Edit tour

Windows Analysis Report
j45EY4ovxx.msi

Overview

General Information

Sample name:	j45EY4ovxx.msi renamed because original name is a hash value
Original sample name:	5163541fd0f7a9dedfc220b437037d626e9ec32c50440ce3d81314d955cb223c.msi
Analysis ID:	1556004
MD5:	38ec29dc1f2a166922af153924482783
SHA1:	1af683febce11f3c95970ba8d876a341da7f5d13
SHA256:	5163541fd0f7a9dedfc220b437037d626e9ec32c50440ce3d81314d955cb223c
Tags:	LionSoftwareLLCmsiuser-JAMESWT_MHT
Infos:

Detection

Matanbuchus

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Matanbuchus

AI detected suspicious sample

Drops executables to the windows directory (C:\Windows) and starts them

Sigma detected: Suspicious GUP Usage

Adds / modifies Windows certificates

Checks for available system drives (often done to infect USB drives)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Launches processes in debugging mode, may be used to hinder debugging

One or more processes crash

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 6596 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\j45EY4ovxx.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 3228 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6156 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding A38CFB463D4DBDBACFCC2901433DC5C1 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 1264 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding A6367389E3E9A6AE9E1BBAB1265F4E9F MD5: 9D09DC1EDA745A5F87553048E57620CF)

MSICE10.tmp (PID: 1292 cmdline: "C:\Windows\Installer\MSICE10.tmp" /DontWait "C:\Users\user\AppData\Roaming\op\\GUP.EXE" MD5: 3CAC7B7B5A847280D8803A5EB4E2B936)

GUP.exe (PID: 3720 cmdline: "C:\Users\user\AppData\Roaming\op\GUP.exe" MD5: 7BE4B26502BB2A8ED4982805B590DEC5)

WerFault.exe (PID: 6508 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 1260 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Matanbuchus	According to PCrisk, Matanbuchus is a loader-type malicious program offered by its developers as Malware-as-a-Service (MaaS). This piece of software is designed to cause chain infections.Since it is used as a MaaS, both the malware it infiltrates into systems, and the attack reasons can vary - depending on the cyber criminals operating it. Matanbuchus has been observed being used in attacks against US universities and high schools, as well as a Belgian high-tech organization.	No Attribution	https://blog.cyber5w.com/matanbuchus-loader-analysis https://blog.cyble.com/2022/06/23/matanbuchus-loader-resurfaces/ https://isc.sans.edu/diary/rss/28752 https://medium.com/@DCSO_CyTec/a-deal-with-the-devil-analysis-of-a-recent-matanbuchus-sample-3ce991951d6a https://r136a1.info/2022/05/25/introduction-of-a-pe-file-extractor-for-various-situations/	https://malpedia.caad.fkie.fraunhofer.de/details/win.matanbuchus

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\op\libcurl.dll	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
C:\Users\user\AppData\Roaming\op\libcurl.dll	Windows_Trojan_Matanbuchus_58a61aaa	unknown	unknown	0x18270:$a1: 55 8B EC 83 EC 08 53 56 0F 57 C0 66 0F 13 45 F8 EB 12 8B 45 F8 83 C0 01 8B 4D FC 83 D1 00 89 45 F8 89 4D FC 8B 55 FC 3B 55

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.2292258011.000000006BEB1000.00000020.00000001.01000000.00000006.sdmp	Windows_Trojan_Matanbuchus_58a61aaa	unknown	unknown	0x17e70:$a1: 55 8B EC 83 EC 08 53 56 0F 57 C0 66 0F 13 45 F8 EB 12 8B 45 F8 83 C0 01 8B 4D FC 83 D1 00 89 45 F8 89 4D FC 8B 55 FC 3B 55

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.GUP.exe.6beb0000.1.unpack	JoeSecurity_Matanbuchus	Yara detected Matanbuchus	Joe Security
6.2.GUP.exe.6beb0000.1.unpack	Windows_Trojan_Matanbuchus_58a61aaa	unknown	unknown	0x18270:$a1: 55 8B EC 83 EC 08 53 56 0F 57 C0 66 0F 13 45 F8 EB 12 8B 45 F8 83 C0 01 8B 4D FC 83 D1 00 89 45 F8 89 4D FC 8B 55 FC 3B 55

Sigma Signatures

System Summary

Sigma detected: Suspicious GUP Usage

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\AppData\Roaming\op\GUP.exe" , CommandLine: "C:\Users\user\AppData\Roaming\op\GUP.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\op\GUP.exe, NewProcessName: C:\Users\user\AppData\Roaming\op\GUP.exe, OriginalFileName: C:\Users\user\AppData\Roaming\op\GUP.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1476, ProcessCommandLine: "C:\Users\user\AppData\Roaming\op\GUP.exe" , ProcessId: 3720, ProcessName: GUP.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://ebaltrahal.com/t	Avira URL Cloud: Label: malware
Source: https://ebaltrahal.com/account2.aspx00	Avira URL Cloud: Label: malware
Source: https://ebaltrahal.com/account2.aspxjH	Avira URL Cloud: Label: malware
Source: https://ebaltrahal.com/	Avira URL Cloud: Label: malware
Source: https://ebaltrahal.com/account2.aspx	Avira URL Cloud: Label: malware
Source: https://bluetreewater.com/data/useraccount.aspx	Avira URL Cloud: Label: malware
Source: https://ebaltrahal.com/y	Avira URL Cloud: Label: malware
Source: https://ebaltrahal.com/#	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\op\libcurl.dll

Avira: detection malicious, Label: TR/Dldr.Agent.xucbl

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\op\libcurl.dll

ReversingLabs: Detection: 66%

Multi AV Scanner detection for submitted file

Source: j45EY4ovxx.msi

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.0% probability

Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdbD source: MSICE10.tmp, 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmp, MSICE10.tmp, 00000005.00000000.2099313167.000000000065F000.00000002.00000001.01000000.00000003.sdmp, j45EY4ovxx.msi, MSICE10.tmp.1.dr, 63c9f5.msi.1.dr, MSICD73.tmp.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: j45EY4ovxx.msi, 63c9f5.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: j45EY4ovxx.msi, MSIC9CE.tmp.0.dr, MSIBC4A.tmp.0.dr, MSICC85.tmp.1.dr, MSICCE4.tmp.1.dr, MSIC99E.tmp.0.dr, MSIBCE8.tmp.0.dr, MSIBD09.tmp.0.dr, 63c9f5.msi.1.dr, MSIC96F.tmp.0.dr, MSIBC99.tmp.0.dr, MSIBD48.tmp.0.dr, MSICD14.tmp.1.dr, MSIBBCC.tmp.0.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb source: MSICE10.tmp, 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmp, MSICE10.tmp, 00000005.00000000.2099313167.000000000065F000.00000002.00000001.01000000.00000003.sdmp, j45EY4ovxx.msi, MSICE10.tmp.1.dr, 63c9f5.msi.1.dr, MSICD73.tmp.1.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_00651860 FindFirstFileExW,		5_2_00651860
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_0079AD81 FindFirstFileExW,		6_2_0079AD81

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: ebaltrahal.com

Source: GUP.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: GUP.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: GUP.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: GUP.exe.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: j45EY4ovxx.msi, 63c9f5.msi.1.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: j45EY4ovxx.msi, 63c9f5.msi.1.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: GUP.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: GUP.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: GUP.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: GUP.exe.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: GUP.exe.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: GUP.exe, 00000006.00000002.2291501776.000000000063E000.00000004.00000020.00020000.00000000.sdmp, gup.xml.1.dr	String found in binary or memory: http://notepad-plus.sourceforge.net/commun/update/getDownLoadUrl.php
Source: GUP.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: GUP.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: GUP.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: GUP.exe.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: j45EY4ovxx.msi, 63c9f5.msi.1.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: j45EY4ovxx.msi, 63c9f5.msi.1.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: j45EY4ovxx.msi, 63c9f5.msi.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: j45EY4ovxx.msi, 63c9f5.msi.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: GUP.exe.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: GUP.exe, 00000006.00000002.2291501776.000000000063E000.00000004.00000020.00020000.00000000.sdmp, gup.xml.1.dr	String found in binary or memory: http://www.gnu.org/licenses/
Source: GUP.exe, 00000006.00000002.2292425687.000000006C109000.00000004.00000001.01000000.00000006.sdmp	String found in binary or memory: https://bluetreewater.com/data/useraccount.aspx
Source: GUP.exe, 00000006.00000002.2291501776.000000000068D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ebaltrahal.com/
Source: GUP.exe, 00000006.00000002.2291501776.000000000068D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ebaltrahal.com/#
Source: GUP.exe, 00000006.00000002.2291501776.0000000000678000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 00000006.00000002.2292425687.000000006C109000.00000004.00000001.01000000.00000006.sdmp, GUP.exe, 00000006.00000002.2291501776.000000000069D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ebaltrahal.com/account2.aspx
Source: GUP.exe, 00000006.00000002.2291501776.000000000063E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ebaltrahal.com/account2.aspx00
Source: GUP.exe, 00000006.00000002.2291501776.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ebaltrahal.com/account2.aspxjH
Source: GUP.exe, 00000006.00000002.2291501776.000000000068D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ebaltrahal.com/t
Source: GUP.exe, 00000006.00000002.2291501776.00000000006AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ebaltrahal.com/y
Source: GUP.exe, 00000006.00000002.2291501776.00000000006AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://notepad-plus-plu.org/update/getD
Source: GUP.exe, 00000006.00000002.2291501776.000000000063E000.00000004.00000020.00020000.00000000.sdmp, gup.xml.1.dr	String found in binary or memory: https://notepad-plus-plu.org/update/getDownloadUrl.php
Source: GUP.exe, 00000006.00000002.2291501776.000000000063E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://notepad-plus-plu.org/update/getDownloadUrl.php?version=
Source: GUP.exe, 00000006.00000002.2291501776.00000000006A5000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 00000006.00000002.2291501776.000000000068D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://notepad-plus-plu.org/update/getDownloadUrl.php?version=4.6
Source: GUP.exe, 00000006.00000002.2291501776.000000000068D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://notepad-plus-plu.org/update/getDownloadUrl.php?version=4.6W
Source: GUP.exe, 00000006.00000002.2291501776.000000000063E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://notepad-plus-plu.org/update/getDownloadUrl.phpp
Source: GUP.exe, 00000006.00000002.2291501776.000000000063E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://notepad-plus-plu.org/update/getDownloadUrl.phpursday:Fri:Friday:Sat:Sat
Source: GUP.exe.1.dr	String found in binary or memory: https://notepad-plus-plus.org/0
Source: GUP.exe	String found in binary or memory: https://notepad-plus-plus.org/downloads/
Source: GUP.exe, 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmp, GUP.exe, 00000006.00000000.2101008580.00000000007AA000.00000002.00000001.01000000.00000005.sdmp, GUP.exe.1.dr	String found in binary or memory: https://notepad-plus-plus.org/downloads/openid_moreinfohttps://npp-user-manual.org/docs/upgrading/#n
Source: GUP.exe	String found in binary or memory: https://npp-user-manual.org/docs/upgrading/#new-version-available-but-auto-updater-find-nothing
Source: j45EY4ovxx.msi, 63c9f5.msi.1.dr	String found in binary or memory: https://www.globalsign.com/repository/0

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.GUP.exe.6beb0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa Author: unknown
Source: 00000006.00000002.2292258011.000000006BEB1000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa Author: unknown
Source: C:\Users\user\AppData\Roaming\op\libcurl.dll, type: DROPPED	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa Author: unknown

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\63c9f5.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICC85.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICCE4.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICD14.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{941EDD8F-91B1-4C2D-BD7E-4E6C3F2A346C}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICD73.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICE10.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSICC85.tmp

Jump to behavior

Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_00650150	5_2_00650150
Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_006471A9	5_2_006471A9
Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_00648393	5_2_00648393
Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_0061D400	5_2_0061D400
Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_0063B570	5_2_0063B570
Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_0064168D	5_2_0064168D
Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_006437DC	5_2_006437DC
Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_0064F7A4	5_2_0064F7A4
Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_00655A59	5_2_00655A59
Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_00641ACC	5_2_00641ACC
Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_00643B75	5_2_00643B75
Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_00645B10	5_2_00645B10
Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_00639CEC	5_2_00639CEC
Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_0064FDF0	5_2_0064FDF0
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_0073A0E0	6_2_0073A0E0
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_007650D0	6_2_007650D0
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_00732100	6_2_00732100
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_007651B0	6_2_007651B0
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_007672BF	6_2_007672BF
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_0074F310	6_2_0074F310
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_0075F300	6_2_0075F300
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_007A14CA	6_2_007A14CA
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_00761480	6_2_00761480
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_00781560	6_2_00781560
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_007525D0	6_2_007525D0
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_0075F650	6_2_0075F650
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_0075B6C7	6_2_0075B6C7
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_0075C770	6_2_0075C770
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_0078C7D0	6_2_0078C7D0
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_0078A7A3	6_2_0078A7A3
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_00738820	6_2_00738820
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_0073A810	6_2_0073A810
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_007888A8	6_2_007888A8
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_00745970	6_2_00745970
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_00794946	6_2_00794946
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_007639C0	6_2_007639C0
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_0073AA79	6_2_0073AA79
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_0079DA48	6_2_0079DA48
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_00732A30	6_2_00732A30
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_00762AE0	6_2_00762AE0
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_00753A80	6_2_00753A80
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_00788BEA	6_2_00788BEA
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_0075EBD0	6_2_0075EBD0
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_00731BC0	6_2_00731BC0
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_00755BC0	6_2_00755BC0
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_0079FCE9	6_2_0079FCE9
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_0075AD00	6_2_0075AD00
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_00763DE0	6_2_00763DE0
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_00760DA0	6_2_00760DA0
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_0075DED0	6_2_0075DED0
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_00734F70	6_2_00734F70
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_00788F49	6_2_00788F49

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\MSIBBCC.tmp D3614D7BECE53E0D408E31DA7D9B0FF2F7285A7DD544C778847ED0C5DED5D52F
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\MSIBC4A.tmp D3614D7BECE53E0D408E31DA7D9B0FF2F7285A7DD544C778847ED0C5DED5D52F

Source: C:\Windows\Installer\MSICE10.tmp	Code function: String function: 0063A06F appears 72 times
Source: C:\Windows\Installer\MSICE10.tmp	Code function: String function: 0063A03C appears 103 times
Source: C:\Windows\Installer\MSICE10.tmp	Code function: String function: 0063A400 appears 40 times
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: String function: 0073BCC0 appears 33 times
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: String function: 007A55D3 appears 109 times
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: String function: 00766CDF appears 39 times
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: String function: 00767A30 appears 62 times
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: String function: 007A5606 appears 79 times

Source: C:\Users\user\AppData\Roaming\op\GUP.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 1260

Source: j45EY4ovxx.msi	Binary or memory string: OriginalFilenameviewer.exeF vs j45EY4ovxx.msi
Source: j45EY4ovxx.msi	Binary or memory string: OriginalFilenamelzmaextractor.dllF vs j45EY4ovxx.msi
Source: j45EY4ovxx.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs j45EY4ovxx.msi

Source: 6.2.GUP.exe.6beb0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 332794db0ed7488e939a91594d2100ee013a7f8f91afc085e15f06fc69098ad5, id = 58a61aaa-51b2-47f2-ab32-2e639957b2d5, last_modified = 2022-04-12
Source: 00000006.00000002.2292258011.000000006BEB1000.00000020.00000001.01000000.00000006.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 332794db0ed7488e939a91594d2100ee013a7f8f91afc085e15f06fc69098ad5, id = 58a61aaa-51b2-47f2-ab32-2e639957b2d5, last_modified = 2022-04-12
Source: C:\Users\user\AppData\Roaming\op\libcurl.dll, type: DROPPED	Matched rule: Windows_Trojan_Matanbuchus_58a61aaa reference_sample = 4eb85a5532b98cbc4a6db1697cf46b9e2b7e28e89d6bbfc137b36c0736cd80e2, os = windows, severity = x86, creation_date = 2022-03-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Matanbuchus, fingerprint = 332794db0ed7488e939a91594d2100ee013a7f8f91afc085e15f06fc69098ad5, id = 58a61aaa-51b2-47f2-ab32-2e639957b2d5, last_modified = 2022-04-12

Source: classification engine

Classification label: mal100.troj.evad.winMSI@10/39@1/0

Source: C:\Windows\Installer\MSICE10.tmp

Code function: 5_2_006162B0 CreateToolhelp32Snapshot,CloseHandle,Process32FirstW,OpenProcess,CloseHandle,Process32NextW,CloseHandle,

5_2_006162B0

Source: C:\Windows\Installer\MSICE10.tmp

Code function: 5_2_00616FE0 CoInitialize,CoCreateInstance,VariantInit,IUnknown_QueryService,IUnknown_QueryInterface_Proxy,IUnknown_QueryInterface_Proxy,CoAllowSetForegroundWindow,SysAllocString,SysAllocString,SysAllocString,VariantInit,LocalFree,OpenProcess,WaitForSingleObject,GetExitCodeProcess,CloseHandle,LocalFree,VariantClear,VariantClear,VariantClear,VariantClear,SysFreeString,VariantClear,CoUninitialize,_com_issue_error,

5_2_00616FE0

Source: C:\Windows\Installer\MSICE10.tmp

Code function: 5_2_00611D80 LoadResource,LockResource,SizeofResource,

5_2_00611D80

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CMLCDBE.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3720

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\Temp\MSIBBCC.tmp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: -options	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: -verbose	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: --help	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: -clean	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: -unzipTo	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: gup.xml	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: gupOptions.xml	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: nativeLang.xml	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: explorer.exe	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: open	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: ^t	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: .zip	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: .zip	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: (:\|	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: WNLOADSTOPPED	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: ADSTOPPED	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: OPPED	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: D_UNZIPFAILED	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: ZIPFAILED	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: AILED	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: explorer.exe	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: open	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: 0.0.0.0	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: 0.0.0.0	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: 0.0.0.0	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: 0.0.0.0	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: gupOptions.xml	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: p:\|	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: D_ABORTORNOT	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: ORTORNOT	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: RNOT	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: X:\|	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: MSGID_UPDATEYES	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: MSGID_UPDATENo	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: @:\|	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: .exe	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: .exe	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: (:\|	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: MSGID_CLOSEAPP	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: @:\|	6_2_0074B210
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Command line argument: open	6_2_0074B210

Source: C:\Windows\System32\msiexec.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: j45EY4ovxx.msi

ReversingLabs: Detection: 47%

Source: GUP.exe	String found in binary or memory: --help
Source: GUP.exe	String found in binary or memory: --help
Source: GUP.exe	String found in binary or memory: Usage : gup --help gup -options gup [-verbose] [-vVERSION_VALUE] [-pCUSTOM_PARAM] gup -clean FOLDER_TO_ACTION gup -unzipTo [-clea
Source: GUP.exe	String found in binary or memory: Usage : gup --help gup -options gup [-verbose] [-vVERSION_VALUE] [-pCUSTOM_PARAM] gup -clean FOLDER_TO_ACTION gup -unzipTo [-clea
Source: GUP.exe	String found in binary or memory: Usage :gup --helpgup -optionsgup [-verbose] [-vVERSION_VALUE] [-pCUSTOM_PARAM]gup -clean FOLDER_TO_ACTIONgup -unzipTo [-clea
Source: GUP.exe	String found in binary or memory: Usage :gup --helpgup -optionsgup [-verbose] [-vVERSION_VALUE] [-pCUSTOM_PARAM]gup -clean FOLDER_TO_ACTIONgup -unzipTo [-clea

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\j45EY4ovxx.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A38CFB463D4DBDBACFCC2901433DC5C1 C
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A6367389E3E9A6AE9E1BBAB1265F4E9F
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSICE10.tmp "C:\Windows\Installer\MSICE10.tmp" /DontWait "C:\Users\user\AppData\Roaming\op\\GUP.EXE"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\op\GUP.exe "C:\Users\user\AppData\Roaming\op\GUP.exe"
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 1260
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A38CFB463D4DBDBACFCC2901433DC5C1 C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A6367389E3E9A6AE9E1BBAB1265F4E9F	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSICE10.tmp "C:\Windows\Installer\MSICE10.tmp" /DontWait "C:\Users\user\AppData\Roaming\op\\GUP.EXE"	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Installer\MSICE10.tmp	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Installer\MSICE10.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Installer\MSICE10.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Installer\MSICE10.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Installer\MSICE10.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Installer\MSICE10.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: libcurl.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\Installer\MSICE10.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: j45EY4ovxx.msi

Static file information: File size 2438144 > 1048576

Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdbD source: MSICE10.tmp, 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmp, MSICE10.tmp, 00000005.00000000.2099313167.000000000065F000.00000002.00000001.01000000.00000003.sdmp, j45EY4ovxx.msi, MSICE10.tmp.1.dr, 63c9f5.msi.1.dr, MSICD73.tmp.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: j45EY4ovxx.msi, 63c9f5.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: j45EY4ovxx.msi, MSIC9CE.tmp.0.dr, MSIBC4A.tmp.0.dr, MSICC85.tmp.1.dr, MSICCE4.tmp.1.dr, MSIC99E.tmp.0.dr, MSIBCE8.tmp.0.dr, MSIBD09.tmp.0.dr, 63c9f5.msi.1.dr, MSIC96F.tmp.0.dr, MSIBC99.tmp.0.dr, MSIBD48.tmp.0.dr, MSICD14.tmp.1.dr, MSIBBCC.tmp.0.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\viewer.pdb source: MSICE10.tmp, 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmp, MSICE10.tmp, 00000005.00000000.2099313167.000000000065F000.00000002.00000001.01000000.00000003.sdmp, j45EY4ovxx.msi, MSICE10.tmp.1.dr, 63c9f5.msi.1.dr, MSICD73.tmp.1.dr

Data Obfuscation

Yara detected Matanbuchus

Source: Yara match	File source: 6.2.GUP.exe.6beb0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\op\libcurl.dll, type: DROPPED

Source: MSIBBCC.tmp.0.dr	Static PE information: section name: .fptable
Source: MSIBC4A.tmp.0.dr	Static PE information: section name: .fptable
Source: MSIBC99.tmp.0.dr	Static PE information: section name: .fptable
Source: MSIBCE8.tmp.0.dr	Static PE information: section name: .fptable
Source: MSIBD09.tmp.0.dr	Static PE information: section name: .fptable
Source: MSIBD48.tmp.0.dr	Static PE information: section name: .fptable
Source: MSIC96F.tmp.0.dr	Static PE information: section name: .fptable
Source: MSIC99E.tmp.0.dr	Static PE information: section name: .fptable
Source: MSIC9CE.tmp.0.dr	Static PE information: section name: .fptable
Source: MSICC85.tmp.1.dr	Static PE information: section name: .fptable
Source: MSICCE4.tmp.1.dr	Static PE information: section name: .fptable
Source: MSICD14.tmp.1.dr	Static PE information: section name: .fptable
Source: MSICE10.tmp.1.dr	Static PE information: section name: .fptable

Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_0063A019 push ecx; ret		5_2_0063A02C
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_007A55B0 push ecx; ret		6_2_007A55C3

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\msiexec.exe

Executable created and started: C:\Windows\Installer\MSICE10.tmp

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIBD09.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIC9CE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIBD48.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIC99E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIBC4A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICE10.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICC85.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICCE4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\op\libcurl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIBBCC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\op\GUP.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIC96F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICD14.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIBC99.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\MSIBCE8.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICE10.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICC85.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICCE4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSICD14.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Blob

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBD09.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIC9CE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIC99E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBD48.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBC4A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICC85.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICCE4.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBBCC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIC96F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSICD14.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBC99.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIBCE8.tmp	Jump to dropped file

Source: C:\Windows\Installer\MSICE10.tmp

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_5-34785

Source: C:\Windows\Installer\MSICE10.tmp	API coverage: 6.0 %
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	API coverage: 8.6 %

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_00651860 FindFirstFileExW,		5_2_00651860
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_0079AD81 FindFirstFileExW,		6_2_0079AD81

Source: GUP.exe, 00000006.00000002.2291501776.0000000000678000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Roaming\op\GUP.exe

Code function: 6_2_00799DF4 LdrInitializeThunk,

6_2_00799DF4

Source: C:\Windows\Installer\MSICE10.tmp

Code function: 5_2_0063A1F1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_0063A1F1

Source: C:\Windows\Installer\MSICE10.tmp

Code function: 5_2_006125A0 GetProcessHeap,

5_2_006125A0

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\Installer\MSICE10.tmp "C:\Windows\Installer\MSICE10.tmp" /DontWait "C:\Users\user\AppData\Roaming\op\\GUP.EXE"

Jump to behavior

Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_0063A1F1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_0063A1F1
Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_0063E23B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_0063E23B
Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_0063A385 SetUnhandledExceptionFilter,	5_2_0063A385
Source: C:\Windows\Installer\MSICE10.tmp	Code function: 5_2_0063985D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_0063985D
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_00784343 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00784343
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_007675EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_007675EC
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_00767836 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00767836
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_007679C3 SetUnhandledExceptionFilter,	6_2_007679C3
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: 6_2_6BED6E7D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_6BED6E7D

Source: C:\Windows\Installer\MSICE10.tmp

Code function: 5_2_00617800 GetWindowsDirectoryW,GetForegroundWindow,ShellExecuteExW,ShellExecuteExW,GetModuleHandleW,GetProcAddress,AllowSetForegroundWindow,GetModuleHandleW,GetProcAddress,Sleep,EnumWindows,SetWindowPos,WaitForSingleObject,GetExitCodeProcess,GetWindowThreadProcessId,GetWindowLongW,

5_2_00617800

Source: C:\Windows\Installer\MSICE10.tmp	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_006550B7
Source: C:\Windows\Installer\MSICE10.tmp	Code function: GetLocaleInfoW,	5_2_0064F310
Source: C:\Windows\Installer\MSICE10.tmp	Code function: GetLocaleInfoEx,FormatMessageA,	5_2_006226C1
Source: C:\Windows\Installer\MSICE10.tmp	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	5_2_00654714
Source: C:\Windows\Installer\MSICE10.tmp	Code function: EnumSystemLocalesW,	5_2_006549D3
Source: C:\Windows\Installer\MSICE10.tmp	Code function: EnumSystemLocalesW,	5_2_00654A1E
Source: C:\Windows\Installer\MSICE10.tmp	Code function: EnumSystemLocalesW,	5_2_00654AB9
Source: C:\Windows\Installer\MSICE10.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00654B50
Source: C:\Windows\Installer\MSICE10.tmp	Code function: EnumSystemLocalesW,	5_2_0064EDE2
Source: C:\Windows\Installer\MSICE10.tmp	Code function: GetLocaleInfoW,	5_2_00654DB0
Source: C:\Windows\Installer\MSICE10.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_00654ED5
Source: C:\Windows\Installer\MSICE10.tmp	Code function: GetLocaleInfoW,	5_2_00654FDB
Source: C:\Windows\Installer\MSICE10.tmp	Code function: GetLocaleInfoEx,	5_2_00638F9C
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: GetLocaleInfoEx,	6_2_0078016A
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: EnumSystemLocalesW,	6_2_0079E23E
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: EnumSystemLocalesW,	6_2_0079E289
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: EnumSystemLocalesW,	6_2_0079E324
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_0079E3AF
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: GetLocaleInfoW,	6_2_0079E602
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_0079E72B
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: EnumSystemLocalesW,	6_2_0079885C
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: GetLocaleInfoW,	6_2_0079E831
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_0079E907
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: GetLocaleInfoW,	6_2_00798E1F
Source: C:\Users\user\AppData\Roaming\op\GUP.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	6_2_0079DF92

