String ID: 3179890297-0
Opcode ID: ef0d96d75a3b96cb2ac75637f9e91ddc45070675a6ce27774970758768ec2d3d
Instruction ID: 3afdfa448a8011226ec30e338593497532448c7dd07635e7c5142cf66edd7f3e
Opcode Fuzzy Hash: ef0d96d75a3b96cb2ac75637f9e91ddc45070675a6ce27774970758768ec2d3d
Instruction Fuzzy Hash: 9E51DF726147C4C3FF209B25E5453DEA312EF85BA0FD44311EAAC16ADADE69C4A28303

Function 00007FF7A44D7F90 Relevance: 3.1, APIs: 2, Instructions: 120COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7A44D810A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7A44D8110

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 76e95b6b704b97de0ba2019d634527e76de5605452a466bcb0a745c9ccca2119
Instruction ID: cef8a07ea1eed63d0324d344b3d3bfebcfb1e104074f589dfe7edda6b52a3f57
Opcode Fuzzy Hash: 76e95b6b704b97de0ba2019d634527e76de5605452a466bcb0a745c9ccca2119
Instruction Fuzzy Hash: 2C41066270BA8549EE64BF17958827AD251BB44BE4F8A0730DE7D077F9DE3DD0418320

Function 0000012A222DA7A0 Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32 ref: 0000012A222DA7F9
CoTaskMemFree.OLE32 ref: 0000012A222DA8BA

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: 683ea69237fd4e2fcfc755988fba80c4d6975a56b19d3b06368b75a078237d42
Instruction ID: f783454819107b2cd7fba13eef77d8f6d18143317ad86a03ea9b3e6e0909d7e5
Opcode Fuzzy Hash: 683ea69237fd4e2fcfc755988fba80c4d6975a56b19d3b06368b75a078237d42
Instruction Fuzzy Hash: DF319572514B84C2E7208B25E48039AB361FB997F4F905315FAAD03A95DB7DC1918B40

Function 0000012A222D90E0 Relevance: 3.1, APIs: 2, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0000012A222D9131
RegCloseKey.ADVAPI32 ref: 0000012A222D9143

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: cb5083d97ad469c6c3493b2db064592496b758c58094e11f55f9889ab986e620
Instruction ID: 968ed2a1167a131419e896269b7501aba0ce32fca2df140c565edc7bccea465a
Opcode Fuzzy Hash: cb5083d97ad469c6c3493b2db064592496b758c58094e11f55f9889ab986e620
Instruction Fuzzy Hash: D621D332314B84C6FF609B26E9443DAE360EF99BD4F885121FA4D13BA9DF69C5A1C701

Function 00007FF7A450737C Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

_set_fmode.LIBCMT ref: 00007FF7A4507393
_RTC_Initialize.LIBCMT ref: 00007FF7A45073B4

Part of subcall function 00007FF7A45449A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7A45449D2

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: Initialize_invalid_parameter_noinfo_set_fmode
String ID:
API String ID: 3548387204-0
Opcode ID: 7ff40415909f9658f6c8f05c258e32d0ae2fe3074e8ab3fcee39be1765333c0d
Instruction ID: 566c75dafd4795ee5f7817b379e3896f8ff23a4ba437ef577be7fea5a2173326
Opcode Fuzzy Hash: 7ff40415909f9658f6c8f05c258e32d0ae2fe3074e8ab3fcee39be1765333c0d
Instruction Fuzzy Hash: D711AF19E1B10369FA947FB754CA2B985514F90342FE20874E60E4A2FBFD1FB8514232

Function 0000012A222FF530 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 0000012A222FF57C
GetLastError.KERNEL32 ref: 0000012A222FF586

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: aae81a2dd0585ac03914996930617a7374804057a0023572312201c9d4728205
Instruction ID: 90904cec1db2fcc783d0969752a0c03a50a24875fd9b2daca7280391c8db4f7d
Opcode Fuzzy Hash: aae81a2dd0585ac03914996930617a7374804057a0023572312201c9d4728205
Instruction Fuzzy Hash: 2611A072304B80C2DB30DB25A5442DDA361AB85FF4F944311EE7A0B7E9CF79C1618B41

Function 00007FF7A4507184 Relevance: 3.0, APIs: 2, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7A45071B4

Part of subcall function 00007FF7A4507C6C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7A4507C75

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7A45071BA

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: f8b37a40f335e3c3195e14df9e3c0dcbaf99f4209189463ec543eb89a52f6b74
Instruction ID: 6ca6854236ff01a5631b4d82425953a5fc1ea896aa15053b1c0a60170173e6a4
Opcode Fuzzy Hash: f8b37a40f335e3c3195e14df9e3c0dcbaf99f4209189463ec543eb89a52f6b74
Instruction Fuzzy Hash: F9E08605E1F20748FC683D6318CA0B481800FD8732EAB1730D93E082FBBD1EB4454130

Function 0000012A2230E200 Relevance: 3.0, APIs: 2, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000012A2230E230

Part of subcall function 0000012A2230F020: std::bad_alloc::bad_alloc.LIBCMT ref: 0000012A2230F029

Concurrency::cancel_current_task.LIBCPMT ref: 0000012A2230E236

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: cb30be615b2a740bb91050d633ba98dd94f54af7fee1c5634fd4bcc6230015a6
Instruction ID: 489275de3057579928d3f671310ef80600a34e8a1bd016d2b620ec73b7c3cb07
Opcode Fuzzy Hash: cb30be615b2a740bb91050d633ba98dd94f54af7fee1c5634fd4bcc6230015a6
Instruction Fuzzy Hash: 76E01260731105C7FF7835B116157E451884F2D770EDC17A0693545AD3ED14C6764633

Function 00007FF7A44F5D5C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,3824448B482475C0,00007FF7A450011E,?,?,?,00007FF7A450049B,?,?,00000000,00007FF7A44FE208,?,?,00007FF7A4505462,00007FF7A44FE13B), ref: 00007FF7A44F5D72
GetLastError.KERNEL32(?,?,3824448B482475C0,00007FF7A450011E,?,?,?,00007FF7A450049B,?,?,00000000,00007FF7A44FE208,?,?,00007FF7A4505462,00007FF7A44FE13B), ref: 00007FF7A44F5D7C

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: cbe3ac59e7844d0f39d24919fd8d71206b1736601cc1fc9aef317310203d6668
Instruction ID: b566cec36b0c3d855161ffbc3fec4c6bf9f8a2050285f6d78c2d122764a66f9c
Opcode Fuzzy Hash: cbe3ac59e7844d0f39d24919fd8d71206b1736601cc1fc9aef317310203d6668
Instruction Fuzzy Hash: 26E08C32F0B60242FB187FF398C903892914F88F80FCA8034D80D42276DE3E68954330

Function 00007FF7A44D9F30 Relevance: 2.6, APIs: 2, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF7A44DA050

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0de784133231444de2e8ac2bf85233e30d04ba23b6457a4fa09f5d6357980d18
Instruction ID: bb7cfc523137742ecb19c0746fd1574426e3a2f7bf8b8a8efe2e623d7d7e06ef
Opcode Fuzzy Hash: 0de784133231444de2e8ac2bf85233e30d04ba23b6457a4fa09f5d6357980d18
Instruction Fuzzy Hash: 51415121B0B74245FEA6AF0392942799250AF45BC0F864034DF4D27BBDDEBFE4568351

Function 0000012A222FCF0C Relevance: 2.5, APIs: 2, Instructions: 18memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32 ref: 0000012A222FCF22
GetLastError.KERNEL32 ref: 0000012A222FCF2C

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 45209dc9db24084941d5b4e6ac6d9946b256a9172249de886d3448e3530a5b4a
Instruction ID: 9db31d11e5f51340ee4ac4ef593c65a0fa6ccd5a87ba4b1d6a53f2c335d0de33
Opcode Fuzzy Hash: 45209dc9db24084941d5b4e6ac6d9946b256a9172249de886d3448e3530a5b4a
Instruction Fuzzy Hash: 9AE02E31B21204C3FF3DA7F29A493F982856F89B40FC020A09805C2292EE3988B08B02

Function 0000012A222EF370 Relevance: 1.7, APIs: 1, Instructions: 183COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222EF5B7

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 7627ebc1c9c8bd860e8bc9382eb45467d66776eed4bb860d5b88a8fd11fc05cd
Instruction ID: 12ab71140d1ccead6a99cf110f05253f8aba85cfdd4f5e021af591fb4231848b
Opcode Fuzzy Hash: 7627ebc1c9c8bd860e8bc9382eb45467d66776eed4bb860d5b88a8fd11fc05cd
Instruction Fuzzy Hash: 45618C72201A80C6FF24CE1A90443ADA3A9EF55F94FD58621DF6D0B7D2DE3AE4A19301

Function 0000012A222A1480 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222A166F

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 9761ae92462a5efc8d833711558f290d21a3228fb8a73918b336a9c919ce9e76
Instruction ID: 33e422d3b197152977e24da53b5d2197b2a21d6290cc4cc1a270d362a3324bc3
Opcode Fuzzy Hash: 9761ae92462a5efc8d833711558f290d21a3228fb8a73918b336a9c919ce9e76
Instruction Fuzzy Hash: E3516A32301B54CAEB198F2AC05439C73A5FB48FA4F984512DE1E47BA9DF3AC4A1C341

Function 0000012A222A7AB0 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222A7C48

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: edde4a4270a045642456d5ae94b45b1a61b59367cbc2ae79fcd3e95f9d9ef683
Instruction ID: 250944cd04e4a34d95a1b7570c4057d89a7d1964a08e4fff7254a02027fa3291
Opcode Fuzzy Hash: edde4a4270a045642456d5ae94b45b1a61b59367cbc2ae79fcd3e95f9d9ef683
Instruction Fuzzy Hash: D241A172315784C2EB289F26A5143DEB755FB44BE4F944A21AFAD07BC9DE39C0618309

Function 0000012A22290160 Relevance: 1.6, APIs: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__std_fs_directory_iterator_open.LIBCPMT ref: 0000012A22290273

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: __std_fs_directory_iterator_open
String ID:
API String ID: 4007087469-0
Opcode ID: b165754dbc8285719f9dd60d32b9377288e672771641b871c799b37d7bd4e097
Instruction ID: e36965f0a3d6102da5206647ae2a2d2b7100864b8e7e524c2c210c5296f6e10e
Opcode Fuzzy Hash: b165754dbc8285719f9dd60d32b9377288e672771641b871c799b37d7bd4e097
Instruction Fuzzy Hash: F241E473A40644C3EB218B19E6443F9A361EB85BF4FA44321EE68437E5EF79C6A18701

Function 0000012A222E1CA0 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 0000012A222DB2E0: __std_fs_get_current_path.LIBCPMT ref: 0000012A222DB358

GetVolumeInformationW.KERNEL32 ref: 0000012A222E1D30

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: InformationVolume__std_fs_get_current_path
String ID:
API String ID: 155845060-0
Opcode ID: 2316ad3bb71fdcb27310d868fceba78f7c90a4096c3bc18ad90a91b627b354ab
Instruction ID: f0e735d6ca6f1c5f861ba1b3f8b36f7fbb7c611a9b515bc362d7c3baeda8e927
Opcode Fuzzy Hash: 2316ad3bb71fdcb27310d868fceba78f7c90a4096c3bc18ad90a91b627b354ab
Instruction Fuzzy Hash: 69519D33A14B84C6EB10CF38E8453DD7764FB99788F904215EB8853AA9DF78C691CB41

Function 0000012A222FD408 Relevance: 1.6, APIs: 1, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000012A222FD430

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 071ebb08b0fc02b9d3ef8c25180f68ab3a457de1887feec64baca47ad46b2841
Instruction ID: 9e1ff8fa94b16acfdec7affc516d530e7bcb40f9d4e8431a4c10de01ed6179f9
Opcode Fuzzy Hash: 071ebb08b0fc02b9d3ef8c25180f68ab3a457de1887feec64baca47ad46b2841
Instruction Fuzzy Hash: A341DE32210204C7FB388F19E5413EDF3A0EB51B48F900205EA9A877E1CB3AD422CF52

Function 0000012A222A7159 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4af04fc58c3735e03b8fc41b2b089ef38169f45a84e4e2090fc73d8f9fef22e2
Instruction ID: 92325cd09f4abb30c02c77a3e57bb3bef73ebf8bcac16d482a39ca150152f1c9
Opcode Fuzzy Hash: 4af04fc58c3735e03b8fc41b2b089ef38169f45a84e4e2090fc73d8f9fef22e2
Instruction Fuzzy Hash: 4D31B671311640C6FF289B56A6143EDF392EF48BD0FD84631EA6D0BBD9DA79C1A18309

Function 0000012A222ED290 Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222ED3E5

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 32d35f8b75417bc3833d0e237fb6496e18b6cfdddd0f8cbb12e1cdf034ad0677
Instruction ID: ee3b36fb4b84a44cf82c855effeb267a06afce65f6835e8f9c4e4ec8eae5de5f
Opcode Fuzzy Hash: 32d35f8b75417bc3833d0e237fb6496e18b6cfdddd0f8cbb12e1cdf034ad0677
Instruction Fuzzy Hash: 42319332311B84C3EB24DB25E24439EB399EB48BD4F904625EBAE17BD9DF39D1618701

Function 0000012A222A1F40 Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222A204C

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 511fa010988e2f6443044a92af9fab06c8b3a34665d7397b8e3076bf5f49563d
Instruction ID: b0608a5deacdf31f3e1485b2d57fc6a0b815aceb1246889620284e6b1fad19a7
Opcode Fuzzy Hash: 511fa010988e2f6443044a92af9fab06c8b3a34665d7397b8e3076bf5f49563d
Instruction Fuzzy Hash: 8C21F732711B50C2FF1DEB15A6013E9A251EF54BB4F644B219A3C43BEAEE79C4E28341

Function 0000012A222A373D Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222A3836

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 917a793721063d462ff31f6642dac392bfad5ea588ad0e64b7d56717294e925f
Instruction ID: c7f8ff1c16c681c5b838fc865374560135442977c4d46d083c41e5663765d2fa
Opcode Fuzzy Hash: 917a793721063d462ff31f6642dac392bfad5ea588ad0e64b7d56717294e925f
Instruction Fuzzy Hash: FF21F772301654CAFF1DDB6597143E9A2819F00FE4FC40A209E2E0BFC9EE79C4A18346

Function 0000012A222FEEA0 Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000012A222FEF97

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fb2abcc3e97f28c6e70c47a0fd1fa5229a04abe3fde6ae5ca4541a6dce7644a9
Instruction ID: 8dd4e8bb8ddfb8d2d3869f2b0c8d5f7a1071035c3a7b8c34723e41c12dc53d6c
Opcode Fuzzy Hash: fb2abcc3e97f28c6e70c47a0fd1fa5229a04abe3fde6ae5ca4541a6dce7644a9
Instruction Fuzzy Hash: CE319332614640C7F7166F5599813EDBBA4AF84BA5FD60205EA29033E2DB7AC4708B13

Function 0000012A223042DD Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000012A2230430B

Part of subcall function 0000012A22304410: GetModuleHandleExW.KERNEL32 ref: 0000012A22304435
Part of subcall function 0000012A22304410: GetProcAddress.KERNEL32 ref: 0000012A2230444B
Part of subcall function 0000012A22304410: FreeLibrary.KERNEL32 ref: 0000012A22304472

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: a6d988fad7f82c8ed6f6a36b49a2ab38b1c706cf5ea4fa191dba1a8892074849
Instruction ID: 2f9b9da77e0b35b4c9481948b935063bbfda01fc160696dce89911fa50d92e48
Opcode Fuzzy Hash: a6d988fad7f82c8ed6f6a36b49a2ab38b1c706cf5ea4fa191dba1a8892074849
Instruction Fuzzy Hash: 69219032A10700CAEB258F64D4403EC37A0EB44768F8856A9DB6C46ED9DB74C7A5C791

Function 0000012A22322F4C Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000012A22322F6F

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a50a0b47cc8fb1f1aa58c7d522dfd3dac9cb2a3c51579a89a64ad1e107e1cc06
Instruction ID: a1a9b5b49b470e20963f8a3e657c3bbd398a8af2d4c3f50d0fbc7e6a99ca1841
Opcode Fuzzy Hash: a50a0b47cc8fb1f1aa58c7d522dfd3dac9cb2a3c51579a89a64ad1e107e1cc06
Instruction Fuzzy Hash: CD219632614B80D7DB61CF19E5803E977A0FB84B54FA44314EB7A876D5DB79CC208B01

Function 0000012A2231E3F8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000012A2231E355