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Windows\Installer\MSICE10.tmp

Code function: 5_2_0063A445 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_0063A445

Source: C:\Windows\Installer\MSICE10.tmp

Code function: 5_2_0064F7A4 GetTimeZoneInformation,

5_2_0064F7A4

Source: C:\Windows\System32\msiexec.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Blob

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	3 Command and Scripting Interpreter	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	121 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 Process Injection	1 Modify Registry	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Disable or Modify Tools	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Process Injection	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Obfuscated Files or Information	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 File Deletion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
j45EY4ovxx.msi	47%	ReversingLabs	Win32.Trojan.Matanbuchus

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\op\libcurl.dll	100%	Avira	TR/Dldr.Agent.xucbl
C:\Users\user\AppData\Local\Temp\MSIBBCC.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIBC4A.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIBC99.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIBCE8.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIBD09.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIBD48.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIC96F.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIC99E.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIC9CE.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\op\GUP.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\op\libcurl.dll	67%	ReversingLabs	Win32.Trojan.Generic
C:\Windows\Installer\MSICC85.tmp	0%	ReversingLabs
C:\Windows\Installer\MSICCE4.tmp	0%	ReversingLabs
C:\Windows\Installer\MSICD14.tmp	0%	ReversingLabs
C:\Windows\Installer\MSICE10.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
https://notepad-plus-plu.org/update/getDownloadUrl.php?version=	0%	Avira URL Cloud	safe
https://ebaltrahal.com/t	100%	Avira URL Cloud	malware
https://ebaltrahal.com/account2.aspx00	100%	Avira URL Cloud	malware
https://notepad-plus-plu.org/update/getDownloadUrl.php?version=4.6W	0%	Avira URL Cloud	safe
https://ebaltrahal.com/account2.aspxjH	100%	Avira URL Cloud	malware
https://ebaltrahal.com/	100%	Avira URL Cloud	malware
https://notepad-plus-plu.org/update/getDownloadUrl.phpp	0%	Avira URL Cloud	safe
https://notepad-plus-plu.org/update/getD	0%	Avira URL Cloud	safe
https://notepad-plus-plu.org/update/getDownloadUrl.php	0%	Avira URL Cloud	safe
https://ebaltrahal.com/account2.aspx	100%	Avira URL Cloud	malware
https://notepad-plus-plu.org/update/getDownloadUrl.phpursday:Fri:Friday:Sat:Sat	0%	Avira URL Cloud	safe
https://notepad-plus-plu.org/update/getDownloadUrl.php?version=4.6	0%	Avira URL Cloud	safe
https://bluetreewater.com/data/useraccount.aspx	100%	Avira URL Cloud	malware
https://ebaltrahal.com/y	100%	Avira URL Cloud	malware
https://npp-user-manual.org/docs/upgrading/#new-version-available-but-auto-updater-find-nothing	0%	Avira URL Cloud	safe
https://ebaltrahal.com/#	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ebaltrahal.com	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://notepad-plus-plu.org/update/getDownloadUrl.php	GUP.exe, 00000006.00000002.2291501776.000000000063E000.00000004.00000020.00020000.00000000.sdmp, gup.xml.1.dr	false	Avira URL Cloud: safe	unknown
https://ebaltrahal.com/account2.aspx	GUP.exe, 00000006.00000002.2291501776.0000000000678000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 00000006.00000002.2292425687.000000006C109000.00000004.00000001.01000000.00000006.sdmp, GUP.exe, 00000006.00000002.2291501776.000000000069D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://notepad-plus-plu.org/update/getDownloadUrl.phpp	GUP.exe, 00000006.00000002.2291501776.000000000063E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ebaltrahal.com/	GUP.exe, 00000006.00000002.2291501776.000000000068D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ebaltrahal.com/account2.aspx00	GUP.exe, 00000006.00000002.2291501776.000000000063E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://notepad-plus.sourceforge.net/commun/update/getDownLoadUrl.php	GUP.exe, 00000006.00000002.2291501776.000000000063E000.00000004.00000020.00020000.00000000.sdmp, gup.xml.1.dr	false		high
https://ebaltrahal.com/account2.aspxjH	GUP.exe, 00000006.00000002.2291501776.0000000000678000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://notepad-plus-plu.org/update/getD	GUP.exe, 00000006.00000002.2291501776.00000000006AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://notepad-plus-plu.org/update/getDownloadUrl.php?version=4.6W	GUP.exe, 00000006.00000002.2291501776.000000000068D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://notepad-plus-plu.org/update/getDownloadUrl.php?version=	GUP.exe, 00000006.00000002.2291501776.000000000063E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://notepad-plus-plus.org/0	GUP.exe.1.dr	false		high
https://ebaltrahal.com/t	GUP.exe, 00000006.00000002.2291501776.000000000068D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://notepad-plus-plus.org/downloads/openid_moreinfohttps://npp-user-manual.org/docs/upgrading/#n	GUP.exe, 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmp, GUP.exe, 00000006.00000000.2101008580.00000000007AA000.00000002.00000001.01000000.00000005.sdmp, GUP.exe.1.dr	false		high
https://notepad-plus-plu.org/update/getDownloadUrl.phpursday:Fri:Friday:Sat:Sat	GUP.exe, 00000006.00000002.2291501776.000000000063E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bluetreewater.com/data/useraccount.aspx	GUP.exe, 00000006.00000002.2292425687.000000006C109000.00000004.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: malware	unknown
https://ebaltrahal.com/y	GUP.exe, 00000006.00000002.2291501776.00000000006AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://notepad-plus-plu.org/update/getDownloadUrl.php?version=4.6	GUP.exe, 00000006.00000002.2291501776.00000000006A5000.00000004.00000020.00020000.00000000.sdmp, GUP.exe, 00000006.00000002.2291501776.000000000068D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://npp-user-manual.org/docs/upgrading/#new-version-available-but-auto-updater-find-nothing	GUP.exe	false	Avira URL Cloud: safe	unknown
http://www.gnu.org/licenses/	GUP.exe, 00000006.00000002.2291501776.000000000063E000.00000004.00000020.00020000.00000000.sdmp, gup.xml.1.dr	false		high
https://ebaltrahal.com/#	GUP.exe, 00000006.00000002.2291501776.000000000068D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://notepad-plus-plus.org/downloads/	GUP.exe	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1556004
Start date and time:	2024-11-14 19:42:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	j45EY4ovxx.msi renamed because original name is a hash value
Original Sample Name:	5163541fd0f7a9dedfc220b437037d626e9ec32c50440ce3d81314d955cb223c.msi
Detection:	MAL
Classification:	mal100.troj.evad.winMSI@10/39@1/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 79% Number of executed functions: 22 Number of non-executed functions: 266
Cookbook Comments:	Found application associated with file extension: .msi

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.89.179.12
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: j45EY4ovxx.msi

Simulations

Behavior and APIs

Time	Type	Description
13:43:20	API Interceptor	1x Sleep call for process: WerFault.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\MSIBC4A.tmp	pdfguruhub.msi	Get hash	malicious	Unknown	Browse
	JR2xwuR1Zc.msi	Get hash	malicious	Unknown	Browse
	rs8dpaIe6D.msi	Get hash	malicious	UltraVNC	Browse
	Bill Details.exe	Get hash	malicious	UltraVNC	Browse
	Bill Details.exe	Get hash	malicious	UltraVNC	Browse
C:\Users\user\AppData\Local\Temp\MSIBBCC.tmp	pdfguruhub.msi	Get hash	malicious	Unknown	Browse
	JR2xwuR1Zc.msi	Get hash	malicious	Unknown	Browse
	rs8dpaIe6D.msi	Get hash	malicious	UltraVNC	Browse
	Bill Details.exe	Get hash	malicious	UltraVNC	Browse
	Bill Details.exe	Get hash	malicious	UltraVNC	Browse

Created / dropped Files

C:\Config.Msi\63c9f6.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	1507
Entropy (8bit):	5.672485948698376
Encrypted:	false
SSDEEP:	24:cbOgKRYUgkW6NRiDyRivRihW9RiSOQtRiBpUPFP9FHGIDhiSSdsLK:cayUg8khXyaP7HGID8Sk
MD5:	1F8327BADB55748A101492D5325DAD99
SHA1:	6DFB56EACC24652B24602E1DD75226AC12AF6C33
SHA-256:	D1373CB358E42127685AEB60E6B2FE92C969D4F7172BAB56804692BFFE7A2398
SHA-512:	63AD0E5E88351B63787080D19D7FD478D55A6A7B86CBA798D5F83A0718B42B72E2815439E177AB71BB5B8BF0D823938D838E6B26CD4754FD78A33F0FE4BB9652
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@amnY.@.....@.....@.....@.....@.....@......&.{941EDD8F-91B1-4C2D-BD7E-4E6C3F2A346C}..ChromiumDriver..j45EY4ovxx.msi.@.....@.....@.....@........&.{EB657984-42A2-4FBD-AF6E-C6A8C5A895A3}.....@.....@.....@.....@.......@.....@.....@.......@......ChromiumDriver......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{B48CC27C-9823-4256-8235-834BFD2D0DBB}&.{941EDD8F-91B1-4C2D-BD7E-4E6C3F2A346C}.@......&.{4A323D5F-6D73-4C26-8E39-BE8928DA13EB}&.{941EDD8F-91B1-4C2D-BD7E-4E6C3F2A346C}.@......&.{657DD84A-3BD6-4FEC-B308-61F1AE5C5C4B}&.{941EDD8F-91B1-4C2D-BD7E-4E6C3F2A346C}.@......&.{A955067D-C818-46EB-AC18-02AE30008615}&.{941EDD8F-91B1-4C2D-BD7E-4E6C3F2A346C}.@......&.{9492B67F-93E9-4E51-A29F-F51CA07A0BB0}&.{941EDD8F-91B1-4C2D-BD7E-4E6C3F2A346C}.@........CreateFolders..Creating folders..Folder: [1]#.>.C:\Users\user\AppData\Roaming\ChromiumDriver\ChromiumDriver\.@........InstallFiles..Copying n

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_GUP.exe_a61eb08bcc5c98b02e1c13c2b9cdcc6b17be1e1_a2f457c8_1c6a3c9d-6464-446d-81a2-db12f6d21b9e\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9766857127247661
Encrypted:	false
SSDEEP:	192:Hzugm33m70BU/Aj7cJ3zuiFaZ24IO8ev:qj33mIBU/AjOzuiFaY4IO8O
MD5:	21A141E048911ACAA936035C8EC70924
SHA1:	250181004B3BB32DCFCB8A7E7A76BDE2C29B3A57
SHA-256:	95D5AE58793D41EDABBEBCF682E7AC9B9CF111E58FD117D992531519B97347DE
SHA-512:	AF4122331FF4E35BA0A3D1ECD21D8AA3A829CCD56006DD343B881313178EA0CC7920DDE4CF44BE0423537E99B96F17E7075E6E6E5998BF3128B8879FBEFF75E2
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.6.0.8.3.3.8.2.1.5.2.2.9.2.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.6.0.8.3.3.8.2.6.3.6.6.7.3.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.c.6.a.3.c.9.d.-.6.4.6.4.-.4.4.6.d.-.8.1.a.2.-.d.b.1.2.f.6.d.2.1.b.9.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.8.c.9.3.8.7.e.-.8.f.2.e.-.4.7.e.a.-.9.b.c.1.-.6.d.9.e.c.b.1.7.c.3.d.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.G.U.P...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.g.u.p...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.e.8.8.-.0.0.0.1.-.0.0.1.4.-.a.8.c.3.-.7.a.0.8.c.5.3.6.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.2.b.5.5.2.e.9.b.2.a.f.3.b.5.d.d.8.2.c.5.b.f.1.b.4.c.5.2.2.1.7.e.0.0.0.0.0.9.0.4.!.0.0.0.0.a.f.a.1.e.e.7.1.f.e.2.3.c.4.e.7.f.8.f.c.0.1.9.5.f.5.f.b.4.a.3.d.9.6.8.5.0.0.b.6.!.G.U.P...e.x.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD119.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Nov 14 18:43:02 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	100598
Entropy (8bit):	1.8794099249146552
Encrypted:	false
SSDEEP:	384:C1PPoIxiEv/PzSQRc/SccUTJ4v55vR2VCrFM8ZL557zhwqzhN+LtjADzOOiXi:IPpxiEHPN8jKvoOh5P+LKGi
MD5:	8DFE72987939920ACE38B22AA9DD810B
SHA1:	9D3210EB0E1B2DD20DCD44662D5F21BD4DE0B4E8
SHA-256:	C85AEB4FEA3ED5EC23AF95CD5EBA144DA84F586FB6F1C1BCF21FE4C801DE92B1
SHA-512:	AB35B82E4121CFA2BA8677F5D69D89EA1B5717F451D2868242A0963555ABEBA91B567EF421423FC8DD7C7FE41293F0AD20CB365860CBC05C75F4A1334CB7E9BD
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........D6g....................................$....C..........T.......8...........T............4..fT....................... ..............................................................................eJ......4!......GenuineIntel............T............D6g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1F5.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8296
Entropy (8bit):	3.6974146712924476
Encrypted:	false
SSDEEP:	192:R6l7wVeJ9m6IFK6YEINSU4IqgmfA4sjprM89bfVsffVm:R6lXJ86IFK6YEiSU4IqgmfA4sHfufQ
MD5:	6DCE6B09F4BE0664C72270A214A14EAF
SHA1:	83BA1939579836425AE8AC61996DB43D00FE7867
SHA-256:	3FA3EAEF0A658F0E6F31578D5299E960EB5D25EAECB9516F664DDBBE3DE1D2D6
SHA-512:	0EC6CE4A6A6A40C8A92A0527887E9D3F058E27C8BE6C83A95E31DE49B0027A8B20AB377962EDDC961050DDEE96FC74AE5681DEAB997672B45413951BFC452890
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.7.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD215.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.476753809711422
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9pWWpW8VYCvYm8M4J0Xi6FRB+q8P6VuZKys8lKd:uIjfdI7f37V9yJxkHuQ/gKd
MD5:	4735DE887CAD617B5DD1C6703975E093
SHA1:	C01E6DA4677A2152B7B6392F7CB7DA10ADBBAEE0
SHA-256:	CFECAA9E99D755AEF6643D4F69E8786D8F72364C10DB7264BA627E33115B2985
SHA-512:	468D00620C6D91A1FEC58E5E40F8209154AE7E0F2F9D5997DABE55104E319F3D6FB33C034C05A7CC01F9F4D168513194CF9F3D1517F81D03234F3684BD5E7902
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="588105" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\MSI3bd62.LOG

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	470
Entropy (8bit):	3.408852469805291
Encrypted:	false
SSDEEP:	12:QwDEafYnhVnMCl3vLxy/LZdMa6GWG2wa8eZUYNK41mcK5H:Q+YnMCl3Ny/LzMajEDpjmFH
MD5:	7B9982F0FEAE1B7B4D6813125DFA6CE6
SHA1:	DF97066EC56557AC4FA5F56081DC25BBC2C723BA
SHA-256:	8E128CA5DD232DBF6361325C8744E9CFAFF4333FD8F0696F14B764D3384C201E
SHA-512:	77801181F2115D7839A43719551CA69A8D0C07C810E9DB09F1EE8B68FCCE66763DC416150F73F71ACABB476AE9CEF6E3C366FE8344C3B946DA2D82030FDD9ADA
Malicious:	false
Preview:	..E.r.r.o.r. .2.8.0.3... .D.i.a.l.o.g. .V.i.e.w. .d.i.d. .n.o.t. .f.i.n.d. .a. .r.e.c.o.r.d. .f.o.r. .t.h.e. .d.i.a.l.o.g. .E.r.r.o.r.D.l.g.......T.h.i.s. .p.a.c.k.a.g.e. .w.a.s. .c.r.e.a.t.e.d. .w.i.t.h. .a. .t.r.i.a.l. .v.e.r.s.i.o.n. .o.f. .A.d.v.a.n.c.e.d. .I.n.s.t.a.l.l.e.r... .Y.o.u. .m.a.y. .u.s.e. .i.t. .f.o.r. .e.v.a.l.u.a.t.i.o.n. .p.u.r.p.o.s.e.s. .o.n.l.y.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.4./.1.1./.2.0.2.4. . .1.3.:.4.3.:.0.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\MSIBBCC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608380087035959
Encrypted:	false
SSDEEP:	24576:ccNkyRsKx6NapcjRh0lhSMXltuGVJ8Wea/xwuC:jNkyRmopy4duG/8Wea/xwuC
MD5:	EC6EBF65FE4F361A73E473F46730E05C
SHA1:	01F946DFBF773F977AF5ADE7C27FFFC7FE311149
SHA-256:	D3614D7BECE53E0D408E31DA7D9B0FF2F7285A7DD544C778847ED0C5DED5D52F
SHA-512:	E4D7AAFA75D07A3071D2739D18B4C2B0A3798F754B339C349DB9A6004D031BF02F3970B030CEC4A5F55B4C19F03794B0CE186A303D936C222E7E6E8726FFFFF7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: pdfguruhub.msi, Detection: malicious, Browse Filename: JR2xwuR1Zc.msi, Detection: malicious, Browse Filename: rs8dpaIe6D.msi, Detection: malicious, Browse Filename: Bill Details.exe, Detection: malicious, Browse Filename: Bill Details.exe, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L...l..f.........."!...).....`............... ......................................Di....@A............................L...,...@....................Z..`=......h....K..p....................L...... K..@............ ...............................text...Z........................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIBC4A.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608380087035959
Encrypted:	false
SSDEEP:	24576:ccNkyRsKx6NapcjRh0lhSMXltuGVJ8Wea/xwuC:jNkyRmopy4duG/8Wea/xwuC
MD5:	EC6EBF65FE4F361A73E473F46730E05C
SHA1:	01F946DFBF773F977AF5ADE7C27FFFC7FE311149
SHA-256:	D3614D7BECE53E0D408E31DA7D9B0FF2F7285A7DD544C778847ED0C5DED5D52F
SHA-512:	E4D7AAFA75D07A3071D2739D18B4C2B0A3798F754B339C349DB9A6004D031BF02F3970B030CEC4A5F55B4C19F03794B0CE186A303D936C222E7E6E8726FFFFF7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: pdfguruhub.msi, Detection: malicious, Browse Filename: JR2xwuR1Zc.msi, Detection: malicious, Browse Filename: rs8dpaIe6D.msi, Detection: malicious, Browse Filename: Bill Details.exe, Detection: malicious, Browse Filename: Bill Details.exe, Detection: malicious, Browse
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L...l..f.........."!...).....`............... ......................................Di....@A............................L...,...@....................Z..`=......h....K..p....................L...... K..@............ ...............................text...Z........................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIBC99.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608380087035959
Encrypted:	false
SSDEEP:	24576:ccNkyRsKx6NapcjRh0lhSMXltuGVJ8Wea/xwuC:jNkyRmopy4duG/8Wea/xwuC
MD5:	EC6EBF65FE4F361A73E473F46730E05C
SHA1:	01F946DFBF773F977AF5ADE7C27FFFC7FE311149
SHA-256:	D3614D7BECE53E0D408E31DA7D9B0FF2F7285A7DD544C778847ED0C5DED5D52F
SHA-512:	E4D7AAFA75D07A3071D2739D18B4C2B0A3798F754B339C349DB9A6004D031BF02F3970B030CEC4A5F55B4C19F03794B0CE186A303D936C222E7E6E8726FFFFF7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L...l..f.........."!...).....`............... ......................................Di....@A............................L...,...@....................Z..`=......h....K..p....................L...... K..@............ ...............................text...Z........................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIBCE8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608380087035959
Encrypted:	false
SSDEEP:	24576:ccNkyRsKx6NapcjRh0lhSMXltuGVJ8Wea/xwuC:jNkyRmopy4duG/8Wea/xwuC
MD5:	EC6EBF65FE4F361A73E473F46730E05C
SHA1:	01F946DFBF773F977AF5ADE7C27FFFC7FE311149
SHA-256:	D3614D7BECE53E0D408E31DA7D9B0FF2F7285A7DD544C778847ED0C5DED5D52F
SHA-512:	E4D7AAFA75D07A3071D2739D18B4C2B0A3798F754B339C349DB9A6004D031BF02F3970B030CEC4A5F55B4C19F03794B0CE186A303D936C222E7E6E8726FFFFF7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L...l..f.........."!...).....`............... ......................................Di....@A............................L...,...@....................Z..`=......h....K..p....................L...... K..@............ ...............................text...Z........................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIBD09.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608380087035959
Encrypted:	false
SSDEEP:	24576:ccNkyRsKx6NapcjRh0lhSMXltuGVJ8Wea/xwuC:jNkyRmopy4duG/8Wea/xwuC
MD5:	EC6EBF65FE4F361A73E473F46730E05C
SHA1:	01F946DFBF773F977AF5ADE7C27FFFC7FE311149
SHA-256:	D3614D7BECE53E0D408E31DA7D9B0FF2F7285A7DD544C778847ED0C5DED5D52F
SHA-512:	E4D7AAFA75D07A3071D2739D18B4C2B0A3798F754B339C349DB9A6004D031BF02F3970B030CEC4A5F55B4C19F03794B0CE186A303D936C222E7E6E8726FFFFF7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L...l..f.........."!...).....`............... ......................................Di....@A............................L...,...@....................Z..`=......h....K..p....................L...... K..@............ ...............................text...Z........................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIBD48.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608380087035959
Encrypted:	false
SSDEEP:	24576:ccNkyRsKx6NapcjRh0lhSMXltuGVJ8Wea/xwuC:jNkyRmopy4duG/8Wea/xwuC
MD5:	EC6EBF65FE4F361A73E473F46730E05C
SHA1:	01F946DFBF773F977AF5ADE7C27FFFC7FE311149
SHA-256:	D3614D7BECE53E0D408E31DA7D9B0FF2F7285A7DD544C778847ED0C5DED5D52F
SHA-512:	E4D7AAFA75D07A3071D2739D18B4C2B0A3798F754B339C349DB9A6004D031BF02F3970B030CEC4A5F55B4C19F03794B0CE186A303D936C222E7E6E8726FFFFF7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L...l..f.........."!...).....`............... ......................................Di....@A............................L...,...@....................Z..`=......h....K..p....................L...... K..@............ ...............................text...Z........................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIC96F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608380087035959
Encrypted:	false
SSDEEP:	24576:ccNkyRsKx6NapcjRh0lhSMXltuGVJ8Wea/xwuC:jNkyRmopy4duG/8Wea/xwuC
MD5:	EC6EBF65FE4F361A73E473F46730E05C
SHA1:	01F946DFBF773F977AF5ADE7C27FFFC7FE311149
SHA-256:	D3614D7BECE53E0D408E31DA7D9B0FF2F7285A7DD544C778847ED0C5DED5D52F
SHA-512:	E4D7AAFA75D07A3071D2739D18B4C2B0A3798F754B339C349DB9A6004D031BF02F3970B030CEC4A5F55B4C19F03794B0CE186A303D936C222E7E6E8726FFFFF7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L...l..f.........."!...).....`............... ......................................Di....@A............................L...,...@....................Z..`=......h....K..p....................L...... K..@............ ...............................text...Z........................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIC99E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608380087035959
Encrypted:	false
SSDEEP:	24576:ccNkyRsKx6NapcjRh0lhSMXltuGVJ8Wea/xwuC:jNkyRmopy4duG/8Wea/xwuC
MD5:	EC6EBF65FE4F361A73E473F46730E05C
SHA1:	01F946DFBF773F977AF5ADE7C27FFFC7FE311149
SHA-256:	D3614D7BECE53E0D408E31DA7D9B0FF2F7285A7DD544C778847ED0C5DED5D52F
SHA-512:	E4D7AAFA75D07A3071D2739D18B4C2B0A3798F754B339C349DB9A6004D031BF02F3970B030CEC4A5F55B4C19F03794B0CE186A303D936C222E7E6E8726FFFFF7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L...l..f.........."!...).....`............... ......................................Di....@A............................L...,...@....................Z..`=......h....K..p....................L...... K..@............ ...............................text...Z........................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIC9CE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608380087035959
Encrypted:	false
SSDEEP:	24576:ccNkyRsKx6NapcjRh0lhSMXltuGVJ8Wea/xwuC:jNkyRmopy4duG/8Wea/xwuC
MD5:	EC6EBF65FE4F361A73E473F46730E05C
SHA1:	01F946DFBF773F977AF5ADE7C27FFFC7FE311149
SHA-256:	D3614D7BECE53E0D408E31DA7D9B0FF2F7285A7DD544C778847ED0C5DED5D52F
SHA-512:	E4D7AAFA75D07A3071D2739D18B4C2B0A3798F754B339C349DB9A6004D031BF02F3970B030CEC4A5F55B4C19F03794B0CE186A303D936C222E7E6E8726FFFFF7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L...l..f.........."!...).....`............... ......................................Di....@A............................L...,...@....................Z..`=......h....K..p....................L...... K..@............ ...............................text...Z........................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\op\GUP.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	632664
Entropy (8bit):	6.649250206858323
Encrypted:	false
SSDEEP:	12288:4hnL9BvdSgq4WhO6JI1TKWP2Tpc1pcBpR0Bj3APRZIbFxviYNTSuDzPnWe:snLz9qHO1TKW+pc1pcBpaBwPRZI/vigr
MD5:	7BE4B26502BB2A8ED4982805B590DEC5
SHA1:	AFA1EE71FE23C4E7F8FC0195F5FB4A3D968500B6
SHA-256:	97E196B8AA0694ECF37BDDAB2ADE90FFBA78251AF7E49F6A24ADEA0A6EE704B3
SHA-512:	013CE05CA4982B8BBAFA33B4011B1A2731C605F581223557EF66CF75DF96307D5B2444A9CCB28B3FF39E34AD989E2D5B931AB9BFCCCD7DD5F63EABDB726AB749
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...........Q..Q..Q.....Z...........D...f5.P...f.G...f.C...f.......]..Ba..Y..Ba.\...g.R..Q.....Ba._..Ba7.P..Q._.P..Ba.P..RichQ..........PE..L...'(.f...............(.............q............@.......................................@..........................................P...............~..X)...`..HI......8...............................@...............\............................text.............................. ..`.rdata..fo.......p..................@..@.data...$;.......*..................@....rsrc........P.......$..............@..@.reloc..HI...`...J...4..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\op\gup.xml