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 77eb78eceebaf9aac1283afbdc11339d6bb147956a1b1fa3eec95f7ad3fa8818
Instruction ID: cb0ef18e60c4a34eb6c17ad30ca53da69dae1a95287a524d7b3a3d47c686261b
Opcode Fuzzy Hash: 77eb78eceebaf9aac1283afbdc11339d6bb147956a1b1fa3eec95f7ad3fa8818
Instruction Fuzzy Hash: 5A118132214680C3FB659F5199003EDE2E4BF85B80FD84861EE8947796DBBAC9718B02

Function 00007FF7A453A9A0 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF7A453A9FE

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 5cb06c29aa60c649fdf38176c6d8eec79acc4c06d7406d5603b5f59ca669a07d
Instruction ID: 6cd4ea20dfe7471ef2e3b50a38a873040f5b949b7b6e70b55f23a256db754da6
Opcode Fuzzy Hash: 5cb06c29aa60c649fdf38176c6d8eec79acc4c06d7406d5603b5f59ca669a07d
Instruction Fuzzy Hash: B5311922E18EC19AF3129FB890412F8E372BF6530DF456231DE4822475EF7662D5C350

Function 0000012A222DC7B0 Relevance: 1.5, APIs: 1, Instructions: 38networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 0000012A222DC7F8

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 233c3997310a297041e1e3fb15b3d4c80a1f67aef0062fad458dcd648ec2920d
Instruction ID: e6e54a9d35799afd07164cfb85664b253c59307a84b88f2260f255582706c308
Opcode Fuzzy Hash: 233c3997310a297041e1e3fb15b3d4c80a1f67aef0062fad458dcd648ec2920d
Instruction Fuzzy Hash: CA01D632714B84C2EB508F2AF544699A3A0FB88FE4F986130EF5D43B4CDB28C8918740

Function 00007FF7A453ACE0 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,00007FF7A453B6C4), ref: 00007FF7A453ACF4

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 4193701b040240acb4aee85f10277e2056db2b535a089b50bbfe366aa39793ce
Instruction ID: 16709a2b3731b84fb5c4f3b10ea935f29b24bd20ba7e9d1f736060b9500d0616
Opcode Fuzzy Hash: 4193701b040240acb4aee85f10277e2056db2b535a089b50bbfe366aa39793ce
Instruction Fuzzy Hash: F5F03131B09A458BD748DB1EA851129B7E2F788700F804139E54EC3774DE7DE851CB50

Function 0000012A22297BD1 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 0000012A22297C14

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 2a33c8ed0ea8a7ff33b4bf5881203da667c28cb78f46e6057f686215caa0375e
Instruction ID: aa4e03acc70fd110041658a6d7d8dc0e6feb7a4c539880dbf4012135a4210693
Opcode Fuzzy Hash: 2a33c8ed0ea8a7ff33b4bf5881203da667c28cb78f46e6057f686215caa0375e
Instruction Fuzzy Hash: B8016236208AC0C1EB70CB52F4443DAB360FBC8B94F804062DE8D43B59DE39C986CB00

Function 0000012A222F0AB4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000012A222F0AD3

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3ae8ffb49856a14d60f99efa49b0fe83e22d235a8448dcdbc0ad68fd56e97e18
Instruction ID: bd9b9dbc1ec54c3b7037121bd4d9bf9a0e69e673e0d05df58a522ec11acc3220
Opcode Fuzzy Hash: 3ae8ffb49856a14d60f99efa49b0fe83e22d235a8448dcdbc0ad68fd56e97e18
Instruction Fuzzy Hash: 2BE09231215A41C3EB657BA995813ACF150AF547B4FE48321AB38022DADA3A84704B02

Function 0000012A2231B67C Relevance: 1.5, APIs: 1, Instructions: 9fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32 ref: 0000012A2231B680

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: ed1b562b9eaccad4d1a8cb5c87ebc476f475394f3bf74eab8c21655979839179
Instruction ID: 068c8424da6932274988f47a12006f23afbf14de0032e524e0c6f510b255e153
Opcode Fuzzy Hash: ed1b562b9eaccad4d1a8cb5c87ebc476f475394f3bf74eab8c21655979839179
Instruction Fuzzy Hash: 92C09236F26901C3E7782B775E827C212E0AF68700FD411A4C50480254DAAC82F7BB53

Function 0000012A2231CFA0 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 0000012A2231CFA9

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 2207f1aaff4f69cd87f85f70297096fb5378e3f094066669bafcd2760b152ba3
Instruction ID: 48d8e3dc39aedd3dd4a5e489f74dee4facbc67b2ddad5a708fbbce9efd8d00e4
Opcode Fuzzy Hash: 2207f1aaff4f69cd87f85f70297096fb5378e3f094066669bafcd2760b152ba3
Instruction Fuzzy Hash: 73B09236B248C0D3C621EB04EC420897331FB94B19FD00040E28942624DE2DDA2A8E00

Function 00007FF7A4526FA0 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF7A4526FA9

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: eb0f60a92e298239e1933a600cd8bffc64c19650151f80036a0ab61d3fcc7aa1
Instruction ID: c49473976cff4b780e72f28bbc11ef07794769ccd76a73b583221a0fa6cd2c7b
Opcode Fuzzy Hash: eb0f60a92e298239e1933a600cd8bffc64c19650151f80036a0ab61d3fcc7aa1
Instruction Fuzzy Hash: C3B09226A19C80C3C621FF05F88202AB771FB98B08FC00160E28D42634CE2CDA2A8F01

Function 00007FF7A453B6A0 Relevance: 1.4, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7A453ACE0: GetSystemInfo.KERNEL32(?,?,?,?,?,?,00007FF7A453B6C4), ref: 00007FF7A453ACF4

InitializeCriticalSection.KERNEL32 ref: 00007FF7A453B770

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: CriticalInfoInitializeSectionSystem
String ID:
API String ID: 3396500325-0
Opcode ID: bcaedd984716a8154b1a368fb8aa1922a009770eacb742e215039dbb87c58d74
Instruction ID: a9ca7189b9332a3994c82e7ae7ae51ec89d86890a973a7cc128243ccfe975ca1
Opcode Fuzzy Hash: bcaedd984716a8154b1a368fb8aa1922a009770eacb742e215039dbb87c58d74
Instruction Fuzzy Hash: 2F41BD32A05B898AD714DF12E48055EFBA8FB64B90F868035DF9943B71DF39E591C710

Function 00007FF7A44F5CE4 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF7A44F63DE,?,?,?,00007FF7A44F5E75,?,?,?,?,00007FF7A4506AB6,?,?,00000000), ref: 00007FF7A44F5D39

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 6a7b2ae2170dc6773900311a114643c1bba646b3fe3a9b71f003f2cd5f34c263
Instruction ID: 9256b33858e506e5d8c8752d538582a373cf572255ce64fabfaa8ad3b74682a7
Opcode Fuzzy Hash: 6a7b2ae2170dc6773900311a114643c1bba646b3fe3a9b71f003f2cd5f34c263
Instruction Fuzzy Hash: FBF04F62B1B60641FE587F6756C82B592D15F45F80F8E8030C80E862FAEE2EA4808230

Function 0000012A222FF8AC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 0000012A222FF8EA

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: eb99e2a0aa2c5a543b3daa01bf1a85af620a59f00b68e4e07b531dba3724a22a
Instruction ID: f8ad2a2fe6a2e00386f4eee2ed8bd9334e26f5ba61ea04ee695b06bba23f53b5
Opcode Fuzzy Hash: eb99e2a0aa2c5a543b3daa01bf1a85af620a59f00b68e4e07b531dba3724a22a
Instruction Fuzzy Hash: 93F0A030311384C7FF64AB715A507E992805F84BA0FED07205D2A866C2DE29C4718B23

Function 00007FF7A44F86B4 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF7A4506A9D,?,?,00000000,00007FF7A45061AB,?,?,?,00007FF7A450518B,?,?,?,00007FF7A4505081), ref: 00007FF7A44F86F2

Memory Dump Source

Source File: 00000000.00000002.2401832050.00007FF7A44D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7A44D0000, based on PE: true

Associated: 00000000.00000002.2401681609.00007FF7A44D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401884187.00007FF7A4558000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2401978302.00007FF7A46A1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2402002248.00007FF7A46A5000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7a44d0000_file.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 144fe1f293cd251bad933485d3714c65b006d2fb5feaa7cd2b0c19a24d47c173
Instruction ID: 390a259ea26598e4ad0eea9fb449bcc37fa3aca43afc8c1197bfea5a906616f8
Opcode Fuzzy Hash: 144fe1f293cd251bad933485d3714c65b006d2fb5feaa7cd2b0c19a24d47c173
Instruction Fuzzy Hash: CFF05E13A0F64241FE547FA359C027592C15F84FA0F8A0A30D82E492FAEF2EE4508234

Non-executed Functions

Function 0000012A222E6060 Relevance: 37.8, APIs: 18, Strings: 3, Instructions: 1064stringmemorynativeCOMMON

Download Yara Rule

APIs

RtlAcquirePebLock.NTDLL ref: 0000012A222E60A2
NtAllocateVirtualMemory.NTDLL ref: 0000012A222E60D7
lstrcpyW.KERNEL32 ref: 0000012A222E6173
lstrcatW.KERNEL32 ref: 0000012A222E6264
NtAllocateVirtualMemory.NTDLL ref: 0000012A222E6322
lstrcpyW.KERNEL32 ref: 0000012A222E63D7
RtlInitUnicodeString.NTDLL ref: 0000012A222E63EC
RtlInitUnicodeString.NTDLL ref: 0000012A222E6401
LdrEnumerateLoadedModules.NTDLL ref: 0000012A222E6414
RtlReleasePebLock.NTDLL ref: 0000012A222E641A

Part of subcall function 0000012A222DA7A0: SHGetKnownFolderPath.SHELL32 ref: 0000012A222DA7F9
Part of subcall function 0000012A222DA7A0: CoTaskMemFree.OLE32 ref: 0000012A222DA8BA

CoInitializeEx.OLE32 ref: 0000012A222E64C5
lstrcpyW.KERNEL32 ref: 0000012A222E66CE
lstrcatW.KERNEL32 ref: 0000012A222E6905
CoGetObject.OLE32 ref: 0000012A222E6921
lstrcpyW.KERNEL32 ref: 0000012A222E7081
lstrcatW.KERNEL32 ref: 0000012A222E72E2
CoGetObject.OLE32 ref: 0000012A222E72FE
CoUninitialize.OLE32 ref: 0000012A222E7872

Strings

bbb, xrefs: 0000012A222E6179
ccc, xrefs: 0000012A222E626A
aaa, xrefs: 0000012A222E6124

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AllocateInitLockMemoryObjectStringUnicodeVirtual$AcquireEnumerateFolderFreeInitializeKnownLoadedModulesPathReleaseTaskUninitialize
String ID: aaa$bbb$ccc
API String ID: 1424456515-3079797815
Opcode ID: ecfe2223f7eeadde9645535169031763849063726ed6cb75cf5c1d5538711545
Instruction ID: 0cf41520ad6843f75f278a941e44b4b2a109d69319aa08a644f594383c3545fe
Opcode Fuzzy Hash: ecfe2223f7eeadde9645535169031763849063726ed6cb75cf5c1d5538711545
Instruction Fuzzy Hash: CBD2B736625FC88AD7A18F69E88169EB3B4F788788F505215EECD57B18EF38C164C740

Function 0000012A222B0189 Relevance: 33.0, APIs: 3, Strings: 15, Instructions: 1494COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222B1771
Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222B1832

Strings

unexpected key without object, xrefs: 0000012A222B174E
Unexpected eof, xrefs: 0000012A222B165A
key declared, but no value, xrefs: 0000012A222B16C7, 0000012A222B16EA, 0000012A222B17EC
conditional not closed, xrefs: 0000012A222B1A2B, 0000012A222B1A4E
object is not closed with '}', xrefs: 0000012A222B1681
", xrefs: 0000012A222B057C
*, xrefs: 0000012A222B03CB
key opened, but never closed, xrefs: 0000012A222B180F
unexpected '}', xrefs: 0000012A222B185B
No closed word, xrefs: 0000012A222B1777, 0000012A222B179A
#include, xrefs: 0000012A222B0AEA
word wasnt properly ended, xrefs: 0000012A222B17BD, 0000012A222B1838
quote was opened but not closed., xrefs: 0000012A222B16A4, 0000012A222B170D
#base, xrefs: 0000012A222B0B16
/, xrefs: 0000012A222B0392

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: "$#base$#include$*$/$No closed word$Unexpected eof$conditional not closed$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 118556049-2258937249
Opcode ID: fb3d0ce16be8bf1dd10de808007757ac4d7fbd6a137d3b39eb93e2abab2d2ff1
Instruction ID: 0c765bbc9e5e68ba38809b3ddf8ef34d875b254fd95f7a3166bb73fad3ddb55f
Opcode Fuzzy Hash: fb3d0ce16be8bf1dd10de808007757ac4d7fbd6a137d3b39eb93e2abab2d2ff1
Instruction Fuzzy Hash: A1E2AF72201BC4C6EF718F25D9843EDA762FB44798FD48112DA4D0BAA9DF79C6A5C302

Function 0000012A222AE7A9 Relevance: 33.0, APIs: 3, Strings: 15, Instructions: 1482COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222AFD91

Part of subcall function 0000012A2228DA30: __std_exception_copy.LIBVCRUNTIME ref: 0000012A2228DA73

Part of subcall function 0000012A22311108: RtlPcToFileHeader.KERNEL32 ref: 0000012A2231114C
Part of subcall function 0000012A22311108: RaiseException.KERNEL32 ref: 0000012A22311192

Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222AFE52

Strings

/, xrefs: 0000012A222AE9B2
unexpected key without object, xrefs: 0000012A222AFD6E
Unexpected eof, xrefs: 0000012A222AFC7A
key declared, but no value, xrefs: 0000012A222AFCE7, 0000012A222AFD0A, 0000012A222AFE0C
conditional not closed, xrefs: 0000012A222B004B, 0000012A222B006E
object is not closed with '}', xrefs: 0000012A222AFCA1
key opened, but never closed, xrefs: 0000012A222AFE2F
unexpected '}', xrefs: 0000012A222AFE7B
*, xrefs: 0000012A222AE9EB
No closed word, xrefs: 0000012A222AFD97, 0000012A222AFDBA
#include, xrefs: 0000012A222AF10A
word wasnt properly ended, xrefs: 0000012A222AFDDD, 0000012A222AFE58
", xrefs: 0000012A222AEB9C
quote was opened but not closed., xrefs: 0000012A222AFCC4, 0000012A222AFD2D
#base, xrefs: 0000012A222AF136

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$ExceptionFileHeaderRaise__std_exception_copy
String ID: "$#base$#include$*$/$No closed word$Unexpected eof$conditional not closed$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 145623376-2258937249
Opcode ID: 89209a7afa24ffc67a57109ed1a85645ccff237d790de18acd80f9e8b496254e
Instruction ID: 678099c456b1839c64a7d3690c93d7f9c98518060b0ccb3e7acd752d17dbcca7
Opcode Fuzzy Hash: 89209a7afa24ffc67a57109ed1a85645ccff237d790de18acd80f9e8b496254e
Instruction Fuzzy Hash: E3E2A072201BC4C6EB75CF24D9803EDA761FB44798F948512DA8D0BE99DF7AC6A5C302

Function 0000012A22266480 Relevance: 30.2, Strings: 24, Instructions: 244COMMON

Download Yara Rule

Strings

mib.bin, xrefs: 0000012A22266744
boot.sdi, xrefs: 0000012A222667D1
bootmgfw.efi, xrefs: 0000012A222664F9
boot.ini, xrefs: 0000012A222664D1
bootstat.dat, xrefs: 0000012A22266715
bootsect.bak, xrefs: 0000012A22266546
winsipolicy.p7b, xrefs: 0000012A222665B8
winre.wim, xrefs: 0000012A22266800
autorun.inf, xrefs: 0000012A222664A8
d3d9caps.dat, xrefs: 0000012A222666E6
ntuser.dat, xrefs: 0000012A22266604
wpsettings.dat, xrefs: 0000012A222667A2
reagent.xml, xrefs: 0000012A2226682F
bootmgr, xrefs: 0000012A2226685E
ntuser.ini, xrefs: 0000012A22266659
indexervolumeguid, xrefs: 0000012A22266773
bootfont.bin, xrefs: 0000012A22266520
ntldr, xrefs: 0000012A22266592
desktop.ini, xrefs: 0000012A2226656C
gdipfontcachev1.dat, xrefs: 0000012A222666B7
ntuser.dat.log, xrefs: 0000012A2226662D
iconcache.db, xrefs: 0000012A222665DE
thumbs.db, xrefs: 0000012A22266688
BOOTNXT, xrefs: 0000012A2226688D