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4607
Entropy (8bit):	5.014058451204837
Encrypted:	false
SSDEEP:	96:rrxgFDl+72Y+WbPRkrm++U4YeJS2kG6QrABYUCJ8PYPwJrkFI:rVgFhunzbpka++UNQo2sBCPwJrkFI
MD5:	30823E98EDC86AC1C1B71BA49366BB86
SHA1:	1FBAEDF0850C6BB298D81843A174FE2ED0D09388
SHA-256:	F26E3A06FC46EEFB24D2D412C5E5ED1BC97EC14E2B7D8670AEA0736CE7FB15DD
SHA-512:	6A907EC6E57D4A7EE0EAC473DF439DB48D4C3457D440417A0A1908E1E8FBC7A15955166DC5D4B2C2DC42E92CAA73C74C12B7F9B477C9991EE677A93CD3AA45F5
Malicious:	false
Preview:	<?xml version="1.0" ?>.. .. Copyright 2007 Don HO <don.h@free.fr>..... This file is part of WinGup..... WinGup is free software: you can redistribute it and/or modify.. it under the terms of the GNU Lesser General Public License as published by.. the Free Software Foundation, either version 3 of the License, or.. (at your option) any later version..... WinGup is distributed in the hope that it will be useful,.. but WITHOUT ANY WARRANTY; without even the implied warranty of.. MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the.. GNU Lesser General Public License for more details..... You should have received a copy of the GNU Lesser General Public License.. along with GUP. If not, see <http://www.gnu.org/licenses/>...-->..<GUPInput>... optional....It's the current version of your program. WinGup will add "?version=versionNumber" at the end of InfoUrl....This parameter will be ignored if you pass directly your version number to WinGup

C:\Users\user\AppData\Roaming\op\libcurl.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	292352
Entropy (8bit):	6.613174333582973
Encrypted:	false
SSDEEP:	6144:0ItnTOW5IHd4lS5Rj0tenQMfJYM4puXlT0HOVVvv2nh:7tTO4IHd5R6enQMhp4EXIh
MD5:	DBC0C2B6D7D32F874BCD3106F289BD39
SHA1:	3A7B9EDF266BC28D3DD5AB227AB85E58D8DD7812
SHA-256:	B3FBD0D41A21FAA8808DC9ACFB383DF8CBFAA6DCDBB97D694F1107151CBECF33
SHA-512:	841388F58B434A6BEA241004251D861FB7F93C09DF4D1CF3AA48D906AA32A8F30A1CEE9A22701D5D876E94E5F1EB674937CFD59839A7B7ADA3316176ADDA228C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Matanbuchus, Description: Yara detected Matanbuchus, Source: C:\Users\user\AppData\Roaming\op\libcurl.dll, Author: Joe Security Rule: Windows_Trojan_Matanbuchus_58a61aaa, Description: unknown, Source: C:\Users\user\AppData\Roaming\op\libcurl.dll, Author: unknown
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@\|..@\|..@\|......J\|.......\|......T\|..F...`\|..F...P\|..F...U\|......K\|..@\|...\|.....B\|.....A\|..*...A\|..Rich@\|..........PE..L...q..g.........."!...&.J....G......i.......`................................K...........@..........................,..$.......x.............................J.\|>..........................@.......P...@............`...............................text....I.......J.................. ..`.rdata.......`.......N..............@..@.data....{F..@.......(..............@....reloc..\|>....J..@...6..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\63c9f5.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {EB657984-42A2-4FBD-AF6E-C6A8C5A895A3}, Number of Words: 10, Subject: ChromiumDriver, Author: ChromiumDriver, Name of Creating Application: ChromiumDriver (Evaluation Installer), Template: ;1033, Comments: Selenium Remote WebDriver implementation for test automation of Windows application based on WinFroms and WPF platforms. (Evaluation Installer), Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Wed Oct 16 20:55:48 2024, Last Saved Time/Date: Wed Oct 16 20:55:48 2024, Last Printed: Wed Oct 16 20:55:48 2024, Number of Pages: 450
Category:	dropped
Size (bytes):	2438144
Entropy (8bit):	7.000748363194672
Encrypted:	false
SSDEEP:	49152:k/p3z0A+biU50unDN5GQizNkyRmopy4duG/8Wea/xwuUkd4:cK3INkomkym
MD5:	38EC29DC1F2A166922AF153924482783
SHA1:	1AF683FEBCE11F3C95970BA8D876A341DA7F5D13
SHA-256:	5163541FD0F7A9DEDFC220B437037D626E9EC32C50440CE3D81314D955CB223C
SHA-512:	3A6C74B3DDCD912581DE4E42B082F132F4FB88EC4D196318391DA8BA2DF00A7B7AA3835ED9CA6C8716BA26C9C559DB5C75EF0BA78D9D00E3C1C5D58D627821E5
Malicious:	false
Preview:	......................>...................&...................................F.......w.......Q...R...S...T...U...V...W.......T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...............................................................................................................................................................................................................................................................................................................................................<...........!...4............................................................................................... ...+..."...#...$...%...&...'...(...)...*...2...,...-......./...0...1...5...3...;...@...6...7...8...9...:...?...=...t...>.......O...A...B...C...D...E...N.......H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSICC85.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608380087035959
Encrypted:	false
SSDEEP:	24576:ccNkyRsKx6NapcjRh0lhSMXltuGVJ8Wea/xwuC:jNkyRmopy4duG/8Wea/xwuC
MD5:	EC6EBF65FE4F361A73E473F46730E05C
SHA1:	01F946DFBF773F977AF5ADE7C27FFFC7FE311149
SHA-256:	D3614D7BECE53E0D408E31DA7D9B0FF2F7285A7DD544C778847ED0C5DED5D52F
SHA-512:	E4D7AAFA75D07A3071D2739D18B4C2B0A3798F754B339C349DB9A6004D031BF02F3970B030CEC4A5F55B4C19F03794B0CE186A303D936C222E7E6E8726FFFFF7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L...l..f.........."!...).....`............... ......................................Di....@A............................L...,...@....................Z..`=......h....K..p....................L...... K..@............ ...............................text...Z........................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Windows\Installer\MSICCE4.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608380087035959
Encrypted:	false
SSDEEP:	24576:ccNkyRsKx6NapcjRh0lhSMXltuGVJ8Wea/xwuC:jNkyRmopy4duG/8Wea/xwuC
MD5:	EC6EBF65FE4F361A73E473F46730E05C
SHA1:	01F946DFBF773F977AF5ADE7C27FFFC7FE311149
SHA-256:	D3614D7BECE53E0D408E31DA7D9B0FF2F7285A7DD544C778847ED0C5DED5D52F
SHA-512:	E4D7AAFA75D07A3071D2739D18B4C2B0A3798F754B339C349DB9A6004D031BF02F3970B030CEC4A5F55B4C19F03794B0CE186A303D936C222E7E6E8726FFFFF7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L...l..f.........."!...).....`............... ......................................Di....@A............................L...,...@....................Z..`=......h....K..p....................L...... K..@............ ...............................text...Z........................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Windows\Installer\MSICD14.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1021792
Entropy (8bit):	6.608380087035959
Encrypted:	false
SSDEEP:	24576:ccNkyRsKx6NapcjRh0lhSMXltuGVJ8Wea/xwuC:jNkyRmopy4duG/8Wea/xwuC
MD5:	EC6EBF65FE4F361A73E473F46730E05C
SHA1:	01F946DFBF773F977AF5ADE7C27FFFC7FE311149
SHA-256:	D3614D7BECE53E0D408E31DA7D9B0FF2F7285A7DD544C778847ED0C5DED5D52F
SHA-512:	E4D7AAFA75D07A3071D2739D18B4C2B0A3798F754B339C349DB9A6004D031BF02F3970B030CEC4A5F55B4C19F03794B0CE186A303D936C222E7E6E8726FFFFF7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......ia.p-..#-..#-..#].."!..#].."...#=..":..#=.."<..#=.."b..#].."7..#]..",..#].."...#-..#...#e.."T..#e..",..#e..#,..#-.g#,..#e..",..#Rich-..#........................PE..L...l..f.........."!...).....`............... ......................................Di....@A............................L...,...@....................Z..`=......h....K..p....................L...... K..@............ ...............................text...Z........................... ..`.rdata....... ......................@..@.data....(..........................@....fptable............................@....rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Windows\Installer\MSICD73.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	422932
Entropy (8bit):	6.503515536190355
Encrypted:	false
SSDEEP:	12288:al7GrJZsRtP01Ab+biU50unhTzTQWNy7kokGqzTC:e7UJaR10A+biU50unhFNyIGqfC
MD5:	4066F5A63406738AEB026DEC1D1E4B44
SHA1:	DD442E9E1D93AB2403AB37D127BF743417F77D5B
SHA-256:	EAA8E3F7F744FD0405E4CAA8DEC499DCC076CC63A1F31300998A2FCCFB0477ED
SHA-512:	C4A9E6806186320CB3A84AA38947412609D0427CF20DDAFCC4B52E8B74586358B170B4FBFA0033D53B231DE841835BC88AA8F39ED55613BAD26658E3AAD7A546
Malicious:	false
Preview:	...@IXOS.@.....@amnY.@.....@.....@.....@.....@.....@......&.{941EDD8F-91B1-4C2D-BD7E-4E6C3F2A346C}..ChromiumDriver..j45EY4ovxx.msi.@.....@.....@.....@........&.{EB657984-42A2-4FBD-AF6E-C6A8C5A895A3}.....@.....@.....@.....@.......@.....@.....@.......@......ChromiumDriver......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{B48CC27C-9823-4256-8235-834BFD2D0DBB}>.C:\Users\user\AppData\Roaming\ChromiumDriver\ChromiumDriver\.@.......@.....@.....@......&.{4A323D5F-6D73-4C26-8E39-BE8928DA13EB}2.01:\Software\ChromiumDriver\ChromiumDriver\Version.@.......@.....@.....@......&.{657DD84A-3BD6-4FEC-B308-61F1AE5C5C4B}.C:\Users\user\AppData\Roaming\op\GUP.exe.@.......@.....@.....@......&.{A955067D-C818-46EB-AC18-02AE30008615}.C:\Users\user\AppData\Roaming\op\gup.xml.@.......@.....@.....@......&.{9492B67F-93E9-4E51-A29F-F51CA07A0BB0}..C:\Users\user\AppData\Roaming

C:\Windows\Installer\MSICE10.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	420864
Entropy (8bit):	6.500505031355211
Encrypted:	false
SSDEEP:	12288:0l7GrJZsRtP01Ab+biU50unhTzTQWNy7kokGqzT:M7UJaR10A+biU50unhFNyIGqf
MD5:	3CAC7B7B5A847280D8803A5EB4E2B936
SHA1:	D20C6283B6EB8F5471B59C4E3D175D784AAEC301
SHA-256:	7A4AE0F0B81A5F43BE29C3CC189887F4D64B859567BEC1EFEC1D3564A77457FE
SHA-512:	F49C71D3A6ACE0FF24DEA24BE8F9DBF85B0EF25D74A78E48087A7C031A28D4B74D843EB97183484A4442D41BF95DB882B65C1484781500A169BA77354809750A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................M...............................................6.............Q....9.........Rich..........PE..L......f.........."....)..........................@.................................\|.....@..........................................p..8........................;..P...p...............................@............................................text............................... ..`.rdata..*%.......&..................@..@.data....7... ......................@....fptable.....`......."..............@....rsrc...8....p.......$..............@..@.reloc...;.......<...0..............@..B........................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{941EDD8F-91B1-4C2D-BD7E-4E6C3F2A346C}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1642869783110767
Encrypted:	false
SSDEEP:	12:JSbX72FjXlAGiLIlHVRpZh/7777777777777777777777777vDHFENd29bit/l0G:J7QI5t2NgUiF
MD5:	1E6C713B457C081462E6002EB25AA235
SHA1:	903100FDC6A3520101584C865F3D9EB0DB8392BD
SHA-256:	34A6DD2154E9A2C9231304A253796DE7BD9EE18BA2C4CF5CE1278553EFED86DB
SHA-512:	02B96F5958E472232DCD4A376CFE66C006654C0406E967BE23C9F2BF2AA442F7F205ED4A3979E3C573BE5BF1B9ADE5F2BC6446D06C8EA3DDDB9D6A77874FB3D0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5993862675144292
Encrypted:	false
SSDEEP:	48:f8PhmuRc06WXJWjT5fesS3VAErCy9X2USDTumlw:ehm1tjTYs8ewCMzKw
MD5:	E3BC62E81E61C55755747EE4C318B92E
SHA1:	20B01DF18B292FB6A2CFF5DCF27B120703037102
SHA-256:	7FD522BBFC27F4CB2D9D6A3413A6C6945CBE244EF730F96A01CD1CE4A04D4025
SHA-512:	F514E06B960030DF28A20D27C4A5FF2CA1459A3D83ED1C28C98F3E816464E9B81DA0C916477B4E6F6E775CD6B991517ED09BC3B9F408B45829773F72B1BE3432
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	364484
Entropy (8bit):	5.365495244943878
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauB:zTtbmkExhMJCIpE+
MD5:	CB5AF7B8F38BD3BE0DF84DEC8EA2955D
SHA1:	8D93DCF47971B26968BFE4EBEC3A4F7E95E89E0D
SHA-256:	170BBEB6124CE2F47E0A1511369C359592908E68D2E70F0C8974EB8A3C15798D
SHA-512:	4CB305A3C9BF7AF24D17EC9AB21C04F5BBE58C8BEE8B3AB0EA2078D6EA2C94D2267A0FC9479838170F3C7485750A9F5BFD5E5CCA2510EF0ABE9705DCD7068F09
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF2055EACFB8F0139D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07201799471881946
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOEDNusdOZt8gVky6lit/:2F0i8n0itFzDHFENd2Git/
MD5:	5C24FFC9007DADAABD97B2DBF7B3A7EC
SHA1:	97DED5027226B9CDBCC437B97F8603B49794D048
SHA-256:	D9C98EF02F4B413557C785289C2D466C50C86CD70ADFA26E6125A785C0A4354F
SHA-512:	C99C6108CD1CD311EE45BE42BF28C7C036BB9740E3979F34E1FB4677F4028BC9DCE9C3DAA95868E295F81330B9813F6B52D896EF84D87475F4D5D703A7F305BC
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF421EB40E7ABCC799.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5993862675144292
Encrypted:	false
SSDEEP:	48:f8PhmuRc06WXJWjT5fesS3VAErCy9X2USDTumlw:ehm1tjTYs8ewCMzKw
MD5:	E3BC62E81E61C55755747EE4C318B92E
SHA1:	20B01DF18B292FB6A2CFF5DCF27B120703037102
SHA-256:	7FD522BBFC27F4CB2D9D6A3413A6C6945CBE244EF730F96A01CD1CE4A04D4025
SHA-512:	F514E06B960030DF28A20D27C4A5FF2CA1459A3D83ED1C28C98F3E816464E9B81DA0C916477B4E6F6E775CD6B991517ED09BC3B9F408B45829773F72B1BE3432
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF542AD7EFCF0D95C0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6A0A71C2B4B1A976.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF72F81BFB5DDDC0B5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF74607AA265147A07.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5993862675144292
Encrypted:	false
SSDEEP:	48:f8PhmuRc06WXJWjT5fesS3VAErCy9X2USDTumlw:ehm1tjTYs8ewCMzKw
MD5:	E3BC62E81E61C55755747EE4C318B92E
SHA1:	20B01DF18B292FB6A2CFF5DCF27B120703037102
SHA-256:	7FD522BBFC27F4CB2D9D6A3413A6C6945CBE244EF730F96A01CD1CE4A04D4025
SHA-512:	F514E06B960030DF28A20D27C4A5FF2CA1459A3D83ED1C28C98F3E816464E9B81DA0C916477B4E6F6E775CD6B991517ED09BC3B9F408B45829773F72B1BE3432
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8D69EDD7AFB495A3.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2793069232896244
Encrypted:	false
SSDEEP:	48:ZnuuyI+CFXJxT58qesS3VAErCy9X2USDTumlw:1uGZTm7s8ewCMzKw
MD5:	C160A991BCF961BA5C7CC8FE50CF0E68
SHA1:	C31ACCA64BFEA81D9A30CC86112DB654B8A31798
SHA-256:	DC19949B7CBA22434BA2FEECB856A4749EA9954769A3935CF64780BB7689C793
SHA-512:	E6C139F5A648216DA9AABDFADB312D59CCF353CEDB9C23C97D342FF4BDDBE5BE9D7C6AA8D3701E2FAED483D2922871F29A9DC0D9ACE91D5DA8C3C4A0D6862BB0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAF768441A53F39EB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBEDCD97CB942FCBA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2793069232896244
Encrypted:	false
SSDEEP:	48:ZnuuyI+CFXJxT58qesS3VAErCy9X2USDTumlw:1uGZTm7s8ewCMzKw
MD5:	C160A991BCF961BA5C7CC8FE50CF0E68
SHA1:	C31ACCA64BFEA81D9A30CC86112DB654B8A31798
SHA-256:	DC19949B7CBA22434BA2FEECB856A4749EA9954769A3935CF64780BB7689C793
SHA-512:	E6C139F5A648216DA9AABDFADB312D59CCF353CEDB9C23C97D342FF4BDDBE5BE9D7C6AA8D3701E2FAED483D2922871F29A9DC0D9ACE91D5DA8C3C4A0D6862BB0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCFC3B07582075ADD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.1506830965262357
Encrypted:	false
SSDEEP:	24:lmlwtHTx0O77FipV0O77b0O77FipV0O77DVAEV0yjCyeYVQwGaVKO2jw/+bu:lmlwlTdSbS3VAErCy9X2Wc
MD5:	58FD8C04D29E4CC0544897F45C224930
SHA1:	34731089E4D9664BE337FA90611971C93D99C47B
SHA-256:	7BE4A60D797342C5048F6BA7DCE4B72A902251468C0658820548A744EEECD931
SHA-512:	5F553FCB9F6AB7F2A7604AD23EE03445944FC50668B724F4D5BF1D91018885629C9AE17B88ACFCA41B91A78C1DD943ACF12CC3A863642EB7A17BBC9A64EA83DE
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDCFA2DE824D005F0.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEC25778180141A29.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2793069232896244
Encrypted:	false
SSDEEP:	48:ZnuuyI+CFXJxT58qesS3VAErCy9X2USDTumlw:1uGZTm7s8ewCMzKw
MD5:	C160A991BCF961BA5C7CC8FE50CF0E68
SHA1:	C31ACCA64BFEA81D9A30CC86112DB654B8A31798
SHA-256:	DC19949B7CBA22434BA2FEECB856A4749EA9954769A3935CF64780BB7689C793
SHA-512:	E6C139F5A648216DA9AABDFADB312D59CCF353CEDB9C23C97D342FF4BDDBE5BE9D7C6AA8D3701E2FAED483D2922871F29A9DC0D9ACE91D5DA8C3C4A0D6862BB0
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {EB657984-42A2-4FBD-AF6E-C6A8C5A895A3}, Number of Words: 10, Subject: ChromiumDriver, Author: ChromiumDriver, Name of Creating Application: ChromiumDriver (Evaluation Installer), Template: ;1033, Comments: Selenium Remote WebDriver implementation for test automation of Windows application based on WinFroms and WPF platforms. (Evaluation Installer), Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Wed Oct 16 20:55:48 2024, Last Saved Time/Date: Wed Oct 16 20:55:48 2024, Last Printed: Wed Oct 16 20:55:48 2024, Number of Pages: 450
Entropy (8bit):	7.000748363194672
TrID:	Windows SDK Setup Transform Script (63028/2) 47.91% Microsoft Windows Installer (60509/1) 46.00% Generic OLE2 / Multistream Compound File (8008/1) 6.09%
File name:	j45EY4ovxx.msi
File size:	2'438'144 bytes
MD5:	38ec29dc1f2a166922af153924482783
SHA1:	1af683febce11f3c95970ba8d876a341da7f5d13
SHA256:	5163541fd0f7a9dedfc220b437037d626e9ec32c50440ce3d81314d955cb223c
SHA512:	3a6c74b3ddcd912581de4e42b082f132f4fb88ec4d196318391da8ba2df00a7b7aa3835ed9ca6c8716ba26c9c559db5c75ef0ba78d9d00e3c1c5d58d627821e5
SSDEEP:	49152:k/p3z0A+biU50unDN5GQizNkyRmopy4duG/8Wea/xwuUkd4:cK3INkomkym
TLSH:	98B5BE217387C43AE5AD01B3A929EE6E553DAE770B3005D7B3E4399E1D708C1667AB03
File Content Preview:	........................>...................&...................................F.......w.......Q...R...S...T...U...V...W.......T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c..................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 14, 2024 19:43:02.505616903 CET	49374	53	192.168.2.5	1.1.1.1
Nov 14, 2024 19:43:02.531429052 CET	53	49374	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 14, 2024 19:43:02.505616903 CET	192.168.2.5	1.1.1.1	0x99e6	Standard query (0)	ebaltrahal.com	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:42:56
Start date:	14/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\j45EY4ovxx.msi"
Imagebase:	0x7ff638cf0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:42:56
Start date:	14/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff638cf0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	13:42:56
Start date:	14/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding A38CFB463D4DBDBACFCC2901433DC5C1 C
Imagebase:	0xe70000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:43:01
Start date:	14/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding A6367389E3E9A6AE9E1BBAB1265F4E9F
Imagebase:	0xe70000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:43:01
Start date:	14/11/2024
Path:	C:\Windows\Installer\MSICE10.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Installer\MSICE10.tmp" /DontWait "C:\Users\user\AppData\Roaming\op\\GUP.EXE"
Imagebase:	0x610000
File size:	420'864 bytes
MD5 hash:	3CAC7B7B5A847280D8803A5EB4E2B936
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:43:01
Start date:	14/11/2024
Path:	C:\Users\user\AppData\Roaming\op\GUP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\op\GUP.exe"
Imagebase:	0x730000
File size:	632'664 bytes
MD5 hash:	7BE4B26502BB2A8ED4982805B590DEC5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Matanbuchus_58a61aaa, Description: unknown, Source: 00000006.00000002.2292258011.000000006BEB1000.00000020.00000001.01000000.00000006.sdmp, Author: unknown
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:43:02
Start date:	14/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 1260
Imagebase:	0xa50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	27.5%
Total number of Nodes:	324
Total number of Limit Nodes:	7

Executed Functions

Function 00616FE0 Relevance: 46.1, APIs: 25, Strings: 1, Instructions: 559
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00616050: GetCurrentProcess.KERNEL32(00000008,?,C1C81EE7), ref: 00616060
Part of subcall function 00616050: OpenProcessToken.ADVAPI32(00000000), ref: 00616067

CoInitialize.OLE32(00000000), ref: 00617052
CoCreateInstance.OLE32(0065FD30,00000000,00000004,0066A530,00000000,?), ref: 00617082
CoUninitialize.COMBASE ref: 00617689
_com_issue_error.COMSUPP ref: 006176B7

Part of subcall function 006118E0: LocalFree.KERNEL32(?,C1C81EE7,?,00000000,0065B020,000000FF,?,?,00670558,?,?,006116A4,80004005), ref: 0061192C

Strings

$, xrefs: 00617593

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Process$CreateCurrentFreeInitializeInstanceLocalOpenTokenUninitialize_com_issue_error
String ID: $
API String ID: 2507920217-3993045852
Opcode ID: 2703456e967bbf36b6d694c5c65cc59da6ee15588dfb85873980df3bf337093a
Instruction ID: 15952a0415d01c9d62099def6af36cf11c79bf9e41aefbf25852ce6245fdb6f8
Opcode Fuzzy Hash: 2703456e967bbf36b6d694c5c65cc59da6ee15588dfb85873980df3bf337093a
Instruction Fuzzy Hash: 5032AE70A08358DFDB15CFA8C808BEDBBB6AF49304F184199E805EB391DB759E85CB51

Function 0064D0AE Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 62
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,0064D268,?,0063E0E9,?,?,?,?,?,?,0061163C,?,?,00000020), ref: 0064D0B1
SetLastError.KERNEL32(00000000,000000FF,?,0063E0E9,?,?,?,?,?,?,0061163C,?,?,00000020), ref: 0064D0CB
SetLastError.KERNEL32(00000000,00000000,00000000,?,000000FF,?,0063E0E9,?,?,?,?,?,?,0061163C,?,?), ref: 0064D101

Strings

h!g, xrefs: 0064D132

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ErrorLast
String ID: h!g
API String ID: 1452528299-3872170642
Opcode ID: 59126430c4091def6273d89e78cc4f9d4ea549cd30e351fae7f016729d6cedd3
Instruction ID: d0c2890c1680838c337e07f7dc554d1f19c6a062812754dab7a0ff8cc6c6e934
Opcode Fuzzy Hash: 59126430c4091def6273d89e78cc4f9d4ea549cd30e351fae7f016729d6cedd3
Instruction Fuzzy Hash: 3601F132A052006EE39137B0BC8AD6F2B9BFF417B5B500139FA08912A2FE914C424259

Function 0064F02D Relevance: 6.1, APIs: 4, Instructions: 83
memorylibraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00676000,00000080,00000004,00000000,?,?,0064F188,0000001A,AppPolicyGetProcessTerminationMethod,00664848,AppPolicyGetProcessTerminationMethod,?,?,0065167E,00000000), ref: 0064F096
VirtualProtect.KERNELBASE(00676000,00000080,00000002,00000000,?,?,0064F188,0000001A,AppPolicyGetProcessTerminationMethod,00664848,AppPolicyGetProcessTerminationMethod,?,?,0065167E,00000000), ref: 0064F0BE
FreeLibrary.KERNEL32(00000000,?,?,?,?,0064F188,0000001A,AppPolicyGetProcessTerminationMethod,00664848,AppPolicyGetProcessTerminationMethod,?,?,0065167E,00000000), ref: 0064F0E0
GetProcAddress.KERNEL32(00000000,?), ref: 0064F0EA

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ProtectVirtual$AddressFreeLibraryProc
String ID:
API String ID: 3998452802-0
Opcode ID: 57c284efb52ec3d3cde639b8d433a8b38e14a2406860861e9f1a72b5685f3073
Instruction ID: 2a8dced443562cc3797afcb67d110e054e5669e507da10c45f2344778ec96ab8
Opcode Fuzzy Hash: 57c284efb52ec3d3cde639b8d433a8b38e14a2406860861e9f1a72b5685f3073
Instruction Fuzzy Hash: 3B21D732600225ABDB319F69DC55E9B379AEF81B70F24423AF911D7291DE61DC0186A1