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: BOOTNXT$autorun.inf$boot.ini$boot.sdi$bootfont.bin$bootmgfw.efi$bootmgr$bootsect.bak$bootstat.dat$d3d9caps.dat$desktop.ini$gdipfontcachev1.dat$iconcache.db$indexervolumeguid$mib.bin$ntldr$ntuser.dat$ntuser.dat.log$ntuser.ini$reagent.xml$thumbs.db$winre.wim$winsipolicy.p7b$wpsettings.dat
API String ID: 118556049-850610325
Opcode ID: 5513c3b579e186655d849d8761bd1d669df1bc04df69b312f31a70fd7f9fa00f
Instruction ID: 92cafcd89debf59711a24507ae4f986c34443a78e93247dada661d3101674da0
Opcode Fuzzy Hash: 5513c3b579e186655d849d8761bd1d669df1bc04df69b312f31a70fd7f9fa00f
Instruction Fuzzy Hash: DCC1B862D60FC9C6E720DB34C9927F45361FBEE384FA06316A98861857EBA4E7D4C341

Function 0000012A222D0D50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 0000012A222D0E06
CoInitializeSecurity.OLE32 ref: 0000012A222D0EC3

Strings

@, xrefs: 0000012A222D0FF6

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Initialize$Security
String ID: @
API String ID: 119290355-2766056989
Opcode ID: 43fd713c0aac2b623095c3864f0337a62321213f8725a0f2194c45e222ca4bf1
Instruction ID: 0acfd85c825a1401b7cb72875df1e8c823a26c5c2bdb14c542c9f7f1a7b4d79e
Opcode Fuzzy Hash: 43fd713c0aac2b623095c3864f0337a62321213f8725a0f2194c45e222ca4bf1
Instruction Fuzzy Hash: 80D1B932B14B84CAFB20CF75E5443DD7361EB88B98F805215EE5917AA9DF3AC2A5C341

Function 0000012A222660C0 Relevance: 25.2, Strings: 20, Instructions: 208COMMON

Download Yara Rule

Strings

Windows, xrefs: 0000012A22266111
#recycle, xrefs: 0000012A22266139
$recycle.bin, xrefs: 0000012A222660E8
System Volume Information, xrefs: 0000012A22266186
config.msi, xrefs: 0000012A222661D2
PerfLogs, xrefs: 0000012A22266244
AppData, xrefs: 0000012A222662F7
Program Files (x86), xrefs: 0000012A22266411
Program Files, xrefs: 0000012A222663E2
All users, xrefs: 0000012A22266384
Boot, xrefs: 0000012A22266160
bootmgr, xrefs: 0000012A222663B3
Application Data, xrefs: 0000012A222661AC
$winreagent, xrefs: 0000012A2226626D
ntldr, xrefs: 0000012A22266326
Windows.old, xrefs: 0000012A222661F8
$windows.~bt, xrefs: 0000012A2226621E
Windows.~bt, xrefs: 0000012A222662C8
ProgramData, xrefs: 0000012A22266355
$windows.~ws, xrefs: 0000012A22266299

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: #recycle$$recycle.bin$$windows.~bt$$windows.~ws$$winreagent$All users$AppData$Application Data$Boot$PerfLogs$Program Files$Program Files (x86)$ProgramData$System Volume Information$Windows$Windows.old$Windows.~bt$bootmgr$config.msi$ntldr
API String ID: 118556049-2722463023
Opcode ID: 386f32a4d5dfa40681defb2796dbc9df35ae9b808f07fb7c421dba766f82abc8
Instruction ID: 739013510afade3e62a78958bd5732c6838e2b246dc5936128a718a6ae2e0491
Opcode Fuzzy Hash: 386f32a4d5dfa40681defb2796dbc9df35ae9b808f07fb7c421dba766f82abc8
Instruction Fuzzy Hash: F2A1B662E60FC9C6E720DB34C9927F56361FBEE384FA06316798861856EF64E6D4C301

Function 0000012A223097C4 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1203COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 0000012A22309813
_invalid_parameter_noinfo.LIBCMT ref: 0000012A22309E46
_invalid_parameter_noinfo.LIBCMT ref: 0000012A22309FBC
_invalid_parameter_noinfo.LIBCMT ref: 0000012A2230A278
_invalid_parameter_noinfo.LIBCMT ref: 0000012A2230A498
_invalid_parameter_noinfo.LIBCMT ref: 0000012A2230A6D3
memcpy_s.LIBCPMT ref: 0000012A2230A7AE
memcpy_s.LIBCPMT ref: 0000012A2230A859
memcpy_s.LIBCPMT ref: 0000012A2230A929

Part of subcall function 0000012A222F4F54: _invalid_parameter_noinfo.LIBCMT ref: 0000012A222F4F86

Strings

1#INF, xrefs: 0000012A2230993F
1#SNAN, xrefs: 0000012A22309926
1#QNAN, xrefs: 0000012A2230992F
1#IND, xrefs: 0000012A22309903

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 61798901ef63ddb9b2fd150afb6021ea1698221561563c44f95e73f05cf7b2a0
Instruction ID: 31d0e269d692ff329e64ac0a10399250afae46893cbb6ce1905b0cac1fd9968f
Opcode Fuzzy Hash: 61798901ef63ddb9b2fd150afb6021ea1698221561563c44f95e73f05cf7b2a0
Instruction Fuzzy Hash: A4B20172A10280CFE7748F68E640BEE77A1FB54788F905255DB0657E88DB38DB20CB52

Function 0000012A222D6D60 Relevance: 18.0, APIs: 1, Strings: 9, Instructions: 472COMMON

Download Yara Rule

APIs

Part of subcall function 0000012A2230E0F0: EnterCriticalSection.KERNEL32 ref: 0000012A2230E100

ShellExecuteW.SHELL32 ref: 0000012A222D72F5

Strings

ios_base::badbit set, xrefs: 0000012A222D7524
.exe, xrefs: 0000012A222D6E0B
temp_directory_path, xrefs: 0000012A222D74FB
.exe, xrefs: 0000012A222D6E34
open, xrefs: 0000012A222D726C
runas, xrefs: 0000012A222D7275
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 0000012A222D6E7B
ios_base::eofbit set, xrefs: 0000012A222D7536
ios_base::failbit set, xrefs: 0000012A222D752F

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: CriticalEnterExecuteSectionShell
String ID: .exe$.exe$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$open$runas$temp_directory_path
API String ID: 4038919937-3845196099
Opcode ID: e7019bed2551195b0fc9bd6dd0e9f58640fa4c8111dc492f63e14e6d27f67156
Instruction ID: dc024a9d331c89dcaf143e8ed55d3812d7abd30cd30de45fadc4e69d037e5479
Opcode Fuzzy Hash: e7019bed2551195b0fc9bd6dd0e9f58640fa4c8111dc492f63e14e6d27f67156
Instruction Fuzzy Hash: F2328072610B80CAEB10CF28E9843DDB7A1FB847A8F905216EA5D47BE9DF79C195C701

Function 0000012A222E6460 Relevance: 12.8, APIs: 8, Instructions: 839stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0000012A222E6060: RtlAcquirePebLock.NTDLL ref: 0000012A222E60A2
Part of subcall function 0000012A222E6060: NtAllocateVirtualMemory.NTDLL ref: 0000012A222E60D7
Part of subcall function 0000012A222E6060: lstrcpyW.KERNEL32 ref: 0000012A222E6173

CoInitializeEx.OLE32 ref: 0000012A222E64C5
lstrcpyW.KERNEL32 ref: 0000012A222E66CE
lstrcatW.KERNEL32 ref: 0000012A222E6905
CoGetObject.OLE32 ref: 0000012A222E6921
lstrcpyW.KERNEL32 ref: 0000012A222E7081
lstrcatW.KERNEL32 ref: 0000012A222E72E2
CoGetObject.OLE32 ref: 0000012A222E72FE
CoUninitialize.OLE32 ref: 0000012A222E7872

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Objectlstrcat$AcquireAllocateInitializeLockMemoryUninitializeVirtual
String ID:
API String ID: 1341382831-0
Opcode ID: 783151e39d26fda8e6c0a589f4d7636057f6fee7d799062d02aeb8ee7367c443
Instruction ID: 93d9bec72e02b866bce81cbc4c6657c341dd4319e17a02c5efc6c6e459ad55ec
Opcode Fuzzy Hash: 783151e39d26fda8e6c0a589f4d7636057f6fee7d799062d02aeb8ee7367c443
Instruction Fuzzy Hash: 77B2763652AFC98AD7A18F29E88169AB3B4F389784F106215FFCD57B18EF74C2548740

Function 0000012A222922AE Relevance: 11.3, APIs: 1, Strings: 5, Instructions: 804COMMON

Download Yara Rule

Strings

directory_iterator::directory_iterator, xrefs: 0000012A22292FD0, 0000012A2229301A
filename, xrefs: 0000012A222928F6
exists, xrefs: 0000012A22292FB4
status, xrefs: 0000012A22292FE0, 0000012A22292FF6
content, xrefs: 0000012A222929AD

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 0-3429737954
Opcode ID: 7fc4497ad5e4363d28f05f684398d5144166f333990f1e9df716402873cc770a
Instruction ID: 11a0f1bd9b8565fb17dcc1ca0185b0912eb4d691bd1a6bbc3887c6e516731f34
Opcode Fuzzy Hash: 7fc4497ad5e4363d28f05f684398d5144166f333990f1e9df716402873cc770a
Instruction Fuzzy Hash: 0D828D32651BC4CAEB20DF34D9843DDB360FB89798F949211EA4D5BAA9EF75C690C301

Function 0000012A223080AC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000012A222F9B94: GetLastError.KERNEL32 ref: 0000012A222F9BA3
Part of subcall function 0000012A222F9B94: FlsGetValue.KERNEL32 ref: 0000012A222F9BB8
Part of subcall function 0000012A222F9B94: SetLastError.KERNEL32 ref: 0000012A222F9C43

TranslateName.LIBCMT ref: 0000012A22308119
TranslateName.LIBCMT ref: 0000012A22308154
GetACP.KERNEL32 ref: 0000012A22308199
IsValidCodePage.KERNEL32 ref: 0000012A223081C1

Strings

utf8, xrefs: 0000012A223082A5

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue
String ID: utf8
API String ID: 1791977518-905460609
Opcode ID: 7b07d4ff2d2c8ac8aae54d70d264f8f5fd38b117be414cfb2d7e50e751da9c84
Instruction ID: c1ed369092d93b946f6fe67ab0d8365bfdd3be79c4291bcdf5aac6354a5e9317
Opcode Fuzzy Hash: 7b07d4ff2d2c8ac8aae54d70d264f8f5fd38b117be414cfb2d7e50e751da9c84
Instruction Fuzzy Hash: 94919E32300B40C7FB249F61DA013DA27A5FF88B84FC441A1DE5947B95EB39CA66C752

Function 0000012A22308AE0 Relevance: 10.7, APIs: 7, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000012A222F9B94: GetLastError.KERNEL32 ref: 0000012A222F9BA3
Part of subcall function 0000012A222F9B94: FlsGetValue.KERNEL32 ref: 0000012A222F9BB8
Part of subcall function 0000012A222F9B94: SetLastError.KERNEL32 ref: 0000012A222F9C43

Part of subcall function 0000012A222F9B94: FlsSetValue.KERNEL32 ref: 0000012A222F9BD9

GetUserDefaultLCID.KERNEL32 ref: 0000012A22308C50

Part of subcall function 0000012A222F9B94: FlsSetValue.KERNEL32 ref: 0000012A222F9C06
Part of subcall function 0000012A222F9B94: FlsSetValue.KERNEL32 ref: 0000012A222F9C17
Part of subcall function 0000012A222F9B94: FlsSetValue.KERNEL32 ref: 0000012A222F9C28

EnumSystemLocalesW.KERNEL32 ref: 0000012A22308C37
ProcessCodePage.LIBCMT ref: 0000012A22308C7A
IsValidCodePage.KERNEL32 ref: 0000012A22308C8C
IsValidLocale.KERNEL32 ref: 0000012A22308CA2
GetLocaleInfoW.KERNEL32 ref: 0000012A22308CFE
GetLocaleInfoW.KERNEL32 ref: 0000012A22308D1A

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 3d25f31d395c3ae3e3608586c5fefc0b956f88d735d05026e9ed1f693fc9eb64
Instruction ID: c982c068b2b3aa962fb492d97b9244d420b24b176ebe059cf54de8b4b93a37d7
Opcode Fuzzy Hash: 3d25f31d395c3ae3e3608586c5fefc0b956f88d735d05026e9ed1f693fc9eb64
Instruction Fuzzy Hash: 1A716872701710CBFF64DB60DA507E873B0BF44B48FC441A68E1957A95EB38C6A5C3A2

Function 0000012A222C65D0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 408COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 0000012A222C6780
__std_exception_destroy.LIBVCRUNTIME ref: 0000012A222C678E
__std_exception_destroy.LIBVCRUNTIME ref: 0000012A222C6A1D
__std_exception_destroy.LIBVCRUNTIME ref: 0000012A222C6A2B

Strings

value, xrefs: 0000012A222C66A6, 0000012A222C694D

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: value
API String ID: 2453523683-494360628
Opcode ID: c9a1c9679dd1c07d46a32787ed4a3d11b74ff9f1976b2642d17621ab4ff0490d
Instruction ID: ff9f69e4fb0d587722192d2172edc8215f671475c824acae8b4f882ff16136aa
Opcode Fuzzy Hash: c9a1c9679dd1c07d46a32787ed4a3d11b74ff9f1976b2642d17621ab4ff0490d
Instruction Fuzzy Hash: C302AE32624BC4C6EB10CB78D5803EDA761EBC57A4F905312FA9D13AEADF69C1A5C701

Function 0000012A222F1688 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 0000012A222F1701
RtlLookupFunctionEntry.KERNEL32 ref: 0000012A222F1719
RtlVirtualUnwind.KERNEL32 ref: 0000012A222F1754
IsDebuggerPresent.KERNEL32 ref: 0000012A222F178D
SetUnhandledExceptionFilter.KERNEL32 ref: 0000012A222F1797
UnhandledExceptionFilter.KERNEL32 ref: 0000012A222F17A2

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 2d623047d3aecc7385336590f9e49eab95d49ea2abbdc5ec59ad4e6f52a05f12
Instruction ID: f4e30907014e01902fb187b29c95641003d085ff5bdaa66b5d4beb1e4a7d9148
Opcode Fuzzy Hash: 2d623047d3aecc7385336590f9e49eab95d49ea2abbdc5ec59ad4e6f52a05f12
Instruction Fuzzy Hash: DC314D36214F80C6EB64CF25E8403DE73A4FB88754F944226EA9D43BA9DF39C665CB41

Function 0000012A2229B1E0 Relevance: 8.4, Strings: 6, Instructions: 915COMMON

Download Yara Rule

Strings

directory_iterator::directory_iterator, xrefs: 0000012A2229C2E2
key, xrefs: 0000012A2229B757, 0000012A2229B939
filename, xrefs: 0000012A2229BD19
files, xrefs: 0000012A2229C009
exists, xrefs: 0000012A2229C275, 0000012A2229C290
content, xrefs: 0000012A2229BE92

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: content$directory_iterator::directory_iterator$exists$filename$files$key
API String ID: 0-2980817763
Opcode ID: 013352e530aa41f7b7de6df28f720281d5960d6063986b80e1d5fa1cee0b14b6
Instruction ID: 793fc41ea1a6890e075b6fe6cd1f28577f1fcb4b921e501e7baf4e6a31a1c7c3
Opcode Fuzzy Hash: 013352e530aa41f7b7de6df28f720281d5960d6063986b80e1d5fa1cee0b14b6
Instruction Fuzzy Hash: D7A24C72605BC4CAEB21CF24D9803DD77A5FB897A8F905215EA9C0BBA9DF75C290C701

Function 0000012A222F4A50 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 0000012A222F4ABA
memcpy_s.LIBCPMT ref: 0000012A222F4AE5

Strings

, xrefs: 0000012A222F4C18

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-3916222277
Opcode ID: 1b748593274e8ddd9ac1e908b2a22b3d8043b10f383cd2471e7c6bd1e5b959b4
Instruction ID: af2162d345d7cf6c9a1f689e5e7de3296469d522fdcefbbff8f2f5a02cde652e
Opcode Fuzzy Hash: 1b748593274e8ddd9ac1e908b2a22b3d8043b10f383cd2471e7c6bd1e5b959b4
Instruction Fuzzy Hash: 69C10772714685C7EB24CF19E188B9EF791FB94B88F848225DB4A43B84DB79D915CF00