Function 00616050 Relevance: 6.0, APIs: 4, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,?,C1C81EE7), ref: 00616060
OpenProcessToken.ADVAPI32(00000000), ref: 00616067
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?), ref: 0061609C
CloseHandle.KERNEL32(?), ref: 006160B2

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 72e193686657d15f72cb86c1f2ef2260ba66ae1b456925ad224b59180e2fc088
Instruction ID: 02b9af8c3bfd168fc3c9436bb80a974fceee98a81d6c8c646901d7bf8705f4e9
Opcode Fuzzy Hash: 72e193686657d15f72cb86c1f2ef2260ba66ae1b456925ad224b59180e2fc088
Instruction Fuzzy Hash: 4AF06274144301ABEB10DF20EC49BAA77E9BB44705F488829F984C22A0D378855CEA63

Function 00621EE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32(C1C81EE7,?,0000FFFF), ref: 00621F0D

Part of subcall function 00614F50: LocalAlloc.KERNEL32(00000040,?,?,?,?,?,00000000,00000000,?,?), ref: 00614F6C

ExitProcess.KERNEL32 ref: 006220E7

Part of subcall function 006189D0: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00618A4D

Strings

Full command line:, xrefs: 00621F3E

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: AllocCommandCreateExitFileLineLocalProcess
String ID: Full command line:
API String ID: 1878577176-831861440
Opcode ID: 1d5165c116f5f2b9cf57db2edec151c3b8b954f30404e904b785f444d6d452b3
Instruction ID: 1f7e8319efc5b5746d690953db36c4211c63792dad5ea18b8077f8b5ecf82a9a
Opcode Fuzzy Hash: 1d5165c116f5f2b9cf57db2edec151c3b8b954f30404e904b785f444d6d452b3
Instruction Fuzzy Hash: 125171318141689ECB65EB60DC69BEEB776AF11300F1881DCE00967292EF741F89CBA5

Function 00618210 Relevance: 4.6, APIs: 3, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,006181E8,C1C81EE7), ref: 00618284
GetLastError.KERNEL32(?,TokenIntegrityLevel,00000000,00000000,006181E8,C1C81EE7), ref: 0061828E
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),?,00000000,00000000,?,TokenIntegrityLevel,00000000,00000000,006181E8,C1C81EE7), ref: 006182EA

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: InformationToken$ErrorLast
String ID:
API String ID: 2567405617-0
Opcode ID: 690c86c7df0d2eb385de810e33efe1ca838b429801cd8c83e6f847dc124e1504
Instruction ID: c666cd23638b61d4bdffec3d91f80d770953289011061e6fa82b9431dbc5f12f
Opcode Fuzzy Hash: 690c86c7df0d2eb385de810e33efe1ca838b429801cd8c83e6f847dc124e1504
Instruction Fuzzy Hash: 15316B71A00605AFDB24CF98CC45BAFBBFAFF44714F14452EE415A7280DBB5AA448BE0

Function 0064ED50 Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0064D0E3,00000001,00000364,00000000,?,000000FF,?,0063E0E9,?,?,?), ref: 0064ED94

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 169024a257cb808732df986dde7dfc796a802c4fedb95a9135010a2289b8224a
Instruction ID: fd13a366b77e16da93ed495607a881f5f8ab3efdf16d0296a502e2e8dd329255
Opcode Fuzzy Hash: 169024a257cb808732df986dde7dfc796a802c4fedb95a9135010a2289b8224a
Instruction Fuzzy Hash: F8F0E932E41636AADBA06B75DC05A9B378BFF413B0F154525FC05E7280DF32D90145E4

Function 0064F530 Relevance: 1.5, APIs: 1, Instructions: 14
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(00676000,00000080,00000002,?), ref: 0064F546

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d77dd71bcbb76e80bebb7fc5644fbae09c9d742a74c0781063af1eb1771fad3d
Instruction ID: 2644fd6ace4ee26b7b17fe270c4c99077b023e53da29b182314bdd1990d66a7e
Opcode Fuzzy Hash: d77dd71bcbb76e80bebb7fc5644fbae09c9d742a74c0781063af1eb1771fad3d
Instruction Fuzzy Hash: CDC08C31340308BBE7209BA2CC0BF4B369EA780F51F058124B646E60C0D9A0ED084260

Non-executed Functions

Function 00617800 Relevance: 42.4, APIs: 16, Strings: 8, Instructions: 417libraryloadersleepCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(00000010,00000104,?,?,?), ref: 006179D8
GetForegroundWindow.USER32(?,?,?), ref: 00617A5D
ShellExecuteExW.SHELL32(?), ref: 00617A7A
ShellExecuteExW.SHELL32(?), ref: 00617AB8
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?,?), ref: 00617B01
GetProcAddress.KERNEL32(00000000), ref: 00617B08
AllowSetForegroundWindow.USER32(00000000), ref: 00617B1E
GetModuleHandleW.KERNEL32(Kernel32.dll,GetProcessId,?,?,?,?), ref: 00617B42
GetProcAddress.KERNEL32(00000000), ref: 00617B49
Sleep.KERNEL32(00000064,?,?,?,?), ref: 00617B6E
EnumWindows.USER32(00617CA0,?), ref: 00617B8A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00004003,?,?,?,?), ref: 00617BA8
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?), ref: 00617BC5
GetExitCodeProcess.KERNEL32(?,?), ref: 00617BD2
GetWindowThreadProcessId.USER32(?,?), ref: 00617CAC
GetWindowLongW.USER32(?,000000F0), ref: 00617CC4

Strings

%s\System32\cmd.exe, xrefs: 006179E5
runas, xrefs: 00617A2D
Kernel32.dll, xrefs: 00617AFC, 00617B3D
.cmd, xrefs: 00617996
open, xrefs: 00617A11
/C ""%s" %s", xrefs: 006179FD
.bat, xrefs: 00617960
GetProcessId, xrefs: 00617AF7, 00617B38

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Window$AddressExecuteForegroundHandleModuleProcProcessShellWindows$AllowCodeDirectoryEnumExitLongObjectSingleSleepThreadWait
String ID: %s\System32\cmd.exe$.bat$.cmd$/C ""%s" %s"$GetProcessId$Kernel32.dll$open$runas
API String ID: 3646750338-986041216
Opcode ID: 30aa488a2702fbc884491d784ec2aee11eb896f934cdb739818b5d17b2247a4c
Instruction ID: 8133340f9d8aa95abc14836261809cfaeb6f35e459386906efc1a320514d6a8f
Opcode Fuzzy Hash: 30aa488a2702fbc884491d784ec2aee11eb896f934cdb739818b5d17b2247a4c
Instruction Fuzzy Hash: 7FF18D71A043099FDB10DFA8C888AEEBBB6FF18311F184569E515EB391DB319E45CB60

Function 0061D400 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 483COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0061D5C2
LocalFree.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,?), ref: 0061D61D
_swprintf.LIBCMT ref: 0061D822
LocalFree.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,?), ref: 0061D87D
_swprintf.LIBCMT ref: 0061D958

Strings

+, xrefs: 0061D8F0
%, xrefs: 0061D8E1

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: _swprintf$FreeLocal
String ID: %$+
API String ID: 2429749586-2626897407
Opcode ID: 6dda37a40db29f8c96706d248f798a7e919b43ce984424b61ad7e22a73f123d6
Instruction ID: e9bbaeaa3210245753d859b469faa243f0efb1e63ed9f7821766ffc143d6edac
Opcode Fuzzy Hash: 6dda37a40db29f8c96706d248f798a7e919b43ce984424b61ad7e22a73f123d6
Instruction Fuzzy Hash: 5502DF71D002199FDB19DFA8DC44BEEBBB6FF49304F184229F815AB281D7349985CB91

Function 006162B0 Relevance: 10.7, APIs: 7, Instructions: 232processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,C1C81EE7), ref: 00616322
CloseHandle.KERNEL32(00000000), ref: 00616363
Process32FirstW.KERNEL32(?,0000022C), ref: 006163A5
OpenProcess.KERNEL32(00000410,00000000,?), ref: 006163C0
CloseHandle.KERNEL32(?), ref: 00616517
Process32NextW.KERNEL32(?,0000022C), ref: 00616534
CloseHandle.KERNEL32(?), ref: 00616565

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: CloseHandle$Process32$CreateFirstNextOpenProcessSnapshotToolhelp32
String ID:
API String ID: 708755948-0
Opcode ID: f1bfc1953d82db9753b528049a2957f31f2c69bcebfc2500baa3d8bfb6e2cd0d
Instruction ID: 6505a17868407b3c71130a4719ee1d0d811fe63cc27204ca01e9ad9912bade2b
Opcode Fuzzy Hash: f1bfc1953d82db9753b528049a2957f31f2c69bcebfc2500baa3d8bfb6e2cd0d
Instruction Fuzzy Hash: B6A14A74905259DFDB20DF68CD48BDEBBBAEF04314F1482D9E409A7290DB759A84CF50

Function 006550B7 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 006551BF
IsValidCodePage.KERNEL32(00000000), ref: 006551FD
IsValidLocale.KERNEL32(?,00000001), ref: 00655210
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00655258
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00655273

Strings

lVf, xrefs: 0065511C

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Locale$InfoValid$CodeDefaultPageUser
String ID: lVf
API String ID: 3475089800-4139570665
Opcode ID: 71a93bbe945ec173b9eb5c9ce7147b058069b0f99a546b9e4562436fe316a218
Instruction ID: 5f0cdbd774f2e2bd0344da59346ce7d94f6869f7b536a063ec0e6d13d0afb425
Opcode Fuzzy Hash: 71a93bbe945ec173b9eb5c9ce7147b058069b0f99a546b9e4562436fe316a218
Instruction Fuzzy Hash: AB518471A00A05ABDB60DFA4CC59BFF77BABF04702F144469ED02E7251EB709A488B60

Function 00655A59 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1424COMMONLIBRARYCODE

Download Yara Rule

APIs

__libm_sse2_log10_precise.LIBCMT ref: 00655C85

Strings

1#SNAN, xrefs: 00655B65
1#IND, xrefs: 00655B5E
1#INF, xrefs: 00655B8F
1#QNAN, xrefs: 00655B6C

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: __libm_sse2_log10_precise
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 3323863637-2761157908
Opcode ID: ca7dae276ec93b3023ae85b73a8f3a9bac62a6cbcc0aed94a48905391dccad71
Instruction ID: 5a5431eccf05205e695f57e59bdb4afba3ccc3a79f29a4ffd4d84d006f9ca813
Opcode Fuzzy Hash: ca7dae276ec93b3023ae85b73a8f3a9bac62a6cbcc0aed94a48905391dccad71
Instruction Fuzzy Hash: 54C27E71E086288FDB65CE28CD447EAB7B6EB44305F5441EAE84DE7240EB74AE85CF41

Function 00654714 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 271COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,?,?,?,?,?,0064BB76,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 006547DD
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0064BB76,?,?,?,00000055,?,-00000050,?,?), ref: 00654814
GetLocaleInfoW.KERNEL32(00000000,00001002,?,00000078,-00000050,00000000,000000D0), ref: 00654980

Strings

lVf, xrefs: 00654756
utf8, xrefs: 006548E6

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: CodeInfoLocalePageValid
String ID: lVf$utf8
API String ID: 790303815-1546860302
Opcode ID: c000864164d9e408fe7007e6c5b7c89acb070917a5eaf08b4f0682a0d0b6b2d8
Instruction ID: 3299a9347634a6a66083c54793a92f1e16ee0282cbfe756c14330ca0c3ca1022
Opcode Fuzzy Hash: c000864164d9e408fe7007e6c5b7c89acb070917a5eaf08b4f0682a0d0b6b2d8
Instruction Fuzzy Hash: BF71DB71600205AAD724AF74CC42BAB73AAEF4970AF1500A9FD05D7285FF70DD89C695

Function 00654ED5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,006551ED,00000002,00000000,?,?,?,006551ED,?,00000000), ref: 00654F6E
GetLocaleInfoW.KERNEL32(?,20001004,006551ED,00000002,00000000,?,?,?,006551ED,?,00000000), ref: 00654F97
GetACP.KERNEL32(?,?,006551ED,?,00000000), ref: 00654FAC

Strings

OCP, xrefs: 00654F29
ACP, xrefs: 00654EF3

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 709788db1bc7daccef1b38dcc4785701d01fcb97e7fe52abfeff777121df8dbd
Instruction ID: 3ce6b5883a3471bebdfc62fef06374bc0a4ce6798e77af684de316b39c95bc5d
Opcode Fuzzy Hash: 709788db1bc7daccef1b38dcc4785701d01fcb97e7fe52abfeff777121df8dbd
Instruction Fuzzy Hash: 41216032604101AADB348F59D905BDBB3A7ABD4B5AF5680A4ED0ADB204EF32DDC9D350

Function 0063A1F1 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0063A1FD
IsDebuggerPresent.KERNEL32 ref: 0063A2C9
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0063A2E2
UnhandledExceptionFilter.KERNEL32(?), ref: 0063A2EC

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: ad9f98e0c7a27acbdcb0edf5e786683ddb77f0f347a0a69239f890aa19d54e3c
Instruction ID: bbc4ed400cd2794ad008f799edd4d816453ebfc8a8efd9468cbd8bf9b7b94a55
Opcode Fuzzy Hash: ad9f98e0c7a27acbdcb0edf5e786683ddb77f0f347a0a69239f890aa19d54e3c
Instruction Fuzzy Hash: C431F5B5D013189BDB21DFA4D9497CDBBB8BF08300F1041AAE44DAB250EB759B849F86

Function 006226C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00000000,00000002,?,?,006132C0,?), ref: 006226D5
FormatMessageA.KERNEL32(00001300,00000000,C1C81EE7,00000000,00000000,00000000,00000000,?,?,?,006132C0,?), ref: 006226FC

Strings

!x-sys-default-locale, xrefs: 006226D0

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: c148795ee9edb9422d2684b393d00039d5131d2cb789948be168427d2bc135d8
Instruction ID: 7f4b03605f51d4120225fd5366fac1bfff32da5040f04614cba99466a0bd09fc
Opcode Fuzzy Hash: c148795ee9edb9422d2684b393d00039d5131d2cb789948be168427d2bc135d8
Instruction Fuzzy Hash: 3CF06576110615FFFB149B94DC1ADEF77AEEB09391F004029F902D6150E6B0AE00DB70

Function 00645B10 Relevance: 5.0, APIs: 3, Instructions: 470COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f92108d1559b770655b7c5004e781b0bb4a3dd80ac85cb6c7a0d19db5291400
Instruction ID: c4e23ee6dce265bfc34aff67ec13de8c1edb07693743871d516e966efd1167de
Opcode Fuzzy Hash: 5f92108d1559b770655b7c5004e781b0bb4a3dd80ac85cb6c7a0d19db5291400
Instruction Fuzzy Hash: 73023C71E006199FDF14CFA8D8806EDFBB2FF48314F24826AE916AB345D730A945CB94

Function 00654B50 Relevance: 4.7, APIs: 3, Instructions: 210COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00001002,?,00000078), ref: 00654BA7
GetLocaleInfoW.KERNEL32(00000000,00001001,?,00000078), ref: 00654BEB
GetLocaleInfoW.KERNEL32(00000000,00001001,?,00000078), ref: 00654CB5

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 966a6b16292954cc707224f95c96228401302f0619d17d706e6f93d6a70f0d56
Instruction ID: a5e30570d0f9fb477add9f73da82eac5c07f794e94a113470235171d4cbcf6f1
Opcode Fuzzy Hash: 966a6b16292954cc707224f95c96228401302f0619d17d706e6f93d6a70f0d56
Instruction Fuzzy Hash: 7F6192715012179FEB289F24CD81BBA77AAEF4430AF1041B9ED05C6245EB34DDC5CB50

Function 0063E23B Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0063E333
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0063E33D
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0063E34A

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 5921b971bbcbd85ffe4c48baa737fb9bc5e5994952d0234fd7228089c5bee3db
Instruction ID: b964b8054b34b3e9c6077d0398d5d257434fc6ae086c4460f557e5e270681853
Opcode Fuzzy Hash: 5921b971bbcbd85ffe4c48baa737fb9bc5e5994952d0234fd7228089c5bee3db
Instruction Fuzzy Hash: DC31C2759013289BCB61DF68D9897CDBBB9BF08310F5041EAE41CA7290EB749B818F95

Function 006471A9 Relevance: 4.6, Strings: 3, Instructions: 822COMMONLIBRARYCODE

Download Yara Rule

Strings

2f, xrefs: 00647A0B
t>f, xrefs: 006472F5, 0064752C
(2f, xrefs: 0064767B

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID:
String ID: 2f$(2f$t>f
API String ID: 0-3916860665
Opcode ID: 7f407f28150757b46a032d350b69eff9a33c31d3f8fcaaf6c4e90c10d7abd96d
Instruction ID: 0c92125998c9dd322290a9f707689e0bbb9fc93eff1c8599329860c3cfa83d25
Opcode Fuzzy Hash: 7f407f28150757b46a032d350b69eff9a33c31d3f8fcaaf6c4e90c10d7abd96d
Instruction Fuzzy Hash: 6B428E7250824ABFDF169E54DC46EEB3F6BEF49344F144008FE04662A1C772C962EBA0

Function 00611D80 Relevance: 4.6, APIs: 3, Instructions: 65COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000000,C1C81EE7,00000001,00000000,?,00000000,0065B0C0,000000FF,?,00611D2C,?,?,?,00000000,?), ref: 00611DAB
LockResource.KERNEL32(00000000,?,00611D2C,?,?,?,00000000,?,-00000010,0065B0A0,000000FF,?,00612048,?,00000000,0065B0ED), ref: 00611DB6
SizeofResource.KERNEL32(00000000,00000000,?,00611D2C,?,?,?,00000000,?,-00000010,0065B0A0,000000FF,?,00612048,?,00000000), ref: 00611DC4

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 4ebb081748208bd7dfebccd97238e139434b2ffd4cd63fde1904c3fad56e3f2e
Instruction ID: 008602d218ffca042084c08d7f475c21417ac5987e1885ff042f3934db764631
Opcode Fuzzy Hash: 4ebb081748208bd7dfebccd97238e139434b2ffd4cd63fde1904c3fad56e3f2e
Instruction Fuzzy Hash: F711E732E00A149BC7349F69EC44BA7F7E9EB86726F05493AED5AD7340EA359C4086D0

Function 006125A0 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006395A8: AcquireSRWLockExclusive.KERNEL32(00673B74,?,?,?,00612646,00674714,C1C81EE7,?,?,0065B16D,000000FF,?,00611A07), ref: 006395B3
Part of subcall function 006395A8: ReleaseSRWLockExclusive.KERNEL32(00673B74,?,?,00612646,00674714,C1C81EE7,?,?,0065B16D,000000FF,?,00611A07,?,?,?,C1C81EE7), ref: 006395ED

GetProcessHeap.KERNEL32 ref: 006125F5

Part of subcall function 00639557: AcquireSRWLockExclusive.KERNEL32(00673B74,?,?,006126B7,00674714,0065EC90), ref: 00639561
Part of subcall function 00639557: ReleaseSRWLockExclusive.KERNEL32(00673B74,?,?,006126B7,00674714,0065EC90), ref: 00639594
Part of subcall function 00639557: WakeAllConditionVariable.KERNEL32(00673B70,?,?,006126B7,00674714,0065EC90), ref: 0063959F

Strings

4Gg, xrefs: 0061266A

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$ConditionHeapProcessVariableWake
String ID: 4Gg
API String ID: 1755742941-2966272359
Opcode ID: 38dbe57f1b22e2324da00e72d7d5fb8f52643f3062868f0ed11959ac2f980d21
Instruction ID: 436ed724f5e01fdadd4ffcee07c0acba25940efc1ef477e594c449a1dfa8d1fa
Opcode Fuzzy Hash: 38dbe57f1b22e2324da00e72d7d5fb8f52643f3062868f0ed11959ac2f980d21
Instruction Fuzzy Hash: 2F218BB0940240DFCB1CCF68EC5A7893BA3E746726F115628E429973D0DFB159848FA5

Function 006437DC Relevance: 2.9, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

5, xrefs: 0064381D
=d, xrefs: 006439E8

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID:
String ID: =d$5
API String ID: 0-1716947385
Opcode ID: 80d743ce86f3f7115c781691013d5d710c6c7ccd326cb6f5c66471442a49c31f
Instruction ID: d4070ba15bbb6b1854b9f63f950009dd88449f77643bf09dc78c3c192363d8d8
Opcode Fuzzy Hash: 80d743ce86f3f7115c781691013d5d710c6c7ccd326cb6f5c66471442a49c31f
Instruction Fuzzy Hash: C3C10631F442699FDF18DEA8C8916EEBBF39F98310F288169E851E7381E6348E45C750

Function 0064F7A4 Relevance: 1.9, APIs: 1, Instructions: 407timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0064FBE9,00000000,00000000,00000000), ref: 0064FAA9

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: InformationTimeZone
String ID:
API String ID: 565725191-0
Opcode ID: f82a8123eb9c637d46b8effcc5f016adc54c3f336f7d79b77499fb7f34f4731b
Instruction ID: ced35c353d0ca52a9066e7879eaca83d7ccd71ccc2c4b1676b5614af2d3ab681
Opcode Fuzzy Hash: f82a8123eb9c637d46b8effcc5f016adc54c3f336f7d79b77499fb7f34f4731b
Instruction Fuzzy Hash: DAC12672900215AFDB14BFA4DC02AAE7BBBEF45710F11407AF804EB291EB719E41CB95

Function 00650150 Relevance: 1.8, APIs: 1, Instructions: 263COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,00000008,?,?,?,0065013E,?,?,00000008,?,?,0065A7DE,00000000), ref: 00650398

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 9af56dbdda33a0e1114dc9f8fe694c68080e80260e269a0eaca2813c3e899ad4
Instruction ID: 81df4ef68a3df25b05468e039d751fcb96811dadcdc28de339b8856b1a16c174
Opcode Fuzzy Hash: 9af56dbdda33a0e1114dc9f8fe694c68080e80260e269a0eaca2813c3e899ad4
Instruction Fuzzy Hash: 58B16A315106099FE719CF28C49ABA57BE1FF45366F248658EC9A8F3A1C335EA85CB40

Function 00639CEC Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00639D02

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: dcff1c1572b18ee02857df06bac44bc3852e7356d485918d2a6d52635f429209
Instruction ID: 8a3ff10f160aceb5a3f04c5d258ac93f4886d6484ffe859b70452ead31c90afc
Opcode Fuzzy Hash: dcff1c1572b18ee02857df06bac44bc3852e7356d485918d2a6d52635f429209
Instruction Fuzzy Hash: 09A16DB1D106168FDB1CCF68D8926AEBBB2FB48324F14912AD45AE7350D3759990CFA0

Function 00641ACC Relevance: 1.7, Strings: 1, Instructions: 466COMMON

Download Yara Rule

Strings

0, xrefs: 00641C75

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b71fcf4a7ddb8ce049ec9badea82592a918ea365e81fd2ef24a598f2e6f8c6df
Instruction ID: 0f7ac48b6257079f96b330c858d908dd0bf2dff0e24a4f6141ae4a88cbd998e9
Opcode Fuzzy Hash: b71fcf4a7ddb8ce049ec9badea82592a918ea365e81fd2ef24a598f2e6f8c6df
Instruction Fuzzy Hash: 1702AD70A046068FCB64CF68C580AEAB7F2FF4A324F244659E4569F791E731ADC6CB14

Function 0064168D Relevance: 1.6, Strings: 1, Instructions: 399COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00641830

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: c6d2d50194c6a1d4677a1bcad9583a9c04a11625165e70af32857ecb80c36ee8
Instruction ID: b7dbd15aad76e2761a0dd610d9656c434ef8921dcae32bfd2d29cc955fecdf67
Opcode Fuzzy Hash: c6d2d50194c6a1d4677a1bcad9583a9c04a11625165e70af32857ecb80c36ee8
Instruction Fuzzy Hash: 4DE1BC74A0060A8FCB28CF68C594AEABBB7FF4A310F14461DE4569B791D734A9C6CB50

Function 00651860 Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1710eb820734e5a842f8af9f96482a10cd11ad206d392cdd1e3bc52e1493d1df
Instruction ID: f834a857a6cc72f4ec08f14366dbfb017e8c3568d3ccee9bebe365af60e33d83
Opcode Fuzzy Hash: 1710eb820734e5a842f8af9f96482a10cd11ad206d392cdd1e3bc52e1493d1df
Instruction Fuzzy Hash: 7E310472900219AFCB24DFA8CC98EEBB77EEB81355F144658FC059B244EA319D448A50

Function 00654DB0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00001001,?,00000078), ref: 00654E00

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8006cae4f33f32a58a5b6bd02da55d3765a2d65df6716e53d384bcb187a9bdba
Instruction ID: 84def425722c15e38a143ca96dc742a57b0b1e5e5adb336834e642ff3774dfd4
Opcode Fuzzy Hash: 8006cae4f33f32a58a5b6bd02da55d3765a2d65df6716e53d384bcb187a9bdba
Instruction Fuzzy Hash: CD218331610206ABEF289B24ED42BBB73AEFF4531AF1000B9FD01D7141EB74AD84C654

Function 00654A1E Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00654B50,00000001,00000000,?,-00000050,?,00655193,00000000,?,?,?,00000055,?), ref: 00654A90

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 4fcde6f6e93194e9b5811ead556d4ac06c5eaff95a134bda55c5e17f941da69c
Instruction ID: d7c6ee74f8678356c96fdea788017f609e4a5a380b3eda34e333351ab424f19e
Opcode Fuzzy Hash: 4fcde6f6e93194e9b5811ead556d4ac06c5eaff95a134bda55c5e17f941da69c
Instruction Fuzzy Hash: 4C11253A6007059FDB18AF38C8916BAB793FF8035EF15442DED8687B40E771A886C740

Function 00654FDB Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00654D6D,00000000,00000000,?), ref: 00655007

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 5d4226545b3ecc362fc199778d26bc91d0a34da42fdb9c8a74daecf4fb19b1ca
Instruction ID: 0a5c819af4c3e7927fbfca8140cbb0b2d766ed931732dc7f7458f13187dd988c
Opcode Fuzzy Hash: 5d4226545b3ecc362fc199778d26bc91d0a34da42fdb9c8a74daecf4fb19b1ca
Instruction Fuzzy Hash: DB01D632B00612EBDB285A64CC19AFA376AEB40366F154428AC43A32C0EE74ED45C6D0

Function 00654AB9 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00654DB0,00000001,?,?,-00000050,?,0065515B,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00654B03

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 656b7db32960d213e38c22d1854fe3af7229308efbddbc3e975b8a09ea01afb7
Instruction ID: 57d5271a62ed19203b1764b834f18003cc2e6241fd34c6ce91870c9e7751d1ae
Opcode Fuzzy Hash: 656b7db32960d213e38c22d1854fe3af7229308efbddbc3e975b8a09ea01afb7
Instruction Fuzzy Hash: 10F0C2367003045FDB24AF35D881AAA7B96EF8036DF05456DFD058B680DAB1AC858B94

Function 00638F9C Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,00000022,00000000,00000002,?,?,00636A10,00000000,0066A8D9,00000004,00635628,0066A8D9,00000004,00635A57,00000000,00000000), ref: 00638FB9

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 792fef980952edf9980c6fa3e52f674fd7a0f846935f68416e1841842e1b704c
Instruction ID: 00a3f66e056fe97ae845ebea29427238f138d3009fb466d6906d41cabadce33a
Opcode Fuzzy Hash: 792fef980952edf9980c6fa3e52f674fd7a0f846935f68416e1841842e1b704c
Instruction Fuzzy Hash: 04E06532660300AAD7259B79991EFE7769BDB01786F104559B602E62C5DEA0DE049290

Function 006549D3 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(00654930,00000001,?,?,?,006551B5,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00654A0A

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 575b01a980049214f69ae65bcf2da20d97aef42433133bc4ed6269fd36efbeea
Instruction ID: 227d68199acf05a4cb9ba0dc7c4b99e7facf8960091c9cc26c69d72bf9c8f1a7
Opcode Fuzzy Hash: 575b01a980049214f69ae65bcf2da20d97aef42433133bc4ed6269fd36efbeea
Instruction Fuzzy Hash: EBF0E53A30020597CB14AF35D8566ABBF96EFC2716F464099EE09CB251CA719887C790

Function 0064EDE2 Relevance: 1.5, APIs: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 006494A1: EnterCriticalSection.KERNEL32(?,?,00652907,00000000,006703B8,0000000C,0065289B,?,?,0064ED86,?,?,0064D0E3,00000001,00000364,00000000), ref: 006494B0

EnumSystemLocalesW.KERNEL32(0064EDC0,00000001,006702B8,0000000C,0064F277,00000000), ref: 0064EE14

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: c83e2ac8003561c8de391333d14a11cb5d2d1db69b014178345a47acdfce9354
Instruction ID: 11324c8a38b12feb0729df090baf960bcada6f5037abe01f6e46a7af3ad41e18
Opcode Fuzzy Hash: c83e2ac8003561c8de391333d14a11cb5d2d1db69b014178345a47acdfce9354
Instruction Fuzzy Hash: EBF09036A40710DFE700DF98D446B9D77F1FB49725F00811AE5119B2D0C7BA4900DF50

Function 0064F310 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0064C6FA,?,20001004,00000000,00000002,?,?,0064BCF8), ref: 0064F344

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: fd2a8389be5de6d3ac64f927c84fb4ae61a299767eeea10bdaf43cfede390c12
Instruction ID: f7a15ff571a731d2c7045ae596bf23347e0a3b5dec8f5faabb1e8a0ac462786c
Opcode Fuzzy Hash: fd2a8389be5de6d3ac64f927c84fb4ae61a299767eeea10bdaf43cfede390c12
Instruction Fuzzy Hash: B9E04F36500618BBCF12AF60DC04ADE3E17FF44762F004424FC0566221CB329921AAD9

Function 0063A385 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0002A3A0,00639B25), ref: 0063A38A

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 20d94972687486a6b0f741d369890e4823061d9186be25efeac16ee5184d4415
Instruction ID: 81fc336b70e17a5fb9a3f93926eabfaf229c60619d2f543a0c41ff0972b4222b
Opcode Fuzzy Hash: 20d94972687486a6b0f741d369890e4823061d9186be25efeac16ee5184d4415
Instruction Fuzzy Hash:

Function 00648393 Relevance: .7, Instructions: 686COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 11fe4f66e403a4e7242daaaaa58a954bb6b35cb6a954825ec3dcf2436c072e97
Instruction ID: fd4b6eb55cdbf15fb574f94182bd569c3d581ec02a902742c0eea24d8b45ce06
Opcode Fuzzy Hash: 11fe4f66e403a4e7242daaaaa58a954bb6b35cb6a954825ec3dcf2436c072e97
Instruction Fuzzy Hash: 47424A74D0020ADFCB18CFA8C991AFEBBB6FF55304F24416DD945A7345EA31AA46CB90

Function 0064FDF0 Relevance: .2, Instructions: 230COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80d99ff76c9ba567092604a14583e63ea3cc4366a26a2baa83158d72e87e23d3
Instruction ID: aad240d558d4ddc1a6dd6e1c4a8db208ced41fa0e7bf14fe09221549ef0bf7d5
Opcode Fuzzy Hash: 80d99ff76c9ba567092604a14583e63ea3cc4366a26a2baa83158d72e87e23d3
Instruction Fuzzy Hash: 9C919D32C00A089BEB12CF68C8513EEB773AF46321F299395DC557B2D1EB759989C750

Function 00643B75 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce90631ccd48a786f0dbaec49c2f70008bc2b08315126eb600449cdff332ad58
Instruction ID: 92d1282fdcc9a7f0afe6b47323c6c3292d63ecda8cfe9eda3d1f2e7f97fe3714
Opcode Fuzzy Hash: ce90631ccd48a786f0dbaec49c2f70008bc2b08315126eb600449cdff332ad58
Instruction Fuzzy Hash: AF518271E00119EFDF05CFA9C991AEEBBB2EF88300F1481A9E815AB341C7349E45DB90

Function 0063B570 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 7f66a36ebbfce4c7563b192b2e6fb19ff84ce59f0eb01cd1bf9f1129a1a05376
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 54112B7764004143D604CE3ED8B45FBA397EFC6331F2D637AD2428B758D322D9459680

Function 006189D0 Relevance: 30.1, APIs: 13, Strings: 4, Instructions: 347filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00618A4D
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00618AA0
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,00000000,0065BFF5,000000FF), ref: 00618AAF
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00618ACB
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,0065BFF5,000000FF), ref: 00618BAB
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000000,0065BFF5,000000FF), ref: 00618BB7
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,00000000,0065BFF5,000000FF), ref: 00618BF3
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,00000000,0065BFF5,000000FF), ref: 00618C11
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,00000000,0065BFF5,000000FF), ref: 00618C2E
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,0065BFF5,000000FF), ref: 00618CC3
ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000005), ref: 00618D08
ShellExecuteW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000005), ref: 00618D5A
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00000000,0065BFF5,000000FF), ref: 00618D8D

Strings

[InternetShortcut]URL=, xrefs: 00618ADF
-_.~!*'();:@&=+$,/?#[], xrefs: 00618B27, 00618B3E
open, xrefs: 00618D01, 00618D21
URL Shortcut content:, xrefs: 00618C49

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ByteCharLocalMultiWide$AllocExecuteFileFreeShell$CloseCreateHandleWrite
String ID: -_.~!*'();:@&=+$,/?#[]$URL Shortcut content:$[InternetShortcut]URL=$open
API String ID: 2199533872-3004881174
Opcode ID: f141b27bedd757ff21b0ac4857b2fa2d513d4cb18ef7719512cc758096090abd
Instruction ID: 3a274b90aedc45ef9e0bbb5ec70f6a046867c1f57ce618189cea57b3b87dd9b3
Opcode Fuzzy Hash: f141b27bedd757ff21b0ac4857b2fa2d513d4cb18ef7719512cc758096090abd
Instruction Fuzzy Hash: 8DC103B19002459FEB20DF68CC45BEEBBB6EF95700F184129E905AB3D1EB744A85C7A1

Function 0062EB07 Relevance: 21.4, APIs: 3, Strings: 9, Instructions: 438COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062EB0E
numpunct.LIBCPMT ref: 0062EEF3

Part of subcall function 0062B266: __EH_prolog3.LIBCMT ref: 0062B26D

Part of subcall function 0062B06C: __EH_prolog3.LIBCMT ref: 0062B073
Part of subcall function 0062B06C: std::_Lockit::_Lockit.LIBCPMT ref: 0062B07D
Part of subcall function 0062B06C: std::_Lockit::~_Lockit.LIBCPMT ref: 0062B0EE

Part of subcall function 0061EA80: std::_Lockit::_Lockit.LIBCPMT ref: 0061EAAD
Part of subcall function 0061EA80: std::_Lockit::_Lockit.LIBCPMT ref: 0061EAD0
Part of subcall function 0061EA80: std::_Lockit::~_Lockit.LIBCPMT ref: 0061EAF8
Part of subcall function 0061EA80: std::_Lockit::~_Lockit.LIBCPMT ref: 0061EBA1

Part of subcall function 006249F5: Concurrency::cancel_current_task.LIBCPMT ref: 00624AB8

Part of subcall function 0062A55D: __EH_prolog3.LIBCMT ref: 0062A564
Part of subcall function 0062A55D: std::_Lockit::_Lockit.LIBCPMT ref: 0062A56E
Part of subcall function 0062A55D: std::_Lockit::~_Lockit.LIBCPMT ref: 0062A5DF

__Getcoll.LIBCPMT ref: 0062ECC3

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

Part of subcall function 00618700: LocalAlloc.KERNEL32(00000040,00000000,0063A1C5,00000000,C1C81EE7,?,00000000,?,FFFFFFFF,?,0065EB28,000000FF,?,006117A4,?,0065FDDA), ref: 00618706

Part of subcall function 0061BCF0: __Getctype.LIBCPMT ref: 0061BCFB

Part of subcall function 0062A970: __EH_prolog3.LIBCMT ref: 0062A977
Part of subcall function 0062A970: std::_Lockit::_Lockit.LIBCPMT ref: 0062A981

Part of subcall function 0062AA9A: __EH_prolog3.LIBCMT ref: 0062AAA1
Part of subcall function 0062AA9A: std::_Lockit::_Lockit.LIBCPMT ref: 0062AAAB

Part of subcall function 0062ACEE: __EH_prolog3.LIBCMT ref: 0062ACF5
Part of subcall function 0062ACEE: std::_Lockit::_Lockit.LIBCPMT ref: 0062ACFF
Part of subcall function 0062ACEE: std::_Lockit::~_Lockit.LIBCPMT ref: 0062AD70

Part of subcall function 0062AC59: __EH_prolog3.LIBCMT ref: 0062AC60
Part of subcall function 0062AC59: std::_Lockit::_Lockit.LIBCPMT ref: 0062AC6A
Part of subcall function 0062AC59: std::_Lockit::~_Lockit.LIBCPMT ref: 0062ACDB

Part of subcall function 006249F5: __EH_prolog3.LIBCMT ref: 006249FC
Part of subcall function 006249F5: std::_Lockit::_Lockit.LIBCPMT ref: 00624A06
Part of subcall function 006249F5: std::_Lockit::~_Lockit.LIBCPMT ref: 00624AAD

Strings

@:g, xrefs: 0062EB8C
T:g, xrefs: 0062EDDA
D:g, xrefs: 0062EC98
\:g, xrefs: 0062EEC7
P:g, xrefs: 0062ED97
X:g, xrefs: 0062EE46
L:g, xrefs: 0062ED52
H:g, xrefs: 0062ECFC
9g, xrefs: 0062EB26

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_$H_prolog3$Lockit::~_$AllocConcurrency::cancel_current_taskGetcollGetctypeLocalnumpunct
String ID: 9g$@:g$D:g$H:g$L:g$P:g$T:g$X:g$\:g
API String ID: 1748785662-3887247132
Opcode ID: 0ea2e6d3cee68d05d27196b1a1aa6a3f2928d4b99e0c6929d1a743b0465ba9e1
Instruction ID: 49dd312d5f546abad52826cdcfcbadc26e20a2420d21d2bf547d9c295bb3587a
Opcode Fuzzy Hash: 0ea2e6d3cee68d05d27196b1a1aa6a3f2928d4b99e0c6929d1a743b0465ba9e1
Instruction Fuzzy Hash: 72D13871D00A359ACB61AFB49C02ABF7AA7EF42360F14452DFC5997382DF7289408F95

Function 0062E635 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 438COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062E63C
numpunct.LIBCPMT ref: 0062EA21

Part of subcall function 0062B233: __EH_prolog3.LIBCMT ref: 0062B23A

Part of subcall function 0062AFD7: __EH_prolog3.LIBCMT ref: 0062AFDE
Part of subcall function 0062AFD7: std::_Lockit::_Lockit.LIBCPMT ref: 0062AFE8
Part of subcall function 0062AFD7: std::_Lockit::~_Lockit.LIBCPMT ref: 0062B059

Part of subcall function 0062B101: __EH_prolog3.LIBCMT ref: 0062B108
Part of subcall function 0062B101: std::_Lockit::_Lockit.LIBCPMT ref: 0062B112
Part of subcall function 0062B101: std::_Lockit::~_Lockit.LIBCPMT ref: 0062B183

Part of subcall function 006249F5: Concurrency::cancel_current_task.LIBCPMT ref: 00624AB8

Part of subcall function 0062A4C8: __EH_prolog3.LIBCMT ref: 0062A4CF
Part of subcall function 0062A4C8: std::_Lockit::_Lockit.LIBCPMT ref: 0062A4D9
Part of subcall function 0062A4C8: std::_Lockit::~_Lockit.LIBCPMT ref: 0062A54A

__Getcoll.LIBCPMT ref: 0062E7F1

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

Part of subcall function 00618700: LocalAlloc.KERNEL32(00000040,00000000,0063A1C5,00000000,C1C81EE7,?,00000000,?,FFFFFFFF,?,0065EB28,000000FF,?,006117A4,?,0065FDDA), ref: 00618706

Part of subcall function 0062E13A: __Getctype.LIBCPMT ref: 0062E149

Part of subcall function 0062A8DB: __EH_prolog3.LIBCMT ref: 0062A8E2
Part of subcall function 0062A8DB: std::_Lockit::_Lockit.LIBCPMT ref: 0062A8EC

Part of subcall function 0062AA05: __EH_prolog3.LIBCMT ref: 0062AA0C
Part of subcall function 0062AA05: std::_Lockit::_Lockit.LIBCPMT ref: 0062AA16

Part of subcall function 0062ABC4: __EH_prolog3.LIBCMT ref: 0062ABCB
Part of subcall function 0062ABC4: std::_Lockit::_Lockit.LIBCPMT ref: 0062ABD5
Part of subcall function 0062ABC4: std::_Lockit::~_Lockit.LIBCPMT ref: 0062AC46

Part of subcall function 0062AB2F: __EH_prolog3.LIBCMT ref: 0062AB36
Part of subcall function 0062AB2F: std::_Lockit::_Lockit.LIBCPMT ref: 0062AB40

Part of subcall function 006249F5: __EH_prolog3.LIBCMT ref: 006249FC
Part of subcall function 006249F5: std::_Lockit::_Lockit.LIBCPMT ref: 00624A06
Part of subcall function 006249F5: std::_Lockit::~_Lockit.LIBCPMT ref: 00624AAD

Strings

t:g, xrefs: 0062E880
p:g, xrefs: 0062E82A
l:g, xrefs: 0062E7C6
|:g, xrefs: 0062E908
d:g, xrefs: 0062E6FF
h:g, xrefs: 0062E742
`:g, xrefs: 0062E6BA
x:g, xrefs: 0062E8C5

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3$Lockit::_$Lockit::~_$AllocConcurrency::cancel_current_taskGetcollGetctypeLocalnumpunct
String ID: `:g$d:g$h:g$l:g$p:g$t:g$x:g$|:g
API String ID: 3146296281-3119374355
Opcode ID: c8a96e386f828e20cae5cfb6f66d8241dc4da425d0e666508d47a94d2813c4af
Instruction ID: da8b56db2602b959fd890725d7bfb043f2bd44f4b8e674f0b21bb177eefa81cc
Opcode Fuzzy Hash: c8a96e386f828e20cae5cfb6f66d8241dc4da425d0e666508d47a94d2813c4af
Instruction Fuzzy Hash: B6D11971C00A319EDB61AFB46C026BF7AABEF51360F14452DF845A7382EF7189409F95

Function 0061F4E0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 263memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018,C1C81EE7,00000000,?), ref: 0061F546
std::_Lockit::_Lockit.LIBCPMT ref: 0061F580
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0061F5E4
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0061F77B
std::_Lockit::~_Lockit.LIBCPMT ref: 0061F82F
Concurrency::cancel_current_task.LIBCPMT ref: 0061F857

Strings

true, xrefs: 0061F6B3
false, xrefs: 0061F69D
bad locale name, xrefs: 0061F85C

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocConcurrency::cancel_current_taskLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 975656625-1062449267
Opcode ID: 885a40504803f32dcf8cb804a344c7ff3f45efa8a6faac6334dcd5c284aed4e8
Instruction ID: ffc8716bb7c5b1566dd0b432928091e1d8a4394555992eba4721bb2aec6cb1c5
Opcode Fuzzy Hash: 885a40504803f32dcf8cb804a344c7ff3f45efa8a6faac6334dcd5c284aed4e8
Instruction Fuzzy Hash: 37B18FB1D01348DEEB50DFA8C945BDEBBF5AF14304F14826DE444EB282E7759A48CBA1

Function 00616B50 Relevance: 15.1, APIs: 10, Instructions: 132timeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?,C1C81EE7,?,00000000), ref: 00616BA5
OpenProcess.KERNEL32(00000400,00000000,00000000,?,C1C81EE7,?,00000000), ref: 00616BC6
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,C1C81EE7,?,00000000), ref: 00616BF9
GetProcessTimes.KERNEL32(00000000,?,00000000,00000000,00000000,?,C1C81EE7,?,00000000), ref: 00616C0A
CloseHandle.KERNEL32(00000000,?,C1C81EE7,?,00000000), ref: 00616C28
CloseHandle.KERNEL32(00000000,?,C1C81EE7,?,00000000), ref: 00616C4C
CloseHandle.KERNEL32(00000000,?,C1C81EE7,?,00000000), ref: 00616C78
CloseHandle.KERNEL32(00000000,?,C1C81EE7,?,00000000), ref: 00616C98
CloseHandle.KERNEL32(00000000,?,C1C81EE7,?,00000000), ref: 00616CBA
CloseHandle.KERNEL32(00000000,?,C1C81EE7,?,00000000), ref: 00616CDA

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: CloseHandle$Process$OpenTimes
String ID:
API String ID: 1711917922-0
Opcode ID: d8732b35281fa14c1682ff740c17a467ba6b83b86183e6c34ff65ebf0cc075eb
Instruction ID: 81a3511ee633beba98cf8f23992bf318999e7e2d3322dbcbcb28d999ae89d205
Opcode Fuzzy Hash: d8732b35281fa14c1682ff740c17a467ba6b83b86183e6c34ff65ebf0cc075eb
Instruction Fuzzy Hash: 0C517A74D01218DFDB10CFA8CA487EEBBB6EF08724F288219E951B73D0D7751A408BA5

Function 00615A00 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 373fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,URL,00000000,?,C1C81EE7,?,00000004), ref: 00615A6A
LocalFree.KERNEL32(?), ref: 00615B7B
MoveFileW.KERNEL32(?,00000000), ref: 00615E1B
DeleteFileW.KERNEL32(?), ref: 00615E63
LocalFree.KERNEL32(?), ref: 00615EFD
LocalFree.KERNEL32(?), ref: 00615FB2

Strings

URL, xrefs: 00615A64, 00615E4B
url, xrefs: 00615B9C, 00615E46

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: FileFreeLocal$DeleteMoveNameTemp
String ID: URL$url
API String ID: 1227976696-346267919
Opcode ID: 11b6e3ec66966eabe9292d67b67d4f326ae74dbd2b30f0b7999002f7cf2b683e
Instruction ID: 5a1cff6b04c21e3ed3b3d6a6679f9798ed1884b123a00e9e237c8534e8047ef4
Opcode Fuzzy Hash: 11b6e3ec66966eabe9292d67b67d4f326ae74dbd2b30f0b7999002f7cf2b683e
Instruction Fuzzy Hash: E7022770D14669DACB24DF24C998BDDB7B2AF94304F1442D9E44AA7291EB74ABC4CF80

Function 00637630 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00637637

Part of subcall function 0061C840: std::_Lockit::_Lockit.LIBCPMT ref: 0061C86D
Part of subcall function 0061C840: std::_Lockit::_Lockit.LIBCPMT ref: 0061C890
Part of subcall function 0061C840: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C8B8
Part of subcall function 0061C840: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C961

Strings

%d / %m / %y, xrefs: 0063799A
%b %d %H : %M : %S %Y, xrefs: 006378EF
%H : %M : %S, xrefs: 006377F3
%m / %d / %y, xrefs: 00637733
:AM:am:PM:pm, xrefs: 006379CC
%H : %M, xrefs: 0063777C
%I : %M : %S %p, xrefs: 006379C1

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: 4df80d0333720fcae8fe0cd3b1d95663986d3536d27b90deae2d84396ce267f3
Instruction ID: c2690baf25290be6b9ec67e138f80469e464402460c2229d402b834a91dfdfd1
Opcode Fuzzy Hash: 4df80d0333720fcae8fe0cd3b1d95663986d3536d27b90deae2d84396ce267f3
Instruction Fuzzy Hash: 53C153B250410AABDF28DF58CD55EFA77FAEF09304F140619FA46A7291D6309A10DBA0

Function 00631AC0 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00631AC7

Part of subcall function 0062A71C: __EH_prolog3.LIBCMT ref: 0062A723
Part of subcall function 0062A71C: std::_Lockit::_Lockit.LIBCPMT ref: 0062A72D

Strings

%d / %m / %y, xrefs: 00631E2A
%b %d %H : %M : %S %Y, xrefs: 00631D7F
%H : %M : %S, xrefs: 00631C83
%m / %d / %y, xrefs: 00631BC3
:AM:am:PM:pm, xrefs: 00631E5C
%H : %M, xrefs: 00631C0C
%I : %M : %S %p, xrefs: 00631E51

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: H_prolog3$LockitLockit::_std::_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 2181796688-2891247106
Opcode ID: a665df344f57011fc4f36a73afa4e1b5015dd2483c83f3b891e29c2d6e4d730d
Instruction ID: cd99c42cfebeb31e68bd8a6d38e394794b64e37f9c03c9021e0535efc951c802
Opcode Fuzzy Hash: a665df344f57011fc4f36a73afa4e1b5015dd2483c83f3b891e29c2d6e4d730d
Instruction Fuzzy Hash: F2C170B6900109ABDB18DF98CD55DFB7BFAEF07704F144219FA42EA251D631DA10DBA0

Function 00631EC0 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00631EC7

Part of subcall function 0061B7F0: std::_Lockit::_Lockit.LIBCPMT ref: 0061B81D
Part of subcall function 0061B7F0: std::_Lockit::_Lockit.LIBCPMT ref: 0061B840
Part of subcall function 0061B7F0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061B868
Part of subcall function 0061B7F0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061B911

Strings

%d / %m / %y, xrefs: 0063222A
%b %d %H : %M : %S %Y, xrefs: 0063217F
%H : %M : %S, xrefs: 00632083
%m / %d / %y, xrefs: 00631FC3
:AM:am:PM:pm, xrefs: 0063225C
%H : %M, xrefs: 0063200C
%I : %M : %S %p, xrefs: 00632251

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: f31f4b4106abb155cb6961427467219c3b368001aa0fc600564154e133e91c9b
Instruction ID: da2fef9137710adead32c498f77389acc38e3afa272fd09217c0ca8b3eb632f2
Opcode Fuzzy Hash: f31f4b4106abb155cb6961427467219c3b368001aa0fc600564154e133e91c9b
Instruction Fuzzy Hash: 2DC182B650010BABDB18DFA8CD65DFF7BFAEB09304F154219FA42A7251D630DA05DBA0

Function 006166A0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 257libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00616150: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 006161B5
Part of subcall function 00616150: LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,000000FF,0065B8CD,000000FF), ref: 0061620F
Part of subcall function 00616150: GetLastError.KERNEL32(?,?,?,000000FF,0065B8CD,000000FF), ref: 0061626B

GetProcAddress.KERNEL32(?,NtQueryInformationProcess), ref: 00616726
ReadProcessMemory.KERNEL32(?,?,?,000001D8,00000000), ref: 00616794
ReadProcessMemory.KERNEL32(?,?,?,00000048,00000000), ref: 006167FB
GetLastError.KERNEL32 ref: 006169AC
FreeLibrary.KERNEL32(?), ref: 00616A05

Strings

NtQueryInformationProcess, xrefs: 00616720

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ErrorLastLibraryMemoryProcessRead$AddressDirectoryFreeLoadProcSystem
String ID: NtQueryInformationProcess
API String ID: 1101900967-2781105232
Opcode ID: 516624140e99c27c4b3eecf9fb5a78b8db2a5d502b49e2e858d39d616591897a
Instruction ID: 6201b990edcdad3905623e9b5a436d56319e7a6b86709f344ae2ead9559aee4b
Opcode Fuzzy Hash: 516624140e99c27c4b3eecf9fb5a78b8db2a5d502b49e2e858d39d616591897a
Instruction Fuzzy Hash: E2B15E709007499BDB20CF64C9497EEBBF1FF48308F144A5DE449A7290D7B5AAC8CB95

Function 0062E188 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0062E18F
_Maklocstr.LIBCPMT ref: 0062E1F8
_Maklocstr.LIBCPMT ref: 0062E20A
_Maklocchr.LIBCPMT ref: 0062E222
_Maklocchr.LIBCPMT ref: 0062E232
_Getvals.LIBCPMT ref: 0062E254

Part of subcall function 00627DCC: _Maklocchr.LIBCPMT ref: 00627DFB
Part of subcall function 00627DCC: _Maklocchr.LIBCPMT ref: 00627E11

Strings

true, xrefs: 0062E205
false, xrefs: 0062E1F3

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Maklocchr$Maklocstr$GetvalsH_prolog3_
String ID: false$true
API String ID: 3549167292-2658103896
Opcode ID: 80b483b301f053ba21e8190bdb251943f39afa10f55d7eee5f5732d54a7f3c8d
Instruction ID: b752238663ce266e7c5abd31a00a9e6c9925b368681d3061aab32a22c01765bd
Opcode Fuzzy Hash: 80b483b301f053ba21e8190bdb251943f39afa10f55d7eee5f5732d54a7f3c8d
Instruction Fuzzy Hash: 74219171D04718AADF14EFA0E846ECF7B79EF04710F00801AF9059F282DA719644CFA5

Function 00620780 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 274memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 0062083F
LocalAlloc.KERNEL32(00000040,?), ref: 00620881