Function 0000012A22299E39 Relevance: 7.3, Strings: 5, Instructions: 1060COMMON

Download Yara Rule

Strings

filename, xrefs: 0000012A2229A077, 0000012A2229A363, 0000012A2229AB88
users, xrefs: 0000012A2229A6F9
!, xrefs: 0000012A2229AA4F
status, xrefs: 0000012A2229B17F
content, xrefs: 0000012A2229A0D9, 0000012A2229A3BF, 0000012A2229AC5B

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: __std_fs_convert_wide_to_narrow$__std_fs_code_page
String ID: !$content$filename$status$users
API String ID: 3645842244-3795777748
Opcode ID: c21eaae1fa6b10ebd25a8f36edfef85f2d62dc2eeffc251c53a3cf9150cdbf15
Instruction ID: 2f6578febfe624127f3ae7ab83f53c6edba8dc880fa36b08360e5e9e265700a9
Opcode Fuzzy Hash: c21eaae1fa6b10ebd25a8f36edfef85f2d62dc2eeffc251c53a3cf9150cdbf15
Instruction Fuzzy Hash: DAB28C72611BC4CAEB31DF24D8803DDA365FB85798F905211EA9D4BAAAEF75C394C301

Function 0000012A2231D6E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000012A2231D741
IsDebuggerPresent.KERNEL32 ref: 0000012A2231D759
OutputDebugStringW.KERNEL32 ref: 0000012A2231D76A

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0000012A2231D763

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 9f2ba7ac1ffdfb54cd24e7aa69bef8e5fd03b463d21a3b8ac8ac174eb3ea57fd
Instruction ID: 102a83346ed031afbddfe33c9bb1ae4beeb8e31b8aca113332e518db804e7e4c
Opcode Fuzzy Hash: 9f2ba7ac1ffdfb54cd24e7aa69bef8e5fd03b463d21a3b8ac8ac174eb3ea57fd
Instruction Fuzzy Hash: 4A117C32310B40D7FB149B22DB543E972A4FF48755F8081659B4983A94EF38D1B4CB92

Function 0000012A222ED60A Relevance: 6.9, Strings: 5, Instructions: 632COMMON

Download Yara Rule

Strings

object separator, xrefs: 0000012A222EDB2E, 0000012A222EDE71
object key, xrefs: 0000012A222EDBDA, 0000012A222EDF29
value, xrefs: 0000012A222EDFE8
array, xrefs: 0000012A222EDD01
object, xrefs: 0000012A222EDDB9

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: array$object$object key$object separator$value
API String ID: 2453523683-2448007618
Opcode ID: e183b7c7a55f04622923c0a3a187c871db2666b0d2710677806a81db6397c651
Instruction ID: b07057eed89a9092bd2dacfb1630bf84425a7a5962f79322d97aeabdbc743682
Opcode Fuzzy Hash: e183b7c7a55f04622923c0a3a187c871db2666b0d2710677806a81db6397c651
Instruction Fuzzy Hash: 9A42FF32614A84D3FB00DF34C4513EDA325EFD6784FC05612EA4E57A9AEF69D2A9C342

Function 0000012A222F8CE0 Relevance: 6.1, APIs: 4, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 0000012A222F8D30
GetSystemInfo.KERNEL32 ref: 0000012A222F8D47
VirtualAlloc.KERNEL32 ref: 0000012A222F8DB4
VirtualProtect.KERNEL32 ref: 0000012A222F8DCE

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 0563650b0593b8a3372685d5b5ba1ed04743c52572833c5a6095c6b83099c874
Instruction ID: 1bb3ee93076b46884f8dec22d38cec979e7b952f22d76c627bb6b2b56fe9eac4
Opcode Fuzzy Hash: 0563650b0593b8a3372685d5b5ba1ed04743c52572833c5a6095c6b83099c874
Instruction Fuzzy Hash: F7313A33310A84DBEB20DF35D9407D973A5FB48B88F945026AA0A8BB48DF39D655C741

Function 0000012A222CA660 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 366COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000012A222CA8BA

Strings

parse_error, xrefs: 0000012A222CA6EC
value, xrefs: 0000012A222CB596

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: __std_exception_copy
String ID: parse_error$value
API String ID: 592178966-1739288027
Opcode ID: f6905ed811f2d1235c2d7198258080b67331814984b245119223fdde80ccb46b
Instruction ID: 2851909d25e3bf6ca5ac4c8f3a3e3c860b93d41f96fede93012fac4a9476070b
Opcode Fuzzy Hash: f6905ed811f2d1235c2d7198258080b67331814984b245119223fdde80ccb46b
Instruction Fuzzy Hash: F6F1CC72B10A84C6FB10DF74D5413EDA372EB95398FC05611EE4C26AEAEF69C2A5C341

Function 0000012A2229C300 Relevance: 5.6, Strings: 4, Instructions: 608COMMON

Download Yara Rule

Strings

directory_iterator::directory_iterator, xrefs: 0000012A2229CDA8
filename, xrefs: 0000012A2229C8B4
exists, xrefs: 0000012A2229CD8C
content, xrefs: 0000012A2229CA73

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: content$directory_iterator::directory_iterator$exists$filename
API String ID: 0-1400943384
Opcode ID: ffca4aa2cce6f64ade1ec00c37f74711e974c2dc01704b9e97f69703ea275362
Instruction ID: 870cd41ce62556a2838fb771289bf9f2f69fec827b206b1dbc4bdfe14cdeabc3
Opcode Fuzzy Hash: ffca4aa2cce6f64ade1ec00c37f74711e974c2dc01704b9e97f69703ea275362
Instruction Fuzzy Hash: 41528F73654BC4CAEB208F28D8803DDB7A1FB89798F905215EA9C17BA9DF75C290C701

Function 0000012A22302B00 Relevance: 5.5, APIs: 3, Instructions: 1005COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000012A22302F4B
_get_daylight.LIBCMT ref: 0000012A22302FEB
_get_daylight.LIBCMT ref: 0000012A22303004

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 5072c22b437b18fafa0fbf01e541954b29129c0515d243df4d3db9686e45aad1
Instruction ID: 8542b98c990fbda8d3de9331c853d5e9df2f9065e9261f17c4cabcc88bb3495e
Opcode Fuzzy Hash: 5072c22b437b18fafa0fbf01e541954b29129c0515d243df4d3db9686e45aad1
Instruction Fuzzy Hash: 3992B032218780C7EB258F25D6543EE37A5FF45B84F844195DB8A0BF99DB79CA20C722

Function 0000012A2231B330 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 0000012A2231B356
FormatMessageA.KERNEL32 ref: 0000012A2231B385

Strings

!x-sys-default-locale, xrefs: 0000012A2231B349

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: c1628e58b74db45d6c1c166ba316052c12fc9305e6d311366bbb753391ec371b
Instruction ID: d150dd07a0df5dd22dfd7d7506cf1b5b8f8cb70e36ae376ded86016203afa9c3
Opcode Fuzzy Hash: c1628e58b74db45d6c1c166ba316052c12fc9305e6d311366bbb753391ec371b
Instruction Fuzzy Hash: EC01A772714784C3E7258B25F6447E9B7A2F7887D4F844165D64943B98CB3CC565C701

Function 0000012A22308560 Relevance: 4.7, APIs: 3, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 0000012A222F9B94: GetLastError.KERNEL32 ref: 0000012A222F9BA3
Part of subcall function 0000012A222F9B94: FlsGetValue.KERNEL32 ref: 0000012A222F9BB8
Part of subcall function 0000012A222F9B94: SetLastError.KERNEL32 ref: 0000012A222F9C43

Part of subcall function 0000012A222F9B94: FlsSetValue.KERNEL32 ref: 0000012A222F9BD9

GetLocaleInfoW.KERNEL32 ref: 0000012A223085CC

Part of subcall function 0000012A222EFC54: _invalid_parameter_noinfo.LIBCMT ref: 0000012A222EFC71

GetLocaleInfoW.KERNEL32 ref: 0000012A22308615

Part of subcall function 0000012A222EFC54: _invalid_parameter_noinfo.LIBCMT ref: 0000012A222EFCCA

GetLocaleInfoW.KERNEL32 ref: 0000012A223086E0

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: e67600567bfe96fbbb60148a47ae1074da6cf3433536b878f09fbb7db3c093e2
Instruction ID: 45b9c436b47d490b5a4d9e08536cfb82938aa3959ccb8d7ee0337bd7928979e1
Opcode Fuzzy Hash: e67600567bfe96fbbb60148a47ae1074da6cf3433536b878f09fbb7db3c093e2
Instruction Fuzzy Hash: 7061AE32300641CBEB349F25E6403EDB3A1FB84B40FD48165DB9A93A95DB38E675CB12

Function 0000012A222D2360 Relevance: 4.4, Strings: 3, Instructions: 648COMMON

Download Yara Rule

Strings

FchumMbSbWM=, xrefs: 0000012A222D2494
HdbFLydZ2ND5+cnmb/HHN0cpxtHjjKOae5irfWKS4vk=, xrefs: 0000012A222D240C
port, xrefs: 0000012A222D300D

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: FchumMbSbWM=$HdbFLydZ2ND5+cnmb/HHN0cpxtHjjKOae5irfWKS4vk=$port
API String ID: 0-1124931492
Opcode ID: 98394cc9c671d34c5bd172290710d06c125bfd0dc61c7d744a0fab5456db32ca
Instruction ID: 6e6384ef9578fc839268c68722b5962f63ebe2281301782475682a65f9851fc2
Opcode Fuzzy Hash: 98394cc9c671d34c5bd172290710d06c125bfd0dc61c7d744a0fab5456db32ca
Instruction Fuzzy Hash: 96723D72529BC4C6EB60CB24E8803DAB3A5FB99784F505315EACD52B99EF78C194CB00

Function 0000012A222982B0 Relevance: 3.9, Strings: 2, Instructions: 1358COMMON

Download Yara Rule

Strings

exists, xrefs: 0000012A222999C3
Software, xrefs: 0000012A22298724, 0000012A22298910

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Software$exists
API String ID: 0-2364128853
Opcode ID: fd2a886e43858c5e6e9e42bae0b661c2f91347490d7295cd3dd4aac71e21bb8f
Instruction ID: 520c5dbb1184eddff73e6814b51a1ae1c25fbc51fab482480cf5b41c279331f0
Opcode Fuzzy Hash: fd2a886e43858c5e6e9e42bae0b661c2f91347490d7295cd3dd4aac71e21bb8f
Instruction Fuzzy Hash: 16E28F72650BC4CAEB208F29D9843DD7364FB89B98FA04211EB9D57BA9DF75C690C301

Function 0000012A222BCD2D Relevance: 3.6, Strings: 2, Instructions: 1104COMMON

Download Yara Rule

Strings

filename, xrefs: 0000012A222BD3E4, 0000012A222BDFA9
content, xrefs: 0000012A222BD4DA, 0000012A222BE09F

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: __std_fs_convert_narrow_to_wide$__std_fs_code_page
String ID: content$filename
API String ID: 2896615418-474635906
Opcode ID: e46f2122aad82c410b295848d973a698972ecccdd57e13d60428f3c3ef5030ea
Instruction ID: e32081ec899fc793055c5c76e68c51da3d0ade6d4d1f19d55340a10559ab9301
Opcode Fuzzy Hash: e46f2122aad82c410b295848d973a698972ecccdd57e13d60428f3c3ef5030ea
Instruction Fuzzy Hash: 1AC22972619BC4C2DB708B14E4803DAF361FBC9790F905216EADD43AA9EF79C5A4CB41

Function 0000012A222D8490 Relevance: 3.4, APIs: 2, Instructions: 391COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 0000012A222D84F3
ShellExecuteW.SHELL32 ref: 0000012A222D8B5B

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ExecuteFileModuleNameShell
String ID:
API String ID: 1703432166-0
Opcode ID: f910226d3b54d046a4c2ee7f832830fdb81b1099d40989d1f7f66936b326c7e7
Instruction ID: ceca1da27c8f931c5d488bdcd56675e4f3291d46daa8afd7350d79c154683e96
Opcode Fuzzy Hash: f910226d3b54d046a4c2ee7f832830fdb81b1099d40989d1f7f66936b326c7e7
Instruction Fuzzy Hash: FB121832629FC48ADB408F29E88169EB3B5F789794F506215FEDD57B59EB38C150C700

Function 0000012A223011E4 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 0000012A22301433
RaiseException.KERNEL32 ref: 0000012A22301444

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: cbf64ba9121148847301cc8f719ae0d59934fa317e5bb9e0b0c4cf2c486d14cb
Instruction ID: 0a47f3533977097581d57f32167060404138cce81b3a6dd7deaa817299c28b63
Opcode Fuzzy Hash: cbf64ba9121148847301cc8f719ae0d59934fa317e5bb9e0b0c4cf2c486d14cb
Instruction Fuzzy Hash: 84B15973610B84CBEB15CF29C98239C77B0F784B88F558952DA9987BB4CB39C961CB11

Function 0000012A2230B398 Relevance: 3.2, APIs: 2, Instructions: 203COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000012A2230B43D
_invalid_parameter_noinfo.LIBCMT ref: 0000012A2230B5EF

Part of subcall function 0000012A222FD574: HeapAlloc.KERNEL32 ref: 0000012A222FD5C9

Part of subcall function 0000012A222FCF0C: HeapFree.KERNEL32 ref: 0000012A222FCF22
Part of subcall function 0000012A222FCF0C: GetLastError.KERNEL32 ref: 0000012A222FCF2C

Part of subcall function 0000012A2230CA40: _invalid_parameter_noinfo.LIBCMT ref: 0000012A2230CA73

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ErrorHeapLast_invalid_parameter_noinfo$AllocFree
String ID:
API String ID: 749460637-0
Opcode ID: b255b449714c885e5a0bb0d6a1e16f5ff3de5fcde9a1ceeb889da3b1d1c00cfb
Instruction ID: 337ad79d10371a8e93ea05b57525bed83d5248c1a7d80504bbd6e8f5112ac5b3
Opcode Fuzzy Hash: b255b449714c885e5a0bb0d6a1e16f5ff3de5fcde9a1ceeb889da3b1d1c00cfb
Instruction Fuzzy Hash: AC61F632305781C3EB209F26A6517EEB391FF95B80F845565AE8947F85FE38C6218B11

Function 0000012A22298060 Relevance: 3.1, APIs: 2, Instructions: 145encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 0000012A222980ED
LocalFree.KERNEL32 ref: 0000012A2229817F

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 1e24a8cc038d9e788c50d72bc66b5103239c069dd5dee8830e5511659a2ec28c
Instruction ID: ba70607ebec54ea0fd8cadb3d0bd7ce718ac520ef16c32d3f3f7290bb58e0dae
Opcode Fuzzy Hash: 1e24a8cc038d9e788c50d72bc66b5103239c069dd5dee8830e5511659a2ec28c
Instruction Fuzzy Hash: 32619B32B14B80CAFB10CFB4E5403DD73A1EB5878CF948225EB8916E9ADB79C1A4C745

Function 0000012A222D3E40 Relevance: 3.1, APIs: 2, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CryptProtectData.CRYPT32 ref: 0000012A222D3E98
LocalFree.KERNEL32 ref: 0000012A222D3F2A

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalProtect
String ID:
API String ID: 2714945720-0
Opcode ID: 1b1f0b59f50daae5b913928cb930c74407ec3cf0d3c045937b738d3d3b56883e
Instruction ID: 7a8488fc2725951385b51ae612cda56541c9d7e0af35727b902889c494b5ea38
Opcode Fuzzy Hash: 1b1f0b59f50daae5b913928cb930c74407ec3cf0d3c045937b738d3d3b56883e
Instruction Fuzzy Hash: 9E413533614B80CEE3208F74E5403ED77A4FB5978CF844229EB8916E8ADB79C6A4C755

Function 0000012A22291E50 Relevance: 2.7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

Strings

emoji, xrefs: 0000012A22291EF7
dumps, xrefs: 0000012A22291ECC

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: CriticalEnterSection
String ID: dumps$emoji
API String ID: 1904992153-2873254224
Opcode ID: 89f21fd7ff167c40c6b685fd52b6794974929237ede9a49185217d6e026611e2
Instruction ID: a301b7c861b0c012906f02792feb674b7c4156bed63a0b8e5353747d0a05eaa3
Opcode Fuzzy Hash: 89f21fd7ff167c40c6b685fd52b6794974929237ede9a49185217d6e026611e2
Instruction Fuzzy Hash: 2BC16A32A51F84CAE700CF39EA812D877B1FB5A788F905255EE8C26B69EF34D161C344