Part of subcall function 00620780: LocalFree.KERNEL32(?,00000000,00000000,?,?,C1C81EE7,C1C81EE7,00000000,?), ref: 00620A66

___std_exception_copy.LIBVCRUNTIME ref: 006208F4
LocalFree.KERNEL32(?), ref: 00620931

Strings

iostream, xrefs: 00620AC0
ios_base::failbit set, xrefs: 006209D2

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Local$AllocFree$___std_exception_copy
String ID: ios_base::failbit set$iostream
API String ID: 2276494016-302468714
Opcode ID: cb07f65f6a41df66a72ca06118388df74cc96d300447cef8f9792b991536f2cb
Instruction ID: 8fec4843d9a2941807c673d034962ac1c170999a8d133a558677c8a3a1879380
Opcode Fuzzy Hash: cb07f65f6a41df66a72ca06118388df74cc96d300447cef8f9792b991536f2cb
Instruction Fuzzy Hash: 56A1A171D00608DFDB14DF68D984BAEBBB6EF48310F14826EE815AB392D7709984CF91

Function 0061BD40 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 195memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000044,C1C81EE7,00000000,?), ref: 0061BD9B
std::_Lockit::_Lockit.LIBCPMT ref: 0061BDD8
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0061BE45
__Getctype.LIBCPMT ref: 0061BE8E
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0061BF02
std::_Lockit::~_Lockit.LIBCPMT ref: 0061BFBF

Strings

bad locale name, xrefs: 0061BFDD

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocGetctypeLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 3635123611-1405518554
Opcode ID: cfbdd28a530e4183b87debea06f0ac9b9a9ca340728d69198a852f6b51477733
Instruction ID: c0c15c51280306cb23a727580ad2e3b7203b4a6734370ddee1c20b70606459f1
Opcode Fuzzy Hash: cfbdd28a530e4183b87debea06f0ac9b9a9ca340728d69198a852f6b51477733
Instruction Fuzzy Hash: 5E814EB0D04388DEEB10CFA8D9457CEBBF5AF14304F188598E444AB392E7759A88DB61

Function 0061C4C0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000018,C1C81EE7,00000000,?,?,?,?,?,?,?,?,00000000,0065C8F5,000000FF), ref: 0061C504
std::_Lockit::_Lockit.LIBCPMT ref: 0061C53E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0061C5A2
__Getctype.LIBCPMT ref: 0061C5EB
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0061C631
std::_Lockit::~_Lockit.LIBCPMT ref: 0061C6E5

Strings

bad locale name, xrefs: 0061C700

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocGetctypeLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 3635123611-1405518554
Opcode ID: 85444ed6a267ae79b105c193e27fe8ea667c23065c386f1c090adc26af70c4df
Instruction ID: e0ddf5b8a7d0bbefa5b586b7dc7cb3cba9dd6a2f2fc7a8e859d378e41142f493
Opcode Fuzzy Hash: 85444ed6a267ae79b105c193e27fe8ea667c23065c386f1c090adc26af70c4df
Instruction Fuzzy Hash: B5614BB0D01288DAEB10CFA8D9057CEBFB5AF15314F188159E454EB381E7B69A48DBA1

Function 0063921D Relevance: 12.2, APIs: 8, Instructions: 225COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 006392A8
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00639334
__alloca_probe_16.LIBCMT ref: 0063935E
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0063939F
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 006393BB
__alloca_probe_16.LIBCMT ref: 006393E1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0063941E
CompareStringEx.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0063943B

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16$CompareInfoString
String ID:
API String ID: 3603178046-0
Opcode ID: 72f98440bf9815e6718b5ff932f550b339b3b9580a72ecf3dc0a42cbd5ec8c06
Instruction ID: 8fdd9766556f926905c4ab045a5b9eb172649cd3c15d3167ad716575216ee777
Opcode Fuzzy Hash: 72f98440bf9815e6718b5ff932f550b339b3b9580a72ecf3dc0a42cbd5ec8c06
Instruction Fuzzy Hash: FF71AF72D14215ABEF209FA4CC85BEEBBBBAF05710F140159E845A7292D6B58D06CFF0

Function 00638CFE Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,CCCCCCCC,0061C98F,?,00000001,00000000,00000000,?,?,0061C98F,?), ref: 00638D47
__alloca_probe_16.LIBCMT ref: 00638D73
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000,?,0061C98F,?,?,00000000,0061CFE3,0000003F,?), ref: 00638DB2
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0061C98F,?,?,00000000,0061CFE3,0000003F), ref: 00638DCF
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,0061C98F,?,?,00000000,0061CFE3,0000003F), ref: 00638E0E
__alloca_probe_16.LIBCMT ref: 00638E2B
LCMapStringEx.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0061C98F,?,?,00000000,0061CFE3,0000003F), ref: 00638E6D
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000,?,0061C98F,?,?,00000000,0061CFE3,0000003F,?), ref: 00638E90

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 2504e135085cfaf04cdc17a57c6de1fc22e15855acc1499958beb68dbd2e2917
Instruction ID: b1aab43f344960a29b08a3ef2cd7a31af2c6690601d6ff0db7bd19432fe9bbfc
Opcode Fuzzy Hash: 2504e135085cfaf04cdc17a57c6de1fc22e15855acc1499958beb68dbd2e2917
Instruction Fuzzy Hash: C2518B7290031AAFEF209F64CC45FEB7BBAEF50B40F144529BA05A7290DB758D11CBA0

Function 006213A0 Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 404registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,-00000002,00000000,?,?), ref: 006217A2
RegQueryValueExW.ADVAPI32(?,00000002,00000000,00000000,006747B8,00000800), ref: 006217C2

Strings

/RunAsAdmin , xrefs: 006214DE, 006214E9, 00621513, 00621523, 00621542
/HideWindow, xrefs: 00621585, 0062158F, 006215BC, 006215CC, 006215EB
/EnforcedRunAsAdmin , xrefs: 006213C0, 006213CA, 006213F3, 00621411
/DontWait , xrefs: 00621447, 00621450, 0062147C, 0062149E

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: OpenQueryValue
String ID: /DontWait $/EnforcedRunAsAdmin $/HideWindow$/RunAsAdmin
API String ID: 4153817207-1914306501
Opcode ID: 0d4ff2886aada759bc92099a4cc81d9cf88b6667050c61a3604664723d033554
Instruction ID: 643c1ec226089ce5ec2b401568d42c87859587bb676f6931289ed2b38471e2cf
Opcode Fuzzy Hash: 0d4ff2886aada759bc92099a4cc81d9cf88b6667050c61a3604664723d033554
Instruction Fuzzy Hash: 6AD1C265A08A728ACB34AF54A8402F672E3EFB7740B5A40A9D8459F351E7718D82CF91

Function 0063D081 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0063D1A0
___TypeMatch.LIBVCRUNTIME ref: 0063D2AE
CallUnexpected.LIBVCRUNTIME ref: 0063D41B

Strings

csm, xrefs: 0063D0BE
csm, xrefs: 0063D1D7
csm, xrefs: 0063D12B

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: ee807b0c8e423bcc3294f377960d8d5f94174b505a4271ed1911b9583dc8bf46
Instruction ID: 61866fedffb8f54b8d308324aba2d7e1d036df938cab75320dee2ecdd109c81d
Opcode Fuzzy Hash: ee807b0c8e423bcc3294f377960d8d5f94174b505a4271ed1911b9583dc8bf46
Instruction Fuzzy Hash: C4B13671900209EFDF15DFA4E8819AEBBB6EF45310F14456AF8016B312D731EA51CBE6

Function 00636A44 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 277COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00636A4B

Part of subcall function 00635722: __EH_prolog3_GS.LIBCMT ref: 00635729
Part of subcall function 00635722: __Getcoll.LIBCPMT ref: 0063578D

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

__Getcoll.LIBCPMT ref: 00636A9A

Part of subcall function 0063556A: __EH_prolog3.LIBCMT ref: 00635571
Part of subcall function 0063556A: std::_Lockit::_Lockit.LIBCPMT ref: 0063557B
Part of subcall function 0063556A: std::_Lockit::~_Lockit.LIBCPMT ref: 006355EC

Part of subcall function 006249F5: __EH_prolog3.LIBCMT ref: 006249FC
Part of subcall function 006249F5: std::_Lockit::_Lockit.LIBCPMT ref: 00624A06
Part of subcall function 006249F5: std::_Lockit::~_Lockit.LIBCPMT ref: 00624AAD

numpunct.LIBCPMT ref: 00636CCA

Part of subcall function 00618700: LocalAlloc.KERNEL32(00000040,00000000,0063A1C5,00000000,C1C81EE7,?,00000000,?,FFFFFFFF,?,0065EB28,000000FF,?,006117A4,?,0065FDDA), ref: 00618706

Strings

:g, xrefs: 00636B29
:g, xrefs: 00636AD3
:g, xrefs: 00636A6F

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_$Getcoll$AllocH_prolog3_Localnumpunct
String ID: :g$:g$:g
API String ID: 2516209439-3928327049
Opcode ID: 31afb7f43d59c7e20c8773661383907ebe67aa3f860257a38b664ce80cf2bc01
Instruction ID: 40d71faca6afc1747f890f70c71ce658b0d84e3af1fddd4b7e9604ac4ca5d99e
Opcode Fuzzy Hash: 31afb7f43d59c7e20c8773661383907ebe67aa3f860257a38b664ce80cf2bc01
Instruction Fuzzy Hash: 8691F471D016257AD761AF74CC026BFBAABDF41360F18C51DF886AB382DE7189408BE5

Function 0061FAC0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 189memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000000C,C1C81EE7,00000000,?,00000000,?,?,?,?,00000000,0065CFB1,000000FF,?,0061EB5A,00000000), ref: 0061FB04
std::_Lockit::_Lockit.LIBCPMT ref: 0061FB3A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0061FB9E
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0061FC5E
std::_Lockit::~_Lockit.LIBCPMT ref: 0061FD12

Strings

bad locale name, xrefs: 0061FD2E

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2968629171-1405518554
Opcode ID: 814b94e7d9b06c06ae03e7d8c0108ae04319fa7fc4e4abc3fc185d23473ed4ee
Instruction ID: ca8b15e7538a7b64d03c8a162c4e4c86d1b50fd3a609221220c24289223758e7
Opcode Fuzzy Hash: 814b94e7d9b06c06ae03e7d8c0108ae04319fa7fc4e4abc3fc185d23473ed4ee
Instruction Fuzzy Hash: C8719EB0D00349DBEF11CFA8D9447DEBFB5AF10304F184169E814AB381E7B69A04DBA1

Function 0061F890 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000008,C1C81EE7,00000000,?,00000000,?,?,?,?,0065CEBD,000000FF,?,0061EC9A,?,?), ref: 0061F8D4
std::_Lockit::_Lockit.LIBCPMT ref: 0061F90A
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0061F96E
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0061F9DE
std::_Lockit::~_Lockit.LIBCPMT ref: 0061FA92

Strings

bad locale name, xrefs: 0061FAAE

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$AllocLocalLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2968629171-1405518554
Opcode ID: 7ebd8c15f541c80606126ae9532c433d1fb00efda784cf7c8e795713bc095818
Instruction ID: f00bb2601869c6ef8fcc3ca9f5ff93934d08b5f6da254a3af19a2d0dcea899d6
Opcode Fuzzy Hash: 7ebd8c15f541c80606126ae9532c433d1fb00efda784cf7c8e795713bc095818
Instruction Fuzzy Hash: EF6171B0D01389EADF10DFA8D5447CEBFB5AF15304F18856CE454AB381D7BA9A44CBA1

Function 0063AD30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0063AD67
___except_validate_context_record.LIBVCRUNTIME ref: 0063AD6F
_ValidateLocalCookies.LIBCMT ref: 0063ADF8
__IsNonwritableInCurrentImage.LIBCMT ref: 0063AE23
_ValidateLocalCookies.LIBCMT ref: 0063AE78

Strings

csm, xrefs: 0063AE0D

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 6ca80cd5cc98ff24c4e3e555c407ee4ab08e32d00141ba33607de12c7c587340
Instruction ID: 3c35f633805b1d56a9ae31c8e61c3d2b24ab4578e5f7b510b6f04650436145f9
Opcode Fuzzy Hash: 6ca80cd5cc98ff24c4e3e555c407ee4ab08e32d00141ba33607de12c7c587340
Instruction Fuzzy Hash: CE41D434A00208ABCF10DFA9C884AEEBBB7FF45314F148159E8559B392D735EA15DBD2

Function 006351EC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006351F3
std::_Lockit::_Lockit.LIBCPMT ref: 006351FD

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

messages.LIBCPMT ref: 00635237
std::_Facet_Register.LIBCPMT ref: 0063524E
std::_Lockit::~_Lockit.LIBCPMT ref: 0063526E

Strings

:g, xrefs: 00635208

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID: :g
API String ID: 2750803064-307150366
Opcode ID: f722f4129ff82da6802039eba2d41a1a767c0df9758aac424a3e94f51481ef68
Instruction ID: 2c7229f6296639a98185f9e23da2414703a67a35027c0d2c2fdb0a63e80e45a0
Opcode Fuzzy Hash: f722f4129ff82da6802039eba2d41a1a767c0df9758aac424a3e94f51481ef68
Instruction Fuzzy Hash: BF01AD31900A259BCB45EBA4C8516AE7B63AF44724F28000CF412AB3D2DB749E419BD5

Function 0062ABC4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062ABCB
std::_Lockit::_Lockit.LIBCPMT ref: 0062ABD5

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

moneypunct.LIBCPMT ref: 0062AC0F
std::_Facet_Register.LIBCPMT ref: 0062AC26
std::_Lockit::~_Lockit.LIBCPMT ref: 0062AC46

Strings

|:g, xrefs: 0062ABE0

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID: |:g
API String ID: 419941038-1423270564
Opcode ID: f74feec9244069ee35db91234b718128a3dd576a8c5766cb733aeb5a8d154e22
Instruction ID: d38a163b56f743e5a505128a95ecfd07eee85a993ea0086dd8c29edd531bd7b9
Opcode Fuzzy Hash: f74feec9244069ee35db91234b718128a3dd576a8c5766cb733aeb5a8d154e22
Instruction Fuzzy Hash: 39010431A00A358BCB08EBA4E8516ED7763AF84314F24000CF811673C1CF708E008B96

Function 0062AC59 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062AC60
std::_Lockit::_Lockit.LIBCPMT ref: 0062AC6A

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

moneypunct.LIBCPMT ref: 0062ACA4
std::_Facet_Register.LIBCPMT ref: 0062ACBB
std::_Lockit::~_Lockit.LIBCPMT ref: 0062ACDB

Strings

X:g, xrefs: 0062AC75

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID: X:g
API String ID: 419941038-1804700824
Opcode ID: ea3c57658dd3908cefe161b7aaabfef7eb0bdb716d0449f789fc540dd2c455d7
Instruction ID: 6b5fac965128bcfc92fe25eca56a5d883dece998eb583e7931e7432a012a66ef
Opcode Fuzzy Hash: ea3c57658dd3908cefe161b7aaabfef7eb0bdb716d0449f789fc540dd2c455d7
Instruction Fuzzy Hash: CC01C032A00A358BCB45EBA4D9566EE7773AF84714F14000CF411AB3D1CF749A41DF96

Function 0062ACEE Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062ACF5
std::_Lockit::_Lockit.LIBCPMT ref: 0062ACFF

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

moneypunct.LIBCPMT ref: 0062AD39
std::_Facet_Register.LIBCPMT ref: 0062AD50
std::_Lockit::~_Lockit.LIBCPMT ref: 0062AD70

Strings

T:g, xrefs: 0062AD0A

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID: T:g
API String ID: 419941038-1653306876
Opcode ID: 1f3f33d942e3ba6b1a07c8243682930f3c833f167b5e308673d3ff73a52b5617
Instruction ID: 352388ae59396f65955d7dfe2e15b4c29ace45ef1056e22f3a93eea51d10d86c
Opcode Fuzzy Hash: 1f3f33d942e3ba6b1a07c8243682930f3c833f167b5e308673d3ff73a52b5617
Instruction Fuzzy Hash: B6010431900A358BCB04EBA4E8016EE7763BF44714F14040CF4516B3D1CF708E418F96

Function 0062AF42 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062AF49
std::_Lockit::_Lockit.LIBCPMT ref: 0062AF53

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

numpunct.LIBCPMT ref: 0062AF8D
std::_Facet_Register.LIBCPMT ref: 0062AFA4
std::_Lockit::~_Lockit.LIBCPMT ref: 0062AFC4

Strings

h:g, xrefs: 0062AF5E

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID: h:g
API String ID: 743221004-1341810952
Opcode ID: d5c85765faa571f9f9b127443deff12ef630300b1441799d9c9bff7735d9ae26
Instruction ID: a057120f8f34d9ba15b3bd68c2caf1ca532177399fecd4d7dad460dbe85af0e9
Opcode Fuzzy Hash: d5c85765faa571f9f9b127443deff12ef630300b1441799d9c9bff7735d9ae26
Instruction Fuzzy Hash: 36010072900A39CBCB45EBA4E952AAE7767AF44314F24000CF850AB3D1DF748A04DF9A

Function 0064D551 Relevance: 9.3, APIs: 6, Instructions: 333COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3767a7d6d0192a2467eac590044d3ed76be4238a063b5c23c08e24abd260c763
Instruction ID: 63654f311620d555ccfb864a6d85aa3e77f6dc201dccaf31c0e29b4d5e129bdb
Opcode Fuzzy Hash: 3767a7d6d0192a2467eac590044d3ed76be4238a063b5c23c08e24abd260c763
Instruction Fuzzy Hash: 66B13872E00355AFDB15CF68CC81BEEBBB7EF59310F25415AE804AB382D6749901CBA4

Function 00612CD0 Relevance: 9.2, APIs: 6, Instructions: 220encryptionCOMMON

Download Yara Rule

APIs

#224.MSI(?,00000001,00000000,00000000,00000000), ref: 00612D50
LocalFree.KERNEL32(?), ref: 00612DBA
LocalFree.KERNEL32(?), ref: 00612E24
CertFreeCertificateContext.CRYPT32(00000000), ref: 00612F65

Part of subcall function 00613DC0: CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000,C1C81EE7), ref: 00613E03

LocalFree.KERNEL32(?), ref: 00612F1B
CertFreeCertificateContext.CRYPT32(00000003,?), ref: 00612FAB

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Free$CertLocal$CertificateContext$#224NameString
String ID:
API String ID: 2751787804-0
Opcode ID: 17756fd39424bee8e325ea6be8a863b6c478fc312455c29eca848cd944e7152c
Instruction ID: 633c464d578754c6e7b2d857c79db1e146acc7934ee7231f665d4c98f1db8600
Opcode Fuzzy Hash: 17756fd39424bee8e325ea6be8a863b6c478fc312455c29eca848cd944e7152c
Instruction Fuzzy Hash: C6916D70D0024ACFDB18CFA8D5687DEBBB2FF44304F144659E415AB391DBB5AA85CB90

Function 0061B7F0 Relevance: 9.1, APIs: 6, Instructions: 145COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0061B81D
std::_Lockit::_Lockit.LIBCPMT ref: 0061B840
std::_Lockit::~_Lockit.LIBCPMT ref: 0061B868
std::_Facet_Register.LIBCPMT ref: 0061B8DD
std::_Lockit::~_Lockit.LIBCPMT ref: 0061B911
LocalFree.KERNEL32 ref: 0061B9B0

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_FreeLocalRegister
String ID:
API String ID: 1378673503-0
Opcode ID: d070445d049a96fd184d042aa09cf890a9afd8b0245fb0f5154bcb0f2e14a07f
Instruction ID: 9a9e20df02f13487c42d38fcc2b61b756e7747d92dee471b17d1eb3f899d08b6
Opcode Fuzzy Hash: d070445d049a96fd184d042aa09cf890a9afd8b0245fb0f5154bcb0f2e14a07f
Instruction Fuzzy Hash: B8510071800619DFCB14CF58D940BEEBBBAFB05720F18465DE814A7390E774AA81CB91

Function 00647CA4 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 373COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00647D8F
__freea.LIBCMT ref: 00647E22
__freea.LIBCMT ref: 00647E42

Strings

a/p, xrefs: 00647F09
am/pm, xrefs: 00647EA8

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: 3df430e1e97c5034aaa3fce9268bc223499343c40827d850f57d11af46804437
Instruction ID: 2d9e05c4f6aa32bfca68feff2f8fc5032750f6c91e07e0f1e20b55ee68a21714
Opcode Fuzzy Hash: 3df430e1e97c5034aaa3fce9268bc223499343c40827d850f57d11af46804437
Instruction Fuzzy Hash: 27C11271914206CECB289F78C954AFE77B3FF45B00F254199EA01AB350EB369D46CBA1

Function 0063CD4A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0063CD41,0063AC5C,0063A3E4), ref: 0063CD58
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0063CD66
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0063CD7F
SetLastError.KERNEL32(00000000,0063CD41,0063AC5C,0063A3E4), ref: 0063CDD1

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5259482a9136677834d034a8a069fbed903a0d0743a097965c8560cc789c5a35
Instruction ID: 65c6a1bb00ac301e14761d5c339a74a7e884b16de070810992e488e01252748b
Opcode Fuzzy Hash: 5259482a9136677834d034a8a069fbed903a0d0743a097965c8560cc789c5a35
Instruction Fuzzy Hash: 2001B1725093126EE76827B4BC95AEA2A97EF01B75F20033EF014622F1EF515C81D6F8

Function 0062E033 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062E03A
_Getvals.LIBCPMT ref: 0062E097
_Mpunct.LIBCPMT ref: 0062E0D2
_Mpunct.LIBCPMT ref: 0062E0EC

Strings

$+xv, xrefs: 0062E0F7

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Mpunct$GetvalsH_prolog3
String ID: $+xv
API String ID: 2204710431-1686923651
Opcode ID: e93cfb1e1b68f10a95879efeef0982fa4add815fc0d9a931cdf0b75490d74fab
Instruction ID: 00d0700b794531941bce99b38174326bf4c222449c5d666a350b884a3cf67e99
Opcode Fuzzy Hash: e93cfb1e1b68f10a95879efeef0982fa4add815fc0d9a931cdf0b75490d74fab
Instruction Fuzzy Hash: 6D21CEB1900F616EDB65DF649850B6BBFF9AB08300F04052EE499C7A82D771E612CF94

Function 00618620 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(C1C81EE7,C1C81EE7,?,?,00000000,0065BF91,000000FF), ref: 006186BB

Part of subcall function 006395A8: AcquireSRWLockExclusive.KERNEL32(00673B74,?,?,?,00612646,00674714,C1C81EE7,?,?,0065B16D,000000FF,?,00611A07), ref: 006395B3
Part of subcall function 006395A8: ReleaseSRWLockExclusive.KERNEL32(00673B74,?,?,00612646,00674714,C1C81EE7,?,?,0065B16D,000000FF,?,00611A07,?,?,?,C1C81EE7), ref: 006395ED

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00618680
GetProcAddress.KERNEL32(00000000), ref: 00618687

Part of subcall function 00639557: AcquireSRWLockExclusive.KERNEL32(00673B74,?,?,006126B7,00674714,0065EC90), ref: 00639561
Part of subcall function 00639557: ReleaseSRWLockExclusive.KERNEL32(00673B74,?,?,006126B7,00674714,0065EC90), ref: 00639594
Part of subcall function 00639557: WakeAllConditionVariable.KERNEL32(00673B70,?,?,006126B7,00674714,0065EC90), ref: 0063959F

Strings

kernel32, xrefs: 0061867B
IsWow64Process, xrefs: 00618676

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease$AddressConditionCurrentHandleModuleProcProcessVariableWake
String ID: IsWow64Process$kernel32
API String ID: 411948497-3789238822
Opcode ID: b4d90b22c0b282d9a1cf7bbdd0eb731ce64fcada565ed4853565e9fea03930b1
Instruction ID: a2bd8dbe4b826a13c1c6992927bb6ef92274fcd4e1648a321db1323a52d9280b
Opcode Fuzzy Hash: b4d90b22c0b282d9a1cf7bbdd0eb731ce64fcada565ed4853565e9fea03930b1
Instruction Fuzzy Hash: 3921E472944704DFCB19CFA4DC09B9AB7BAF709720F05022AE815D3390DB756940CF91

Function 0062B06C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062B073
std::_Lockit::_Lockit.LIBCPMT ref: 0062B07D

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Facet_Register.LIBCPMT ref: 0062B0CE
std::_Lockit::~_Lockit.LIBCPMT ref: 0062B0EE

Strings

\:g, xrefs: 0062B088

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: \:g
API String ID: 2854358121-1821910084
Opcode ID: 0eab1eff1fe17506045b2b0d6a416e646e807568a1df0cc10289ae64ab46860f
Instruction ID: a95dfd4f73b871882523b5099d966f5ca1167b7c10366faa834033e4c39413ca
Opcode Fuzzy Hash: 0eab1eff1fe17506045b2b0d6a416e646e807568a1df0cc10289ae64ab46860f
Instruction Fuzzy Hash: A101C032900A399BCB45EBA4D852AAF7B77AF44724F24000CF861A73D1DF349A459FD5

Function 00624047 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062404E
std::_Lockit::_Lockit.LIBCPMT ref: 00624058

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Facet_Register.LIBCPMT ref: 006240A9
std::_Lockit::~_Lockit.LIBCPMT ref: 006240C9

Strings

8g, xrefs: 00624063

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 8g
API String ID: 2854358121-544791708
Opcode ID: 82f868fa4739ce44c142fa709efda2d965f576737416b6ca5fc35317f1fd1c64
Instruction ID: 44988ef24f3277803d4289c765fcc525981f5a7cc87960b746b2706223ce1ad1
Opcode Fuzzy Hash: 82f868fa4739ce44c142fa709efda2d965f576737416b6ca5fc35317f1fd1c64
Instruction Fuzzy Hash: 7E010031900A3A8BCB18EFA4D841AAE77B3AF44714F14040CF810A73C1CF308A459F96

Function 00635157 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0063515E
std::_Lockit::_Lockit.LIBCPMT ref: 00635168

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Facet_Register.LIBCPMT ref: 006351B9
std::_Lockit::~_Lockit.LIBCPMT ref: 006351D9

Strings

:g, xrefs: 00635173

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: :g
API String ID: 2854358121-307150366
Opcode ID: bab9ffb25a7a816da27eed972f6b8cb6cbff47eb3b58b073505ba21d047fcd08
Instruction ID: 5b49bca726b916615cb9406142862f53b13b780bc22eb07c2b17cb119a675a5d
Opcode Fuzzy Hash: bab9ffb25a7a816da27eed972f6b8cb6cbff47eb3b58b073505ba21d047fcd08
Instruction Fuzzy Hash: 1B01AD31900A298BCB45EBA4D9556AEBBB3AF44714F24000CF812A7391DB349E41DBD5