Function 0000012A223000E4 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 0000012A223001F1
gfff, xrefs: 0000012A2230026E

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: f7d7acf6635923ecb5a536e0cc5907b1d60ff5164424813373545ae2aaaba18f
Instruction ID: ca1d8736a5ca06fc632edde3b884d6085687920fe31f03e6000524442e0b984f
Opcode Fuzzy Hash: f7d7acf6635923ecb5a536e0cc5907b1d60ff5164424813373545ae2aaaba18f
Instruction Fuzzy Hash: D55177367182C4C7E7288E35AA407E9BB91E745B94F888261CBA84BEC1CB39C5568702

Function 0000012A222B7300 Relevance: 2.0, APIs: 1, Instructions: 460COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222B737A

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 694665b0a32a073c6327a44d4c6305803ad6deffc27ffcd301aebfd43908e18f
Instruction ID: f7f851dee5a3c5a479850f07860755ac4217ffa49e71c0348cef3319d7c50e8e
Opcode Fuzzy Hash: 694665b0a32a073c6327a44d4c6305803ad6deffc27ffcd301aebfd43908e18f
Instruction Fuzzy Hash: CA028973710B84C6EB14CBA5D4403EEB3A6EB48B98F948222DE9D17B99DF35C5A1C341

Function 0000012A22305EC4 Relevance: 1.9, APIs: 1, Instructions: 371COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 0000012A2230600C

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 96164b086520156f9a4ab29e2f4e10827f8fcfd3e8ecb2edf7f234c4d657f42c
Instruction ID: eb5708773c56322ef11704e841c29ce377f45f459f0c721c5e2488377a7f4f3d
Opcode Fuzzy Hash: 96164b086520156f9a4ab29e2f4e10827f8fcfd3e8ecb2edf7f234c4d657f42c
Instruction Fuzzy Hash: DB12BE32A08BD4C6E751CF3895047ED73A4FB58B48F859215EF8883696EF35D294CB01

Function 0000012A22306634 Relevance: 1.8, APIs: 1, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ae13ed17a61677afdb80beac7f468d9955fd991688634fe67f07a5118aa9c0a
Instruction ID: 463b2480d9bbcaeaeb42964a1c53c3d2bfcf49c449cf7765bb46d9b6ae323eb9
Opcode Fuzzy Hash: 5ae13ed17a61677afdb80beac7f468d9955fd991688634fe67f07a5118aa9c0a
Instruction Fuzzy Hash: D6E18C72700B90C6E720DB61E5407EE77A4FB99B88F8186629F9D53B96EF38C254C701

Function 0000012A222D4520 Relevance: 1.7, Strings: 1, Instructions: 499COMMON

Download Yara Rule

Strings

%, xrefs: 0000012A222D4B2E

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: 0d4475c43f23c8ec1a1d4476fa06b162d9d1a11d1c05aa50102c02388e884ba3
Instruction ID: 86c0ac85ab913ce19e26a71f49e5467522730322b8c1613ae61d5dd8710daddc
Opcode Fuzzy Hash: 0d4475c43f23c8ec1a1d4476fa06b162d9d1a11d1c05aa50102c02388e884ba3
Instruction Fuzzy Hash: BC121232704BC4CAFB29CFA5D4103EDA7B1EB55788F844216EE4A27B89DB39C465C742

Function 0000012A222CEC30 Relevance: 1.7, APIs: 1, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222CEF4C

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 347e54d5a13c956be7cd698dc90638a669ffa989abad20f87f94c84d8599c0d6
Instruction ID: 8017f27140d7288d87f4c1d3ec98db579d85ed9cec733195db5f9d66928308b8
Opcode Fuzzy Hash: 347e54d5a13c956be7cd698dc90638a669ffa989abad20f87f94c84d8599c0d6
Instruction Fuzzy Hash: 4EA17772601B98CAEB01CB69D8803ECB7B0F799B88F948416DF8D57B59DB39C1A1C351

Function 0000012A222CE5F0 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222CE904

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8230080c39ec98acddb00a96bf5ae377e0064c30a013f7fc6a5e0fe4b300c046
Instruction ID: 29e3ea80a5d91abd8cc9c2891de5dd1cb021adab80c851643d82a4bf398932e2
Opcode Fuzzy Hash: 8230080c39ec98acddb00a96bf5ae377e0064c30a013f7fc6a5e0fe4b300c046
Instruction Fuzzy Hash: C3A19932615B98CAEB00CBA9D8803ECB7B0F798B48F948516DF8D57B59DB39C1A1C351

Function 0000012A222CE2C0 Relevance: 1.7, APIs: 1, Instructions: 220COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222CE5E9

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 38021ef5b019370fe08054ad70401da03efec02ddda1724ddd20f961e2ef4444
Instruction ID: dd4f7f4621600094a2fbbd4858545250a37809296458e4b8f9759d61c116bb96
Opcode Fuzzy Hash: 38021ef5b019370fe08054ad70401da03efec02ddda1724ddd20f961e2ef4444
Instruction Fuzzy Hash: 1EA1AA72615B98CAEB00CBA9D4803ECB7B0FB99B88F948516DF8D17B55DB39C0A1C301

Function 0000012A222CDFC0 Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222CE2B8

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: e7cf38834f5355907c828507a72a25953d657d233342f84dd9427b185fd96a7b
Instruction ID: 85ebe37236eadbed244aeccdbcad8b94aa798aa0966aa3e57b61cace259f52b9
Opcode Fuzzy Hash: e7cf38834f5355907c828507a72a25953d657d233342f84dd9427b185fd96a7b
Instruction Fuzzy Hash: AFA18972711B98CAEB00CBA9D8803ECA7B0F759B48F948416CF8D57B59DB79C1A1C341

Function 0000012A222CEF60 Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222CF258

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: c2d40fcef9386a63fa6140481a3623f546cf2aac0fb24fac63482f73a5cc29fb
Instruction ID: 513e0d1cec5d7e8d7212e12e434255ba18387b3130aa9d970730b4d2c14f895b
Opcode Fuzzy Hash: c2d40fcef9386a63fa6140481a3623f546cf2aac0fb24fac63482f73a5cc29fb
Instruction Fuzzy Hash: BDA15672605B98CAEB00CBA9D8803ECA7B0F795B88F948416DF8D57B59DF79C0A1C351

Function 0000012A22323010 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 0000012A22323073

Part of subcall function 0000012A2231DD4C: _invalid_parameter_noinfo.LIBCMT ref: 0000012A2231DD60

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID:
API String ID: 474895018-0
Opcode ID: 06790a4295a3107e2dbbee03963e66067c54e8b338688e48600b3255dd4e86cc
Instruction ID: 1146cdfee9be45ab45ce36cd07b1b216885fdccb297afed5b2a666bb7b4b2917
Opcode Fuzzy Hash: 06790a4295a3107e2dbbee03963e66067c54e8b338688e48600b3255dd4e86cc
Instruction Fuzzy Hash: 22612732B14290C7FB749A68C5447EDB291AF80760F9943A9DA398B7D1E675CC618703

Function 0000012A223087AC Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 0000012A222F9B94: GetLastError.KERNEL32 ref: 0000012A222F9BA3
Part of subcall function 0000012A222F9B94: FlsGetValue.KERNEL32 ref: 0000012A222F9BB8
Part of subcall function 0000012A222F9B94: SetLastError.KERNEL32 ref: 0000012A222F9C43

Part of subcall function 0000012A222F9B94: FlsSetValue.KERNEL32 ref: 0000012A222F9BD9

GetLocaleInfoW.KERNEL32 ref: 0000012A22308814

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: 26972a3f8ec8664294c930cd51fb86fe8abaacfcc16369afc2f7ca5bbb20aff8
Instruction ID: 1b95c0a70f3ebb165c31cfb1a2ad205b2d50011de22703c7aea650c28bffe2a8
Opcode Fuzzy Hash: 26972a3f8ec8664294c930cd51fb86fe8abaacfcc16369afc2f7ca5bbb20aff8
Instruction Fuzzy Hash: 08318232704681C7FB68DF26E6413DA73A1FB88780FC481659A5983B86DF38D665C742

Function 0000012A223083F8 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000012A222F9B94: GetLastError.KERNEL32 ref: 0000012A222F9BA3
Part of subcall function 0000012A222F9B94: FlsGetValue.KERNEL32 ref: 0000012A222F9BB8
Part of subcall function 0000012A222F9B94: SetLastError.KERNEL32 ref: 0000012A222F9C43

EnumSystemLocalesW.KERNEL32 ref: 0000012A22308496

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 545877f1b48be7b9932d6e1bd4acb48e8ec6ab1aa6b15a7524e22e0cca3c5db5
Instruction ID: 7508a64eca7b3042d73b0844d7c531dc0ac6952149ccba885d2422b1ed20da8b
Opcode Fuzzy Hash: 545877f1b48be7b9932d6e1bd4acb48e8ec6ab1aa6b15a7524e22e0cca3c5db5
Instruction Fuzzy Hash: 0C11B1B3A14644CBEB148F1AD1407EC7BA1FB90FA0FC48155D665437C0DA34C6E1C751

Function 0000012A222BB290 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

., xrefs: 0000012A222BB590

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 12a7e4541c2ed35f9cf3a3c3ac00b32631fc0276b8037fb8a9bf4062ea6a643e
Instruction ID: 795d6493fdaf6b02ae5a57a244101e92538bfef2ef931168cca40a1d6a4f558d
Opcode Fuzzy Hash: 12a7e4541c2ed35f9cf3a3c3ac00b32631fc0276b8037fb8a9bf4062ea6a643e
Instruction Fuzzy Hash: A6C1A372200B84C7EB60CF26D5543EDA3A2FB58794FD44211EF9947B99DB7AC8A1C702

Function 0000012A223084C8 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000012A222F9B94: GetLastError.KERNEL32 ref: 0000012A222F9BA3
Part of subcall function 0000012A222F9B94: FlsGetValue.KERNEL32 ref: 0000012A222F9BB8
Part of subcall function 0000012A222F9B94: SetLastError.KERNEL32 ref: 0000012A222F9C43

EnumSystemLocalesW.KERNEL32 ref: 0000012A22308546

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 9a12b1fb76cf22861b2f448ca0e92b673a6715a3d8d74ac81b673a24401075ac
Instruction ID: 9ba9fbc5757adbaece37d36157ec545c737fb530c6fa10a53a64d2bea65253b0
Opcode Fuzzy Hash: 9a12b1fb76cf22861b2f448ca0e92b673a6715a3d8d74ac81b673a24401075ac
Instruction Fuzzy Hash: DC01F772B04280CBEB204F15F5407DD76E2EB80BA4FC5C261D62547AC8CB74C9A1C712

Function 0000012A222FD620 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32 ref: 0000012A222FD66F

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 3ab42c288a21d81e2ffe37b664d861115ee0eba558140e8c864f0cc5d19cbbb4
Instruction ID: de0b206431ef68487b94f697133a4b3ea2a46a5c213f67279d794da2e82084a1
Opcode Fuzzy Hash: 3ab42c288a21d81e2ffe37b664d861115ee0eba558140e8c864f0cc5d19cbbb4
Instruction Fuzzy Hash: 45F08772300B44C3E700DF2AFA806D96362FB89B80F849129EA5983364EF38C4B1CB41

Function 0000012A222F83E0 Relevance: 1.5, APIs: 1, Instructions: 27timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000012A222F83F4

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 713c3d38103c6f848aca492c9c1a39ab827052b45dc84a8fea4063941d8e3ae6
Instruction ID: d12b76d280a74f52204d0caaa196094beb2f81c436f8c831e9ebf694dd443811
Opcode Fuzzy Hash: 713c3d38103c6f848aca492c9c1a39ab827052b45dc84a8fea4063941d8e3ae6
Instruction Fuzzy Hash: 41F027B2B2554C83EF04871594143A8E281AF68BF4FD06720AE3A0E7C8EB1DC0668701

Function 0000012A222D0F97 Relevance: 1.5, APIs: 1, Instructions: 19comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 0000012A222D0FD4
CoSetProxyBlanket.OLE32 ref: 0000012A222D1022

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: BlanketCreateInstanceProxy
String ID:
API String ID: 1899829610-0
Opcode ID: 8a3e6e1c51c001c4c0da1831722352a0c161e157014927c20211d47a8b45fbac
Instruction ID: e5a981f08015e8566058d881023b3b6ea23fbc8822d57032e78a8389250156ae
Opcode Fuzzy Hash: 8a3e6e1c51c001c4c0da1831722352a0c161e157014927c20211d47a8b45fbac
Instruction Fuzzy Hash: 6AF01C32701B44DBFB21CF70D5402EDB771FB88708F944256DA8A52A64DF25C229C382

Function 0000012A222FFC34 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 0000012A222FFF93

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: fdcb331307c883477c1ebbb26715ba124aeb4ca5a2bdfa5a0e441948dc03e22f
Instruction ID: 7419ab60f4a8dbb205a69c21c9e06964bcdb33c8a836855557e414305c198941
Opcode Fuzzy Hash: fdcb331307c883477c1ebbb26715ba124aeb4ca5a2bdfa5a0e441948dc03e22f
Instruction Fuzzy Hash: 13A132737047C487EB25CB29A0107DABB91EB55B84F858122DE89477C6EE3EC915CB02

Function 0000012A222F6D5C Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

, xrefs: 0000012A222F6F42

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 8963ced5e9b6de3aab59e757bdcd7ba08b4f4af4977f145d74a5134f21bc2d58
Instruction ID: 7439efd670bef863f83690688bf0bf4f7a74216ff569d7477a9e80b19724367f
Opcode Fuzzy Hash: 8963ced5e9b6de3aab59e757bdcd7ba08b4f4af4977f145d74a5134f21bc2d58
Instruction Fuzzy Hash: 22B18D73204794C7E7658F39C0507ADBBA0EB09B48FA90219CB5A07795DB37C861DB46

Function 0000012A22309084 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000012A22309088

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 821eb4daeda04d3c8aa90b2308e45ed5b1180566e4f4d070028705abe430cb4e
Instruction ID: 3e636a58cb2bd908958c4b254cd2064a1364271a7fb3357f5729a0ac44df2722
Opcode Fuzzy Hash: 821eb4daeda04d3c8aa90b2308e45ed5b1180566e4f4d070028705abe430cb4e
Instruction Fuzzy Hash: CBB09230A23A49C3EB186B116E4238823A5BF8AB00FC84098804C81320DB2C01B54702

Function 0000012A222DE9F3 Relevance: .7, Instructions: 696COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef8bea2b9e28876f8b9b4e4824cd7716e0e946dc2cd3a10c77a8e21eeaef7e74
Instruction ID: d5261cffb0bf90a8087a7be90112832713d550244784a5ce45557e5136a55b46
Opcode Fuzzy Hash: ef8bea2b9e28876f8b9b4e4824cd7716e0e946dc2cd3a10c77a8e21eeaef7e74
Instruction Fuzzy Hash: 07724932604BC4CAEB71CF24E8403D9B7A5F789798F905215EA9C5BB99EF39C294C704

Function 0000012A2231E400 Relevance: .6, Instructions: 634COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4b664f3ee2bea4bb10d9a368a7c1c53d52f1da23547b0bd426001d6e8c04f18
Instruction ID: 5d37a357ce5b593debc742bd5a724854f053915eafbba2f417ddd033de1f5c56
Opcode Fuzzy Hash: c4b664f3ee2bea4bb10d9a368a7c1c53d52f1da23547b0bd426001d6e8c04f18
Instruction Fuzzy Hash: 3562A231625F94CBEB939F35AA217D56364BF563C0FC19393E80A77650DB78C4628A02

Function 0000012A222F75F4 Relevance: .3, Instructions: 317COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e65b2f4e4bbc789700892bdf0031f1e8fb899c5dabc392f52dc38f2e5a2dcae9
Instruction ID: 631ec9d80fbd9b80f1d617e1bac44a3567bc1c50cdb491a7f4adf2b3c3eb8997
Opcode Fuzzy Hash: e65b2f4e4bbc789700892bdf0031f1e8fb899c5dabc392f52dc38f2e5a2dcae9
Instruction Fuzzy Hash: 67D1C936610644C7FB788F2985007EDB7A1EB49B48FA4420ADE59077D9DB37C8A2DF42