Function 00635281 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00635288
std::_Lockit::_Lockit.LIBCPMT ref: 00635292

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Facet_Register.LIBCPMT ref: 006352E3
std::_Lockit::~_Lockit.LIBCPMT ref: 00635303

Strings

:g, xrefs: 0063529D

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: :g
API String ID: 2854358121-307150366
Opcode ID: e1a60329a65b5b436ef306dcb62ddb9d4b0cab433384d5925a2774376093e340
Instruction ID: 23b9004cd82cdb0dd678802591e2bd822a24f9d00012cf43775c8fc343a49991
Opcode Fuzzy Hash: e1a60329a65b5b436ef306dcb62ddb9d4b0cab433384d5925a2774376093e340
Instruction Fuzzy Hash: 080100319006258BCB04EBA4C8016EE7B63AF44724F24000DF812AB3D1DF749E00CBD5

Function 0062A5F2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062A5F9
std::_Lockit::_Lockit.LIBCPMT ref: 0062A603

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Facet_Register.LIBCPMT ref: 0062A654
std::_Lockit::~_Lockit.LIBCPMT ref: 0062A674

Strings

l:g, xrefs: 0062A60E

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: l:g
API String ID: 2854358121-1223934420
Opcode ID: 3a7ffbd376241d2d1f688d629c089c7f8e0f9635c6c3526876b5f362250d4f37
Instruction ID: 1d00fea6f7c60342736b72ed0fde42d2e72f31ac202d525b92de5d20efe3a41c
Opcode Fuzzy Hash: 3a7ffbd376241d2d1f688d629c089c7f8e0f9635c6c3526876b5f362250d4f37
Instruction Fuzzy Hash: D10100359006358BCB04EBA4D8526EE7777BF44714F18001CF851AB3D1DF748A059B96

Function 0062A687 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062A68E
std::_Lockit::_Lockit.LIBCPMT ref: 0062A698

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Facet_Register.LIBCPMT ref: 0062A6E9
std::_Lockit::~_Lockit.LIBCPMT ref: 0062A709

Strings

D:g, xrefs: 0062A6A3

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: D:g
API String ID: 2854358121-2125321868
Opcode ID: 06f03d31da33a033921f5e2a0c4e14be71f035f85ba0a23a66349a379d06d508
Instruction ID: 134a060a49b30e38ae013d9ae54e6237d3ca83613fd4f08e80e72d72b2885284
Opcode Fuzzy Hash: 06f03d31da33a033921f5e2a0c4e14be71f035f85ba0a23a66349a379d06d508
Instruction Fuzzy Hash: 0301ED35900A398BCB44EFA4D8566AE7773AF44714F14000CF411AB3D1CFB08A418B9A

Function 0062AD83 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062AD8A
std::_Lockit::_Lockit.LIBCPMT ref: 0062AD94

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Facet_Register.LIBCPMT ref: 0062ADE5
std::_Lockit::~_Lockit.LIBCPMT ref: 0062AE05

Strings

`:g, xrefs: 0062AD9F

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: `:g
API String ID: 2854358121-1105803440
Opcode ID: 54fc5f38ac2027ec1492027f031e86059cb52a1a5269fb3cc6ca26b3c7805c55
Instruction ID: 80f8862b6e68d1f20ef8181aa059c74ca2b5818931c80d04b3852324c9563833
Opcode Fuzzy Hash: 54fc5f38ac2027ec1492027f031e86059cb52a1a5269fb3cc6ca26b3c7805c55
Instruction Fuzzy Hash: 9301E1319005398BCB44EBA4D812ABEB763AF44324F14000CF4516B3C1CF708E459B96

Function 0062AE18 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062AE1F
std::_Lockit::_Lockit.LIBCPMT ref: 0062AE29

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Facet_Register.LIBCPMT ref: 0062AE7A
std::_Lockit::~_Lockit.LIBCPMT ref: 0062AE9A

Strings

@:g, xrefs: 0062AE34

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: @:g
API String ID: 2854358121-2040823376
Opcode ID: bbee3d2862166bd78dd930832d89d95edd666ca636ff6d108e3ff9919792004b
Instruction ID: 02bf41f8402f7bddba6c292590241f09fded53ddcb2450703df2ae0411a35657
Opcode Fuzzy Hash: bbee3d2862166bd78dd930832d89d95edd666ca636ff6d108e3ff9919792004b
Instruction Fuzzy Hash: A901E1319006258BCB45EBA4E8126EEBB63AF84714F14040CF490A7391CF708A05AF96

Function 0062AEAD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062AEB4
std::_Lockit::_Lockit.LIBCPMT ref: 0062AEBE

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Facet_Register.LIBCPMT ref: 0062AF0F
std::_Lockit::~_Lockit.LIBCPMT ref: 0062AF2F

Strings

d:g, xrefs: 0062AEC9

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: d:g
API String ID: 2854358121-1189122156
Opcode ID: 52bf7e3431be741a6f7a105911e986b749d6645962bd9e6e8345df27473ad3c3
Instruction ID: a306d705d68c98a6c616ccfcad6cebdf054272b3433f46cafef9ac17b67fd6ba
Opcode Fuzzy Hash: 52bf7e3431be741a6f7a105911e986b749d6645962bd9e6e8345df27473ad3c3
Instruction Fuzzy Hash: 7D010471900679DBCB44EFA8D8516EE7763AF44314F14000CF850AB3C1CF748A469F96

Function 0064A628 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,C1C81EE7,?,?,00000001,0065D620,000000FF,?,0064A61D,?,?,0064A5F4,?,?), ref: 0064A65D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0064A66F
FreeLibrary.KERNEL32(00000000,?,00000001,0065D620,000000FF,?,0064A61D,?,?,0064A5F4,?,?), ref: 0064A691

Strings

mscoree.dll, xrefs: 0064A656
CorExitProcess, xrefs: 0064A667

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a32d89328016db33549aae4488f4dac52dd72a3244accbf7b83ca22b3cd6bdc2
Instruction ID: ccd78a5dca15fd67e07a0c85b85005c5644d13e93536b377f1ab386b9f49b503
Opcode Fuzzy Hash: a32d89328016db33549aae4488f4dac52dd72a3244accbf7b83ca22b3cd6bdc2
Instruction Fuzzy Hash: CD016271950725EBDB11CF90DC05FAEBBBAFB05B66F050629E811A2290DB759900CA90

Function 0064F0FA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,0064F064,?,?,?,?,?,0064F188,0000001A,AppPolicyGetProcessTerminationMethod,00664848,AppPolicyGetProcessTerminationMethod,?), ref: 0064F109
GetLastError.KERNEL32(?,0064F064,?,?,?,?,?,0064F188,0000001A,AppPolicyGetProcessTerminationMethod,00664848,AppPolicyGetProcessTerminationMethod,?,?,0065167E,00000000), ref: 0064F113
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,?,?,?), ref: 0064F151

Strings

ext-ms-, xrefs: 0064F136
api-ms-, xrefs: 0064F120

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-$ext-ms-
API String ID: 3177248105-537541572
Opcode ID: e7d384a7d63e2b28ecc8a290a0f1c949c46ecc7d597dc9b1b00cf7ec74e43d14
Instruction ID: bd1dd9b751c1445a370f22a496043500a242a85978670ebac3b1969e3e1cee35
Opcode Fuzzy Hash: e7d384a7d63e2b28ecc8a290a0f1c949c46ecc7d597dc9b1b00cf7ec74e43d14
Instruction Fuzzy Hash: 25F03030680305F7EF211B61EC56F993F579F00B51F642030FE0CE92E1EB62E9619585

Function 0062A7B1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062A7B8
std::_Lockit::_Lockit.LIBCPMT ref: 0062A7C2

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

messages.LIBCPMT ref: 0062A7FC
std::_Lockit::~_Lockit.LIBCPMT ref: 0062A833

Strings

p:g, xrefs: 0062A7CD

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3messages
String ID: p:g
API String ID: 50917705-1573886912
Opcode ID: 533a9d0def195b600ec2fa8bafe94d79950254ead45f4b782f44a694e3a61004
Instruction ID: a80da95a21d892b21e1b43615df878ccb4c4f592a71c08ce754f60488e872d0b
Opcode Fuzzy Hash: 533a9d0def195b600ec2fa8bafe94d79950254ead45f4b782f44a694e3a61004
Instruction Fuzzy Hash: 41F096319009255BCB59FBA0D8526FE3737AF00724F14051CF550AB2D1EF748A459B9A

Function 0062A846 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062A84D
std::_Lockit::_Lockit.LIBCPMT ref: 0062A857

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

messages.LIBCPMT ref: 0062A891
std::_Lockit::~_Lockit.LIBCPMT ref: 0062A8C8

Strings

H:g, xrefs: 0062A862

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3messages
String ID: H:g
API String ID: 50917705-2008494056
Opcode ID: ca5ff19217282506308ca4071e4e04261cefc139ff7425cc72c45ca6230ad33d
Instruction ID: b1696eada0fb281dc64365415d267dddb587250bc2cdd507c2318ba918971b5d
Opcode Fuzzy Hash: ca5ff19217282506308ca4071e4e04261cefc139ff7425cc72c45ca6230ad33d
Instruction Fuzzy Hash: 19F0F03180092A9FCB88FBB0D812AEE3323AF00728F14010CF4206B2C1DF398A459F96

Function 0064E99C Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0064EA1F
__alloca_probe_16.LIBCMT ref: 0064EAE8
__freea.LIBCMT ref: 0064EB4F

Part of subcall function 0064D330: HeapAlloc.KERNEL32(00000000,?,?,?,0064CD65,?,00000000,?,0063E0E9,?,?,?,?,?,?,0061163C), ref: 0064D365

__freea.LIBCMT ref: 0064EB62
__freea.LIBCMT ref: 0064EB6F

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: a738876e4d86998fcce5d91cd2fb963ca022693adef7b3960019fe6424d16581
Instruction ID: 8066e3e3ccb352a85ebd8d5b24496df31bf0d5be974652ac1e766738f09886d2
Opcode Fuzzy Hash: a738876e4d86998fcce5d91cd2fb963ca022693adef7b3960019fe6424d16581
Instruction Fuzzy Hash: 0951B472600206AFEB219F60CD81EFB7AABFF44714F25052DFD09D6241EB72DC418669

Function 0061C840 Relevance: 7.6, APIs: 5, Instructions: 109COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0061C86D
std::_Lockit::_Lockit.LIBCPMT ref: 0061C890
std::_Lockit::~_Lockit.LIBCPMT ref: 0061C8B8
std::_Facet_Register.LIBCPMT ref: 0061C92D
std::_Lockit::~_Lockit.LIBCPMT ref: 0061C961

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: cdb64214d9e5f74aba5bac88edf0616fdc2395117fb06ae42ca8eddb273ebf39
Instruction ID: 52d07d552b6ad171ec3564e71d8bf2adf5d68750d7183a333fb90c35526f0ba3
Opcode Fuzzy Hash: cdb64214d9e5f74aba5bac88edf0616fdc2395117fb06ae42ca8eddb273ebf39
Instruction Fuzzy Hash: A141C1718002299FCB05DF58D940BEEFBB6FF44320F184159E858A7391D774AE85CBA1

Function 0061F240 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0061F26D
std::_Lockit::_Lockit.LIBCPMT ref: 0061F290
std::_Lockit::~_Lockit.LIBCPMT ref: 0061F2B8
std::_Facet_Register.LIBCPMT ref: 0061F32D
std::_Lockit::~_Lockit.LIBCPMT ref: 0061F361

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: f31f8e3d9652d434f7096f78276f3d643fb56c20fb952f2b679d2a6e7ebf1515
Instruction ID: 9ada495500ad54d48332b138357c94136c433e2cb0059785fc349ed5af28c7e5
Opcode Fuzzy Hash: f31f8e3d9652d434f7096f78276f3d643fb56c20fb952f2b679d2a6e7ebf1515
Instruction Fuzzy Hash: 3B41C171800619CFCB05DF98D840BEEBBB6FB40320F284269E815A73A1D774AE81CBD1

Function 0061EA80 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0061EAAD
std::_Lockit::_Lockit.LIBCPMT ref: 0061EAD0
std::_Lockit::~_Lockit.LIBCPMT ref: 0061EAF8
std::_Facet_Register.LIBCPMT ref: 0061EB6D
std::_Lockit::~_Lockit.LIBCPMT ref: 0061EBA1

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: ec27e3054cfaad087d275b8b96dcb50b353686584af42b06c97e6d5193bf7759
Instruction ID: e95b1c64c11099f3ba41b04c71b18dcc3a667694e3392977bae84ac9c7f3bc6a
Opcode Fuzzy Hash: ec27e3054cfaad087d275b8b96dcb50b353686584af42b06c97e6d5193bf7759
Instruction Fuzzy Hash: F941AC7180425ACFCB05DF58D940BEEFBB6FB50320F188159E81AA7391D775AE81CB91

Function 0061EBC0 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0061EBED
std::_Lockit::_Lockit.LIBCPMT ref: 0061EC10
std::_Lockit::~_Lockit.LIBCPMT ref: 0061EC38
std::_Facet_Register.LIBCPMT ref: 0061ECAD
std::_Lockit::~_Lockit.LIBCPMT ref: 0061ECE1

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 7897eff6ca7da21d3225dbb827e40008656dc63539dc0aeebbcf87a3ed7934da
Instruction ID: 9e394fd004c07b007f8f77b47a97d4a78848dfeec0520a97d954140f598abcce
Opcode Fuzzy Hash: 7897eff6ca7da21d3225dbb827e40008656dc63539dc0aeebbcf87a3ed7934da
Instruction Fuzzy Hash: E341BC71800259DFCB09DF58D980BEEBBB6FB40320F184159E825A7390D775AE81CBD1

Function 00617E40 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 82COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000010,00000010,?,00617ACB,?,?,?), ref: 00617E47

Strings

Call to ShellExecuteEx() returned:, xrefs: 00617E6D
Last error=, xrefs: 00617ED3
true, xrefs: 00617E51
false, xrefs: 00617E56

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ErrorLast
String ID: Call to ShellExecuteEx() returned:$Last error=$false$true
API String ID: 1452528299-1782174991
Opcode ID: d5a8002e123045af4b0cd3c52e009ca64256fe1371214f25ee0646bee1de3f88
Instruction ID: 84219bc8e84d7a103b07a0f0f499fa4ab680c8e26e9ffd40e9232a978711f42b
Opcode Fuzzy Hash: d5a8002e123045af4b0cd3c52e009ca64256fe1371214f25ee0646bee1de3f88
Instruction Fuzzy Hash: FF218E49B102628ACB705F7CC4003BAA6F2EF54744F6918AFECC8D7390F6698CC28395

Function 00627D3A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 00627D5A
_Maklocstr.LIBCPMT ref: 00627D77
_Maklocstr.LIBCPMT ref: 00627D94
_Maklocchr.LIBCPMT ref: 00627DA6
_Maklocchr.LIBCPMT ref: 00627DB9

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Maklocstr$Maklocchr
String ID:
API String ID: 2020259771-0
Opcode ID: 6e211074460127c52ec1a77178790c00f142d0109e0532b7552359e3ea49e2ba
Instruction ID: 7982ed277780ed0047d79902e532136b8d733e7a3b103bac1b38616892473c1c
Opcode Fuzzy Hash: 6e211074460127c52ec1a77178790c00f142d0109e0532b7552359e3ea49e2ba
Instruction Fuzzy Hash: 72118CB1908B54BBE3209BA5E881F63B7EDFF09750F044919F185CBA40D264F8508BA8

Function 00624171 Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00624178
std::_Lockit::_Lockit.LIBCPMT ref: 00624182

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

numpunct.LIBCPMT ref: 006241BC
std::_Facet_Register.LIBCPMT ref: 006241D3
std::_Lockit::~_Lockit.LIBCPMT ref: 006241F3

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: 5206e7942d93f5a3adf33098fe4a570fb27994fa8d12a9c64d567f68ea88a3e5
Instruction ID: 33717609983c2e2b1457f91e7407f254781b9e51a89693489835f0bbd8135598
Opcode Fuzzy Hash: 5206e7942d93f5a3adf33098fe4a570fb27994fa8d12a9c64d567f68ea88a3e5
Instruction Fuzzy Hash: 9311CE3590063A8BCB48EFA4E855ABE7BA3AF94714F28000CF911A7391DF749E418F95

Function 006353AB Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006353B2
std::_Lockit::_Lockit.LIBCPMT ref: 006353BC

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

moneypunct.LIBCPMT ref: 006353F6
std::_Facet_Register.LIBCPMT ref: 0063540D
std::_Lockit::~_Lockit.LIBCPMT ref: 0063542D

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 7c1e1b0947191abf41b33708bd232ee419519624ac8a542e84756b9459d61f8f
Instruction ID: f9113916c980ccdb546efaf21c956a49e98aa9723bd10b397920ced0d64e35c1
Opcode Fuzzy Hash: 7c1e1b0947191abf41b33708bd232ee419519624ac8a542e84756b9459d61f8f
Instruction Fuzzy Hash: 4101C071900A259BCB49EBA4D851AAE77A3BF44725F24000CF812A73D2DF749E819BD5

Function 00635440 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00635447
std::_Lockit::_Lockit.LIBCPMT ref: 00635451

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

moneypunct.LIBCPMT ref: 0063548B
std::_Facet_Register.LIBCPMT ref: 006354A2
std::_Lockit::~_Lockit.LIBCPMT ref: 006354C2

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 2312e435bb4742002a50f7faeb41db657da5443482924cf29b44cdb088c9172c
Instruction ID: a4eb495a8781902bb68ce8a7ba1cac174bf72ce5057d8cbfaf29390419c8cc24
Opcode Fuzzy Hash: 2312e435bb4742002a50f7faeb41db657da5443482924cf29b44cdb088c9172c
Instruction Fuzzy Hash: BB0104319006259BCB08EBA4C801AAEB7B3AF44715F14000CF516673C2DF348A408BD5

Function 00623FB2 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00623FB9
std::_Lockit::_Lockit.LIBCPMT ref: 00623FC3

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

codecvt.LIBCPMT ref: 00623FFD
std::_Facet_Register.LIBCPMT ref: 00624014
std::_Lockit::~_Lockit.LIBCPMT ref: 00624034

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registercodecvt
String ID:
API String ID: 712880209-0
Opcode ID: d82e61691b7304d23251989def6832749f32f2702f644937832ea2d3f60c17df
Instruction ID: 0ab37cdb5685a1a5d8ef067f86b62ff4211f6e998ab9bffe3c9884203b1c2460
Opcode Fuzzy Hash: d82e61691b7304d23251989def6832749f32f2702f644937832ea2d3f60c17df
Instruction Fuzzy Hash: D201C4319006399BCB45EBA4E855AEE7B73AF44714F14000CF911AB3D1DF749E819F95

Function 00616150 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 105libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 006161B5
GetLastError.KERNEL32(?,?,?,000000FF,0065B8CD,000000FF), ref: 0061626B

Part of subcall function 00611FD0: FindResourceW.KERNEL32(00000000,?,00000006,?,00000000,0065B0ED,000000FF,?,80070057,?,00000000,?,00000010,?,00611B09,?), ref: 0061205C

LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,000000FF,0065B8CD,000000FF), ref: 0061620F

Strings

ntdll.dll, xrefs: 006161EB

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: DirectoryErrorFindLastLibraryLoadResourceSystem
String ID: ntdll.dll
API String ID: 4113295189-2227199552
Opcode ID: 774c7eb534931b7f61b6f4ae73260d06a46f370bd947ab67006fc9a271f925a4
Instruction ID: 60927a343458c834efc0a0b6769ad90a3f6f7008e1775c9adb48b247a7922c53
Opcode Fuzzy Hash: 774c7eb534931b7f61b6f4ae73260d06a46f370bd947ab67006fc9a271f925a4
Instruction Fuzzy Hash: 24416E75A002099FDB10DF68CC85BEEBBB6FF08310F184169E915EB2C1DBB49A45CB91

Function 0063690D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00636914
_Mpunct.LIBCPMT ref: 006369AC
_Mpunct.LIBCPMT ref: 006369C6

Strings

$+xv, xrefs: 006369D1

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Mpunct$H_prolog3
String ID: $+xv
API String ID: 4281374311-1686923651
Opcode ID: 588d4fe9944ee4a0cf06ef09de8319c6a8747450d97dfc927a48cadf61c0dec0
Instruction ID: a1d8cebd579bee13e435cbfbe2588be6a7b3c00a8140d88916af73ea4d3a4a26
Opcode Fuzzy Hash: 588d4fe9944ee4a0cf06ef09de8319c6a8747450d97dfc927a48cadf61c0dec0
Instruction Fuzzy Hash: 5421CEB1800B52AEDB65DF64C850B6BBFF9AB08300F04491EF499C7A82D730E601CBD4

Function 0062DF5D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062DF64

Part of subcall function 00627D3A: _Maklocstr.LIBCPMT ref: 00627D5A
Part of subcall function 00627D3A: _Maklocstr.LIBCPMT ref: 00627D77
Part of subcall function 00627D3A: _Maklocstr.LIBCPMT ref: 00627D94
Part of subcall function 00627D3A: _Maklocchr.LIBCPMT ref: 00627DA6
Part of subcall function 00627D3A: _Maklocchr.LIBCPMT ref: 00627DB9

_Mpunct.LIBCPMT ref: 0062DFFC
_Mpunct.LIBCPMT ref: 0062E016

Strings

$+xv, xrefs: 0062E021

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Maklocstr$MaklocchrMpunct$H_prolog3
String ID: $+xv
API String ID: 2939335142-1686923651
Opcode ID: a0baf45e5f1f8e54c133a919183d7ba17b564be77684add06580bd1969e5178c
Instruction ID: e00ed30566c7a9572da8e64a6ff7a02101a4a4a3a130847f67e26edc00bee70c
Opcode Fuzzy Hash: a0baf45e5f1f8e54c133a919183d7ba17b564be77684add06580bd1969e5178c
Instruction Fuzzy Hash: 06219EB1904F66AEDB65DF749850BABBBF9AB08300F04091EE499C7A41D770E605CF94

Function 00627E2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 00627E6A
_Maklocstr.LIBCPMT ref: 00627E83

Part of subcall function 00627FB2: Concurrency::cancel_current_task.LIBCPMT ref: 00628054

_Maklocstr.LIBCPMT ref: 00627E92

Strings

:AM:am:PM:pm, xrefs: 00627E8A

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Maklocstr$Concurrency::cancel_current_task
String ID: :AM:am:PM:pm
API String ID: 980645097-1966799564
Opcode ID: 23cd73da012e299f7296fddedce4ecfb49396b2d385d3f7cf1b7dbd9af039adf
Instruction ID: 4a2037933de782faa26c2901b5af7a34219d0d2c9e645a99e1fde77832ce2a6b
Opcode Fuzzy Hash: 23cd73da012e299f7296fddedce4ecfb49396b2d385d3f7cf1b7dbd9af039adf
Instruction Fuzzy Hash: F301A772D047187BDB50AFA4EC46C9FB3BDEB85710B01441EF805AB242DA74AD058BA4

Function 0062A8DB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062A8E2
std::_Lockit::_Lockit.LIBCPMT ref: 0062A8EC

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Lockit::~_Lockit.LIBCPMT ref: 0062A95D

Strings

t:g, xrefs: 0062A8F7

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: t:g
API String ID: 1383202999-1522938652
Opcode ID: ee44f3111d0b87a3d7fff4d6cbab29d581337bad3e6099858cb9289f60bfbea1
Instruction ID: 31bd3daff9e5cabf0cd8aa83fddb7b53cb9c9bab24d3bc41506a580aa35a758c
Opcode Fuzzy Hash: ee44f3111d0b87a3d7fff4d6cbab29d581337bad3e6099858cb9289f60bfbea1
Instruction Fuzzy Hash: 61F0C2318009295BCB44EAA0D852AFE2327AF00724F14010CF550672D1DF348A848B95

Function 0062A970 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062A977
std::_Lockit::_Lockit.LIBCPMT ref: 0062A981

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Lockit::~_Lockit.LIBCPMT ref: 0062A9F2

Strings

L:g, xrefs: 0062A98C

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: L:g
API String ID: 1383202999-1891534644
Opcode ID: a29cc7fda35b41449d542ad3689fa9bb2d4e8bcd8e8aec6ea9ab064247ccb66c
Instruction ID: 81c54a1e04211392a507a090283b3cc599cc496f0df4218bf4f66d5837326cc9
Opcode Fuzzy Hash: a29cc7fda35b41449d542ad3689fa9bb2d4e8bcd8e8aec6ea9ab064247ccb66c
Instruction Fuzzy Hash: 9DF0F631C009259BCB44FFA0D812BFE2323AF00728F14010CF454672D1EF348A849B99

Function 0062AA05 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062AA0C
std::_Lockit::_Lockit.LIBCPMT ref: 0062AA16

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Lockit::~_Lockit.LIBCPMT ref: 0062AA87

Strings

x:g, xrefs: 0062AA21

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: x:g
API String ID: 1383202999-1406978680
Opcode ID: d67f3016b6ca8967e69070829c602708a3bfe68f63eacb02359334d185f8be3c
Instruction ID: 56c86d15a13659f70f79e3283952fff3a6d845e2e7197d33ef10da2d08569243
Opcode Fuzzy Hash: d67f3016b6ca8967e69070829c602708a3bfe68f63eacb02359334d185f8be3c
Instruction Fuzzy Hash: 86F096319009265BCB45FBA0D952AEE2727AF00754F14450CF550A72D1DF748A459B95

Function 0062AA9A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062AAA1
std::_Lockit::_Lockit.LIBCPMT ref: 0062AAAB

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Lockit::~_Lockit.LIBCPMT ref: 0062AB1C

Strings

P:g, xrefs: 0062AAB6

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: P:g
API String ID: 1383202999-1703075104
Opcode ID: 4ce5ed1be8627bd2fc18eddf5408a5cd854ff0e2af600d17eabcd0e924836d83
Instruction ID: 983cc091f9e4e0561a1c9fc290963a63eb52759b1bdecad74bfe4f38fab50aaa
Opcode Fuzzy Hash: 4ce5ed1be8627bd2fc18eddf5408a5cd854ff0e2af600d17eabcd0e924836d83
Instruction Fuzzy Hash: 31F0903190092A9BCB59FFA0D852AFE2723AF04729F14041CF9646B2D2DF748A44DF96

Function 0063DE82 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0063DE33,00000000,?,00673F04,?,?,?,0063DFD6,00000004,InitializeCriticalSectionEx,0066230C,InitializeCriticalSectionEx), ref: 0063DE8F
GetLastError.KERNEL32(?,0063DE33,00000000,?,00673F04,?,?,?,0063DFD6,00000004,InitializeCriticalSectionEx,0066230C,InitializeCriticalSectionEx,00000000,?,0063DD8D), ref: 0063DE99
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0063DEC1

Strings

api-ms-, xrefs: 0063DEA6

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: effdfeae2a21f746efeefd4803df08e66af743be450bbb309e94ad4e74921aad
Instruction ID: 3cd315368edf66c4b8d9194a96d0dff9b5727369ebaf64bce13065d971dc8ed8
Opcode Fuzzy Hash: effdfeae2a21f746efeefd4803df08e66af743be450bbb309e94ad4e74921aad
Instruction Fuzzy Hash: F3E04F70A80305B7EF211B60EC16B9A3F5B9F10B52F241030F90CE81E1D761A95495C8

Function 00639557 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(00673B74,?,?,006126B7,00674714,0065EC90), ref: 00639561
ReleaseSRWLockExclusive.KERNEL32(00673B74,?,?,006126B7,00674714,0065EC90), ref: 00639594
WakeAllConditionVariable.KERNEL32(00673B70,?,?,006126B7,00674714,0065EC90), ref: 0063959F

Strings

t;g, xrefs: 0063955B

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWake
String ID: t;g
API String ID: 1466638765-1138557533
Opcode ID: 3f754a814b4b7765d3092e723aa4190b7659d56d26209443c11e945b2aa8c5b8
Instruction ID: 75717f92251b4bbedf2881dae27843b666cdb68a6a5a040e84c8347668dde43e
Opcode Fuzzy Hash: 3f754a814b4b7765d3092e723aa4190b7659d56d26209443c11e945b2aa8c5b8
Instruction Fuzzy Hash: 9BF06D75900621DFC318DF58EC58D983BABFB0971AB11102AF90D83320CB706980DBB4

Function 0063952C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(00673B74), ref: 00639536
ReleaseSRWLockExclusive.KERNEL32(00673B74), ref: 00639543
WakeAllConditionVariable.KERNEL32(00673B70), ref: 0063954E

Strings

t;g, xrefs: 00639530

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWake
String ID: t;g
API String ID: 1466638765-1138557533
Opcode ID: c09ec6faeebc214dd96efbc4e6f562576e05b9260daabb3e3880ccf2b191adef
Instruction ID: f2902f1e847262b97252d9be785e8afe06c436a28302a4f7b4de2b32cc9f0dde
Opcode Fuzzy Hash: c09ec6faeebc214dd96efbc4e6f562576e05b9260daabb3e3880ccf2b191adef
Instruction Fuzzy Hash: 48D0C932541635EBC350ABA4EC08ADA7BAEEF0A77BF115062F54D82210CB7059408BF6

Function 0061ED00 Relevance: 6.5, APIs: 4, Instructions: 460COMMON

Download Yara Rule

APIs

_strcspn.LIBCMT ref: 0061EDA1
_strcspn.LIBCMT ref: 0061EDC5

Part of subcall function 0061B410: LocalAlloc.KERNEL32(00000040,C1C81F0B,C1C81EE7,00000000,?,?,C1C81EE7,00000001,?,?,?,?,C1C81EE7,00000000,?), ref: 0061B466
Part of subcall function 0061B410: LocalFree.KERNEL32(C1C81EE7,?,?,?,?,?,?,C1C81EE7,00000001,?,?,?,?,C1C81EE7,00000000,?), ref: 0061B55D

LocalFree.KERNEL32(?), ref: 0061F1A5
LocalFree.KERNEL32(?), ref: 0061F1F1

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Local$Free$_strcspn$Alloc
String ID:
API String ID: 3422560186-0
Opcode ID: 4ec5a7a26690b56e70ccb3831bbbdd1fee02ac04b6039a2361fbd0f6e88e6c57
Instruction ID: 128e0f4076dd19f8e6b988bc1abd3ece7bf80d7beb7d9a06cacecdd77e3622aa
Opcode Fuzzy Hash: 4ec5a7a26690b56e70ccb3831bbbdd1fee02ac04b6039a2361fbd0f6e88e6c57
Instruction Fuzzy Hash: 2D026A75E00249DFDB14CFA4C854AEEBBB6FF88310F184169E815AB351D731AE86CB91

Function 006270C9 Relevance: 6.3, APIs: 4, Instructions: 347COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 006270D0
_strcspn.LIBCMT ref: 0062713E
_strcspn.LIBCMT ref: 0062715E
ctype.LIBCPMT ref: 006271CE

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: f60f5b56e68cd79511fc191c607cb0387494fc8dcf4e47939d8bd134ffe33bb1
Instruction ID: 9bf7b48499bb8349e612700b96264ac769d8835e18a18d4f4eac51168057872a
Opcode Fuzzy Hash: f60f5b56e68cd79511fc191c607cb0387494fc8dcf4e47939d8bd134ffe33bb1
Instruction Fuzzy Hash: 56D16771D04629EFDF14DFA4D884AEEBBBAEF08310F144129E815AB251D730AE55CFA4

Function 00622A5C Relevance: 6.3, APIs: 4, Instructions: 343COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00622A63
_strcspn.LIBCMT ref: 00622AD1
_strcspn.LIBCMT ref: 00622AF1
ctype.LIBCPMT ref: 00622B61

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: 0bf4860722bd9d140460cd06e2d9b8b255775befae5d4bbe29a9264829bfbd33
Instruction ID: fa823837322616f149ad8654174bf02e075140749f1c882dd1a6e86452d46c46
Opcode Fuzzy Hash: 0bf4860722bd9d140460cd06e2d9b8b255775befae5d4bbe29a9264829bfbd33
Instruction Fuzzy Hash: 67D16B71D0061AAFDF55DFA4D890AEEBBB6FF08310F14451AE815AB251D730AE45CFA0

Function 00658298 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(C1C81EE7,00000000,00000000,?), ref: 006582FB

Part of subcall function 006512CA: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,00000000,?,-00000008,-00000008,00000000,?,?,0064EB45,?,00000000), ref: 00651329

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00658551
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00658597
GetLastError.KERNEL32 ref: 0065863A

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: c78fafbf9c4d19573030734dc95f0b0465584ed607cf7614141a6f56e5da0bc8
Instruction ID: 71200edf28d181491704d417369038fe74a73d86196d0d181c85d94c451437a1
Opcode Fuzzy Hash: c78fafbf9c4d19573030734dc95f0b0465584ed607cf7614141a6f56e5da0bc8
Instruction Fuzzy Hash: EFD18C75D002489FCB15CFA8D8909EDBBF6FF48311F28416AE856FB751EA30A946CB50

Function 0063CE2A Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0063CEF1
___AdjustPointer.LIBCMT ref: 0063CF14
___AdjustPointer.LIBCMT ref: 0063CFB0

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 09877da74207bcd8eaeb04662ed75c8e1ca70b482e86e85795d41224c460fe57
Instruction ID: 88d0d2ad7907d3554a2ad83c7405615934db1b18a53c87c7eaae7c8803046334
Opcode Fuzzy Hash: 09877da74207bcd8eaeb04662ed75c8e1ca70b482e86e85795d41224c460fe57
Instruction Fuzzy Hash: 7751EE72A00602AFDB288F50D845BAAB7A7EF40720F14452DF84AA7391E735EC91D7D4

Function 00614960 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 160memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,80000022,?,?,/Ca,?,00000000,?), ref: 006149BA
LocalAlloc.KERNEL32(00000040,7FFFFFFF,?,?,/Ca,?,00000000,?), ref: 00614A04
LocalFree.KERNEL32(00000000,?,/Ca,?,00000000,?), ref: 00614A85

Strings

/Ca, xrefs: 00614968

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Local$Alloc$Free
String ID: /Ca
API String ID: 209276640-766612935
Opcode ID: 7c0081e033736385e3db2f2afd9b9e71208ede174129c0d26fdc379ecb3f6893
Instruction ID: 7882ec9daff2d09ab47ce115bb05c1e01bd67a17d46ec4da73b089613502db66
Opcode Fuzzy Hash: 7c0081e033736385e3db2f2afd9b9e71208ede174129c0d26fdc379ecb3f6893
Instruction Fuzzy Hash: 0441F0727042568BCB14DF68D8809AEB3D6AF88310F190A3EF856C7385EB31D95587A9

Function 00614850 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,80000022,?,?,?,?,?,0061432F,00000000,?), ref: 006148C9
LocalAlloc.KERNEL32(00000040,7FFFFFFF,?,?,?,?,?,0061432F,00000000,?), ref: 006148E5
LocalFree.KERNEL32(?,00000000,?), ref: 0061493B

Strings

/Ca, xrefs: 00614853

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Local$Alloc$Free
String ID: /Ca
API String ID: 209276640-766612935
Opcode ID: 73a3db2163c8ea9f79be01dab2ccbce3e6a129e26ba77b09d5e0b62e5b98a6f3
Instruction ID: cf502e22e3486358c26ae3f0312e450f14ba116ae83def02943ef3a62394a9b8
Opcode Fuzzy Hash: 73a3db2163c8ea9f79be01dab2ccbce3e6a129e26ba77b09d5e0b62e5b98a6f3
Instruction Fuzzy Hash: 9931D1726002118BD7189F28C985AAF77DBEB813A5F280A6DE526DB3D0EE30DC818651

Function 00649D05 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a28df73b424b739d6e97a30b6537213f095732ad56528ea8874b39e382971c7d
Instruction ID: dd76a1727dbd6ccb1a7f7f66d4c32807b31698c849ceb4331da285f5ea60df9f
Opcode Fuzzy Hash: a28df73b424b739d6e97a30b6537213f095732ad56528ea8874b39e382971c7d
Instruction Fuzzy Hash: 71219331A44A05AF9B60EF71DC40DAB77ABAF00364B108528F915D7290EB31EC1087B0

Function 006192A0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00618D7C,00000000,?,?,?,?,?,?,?,00000000,0065BFF5,000000FF), ref: 006192A7

Strings

Call to ShellExecute() for verb<, xrefs: 006192B1
Last error=, xrefs: 00619301
> returned:, xrefs: 006192B6

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ErrorLast
String ID: > returned:$Call to ShellExecute() for verb<$Last error=
API String ID: 1452528299-1781106413
Opcode ID: b942b7fb504f26f4ec48dee3f70928f4c0dc41bef9a250c739198a9123f9db45
Instruction ID: 7807b15c9488f66b14b78edf8862c037c3d8ce074e03baafbd78333005197436
Opcode Fuzzy Hash: b942b7fb504f26f4ec48dee3f70928f4c0dc41bef9a250c739198a9123f9db45
Instruction Fuzzy Hash: 32218159B2026187CB701F7C84112B9B6F6AF54754F29542FD8D8D7390FA798CC2C3A5

Function 006249F5 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006249FC
std::_Lockit::_Lockit.LIBCPMT ref: 00624A06
std::_Lockit::~_Lockit.LIBCPMT ref: 00624AAD
Concurrency::cancel_current_task.LIBCPMT ref: 00624AB8

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$Concurrency::cancel_current_taskH_prolog3Lockit::_Lockit::~_
String ID:
API String ID: 4244582100-0
Opcode ID: b85df116223be23194530d33a1468108c4d1d7035348b29463924f5f7129e179
Instruction ID: 33198ef847393cf7c3d9ca459f7c1e1ebe8d2c683f08c6dca8290edc1557149f
Opcode Fuzzy Hash: b85df116223be23194530d33a1468108c4d1d7035348b29463924f5f7129e179
Instruction Fuzzy Hash: 3E213B34A40A26AFCB04EF14D891AADB772FF48711F008459E816AB7A1DF30AD10CF99

Function 006218C0 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000,C1C81EE7), ref: 006218FC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 0062191C
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 0062194D
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 00621966

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: 2fce513d6c7e1c17205a550c6d60ab1edce74e715bd1705ba9d7be15c6687b96
Instruction ID: 8f09daf2a99321fbc1d72e8a248ee5ba4c428a6e93889ea4f57bdfc77b7f0d5f
Opcode Fuzzy Hash: 2fce513d6c7e1c17205a550c6d60ab1edce74e715bd1705ba9d7be15c6687b96
Instruction Fuzzy Hash: BB219070A44718AFD720DF54DC0AFAFBBB9FB05B24F10422AF515AB2C0D7B46A458B94

Function 006240DC Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006240E3
std::_Lockit::_Lockit.LIBCPMT ref: 006240ED

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Facet_Register.LIBCPMT ref: 0062413E
std::_Lockit::~_Lockit.LIBCPMT ref: 0062415E

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: f6fc3aead649d9badf6ec29d00634f75b77abb89a788338ead2a9939e4bbad35
Instruction ID: 8f60696aef62a26282a4adc3e5ed53efcb5a148f9451f4ac84e26c9746372104
Opcode Fuzzy Hash: f6fc3aead649d9badf6ec29d00634f75b77abb89a788338ead2a9939e4bbad35
Instruction Fuzzy Hash: CA01ED71900A3A8BCB44EBA4E8556FE7B63AF84724F14000CF510A7392DF709A418F96

Function 0062B101 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062B108
std::_Lockit::_Lockit.LIBCPMT ref: 0062B112

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Facet_Register.LIBCPMT ref: 0062B163
std::_Lockit::~_Lockit.LIBCPMT ref: 0062B183

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 36c4e4f357d64b65d8c5d2cdd90e59aa7ffabde5674b6e2e9717431009a8cc6a
Instruction ID: 4aa2334db7669a17552ba5b6dee548c74419ff2df5c8cccd4870c421b12ef437
Opcode Fuzzy Hash: 36c4e4f357d64b65d8c5d2cdd90e59aa7ffabde5674b6e2e9717431009a8cc6a
Instruction Fuzzy Hash: 6201AD32900A699BCB49EBA4D85A6EE7763AF44724F24010CF850AB392DF349A419F95

Function 00635316 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0063531D
std::_Lockit::_Lockit.LIBCPMT ref: 00635327

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Facet_Register.LIBCPMT ref: 00635378
std::_Lockit::~_Lockit.LIBCPMT ref: 00635398

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 921e14dbc1190e3bc36bd2bd54c1e5369d026cd2d2c27cf2acd3100702c68fc3
Instruction ID: a5ed735d1b0aa181c53dae48986a69d620722faf825b1dccef9108340626d591
Opcode Fuzzy Hash: 921e14dbc1190e3bc36bd2bd54c1e5369d026cd2d2c27cf2acd3100702c68fc3
Instruction Fuzzy Hash: 2E0100759006258BCB04EBA4C811AAE7773BF84724F28040CF812AB3D1EFB48A419BD5

Function 0062A4C8 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062A4CF
std::_Lockit::_Lockit.LIBCPMT ref: 0062A4D9

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Facet_Register.LIBCPMT ref: 0062A52A
std::_Lockit::~_Lockit.LIBCPMT ref: 0062A54A

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 901a307eb096ba422fad1d93d9c76a1841e76a11bb14429662ccb5cecfc9ad46
Instruction ID: e1da5beda9334a7d0e68100d795c6b69f22275101c4239ba3fb48a199b92bc23
Opcode Fuzzy Hash: 901a307eb096ba422fad1d93d9c76a1841e76a11bb14429662ccb5cecfc9ad46
Instruction Fuzzy Hash: 4901ED31900A258BCB45EBA4D842AAE7773AF84324F14000CF411AB381CB708A048F96

Function 006354D5 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006354DC
std::_Lockit::_Lockit.LIBCPMT ref: 006354E6

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Facet_Register.LIBCPMT ref: 00635537
std::_Lockit::~_Lockit.LIBCPMT ref: 00635557

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: c105414160acfec40e9e378c77bc82c2a019f1ec0c7d684243ab6c602ad710ae
Instruction ID: 69a7c7b260a76e1882f18b041987ad7462418a1c2b46a5fabbda87ed65972b19
Opcode Fuzzy Hash: c105414160acfec40e9e378c77bc82c2a019f1ec0c7d684243ab6c602ad710ae
Instruction Fuzzy Hash: 88010071900625CBCB05EBA4C841AAE7B73AF84724F14000DF812AB3C1CF30DA059BD5

Function 0063556A Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00635571
std::_Lockit::_Lockit.LIBCPMT ref: 0063557B

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Facet_Register.LIBCPMT ref: 006355CC
std::_Lockit::~_Lockit.LIBCPMT ref: 006355EC

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 65eac19ebd4ecb6fa57246b98fc79aa71c1692ef0507ad647c68d2b2397ed43b
Instruction ID: 1047c20448103ca15a687c650916178794140e989f45a8fa674925049d65005d
Opcode Fuzzy Hash: 65eac19ebd4ecb6fa57246b98fc79aa71c1692ef0507ad647c68d2b2397ed43b
Instruction Fuzzy Hash: 1D01C075900A298BCB45EBA4D8516FE7BB3AF84724F14010CF412A73D1CF349A419BD5

Function 0062A55D Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062A564
std::_Lockit::_Lockit.LIBCPMT ref: 0062A56E

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Facet_Register.LIBCPMT ref: 0062A5BF
std::_Lockit::~_Lockit.LIBCPMT ref: 0062A5DF

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 8f9340ca15b7e26d1966549f8735670f326544ae2b0387b4dd002b03c16256af
Instruction ID: ad9bdd3ba48f0170ecbaa20a3892076d4a4e236d357b56b5a9aa412fb458ca97
Opcode Fuzzy Hash: 8f9340ca15b7e26d1966549f8735670f326544ae2b0387b4dd002b03c16256af
Instruction Fuzzy Hash: FF01AD369009258FCB45EBA4D8526AE7B67AF84724F24000CF850A7392DF749A45DF96

Function 0062AFD7 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062AFDE
std::_Lockit::_Lockit.LIBCPMT ref: 0062AFE8

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

std::_Facet_Register.LIBCPMT ref: 0062B039
std::_Lockit::~_Lockit.LIBCPMT ref: 0062B059

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 9416eb356411ca5db31c7a6de78bb6ef790ae720cd45b322aa55a0a5618ba612
Instruction ID: a1f09e8e7be6312267da7459aab4ef4bacfc1da0ca422b4d2de6b7f98fd09437
Opcode Fuzzy Hash: 9416eb356411ca5db31c7a6de78bb6ef790ae720cd45b322aa55a0a5618ba612
Instruction Fuzzy Hash: 2C01C031900A359BCB5AEFA4D8926EE7767EF44724F24000CF821A73D1DF349A419B99

Function 00626624 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062662B
std::_Lockit::_Lockit.LIBCPMT ref: 00626636
std::_Lockit::~_Lockit.LIBCPMT ref: 006266A4

Part of subcall function 00626787: std::locale::_Locimp::_Locimp.LIBCPMT ref: 0062679F

std::locale::_Setgloballocale.LIBCPMT ref: 00626651

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_Setgloballocale
String ID:
API String ID: 677527491-0
Opcode ID: 8318c8f1531970801029c8a23ba038b2a4ba63e3d9ff93f5defd790eeefa2e77
Instruction ID: b1a2da34f25fadd15ed2e251e6750516a12a1aaed37e24ff5e217bb10f75a71b
Opcode Fuzzy Hash: 8318c8f1531970801029c8a23ba038b2a4ba63e3d9ff93f5defd790eeefa2e77
Instruction Fuzzy Hash: 1F01BCB5A00A209BCB49EB60E84597C7B63BF84344F14001CF80257391DF74AE42DFCA

Function 0062A71C Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062A723
std::_Lockit::_Lockit.LIBCPMT ref: 0062A72D

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

ctype.LIBCPMT ref: 0062A767
std::_Lockit::~_Lockit.LIBCPMT ref: 0062A79E

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3ctype
String ID:
API String ID: 3358926169-0
Opcode ID: 213b5f24b568f32a7e962f8bc32070b7bb35ecf35eb60935bfb9e8a366a838e8
Instruction ID: 27fa7ef356d304c71fdc4ae3c038b855fee017a4bf556b8f108c71fa6b2b0e26
Opcode Fuzzy Hash: 213b5f24b568f32a7e962f8bc32070b7bb35ecf35eb60935bfb9e8a366a838e8
Instruction Fuzzy Hash: CAF0F6359009299BCB45FBA0D852BFE3733AF44718F14000CF6106B3C2DF748A458B9A

Function 00659BC7 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,006594C1,00000000,00000001,00000000,?,?,0065868E,?,00000000,00000000), ref: 00659BDE
GetLastError.KERNEL32(?,006594C1,00000000,00000001,00000000,?,?,0065868E,?,00000000,00000000,?,?,?,00658C31,00000000), ref: 00659BEA

Part of subcall function 00659BB0: CloseHandle.KERNEL32(FFFFFFFE,00659BFA,?,006594C1,00000000,00000001,00000000,?,?,0065868E,?,00000000,00000000,?,?), ref: 00659BC0

___initconout.LIBCMT ref: 00659BFA

Part of subcall function 00659B71: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00659BA0,006594AE,?,?,0065868E,?,00000000,00000000,?), ref: 00659B84

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,006594C1,00000000,00000001,00000000,?,?,0065868E,?,00000000,00000000,?), ref: 00659C0F

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 97a59b0b7691f7888cf092c98ab057471f041312c4ba4fb6721ed11681d8b83a
Instruction ID: fec097114ea95d3dc62175f0acb75066fd62aca37484a9cbdc56c72398d45a5a
Opcode Fuzzy Hash: 97a59b0b7691f7888cf092c98ab057471f041312c4ba4fb6721ed11681d8b83a
Instruction Fuzzy Hash: B2F01C36000219FBCF625F91EC14E9A3F67FB093A2F044120FE0986160D6328860EBE4

Function 0062AB2F Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0062AB36
std::_Lockit::_Lockit.LIBCPMT ref: 0062AB40

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

moneypunct.LIBCPMT ref: 0062AB7A
std::_Lockit::~_Lockit.LIBCPMT ref: 0062ABB1

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3moneypunct
String ID:
API String ID: 3160146232-0
Opcode ID: 00d941003f736d3e2c3f4a5e1cb3ee525f29d6581c870e8d2971a494d544d049
Instruction ID: 134363ce132d5fca44c50fa36d1b2672102f2881a1255b00ff47625d97769283
Opcode Fuzzy Hash: 00d941003f736d3e2c3f4a5e1cb3ee525f29d6581c870e8d2971a494d544d049
Instruction Fuzzy Hash: 2AF05831A409399BCB45EFA0D812AEE7727AB40709F14001CF8816B282DF748A059B9A

Function 00658B4F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 196fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00658298: GetConsoleOutputCP.KERNEL32(C1C81EE7,00000000,00000000,?), ref: 006582FB

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,00652C3F,?), ref: 00658CD4
GetLastError.KERNEL32(?,?,00652C3F,?,00652AD3,00000000,?,00000000,00652AD3,?,?,?,006703F8,0000002C,00652B44,?), ref: 00658CDE

Strings

?,e, xrefs: 00658C56, 00658CFF

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID: ?,e
API String ID: 2915228174-3567224262
Opcode ID: 61306b262799830aee4163c7e355d2b991b860881f11db2e6000a7b25fff9f83
Instruction ID: 161b3b9b95c6148466e72201fe32644e08a270d69cc35cefd38d91eed9ecd086
Opcode Fuzzy Hash: 61306b262799830aee4163c7e355d2b991b860881f11db2e6000a7b25fff9f83
Instruction Fuzzy Hash: 4961A4B1900119AFDF15DFA8C844AFEBBBBAF19305F140149ED04B7652DB32D90ACB60

Function 006344C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 193COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 006344C7
__cftoe.LIBCMT ref: 0063455A

Strings

!%x, xrefs: 006344D5

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: e35da16d2d1d42d1aa802c1c5fe286f41bc6bf57334c96de3870205470cdbdb3
Instruction ID: 5002dc8bef7a64909164ed256bfde02e663fb35fb3621ff5e5d3c0d72f2803e6
Opcode Fuzzy Hash: e35da16d2d1d42d1aa802c1c5fe286f41bc6bf57334c96de3870205470cdbdb3
Instruction Fuzzy Hash: 15717A71D00108AFDF18EFA8E881AEEB7B6EF09314F144529F415A7351EB35AE51CB94

Function 00638490 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00638497
__cftoe.LIBCMT ref: 0063852B

Strings

!%x, xrefs: 006384B1

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: 762ed906a62aa00894e8fa8d9d58289b0b28852878d3ce31ba2aeb700ceaa411
Instruction ID: f90f3d03fc4e87c06293a4a45ac23e722fa2e4c972e2ae97def04b453725e1cd
Opcode Fuzzy Hash: 762ed906a62aa00894e8fa8d9d58289b0b28852878d3ce31ba2aeb700ceaa411
Instruction Fuzzy Hash: 42718C71D00218AFDF05DFA8D881AEEBBB6FF09304F180529F855A7342EA31AD45CB94

Function 00624B8A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 189COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00624B91

Part of subcall function 0061BFF0: std::_Lockit::_Lockit.LIBCPMT ref: 0061C020
Part of subcall function 0061BFF0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C048

Part of subcall function 00618700: LocalAlloc.KERNEL32(00000040,00000000,0063A1C5,00000000,C1C81EE7,?,00000000,?,FFFFFFFF,?,0065EB28,000000FF,?,006117A4,?,0065FDDA), ref: 00618706

Part of subcall function 0061C3C0: __Getctype.LIBCPMT ref: 0061C3CA

Strings

8g, xrefs: 00624C0C
$9g, xrefs: 00624BA7

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$AllocGetctypeH_prolog3LocalLockit::_Lockit::~_
String ID: $9g$8g
API String ID: 3791111190-2548076957
Opcode ID: eb0f201d129c8b38da705444ea8aa69b6cf6da011514af4f35f29aa75124f63d
Instruction ID: e820dd1ae01d7955da8f64d602236e4a24f82ea477a3661e5544dca6f3bad7a9
Opcode Fuzzy Hash: eb0f201d129c8b38da705444ea8aa69b6cf6da011514af4f35f29aa75124f63d
Instruction Fuzzy Hash: 335107B1D01A36ABD7616FA59C42ABF7A6BEF05360F04452DFD049B282DF3089409FA5

Function 00633640 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00633647
_swprintf.LIBCMT ref: 006336BF

Part of subcall function 0062A71C: __EH_prolog3.LIBCMT ref: 0062A723
Part of subcall function 0062A71C: std::_Lockit::_Lockit.LIBCPMT ref: 0062A72D

Strings

%.0Lf, xrefs: 006336B7

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: H_prolog3H_prolog3_LockitLockit::__swprintfstd::_
String ID: %.0Lf
API String ID: 3614004578-1402515088
Opcode ID: 672d14124bb184f1c9c2756a3083c8ae9f096fb8427d6ebffd4f82831636a91c
Instruction ID: 5576fde3666edd