Function 0000012A222FA5CC Relevance: .3, Instructions: 309COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: eea443f3bcc904fb54bee0150b0c4244d957023c928811ec97b6a0afa435460c
Instruction ID: 8fa6e004f0021429f1c35e059e9aa0209ba17e77c7ddfeca3e8ac8ebcbe7062b
Opcode Fuzzy Hash: eea443f3bcc904fb54bee0150b0c4244d957023c928811ec97b6a0afa435460c
Instruction Fuzzy Hash: D6C1A636204780C6EB609B61D9107EEA7A1FF94B88FC04015DE8A57BE5EB3EC565CB02

Function 0000012A22287A00 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6232c3cce7012c161286b434481a23847154d354bc60381b5c84130f59901b81
Instruction ID: e64c1eb2b277453e3e777c4b7f12f48860d5c60ec2d3c901fe4adcacfa0e7f70
Opcode Fuzzy Hash: 6232c3cce7012c161286b434481a23847154d354bc60381b5c84130f59901b81
Instruction Fuzzy Hash: 2F02C232A15FC48DE7628F39E8913D9B7A4F79D788F105215EB9C2AB59EB70C264C340

Function 0000012A222F263C Relevance: .3, Instructions: 283COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b1ff37c9c8c0ed2c94d0b59bfc79a613658ca63d3a8af0ff9b007705a1e65b
Instruction ID: 56ff0dccd2d669ab619aacb75eb525e548e5830ca91be767e53156399231c188
Opcode Fuzzy Hash: 30b1ff37c9c8c0ed2c94d0b59bfc79a613658ca63d3a8af0ff9b007705a1e65b
Instruction Fuzzy Hash: C0918837314240CBFF294E2994207F9E6C0AF52794FD413289E66577C4CABAC926DF92

Function 0000012A222F70EC Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b64f3173518c63d885d234e93cc0a50cd31abaa228072904e3532190c524c3b3
Instruction ID: 9b1d951dc2cbc9746efdd739ab40493203cca56d013930dbf9449d75c2b86aa7
Opcode Fuzzy Hash: b64f3173518c63d885d234e93cc0a50cd31abaa228072904e3532190c524c3b3
Instruction Fuzzy Hash: 4DB18E72204B94C7E7698F3AC4503EDBBA0F749B48FA8111ADF4A07399CB76C461CB46

Function 0000012A2231DF80 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fa4cd667469d4b0a1c5e9f271b4667fcf9c76d7785ea79ecd5508c77b1f82ccc
Instruction ID: bda38396c865ece23d6e3327c772f35c6c412b7890be9324e6524c77654d2b06
Opcode Fuzzy Hash: fa4cd667469d4b0a1c5e9f271b4667fcf9c76d7785ea79ecd5508c77b1f82ccc
Instruction Fuzzy Hash: 0C81B072300A50C7EB64CF25C5953AD63A0FB84B98F948626EE2E97B95CF3AC161C741

Function 0000012A22267010 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 849eb030a3b6be4593520a5be339f4b3e181f24299b72aa228ec8ecff61ba610
Instruction ID: 745d4ea7b651071f545d6b511957a4dec1a4068c05c94742341574a26bf4b1f1
Opcode Fuzzy Hash: 849eb030a3b6be4593520a5be339f4b3e181f24299b72aa228ec8ecff61ba610
Instruction Fuzzy Hash: 8FB10532A15FC88DD7208F79E8413DAB7B4F79A798F901215EACC26B19EB74C260C701

Function 0000012A22300764 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c35c59ce87947df84fa0d3a28c55520bd187c5527440cbecb115127f07f88ba
Instruction ID: 4603f97ad241aeb2877c993958b1a3296a4f21f62ffac5e0d9bcd6ffee74787e
Opcode Fuzzy Hash: 9c35c59ce87947df84fa0d3a28c55520bd187c5527440cbecb115127f07f88ba
Instruction Fuzzy Hash: E381F872608780C7EB74CF1A95403EAB690FB857D4F944225DB9943FD5CB3DC6508B11

Function 0000012A222ACF20 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec938e2278b14a04dbb626e947d484f460c30e86730ef98d8f8e7ce8a528cec
Instruction ID: 6c65e28ed7fa164cf95bc09d6eda64a10c25c359df59491d90cf14428408ab04
Opcode Fuzzy Hash: 5ec938e2278b14a04dbb626e947d484f460c30e86730ef98d8f8e7ce8a528cec
Instruction Fuzzy Hash: 576106B2710A88C3EF248F69D4466ECA361FB587D4F959222EF5D47B84DE3AD1A1C301

Function 0000012A222D1EB0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec3095b0a070363a6b3d0b209bb6e6fc7c1252a045829612813a27797fc13bfd
Instruction ID: 077a13ae4b32f22a623a46063eb353329e57d29a317785a84377699910921115
Opcode Fuzzy Hash: ec3095b0a070363a6b3d0b209bb6e6fc7c1252a045829612813a27797fc13bfd
Instruction Fuzzy Hash: 9661EE2321E2C48FD30EDF7C589106D7F61D3A7908388469DEAC5EBB4BC504C91ACBA6

Function 0000012A22337008 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32622de27a61a8a2e5330a76705853dc24aae8fd8be83df1bd1a29b95d32b718
Instruction ID: b9c588a418d730043c49fa907d26bce0d39188cc8d84597042d60fe2a73c212e
Opcode Fuzzy Hash: 32622de27a61a8a2e5330a76705853dc24aae8fd8be83df1bd1a29b95d32b718
Instruction Fuzzy Hash: 3351C3AB94EAC48BF7B24A280D662C81F94EF62B14FCD70DAC740873C3D55A5A158393

Function 0000012A222F6344 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15eac905c6263da8fcd042729b4cf6c2eac0663125a33ca76778ac8e5de10585
Instruction ID: c993c8c53dc4c1b26984d0e782a289394175055ca2165dbb53c016a43c8c0c69
Opcode Fuzzy Hash: 15eac905c6263da8fcd042729b4cf6c2eac0663125a33ca76778ac8e5de10585
Instruction Fuzzy Hash: 9351BC77210650C3EB288F29C1643BCB7A1EB55F58F950118DF6A1B799CB22DCA2CB81

Function 0000012A222F6714 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65988544bd8c51d46c1f2ecd44d2c2020be5c6c9d2ff497e3ff94f9df2993759
Instruction ID: 00d43f79438c9da48356756e68dd8c461b3938ecdfbe13836694c8bd920bd2b5
Opcode Fuzzy Hash: 65988544bd8c51d46c1f2ecd44d2c2020be5c6c9d2ff497e3ff94f9df2993759
Instruction Fuzzy Hash: CE51BB77604650C3E7288F28C2643FCA7A1EB55B58FA54119CF5A177A8CB26DCA2CF81

Function 0000012A222F652C Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09a4a0272fcb28be4f4c2347f47eb615663c13edcd1074745415d1c72bb9a049
Instruction ID: 56b31379abd1bf3959f6f0663710dd0693db34586e2d9daf4c8f77a1223c0d5a
Opcode Fuzzy Hash: 09a4a0272fcb28be4f4c2347f47eb615663c13edcd1074745415d1c72bb9a049
Instruction Fuzzy Hash: 3D519BB3610650C7E7288F28C1643BCABB0EB55B58F954119CF5A2B799CB27DCA1CF81

Function 0000012A2230AE2C Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 524a67a308e0381021d23f137e11a16671e3ac2dcb6a1eb552cac3911bac65d9
Instruction ID: da0659341f0c431e9caf20cc409e1d3b7cd42ddba6c071c683d97b5d345e17a6
Opcode Fuzzy Hash: 524a67a308e0381021d23f137e11a16671e3ac2dcb6a1eb552cac3911bac65d9
Instruction Fuzzy Hash: 3041B033310A54C2EF04CF2AEA142D9B3A1AB48FD4F899126EE4D97B58DF3CC5928701

Function 0000012A22337090 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d19410ad7230259186e62de70c501f604483edc097cd3d5680812bf89975e4c9
Instruction ID: 37cae6a6154538328bc67ccbd789fee3c1cb87e33ffedf68f01ada2411ea0d2b
Opcode Fuzzy Hash: d19410ad7230259186e62de70c501f604483edc097cd3d5680812bf89975e4c9
Instruction Fuzzy Hash: AF31B49B95DAC58BF3B249280D671C81FE4EB62B14F8E70CAC740873C7D55A49198753

Function 0000012A22337098 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938643a2e72afeb32524c677afc066cef9a073125af7897a2a4558e983be0b23
Instruction ID: f682a038837d55b9e2df6831d027efe324aa75ae2d86f37b1a98aa9693e2fab7
Opcode Fuzzy Hash: 938643a2e72afeb32524c677afc066cef9a073125af7897a2a4558e983be0b23
Instruction Fuzzy Hash: 7331949B95EAC18BF3B249280D671C81FE5EB62B14F8E70CAC740873C7D55A49198753

Function 0000012A223372E0 Relevance: .0, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e51f03ad5b1bc1da5b5b4d0cb77678dcf910ea01579b6d52af028a58c4ca108
Instruction ID: e6472cfd919f03db14f5cfdbe59d88d076f00b1ee61ae063a7774732c12b4d10
Opcode Fuzzy Hash: 7e51f03ad5b1bc1da5b5b4d0cb77678dcf910ea01579b6d52af028a58c4ca108
Instruction Fuzzy Hash: 611100AB54E9C18BF3B249240F972C81BD0FB62B24F8D20CEDB4087283D5469A2953C3

Function 0000012A223376D0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802a02f397435f7a2983d68343294454bc351265127295eb8017025d374bf0fa
Instruction ID: 2acd5f021c3522d80acb9d6d3964bc943cb08d3d78699d9f3cfb9398e7bbb67f
Opcode Fuzzy Hash: 802a02f397435f7a2983d68343294454bc351265127295eb8017025d374bf0fa
Instruction Fuzzy Hash: AA01A1A751E6C08BF7734A294E7A6D82FA0AB56F40FCD90DBC390872C3D5090D2587A3

Function 0000012A22337100 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d140950b30a8c0819f409446343fd7a16b42e04218d9a303406ff1e5d3a830a6
Instruction ID: 228e894e9867543ed86170d36645890a1338accfce7d204cfee267be0b0d7c9f
Opcode Fuzzy Hash: d140950b30a8c0819f409446343fd7a16b42e04218d9a303406ff1e5d3a830a6
Instruction Fuzzy Hash: EC0191AFD4D9C58BF7B149140AD72C41BD9EF62758F8970C9C7408B3C7E94A4A2B4683

Function 0000012A223376C0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47b12ad1dd9cb6d4a9d9e2362430c60ebee91eeab1b6ea40ce17222472a3128
Instruction ID: 8b75a28009da2edf0da56535817584fcc8f02f2db389f2607f8fb1513c314880
Opcode Fuzzy Hash: b47b12ad1dd9cb6d4a9d9e2362430c60ebee91eeab1b6ea40ce17222472a3128
Instruction Fuzzy Hash: 59C09BDB50E5C587F371551D057D7CC3F949F12A10FC8648DC7B045157D44505574B97

Function 0000012A222D0A40 Relevance: 28.7, APIs: 19, Instructions: 177processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0000012A222D0A94
Process32FirstW.KERNEL32 ref: 0000012A222D0AD8
Process32NextW.KERNEL32 ref: 0000012A222D0AED
OpenProcess.KERNEL32 ref: 0000012A222D0B2B
OpenProcessToken.ADVAPI32 ref: 0000012A222D0B52
GetTokenInformation.ADVAPI32 ref: 0000012A222D0B7D
GetLastError.KERNEL32 ref: 0000012A222D0B8B
GetTokenInformation.ADVAPI32 ref: 0000012A222D0BCB
ConvertSidToStringSidA.ADVAPI32 ref: 0000012A222D0BE2
CloseHandle.KERNEL32 ref: 0000012A222D0C56
CloseHandle.KERNEL32 ref: 0000012A222D0C61
DuplicateTokenEx.ADVAPI32 ref: 0000012A222D0C96
CloseHandle.KERNEL32 ref: 0000012A222D0CAD

Part of subcall function 0000012A222F82DC: _invalid_parameter_noinfo.LIBCMT ref: 0000012A222F82F9

CloseHandle.KERNEL32 ref: 0000012A222D0CBB
CloseHandle.KERNEL32 ref: 0000012A222D0CC6
Process32NextW.KERNEL32 ref: 0000012A222D0CD3
CloseHandle.KERNEL32 ref: 0000012A222D0CF8
CloseHandle.KERNEL32 ref: 0000012A222D0D01
CloseHandle.KERNEL32 ref: 0000012A222D0D16

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: CloseHandle$Token$Process32$InformationNextOpenProcess$ConvertCreateDuplicateErrorFirstLastSnapshotStringToolhelp32_invalid_parameter_noinfo
String ID:
API String ID: 1854266383-0
Opcode ID: c6496b269248900584d7fd2b61856a7f51f25a84bdd1b29fe432eca5ef48a86e
Instruction ID: cafe539df870c7b16f296b6c165ca5116184ab7441e8989d8e152cd74bc4dc5f
Opcode Fuzzy Hash: c6496b269248900584d7fd2b61856a7f51f25a84bdd1b29fe432eca5ef48a86e
Instruction Fuzzy Hash: 9B815D32214B80C7EB60CF26E9407DEB3A4FB88B94F805155EE8947B68DF79C665CB41

Function 0000012A222B00A0 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 213COMMON

Download Yara Rule

Strings

key opened, but never closed, xrefs: 0000012A222B180F
unexpected key without object, xrefs: 0000012A222B174E
unexpected '}', xrefs: 0000012A222B185B
No closed word, xrefs: 0000012A222B1777, 0000012A222B179A
word wasnt properly ended, xrefs: 0000012A222B17BD, 0000012A222B1838
key declared, but no value, xrefs: 0000012A222B16C7, 0000012A222B16EA, 0000012A222B17EC
object is not closed with '}', xrefs: 0000012A222B1681
quote was opened but not closed., xrefs: 0000012A222B16A4, 0000012A222B170D

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: No closed word$key declared, but no value$key opened, but never closed$object is not closed with '}'$quote was opened but not closed.$unexpected '}'$unexpected key without object$word wasnt properly ended
API String ID: 0-2700065129
Opcode ID: 35ebc0e4c6ce7c451108ec51098032febae9265251e742270f516eca66df3e48
Instruction ID: d9bc2d025dd2d7cfeb50c842b51e75786489e9eccd93d50277eaeec89ced344a
Opcode Fuzzy Hash: 35ebc0e4c6ce7c451108ec51098032febae9265251e742270f516eca66df3e48
Instruction Fuzzy Hash: E5A13C32524AC5D6EB64EF20ED803DA7765FF90348FD05452FA8A0697ADF78C6A9C301

Function 0000012A222D67D0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 173COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000012A222D684E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000012A222D6897
Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222D6A13
Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222D6A26
Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222D6A2C

Strings

false, xrefs: 0000012A222D691E
true, xrefs: 0000012A222D694B
bad locale name, xrefs: 0000012A222D6A19

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name$false$true
API String ID: 164343898-1062449267
Opcode ID: 0b2b8b1ebde26f0327f7eb5f0c4ac08a6e82aecb28469974c04ea552e424ff36
Instruction ID: 2c1ce1dc544ec73929160bf0c4a0278ecfd1425975753aaf5d9894dd2df6b3e5
Opcode Fuzzy Hash: 0b2b8b1ebde26f0327f7eb5f0c4ac08a6e82aecb28469974c04ea552e424ff36
Instruction Fuzzy Hash: 87718932701B40CBEB24DFA0E5503ED77B6EF84B08F944129AE4867B99DB39C421D746

Function 0000012A222E5720 Relevance: 13.6, APIs: 9, Instructions: 127COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0000012A222E5784
GetProcessId.KERNEL32 ref: 0000012A222E578D
RmStartSession.RSTRTMGR ref: 0000012A222E57BC
RmRegisterResources.RSTRTMGR ref: 0000012A222E57E5
RmGetList.RSTRTMGR ref: 0000012A222E581E
RmGetList.RSTRTMGR ref: 0000012A222E5880
RmEndSession.RSTRTMGR ref: 0000012A222E58BC

Part of subcall function 0000012A2230E0F0: EnterCriticalSection.KERNEL32 ref: 0000012A2230E100

RmEndSession.RSTRTMGR ref: 0000012A222E58F4
RmEndSession.RSTRTMGR ref: 0000012A222E5909

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Session$ListProcess$CriticalCurrentEnterRegisterResourcesSectionStart
String ID:
API String ID: 3572076967-0
Opcode ID: d817a67acd6db6480a775f706d479f0e5b7ae8bde52ed5eae0e180c41ccf0277
Instruction ID: 23bece05b86cee9213a68428a96e131f76b6e7c54bf88d8909425eee825439ee
Opcode Fuzzy Hash: d817a67acd6db6480a775f706d479f0e5b7ae8bde52ed5eae0e180c41ccf0277
Instruction Fuzzy Hash: FB514A32B10600CBF724CFA5E9407DCB3B9FB88754F80452ADA4A53B98DF349965CB41

Function 0000012A222F5014 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000012A222F5058
_invalid_parameter_noinfo.LIBCMT ref: 0000012A222F5430
_invalid_parameter_noinfo.LIBCMT ref: 0000012A222F56DB

Strings

f, xrefs: 0000012A222F517A
0, xrefs: 0000012A222F5480
p, xrefs: 0000012A222F510A
p, xrefs: 0000012A222F5182

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$f$p$p
API String ID: 3215553584-1202675169
Opcode ID: ddb5b90cffe7d2d3e0c664012388527694b11d3f7d0ea02711828fb826aaea95
Instruction ID: e53f7d2a1b680502e6081b5328581b44ea2cd1c4acf2f3fe86975e23b9b95b70
Opcode Fuzzy Hash: ddb5b90cffe7d2d3e0c664012388527694b11d3f7d0ea02711828fb826aaea95
Instruction Fuzzy Hash: 0E12C372705241C7FB349E19E1487EEF6AAFB80754FD84115E6924BAC8D77AC9B08F02

Function 0000012A222FD69C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 0000012A222FD81B
GetProcAddress.KERNEL32 ref: 0000012A222FD827

Strings

api-ms-, xrefs: 0000012A222FD765
ext-ms-, xrefs: 0000012A222FD778

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 12135105b5f4dd6ea4bcef39dd476f6d9ed135b4d13e617c32e3e87089a7a057
Instruction ID: 1248d40421ac166be686540e623962f63774f96bf1d7c23933fd81700527eff8
Opcode Fuzzy Hash: 12135105b5f4dd6ea4bcef39dd476f6d9ed135b4d13e617c32e3e87089a7a057
Instruction Fuzzy Hash: 2741E172311600C3FB259B269A047D9A391FF45BE0FC88125ED098B798EF39C462C742

Function 0000012A222D6C10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 81networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 0000012A222D6C79
InternetOpenUrlA.WININET ref: 0000012A222D6CAE
InternetReadFile.WININET ref: 0000012A222D6CCF
InternetReadFile.WININET ref: 0000012A222D6D0F
InternetCloseHandle.WININET ref: 0000012A222D6D1C
InternetCloseHandle.WININET ref: 0000012A222D6D25

Strings

File Downloader, xrefs: 0000012A222D6C72

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: 3ee79157f89af13d5e06345f82add2bd8ba9855f0618fbf83edde4809386b858
Instruction ID: 5b684b2e624b277e487976bf4e544432744e866659bfdad3b68b9d843f3189da
Opcode Fuzzy Hash: 3ee79157f89af13d5e06345f82add2bd8ba9855f0618fbf83edde4809386b858
Instruction Fuzzy Hash: 04316B32214B84C7EB208F26F5507EAB7A0FB89BC4F945016EE8943B58DF79D1A1CB41

Function 0000012A2230BB28 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000012A2230BB59
GetLastError.KERNEL32 ref: 0000012A2230BB65
CloseHandle.KERNEL32 ref: 0000012A2230BB7D
CreateFileW.KERNEL32 ref: 0000012A2230BBA8
WriteConsoleW.KERNEL32 ref: 0000012A2230BBC7

Strings

CONOUT$, xrefs: 0000012A2230BB89

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 224f991252595473e360711b9ed6629489629b1a0c31b547de0f3402cf39e5f5
Instruction ID: b3be1e9f3c399a84fb0728e6dc908d3a9a4847dd716e8d6fcdf5fa1e50110071
Opcode Fuzzy Hash: 224f991252595473e360711b9ed6629489629b1a0c31b547de0f3402cf39e5f5
Instruction Fuzzy Hash: 3B11B232710B40C7E3608F46EA543D9B7A0FB88FE4F800254EA1987BA8DF7CC6648745

Function 0000012A2231D314 Relevance: 9.2, APIs: 6, Instructions: 240COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 0000012A2231D3BD
MultiByteToWideChar.KERNEL32 ref: 0000012A2231D460
MultiByteToWideChar.KERNEL32 ref: 0000012A2231D501
MultiByteToWideChar.KERNEL32 ref: 0000012A2231D54B
MultiByteToWideChar.KERNEL32 ref: 0000012A2231D5E2
CompareStringEx.KERNEL32 ref: 0000012A2231D615

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: f9a507bb13e9e0357262f9cd78c472a85d4b7cc200172b173b9b3c32d6c59667
Instruction ID: 5de94da8d7a715b0ddf36e969d5a5d91ad636e1d1051d999084d2618d5f033d0
Opcode Fuzzy Hash: f9a507bb13e9e0357262f9cd78c472a85d4b7cc200172b173b9b3c32d6c59667
Instruction Fuzzy Hash: 6AA1C132304788C7FF348F2596403EA6691EF46BA8FC846B5FA5907BC5DB78C9658342

Function 0000012A222D1290 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 471COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.ADVAPI32 ref: 0000012A222D1688
RevertToSelf.ADVAPI32 ref: 0000012A222D16A6

Strings

APPB, xrefs: 0000012A222D17C7

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ImpersonateLoggedRevertSelfUser
String ID: APPB
API String ID: 1724704203-1278849820
Opcode ID: 7f7f5109e41dca8e66b5236d4894fffc124ff912079303a337b41852e6f7daf8
Instruction ID: 4dc9e693f6fdb94137b96088ce964282c79b1f6ddcc99f696a15b45d0f4f6a69
Opcode Fuzzy Hash: 7f7f5109e41dca8e66b5236d4894fffc124ff912079303a337b41852e6f7daf8
Instruction Fuzzy Hash: 6812AD72B10794CAFF109BB8D9443DD6B61EB497A8F905201EA6D17EEADF79C091C302

Function 0000012A2231CFB8 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 0000012A2231D02A
MultiByteToWideChar.KERNEL32 ref: 0000012A2231D0D2
LCMapStringEx.KERNEL32 ref: 0000012A2231D109
LCMapStringEx.KERNEL32 ref: 0000012A2231D162
LCMapStringEx.KERNEL32 ref: 0000012A2231D20F
WideCharToMultiByte.KERNEL32 ref: 0000012A2231D251

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 568cdcc071fa6e11a5db189a350f89fe32867b41da656cec5731020258f84116
Instruction ID: 5b821e0c854c7f8f201c0c8371cb8e38d2083d2e2185e62565cb5cff5d0d06b3
Opcode Fuzzy Hash: 568cdcc071fa6e11a5db189a350f89fe32867b41da656cec5731020258f84116
Instruction Fuzzy Hash: CA81C072210784C7EB648F61E5403EAB7E1FF95BA8F840265FE6917BD8DB38C4568702

Function 0000012A222F9D0C Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000012A222F9D1B
FlsSetValue.KERNEL32(?,?,8000000000000000,0000012A222F5E25,?,?,?,?,0000012A222FCF40), ref: 0000012A222F9D51
FlsSetValue.KERNEL32(?,?,8000000000000000,0000012A222F5E25,?,?,?,?,0000012A222FCF40), ref: 0000012A222F9D7E
FlsSetValue.KERNEL32(?,?,8000000000000000,0000012A222F5E25,?,?,?,?,0000012A222FCF40), ref: 0000012A222F9D8F
FlsSetValue.KERNEL32(?,?,8000000000000000,0000012A222F5E25,?,?,?,?,0000012A222FCF40), ref: 0000012A222F9DA0
SetLastError.KERNEL32 ref: 0000012A222F9DBB

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 0291658c5b6c0106ab0d2cb5e60e5aeecda8532e62d2d16efa8b2628965b4a39
Instruction ID: 0d747169887bff73c4a5e7bbc3572ffcf151efdf135fc95869ef0eb25c7b320f
Opcode Fuzzy Hash: 0291658c5b6c0106ab0d2cb5e60e5aeecda8532e62d2d16efa8b2628965b4a39
Instruction Fuzzy Hash: 64117F32304740C3FB78A73597613EDA2929F85BB0FA44724B8361B7D6DE6A94618F07

Function 0000012A22304410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000012A22304435
GetProcAddress.KERNEL32 ref: 0000012A2230444B
FreeLibrary.KERNEL32 ref: 0000012A22304472

Strings

mscoree.dll, xrefs: 0000012A2230442C
CorExitProcess, xrefs: 0000012A22304444

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8a1d3a3be8c220392397c732354a95df63a527e80713268e78113875a5d94587
Instruction ID: 7aa3f4232a135c8bf75632657a9d83cc2b94625ae8de57aac78ceed76121bd23
Opcode Fuzzy Hash: 8a1d3a3be8c220392397c732354a95df63a527e80713268e78113875a5d94587
Instruction Fuzzy Hash: 23F09071311B04C3FB248B24E9483EA6360EF89BB1FD42255CA6A467E4CF2CC369C352

Function 0000012A22300EC4 Relevance: 7.7, APIs: 5, Instructions: 196COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000012A22300F07
_set_statfp.LIBCMT ref: 0000012A22300F25
_set_statfp.LIBCMT ref: 0000012A22300F4E
_set_statfp.LIBCMT ref: 0000012A22301187

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a8e7f674e444c430dcab0a326aefe8bd211f8fcb11616e81174b6f6b026ae09c
Instruction ID: 036a83371b9395ae8f1228f89e32aa68721e62a75aec579f49a6d34c9b0aec71
Opcode Fuzzy Hash: a8e7f674e444c430dcab0a326aefe8bd211f8fcb11616e81174b6f6b026ae09c
Instruction Fuzzy Hash: E0811832114B44C7F37A8F35A6403EB6360FF45794F844381FA9526EE5D734CBA28616

Function 0000012A222F2174 Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000012A222F21ED
_invalid_parameter_noinfo.LIBCMT ref: 0000012A222F223D
_invalid_parameter_noinfo.LIBCMT ref: 0000012A222F2285
_invalid_parameter_noinfo.LIBCMT ref: 0000012A222F22BD
_invalid_parameter_noinfo.LIBCMT ref: 0000012A222F2330

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8fe47afb3800f68be13bbe9b63e2be9326a40284285b68905b179da7a6afdabd
Instruction ID: 837deb79be7828087b26ab1eb06abf85ff31733573e4bb0e45d999caa80b1fb6
Opcode Fuzzy Hash: 8fe47afb3800f68be13bbe9b63e2be9326a40284285b68905b179da7a6afdabd
Instruction Fuzzy Hash: E051A472105B84C7E7629F25D4603EDBBD4AF57B44FC98101CAC84B386DABB8865CB83

Function 0000012A2230CED0 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000012A2230CEF8
_set_statfp.LIBCMT ref: 0000012A2230CF13
_set_statfp.LIBCMT ref: 0000012A2230CF2F
_set_statfp.LIBCMT ref: 0000012A2230CF6B

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bd658b213281b8180d680cb5284e660fc3441ab3d2b441db00ad661a662aa27e
Instruction ID: 1360b881809a07562b22eef2cbd2a3d9006574860667ec5039f4f7a16285a45a
Opcode Fuzzy Hash: bd658b213281b8180d680cb5284e660fc3441ab3d2b441db00ad661a662aa27e
Instruction Fuzzy Hash: E411E972A20B05C7F7581129E7463E510406F593B0FD40EA4BBBA06EE78A94CB69533F

Function 0000012A222F9DD4 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,0000012A222F1617,?,?,00000000,0000012A222F18B2,?,?,?,?,8000000000000000,0000012A222F183E), ref: 0000012A222F9DF3
FlsSetValue.KERNEL32(?,?,?,0000012A222F1617,?,?,00000000,0000012A222F18B2,?,?,?,?,8000000000000000,0000012A222F183E), ref: 0000012A222F9E12
FlsSetValue.KERNEL32(?,?,?,0000012A222F1617,?,?,00000000,0000012A222F18B2,?,?,?,?,8000000000000000,0000012A222F183E), ref: 0000012A222F9E3A
FlsSetValue.KERNEL32(?,?,?,0000012A222F1617,?,?,00000000,0000012A222F18B2,?,?,?,?,8000000000000000,0000012A222F183E), ref: 0000012A222F9E4B
FlsSetValue.KERNEL32(?,?,?,0000012A222F1617,?,?,00000000,0000012A222F18B2,?,?,?,?,8000000000000000,0000012A222F183E), ref: 0000012A222F9E5C

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f55f60610ccbbd11ac5afcea04d06306d007cbd4dfe34afa1d74e38bb4d8ccd3
Instruction ID: a9a2b4a960232b4a4fe5bd950c1a2abfca68b4786f1eda097d2da2641045cb24
Opcode Fuzzy Hash: f55f60610ccbbd11ac5afcea04d06306d007cbd4dfe34afa1d74e38bb4d8ccd3
Instruction Fuzzy Hash: EE119031304740C3FB68A32697513E9E2929F957F0F884726693A166D6EE2BC4618F07

Function 0000012A222F9C68 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 0000012A222F9C79
FlsSetValue.KERNEL32 ref: 0000012A222F9C98
FlsSetValue.KERNEL32 ref: 0000012A222F9CC0
FlsSetValue.KERNEL32 ref: 0000012A222F9CD1
FlsSetValue.KERNEL32 ref: 0000012A222F9CE2

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 42cfa90bd700e5d3fc50fa41c25dc326aaa7814977aea507f23d9374e29609b8
Instruction ID: 58c8d0fc80df09d32d3920c72a31b39f8f54323056b99e082f45b28284639c7f
Opcode Fuzzy Hash: 42cfa90bd700e5d3fc50fa41c25dc326aaa7814977aea507f23d9374e29609b8
Instruction Fuzzy Hash: D2114031244741C3FF78B33595627E992918F85770FD80B24A9361A2D6EE2F98718F0B

Function 0000012A22321D64 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000012A22322043

Part of subcall function 0000012A2230B70C: _invalid_parameter_noinfo.LIBCMT ref: 0000012A2230B729

Strings

UTF-8, xrefs: 0000012A22321FC2
UTF-16LEUNICODE, xrefs: 0000012A22321FE1
ccs, xrefs: 0000012A22321F7E

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 0524d665bc5a06fd11eb7e2e04d7f90da3eaa764dfd4209342eddcaac0b5d37c
Instruction ID: 827111e5c6b586276e2f7c451de0a58a7a4eedbcf7ee8379d7d0522c1531aee4
Opcode Fuzzy Hash: 0524d665bc5a06fd11eb7e2e04d7f90da3eaa764dfd4209342eddcaac0b5d37c
Instruction Fuzzy Hash: 0081A972604340D7FB658F29C7503F86AA0FB11B88FD58395DAB2572EAD369CD229703

Function 0000012A222A8470 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000012A222A84DF
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000012A222A8527
_Getcoll.LIBCPMT ref: 0000012A222A855B

Strings

bad locale name, xrefs: 0000012A222A8660

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: std::_$GetcollLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1287851536-1405518554
Opcode ID: 7d59226df601bcff8e776ffd1cced10335b944736ff616c77631024c031261a6
Instruction ID: c9aaff4d803a8d5dbf0652012cca11b5d58eea3316bf69a942a88bb6d000b6f9
Opcode Fuzzy Hash: 7d59226df601bcff8e776ffd1cced10335b944736ff616c77631024c031261a6
Instruction Fuzzy Hash: 2E717832702B40CBFB18DFB4D4903DD73A6EF44B98F844525EE592BE9ADA35C4618386

Function 0000012A222BB690 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

__std_exception_destroy.LIBVCRUNTIME ref: 0000012A222BB870
__std_exception_destroy.LIBVCRUNTIME ref: 0000012A222BB87D

Strings

, column , xrefs: 0000012A222BB748
at line , xrefs: 0000012A222BB71A

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: __std_exception_destroy
String ID: at line $, column
API String ID: 2453523683-191570568
Opcode ID: 07cc318ea6f4cb38e2858a1fcdbb1645a681353122ee49c143944ed3fea36794
Instruction ID: bd3e67f2191488e790a341e76afde8feaeaac41e282b59f3d7cdfa962f2959e5
Opcode Fuzzy Hash: 07cc318ea6f4cb38e2858a1fcdbb1645a681353122ee49c143944ed3fea36794
Instruction Fuzzy Hash: 3651C472614744C2EB249F19E54439EA762FB85BD0F904215EFA803FDADF79C1A1C741

Function 0000012A2228EA30 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000012A2228EA9E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000012A2228EAE6
_Getctype.LIBCPMT ref: 0000012A2228EB24

Strings

bad locale name, xrefs: 0000012A2228EBDD

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: std::_$GetctypeLocinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1612978173-1405518554
Opcode ID: 260ccd5864991d9dece1b379a2f854b2d3b4e274d1679676f7300d2c755ddcc6
Instruction ID: 3a44b3a8d1e2a5ba91a048ac7001c1fec6ad18f5d88c045f3e6a0afa476d27bb
Opcode Fuzzy Hash: 260ccd5864991d9dece1b379a2f854b2d3b4e274d1679676f7300d2c755ddcc6
Instruction Fuzzy Hash: 8B512532702B40CBEB10DFA0D5903ED73B5FF54B48F844429AA4A26A9ADB35C5369396

Function 0000012A222FC220 Relevance: 6.3, APIs: 4, Instructions: 305fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000012A222FC2A7
WriteFile.KERNEL32 ref: 0000012A222FC56E
WriteFile.KERNEL32 ref: 0000012A222FC5B7
GetLastError.KERNEL32 ref: 0000012A222FC678

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 9747b9886aa077a2834e1a796ac88b116a11c1980555fa48c7763810529486d9
Instruction ID: fcfff80bd1634af4a796741ec91a395e5edfdb87edc8d8c069b40cdeaaf14af2
Opcode Fuzzy Hash: 9747b9886aa077a2834e1a796ac88b116a11c1980555fa48c7763810529486d9
Instruction Fuzzy Hash: 27D11132708A80CAEB10CF79D5402EC7BB1FB44BD8F955216CE5EA7B99CA35C526CB41

Function 0000012A222FCBFC Relevance: 6.2, APIs: 4, Instructions: 218COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 0000012A222FCD1F
GetLastError.KERNEL32 ref: 0000012A222FCDA9

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 7063050246c2fad88b065a933e2c6f249031a7ed32688652b8e99d20094d880a
Instruction ID: 38cf7f7ef2ed6b12d9a61d2692ccf7df4d5c4cba78acfd5d8bd34edbbf4fb2ee
Opcode Fuzzy Hash: 7063050246c2fad88b065a933e2c6f249031a7ed32688652b8e99d20094d880a
Instruction Fuzzy Hash: 0091E473610A50CBFB60CB65D4807EDBBA0FB45B98FC46106EE0A57B94DB36C4A5CB12

Function 0000012A22323288 Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000012A223232C9
_invalid_parameter_noinfo.LIBCMT ref: 0000012A22323349
_invalid_parameter_noinfo.LIBCMT ref: 0000012A2232339D
_get_daylight.LIBCMT ref: 0000012A223233F5

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo$_get_daylight
String ID:
API String ID: 72036449-0
Opcode ID: 23c2d46af6276b08be865227d4156c69869a5f5364afc3469a4aa53254264490
Instruction ID: f915fff9da0200d1b3e313682d34b5fb314cd15e0e795be8de4217880f8cfca9
Opcode Fuzzy Hash: 23c2d46af6276b08be865227d4156c69869a5f5364afc3469a4aa53254264490
Instruction Fuzzy Hash: 4D51E232704240C7F77A4A28D3153FD6A90EF81714FD986A59B658F2DADA39CE708B43

Function 0000012A222AE11E Relevance: 6.1, APIs: 4, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11253eda9c7c499353b49b5698aa52a541508f24b12a2406619ea18b2ea80f0c
Instruction ID: ab4e9fb5c444bc509b1cca7538bd5edec37f9e3cf22df2f9a6ae8063841e3bca
Opcode Fuzzy Hash: 11253eda9c7c499353b49b5698aa52a541508f24b12a2406619ea18b2ea80f0c
Instruction Fuzzy Hash: 00411A32710784C7FB289F66A5403E9E291EF547A4F980635AF9907FD6DF39C4A28301

Function 0000012A222E5E90 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0000012A222E5EB0
FreeEnvironmentStringsW.KERNEL32 ref: 0000012A222E5FAB
RtlInitUnicodeString.NTDLL ref: 0000012A222E601E
RtlInitUnicodeString.NTDLL ref: 0000012A222E602B

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID:
API String ID: 2488768755-0
Opcode ID: cef6bd626e89cee4a41faeeadaa7e73642fdf2a1d22d5dbd2bf98128b470d8ba
Instruction ID: d350bab4901f53f8ceac9a25eda1751ee1983745c50a10f9b76cf25d1ed42c77
Opcode Fuzzy Hash: cef6bd626e89cee4a41faeeadaa7e73642fdf2a1d22d5dbd2bf98128b470d8ba
Instruction Fuzzy Hash: 2051AD32A14B80C3EB218F15E54039DB364FB99B94F949215EB9903BA5DF78E5F0C305

Function 0000012A222A2210 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 0000012A2231C4DC: std::_Lockit::_Lockit.LIBCPMT ref: 0000012A2231C4F9
Part of subcall function 0000012A2231C4DC: std::locale::_Setgloballocale.LIBCPMT ref: 0000012A2231C51C

std::_Lockit::_Lockit.LIBCPMT ref: 0000012A222A2251
std::_Lockit::_Lockit.LIBCPMT ref: 0000012A222A2276
std::_Facet_Register.LIBCPMT ref: 0000012A222A2322
Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222A2384

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_RegisterSetgloballocalestd::locale::_
String ID:
API String ID: 3698853521-0
Opcode ID: 52f09004af13444489614d13a4beed677261be053e2b71cb6c70c7ba7eb4c573
Instruction ID: 58d1f8f4be785327617833c37e5323c3d5031b0cdaa2daf74e9184a8a27b8536
Opcode Fuzzy Hash: 52f09004af13444489614d13a4beed677261be053e2b71cb6c70c7ba7eb4c573
Instruction Fuzzy Hash: 18419132214B40C3EB14DF15EA403D9B7A4FB49B94FA41661EE9D07BA9DF79C461C702

Function 0000012A222F2018 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000012A222F2091
_invalid_parameter_noinfo.LIBCMT ref: 0000012A222F20F6
_invalid_parameter_noinfo.LIBCMT ref: 0000012A222F2132
_invalid_parameter_noinfo.LIBCMT ref: 0000012A222F2163

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 46041605b107bf846d44f5685209754c03f59a2c6bd87be6db18ef3a7a800cef
Instruction ID: 3303802e8f1fc794c24b63f6f2d863a759fe2cca76bd226abb6873d080891978
Opcode Fuzzy Hash: 46041605b107bf846d44f5685209754c03f59a2c6bd87be6db18ef3a7a800cef
Instruction Fuzzy Hash: A6418E33104BC4C7E7629F21D4603EEBBA4AB16B44F88C115DBC80779ADA7B8865CB53

Function 0000012A222A3F00 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000012A222A3F2B
std::_Lockit::_Lockit.LIBCPMT ref: 0000012A222A3F50
std::_Facet_Register.LIBCPMT ref: 0000012A222A3FFB
Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222A4046

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 9af72d6ad9fd38ab47eddf7528dcaacaf76fef6c26246278d57936cf75c35419
Instruction ID: 874b61d2250d2f6f3402a664c84408290ead714eb54fcd125f39723550a7204e
Opcode Fuzzy Hash: 9af72d6ad9fd38ab47eddf7528dcaacaf76fef6c26246278d57936cf75c35419
Instruction Fuzzy Hash: 9A418132254A40C2EB19DF19EA403D9B7A1FB89BD4F980561EA8D47BE9DE39C461C702

Function 0000012A222D6360 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000012A222D638B
std::_Lockit::_Lockit.LIBCPMT ref: 0000012A222D63B0
std::_Facet_Register.LIBCPMT ref: 0000012A222D645B
Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222D64A6

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: 630083b87030d874fb98124a302e25b2be5d17abf895b295ad6d9102da189e85
Instruction ID: 49b0333310b7e42614236d79bf3a1867efb234127f5f01040c02119d9b01ee8e
Opcode Fuzzy Hash: 630083b87030d874fb98124a302e25b2be5d17abf895b295ad6d9102da189e85
Instruction Fuzzy Hash: 21417132244B40C3EB25DF19F6403E9B760FB89BA4F980521EA8D077A9DE38D461C742

Function 0000012A222D64B0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000012A222D64DB
std::_Lockit::_Lockit.LIBCPMT ref: 0000012A222D6500
std::_Facet_Register.LIBCPMT ref: 0000012A222D65AB
Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222D65F6

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 1168246061-0
Opcode ID: a59cef1689774fe1fab41ed2815740ae3a49e56a25c405c4f9a4d703edcec962
Instruction ID: 23e60f110e1f3356489a7e4334a27ba31e31dd2529591028f0e110099fd45707
Opcode Fuzzy Hash: a59cef1689774fe1fab41ed2815740ae3a49e56a25c405c4f9a4d703edcec962
Instruction Fuzzy Hash: D2415F32244B40C2EB15DF19F6403E9A761FB49BA4FC80661AB4D477A9DF38C4A2C742

Function 0000012A222B5AE0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000012A222B5B0B
std::_Lockit::_Lockit.LIBCPMT ref: 0000012A222B5B30

Part of subcall function 0000012A222B6720: std::_Lockit::_Lockit.LIBCPMT ref: 0000012A222B678E
Part of subcall function 0000012A222B6720: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000012A222B67D6

std::_Facet_Register.LIBCPMT ref: 0000012A222B5BDB
Concurrency::cancel_current_task.LIBCPMT ref: 0000012A222B5C26

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: std::_$LockitLockit::_$Concurrency::cancel_current_taskFacet_Locinfo::_Locinfo_ctorRegister
String ID:
API String ID: 4181401918-0
Opcode ID: 341d0c1e0db9659c00f22877e9a5ce8211df1a606b3819ad1c108b85621a30d4
Instruction ID: e5a97bff3e44433bb2c2812e3309238abab70849f5b95ab6c30dca8646676506
Opcode Fuzzy Hash: 341d0c1e0db9659c00f22877e9a5ce8211df1a606b3819ad1c108b85621a30d4
Instruction Fuzzy Hash: 9B419372214B40C3FB15DF19EA503D9B7A5FF89BA4F880561AA4D0B7A9DE38C471C702

Function 0000012A2231B5B0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 0000012A2231B5F9
GetLastError.KERNEL32 ref: 0000012A2231B607
WideCharToMultiByte.KERNEL32 ref: 0000012A2231B63C
GetLastError.KERNEL32 ref: 0000012A2231B64A

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 34891596e761fd8460ac700fee511bf0e15182bd71cca03b29692357d58ccc2a
Instruction ID: 066688017a08c7daed11493f7dffbf684f66f5b64684874374473d7f33e6d821
Opcode Fuzzy Hash: 34891596e761fd8460ac700fee511bf0e15182bd71cca03b29692357d58ccc2a
Instruction Fuzzy Hash: DE216D72614B84C7E7208F16E54439EBBB5F799FD4F640168DB8993B58DB38C922CB40

Function 0000012A2231BA9C Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000012A2231BAC0
GetFileAttributesW.KERNEL32 ref: 0000012A2231BACF
__std_fs_open_handle.LIBCPMT ref: 0000012A2231BAF8
CloseHandle.KERNEL32 ref: 0000012A2231BB0A

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: AttributesCloseErrorFileHandleLast__std_fs_open_handle
String ID:
API String ID: 833716960-0
Opcode ID: 56b2687e7590be9060b2f521e43c00ef56049a5b324cbe43c349fec2da949a14
Instruction ID: 7624223dd6368e01bf01c27263cd08e4eb719e8a6c38cfa2b76e7bf0d817edd5
Opcode Fuzzy Hash: 56b2687e7590be9060b2f521e43c00ef56049a5b324cbe43c349fec2da949a14
Instruction Fuzzy Hash: AF11EC31714640C7F7605F29B6443FA6662EF447F0F905664FA7747EE8DA38C4618B42

Function 0000012A222D6A40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000012A222D6AAE
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000012A222D6AF6

Strings

bad locale name, xrefs: 0000012A222D6BCB

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: f17d3fb1ab4900325ab20bc1be1c582491b167ab2b0c0b2ba31f7b8690cde388
Instruction ID: 474564a57de6220aed1c14a25210214f05485132d37bd879960342942a43d9b9
Opcode Fuzzy Hash: f17d3fb1ab4900325ab20bc1be1c582491b167ab2b0c0b2ba31f7b8690cde388
Instruction Fuzzy Hash: 06512832302B40CAEB14DFB0E8903ED73B4EF54B48F884425AA4967A99DE36C576D746

Function 0000012A222B6720 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0000012A222B678E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0000012A222B67D6

Strings

bad locale name, xrefs: 0000012A222B68B5

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 1793afee5c47b6d22711c2cdef7b3f3dfeb31d4047eb3ef77c9b152621f41820
Instruction ID: 14620575f6bd0d4f724fdfc088a32d75999060f473fdcf10486c5bdfb2e312ed
Opcode Fuzzy Hash: 1793afee5c47b6d22711c2cdef7b3f3dfeb31d4047eb3ef77c9b152621f41820
Instruction Fuzzy Hash: 4F513832302A40CAEF20DFB0E4903ED73B5EF58B48F884425EA4967A99DE35C535D746

Function 0000012A22302218 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0000012A223075C0: _invalid_parameter_noinfo.LIBCMT ref: 0000012A223075F3

_get_daylight.LIBCMT ref: 0000012A22302330
_get_daylight.LIBCMT ref: 0000012A22302341

Strings

?, xrefs: 0000012A223022C1

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: bafd76418e14a8637ae48fdc26faac071872ff900bc580b65dcd3d0261e10793
Instruction ID: 67687ca08ad92f979712ce86a9013bf82b25d39f099909518530092c0a42f750
Opcode Fuzzy Hash: bafd76418e14a8637ae48fdc26faac071872ff900bc580b65dcd3d0261e10793
Instruction Fuzzy Hash: F4416A32610780C7FB608B25D6113FAA764FF80BA4F944265EF9807FD9DB78C5618B02

Function 0000012A22301550 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_set_errno_from_matherr.LIBCMT ref: 0000012A223015A4
_set_errno_from_matherr.LIBCMT ref: 0000012A22301611

Strings

exp, xrefs: 0000012A2230157F

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: _set_errno_from_matherr
String ID: exp
API String ID: 1187470696-113136155
Opcode ID: 923f91936fd528ad164bd700489891902ce9ad963cd2544eea48445b34140e2b
Instruction ID: 94b533503cfad1585aa6d932e7ccb924c6d4b8eff3b83d7079e5dcb6c73513ac
Opcode Fuzzy Hash: 923f91936fd528ad164bd700489891902ce9ad963cd2544eea48445b34140e2b
Instruction Fuzzy Hash: B5212736B11614CFE750CF78D9403ED37B0FB48748F801565FA4A96B4ADB38D6518B51

Function 0000012A22311108 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 0000012A2231114C
RaiseException.KERNEL32 ref: 0000012A22311192

Strings

csm, xrefs: 0000012A2231117F

Memory Dump Source

Source File: 00000000.00000002.2401017716.0000012A22260000.00000040.10000000.00040000.00000000.sdmp, Offset: 0000012A22260000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12a22260000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: a8459bb6fad1551cf5a45c3703ef9eb160a5f06788234bdcb96471953bc322dd
Instruction ID: c0b083f66c87a85e9642a201968e105582e201f992a0bdd006a33cd0ea3c83da
Opcode Fuzzy Hash: a8459bb6fad1551cf5a45c3703ef9eb160a5f06788234bdcb96471953bc322dd
Instruction Fuzzy Hash: E4111C32214B8482EB218F15E5403DAB7A5FB88B94F585271EECD07B69DF39C562CB40

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
file.exe

Function 0000012A222E1580 Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 225
windowCOMMON

Function 00007FF7A45216C0 Relevance: 43.1, APIs: 9, Strings: 15, Instructions: 1071
COMMON

Function 0000012A2231B76C Relevance: 27.2, APIs: 18, Instructions: 229
fileCOMMON

Function 00007FF7A44DD190 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 76
memorynativelibraryCOMMON

Function 0000012A2229D930 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 864
libraryloaderCOMMON

Function 00007FF7A44DD5E0 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 316
COMMON

Function 0000012A222D8020 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 256
synchronizationCOMMON

Function 0000012A223022FC Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 335
timeCOMMONLIBRARYCODE

Function 0000012A222E0CC0 Relevance: 13.9, APIs: 9, Instructions: 377
networkfileCOMMON

Function 0000012A222DA8F0 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 452
fileCOMMON

Function 0000012A222FEFBC Relevance: 10.8, APIs: 7, Instructions: 286
COMMONLIBRARYCODE

Function 0000012A222DA4D0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 192
windowCOMMON

Function 0000012A222DB650 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 286
networkCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre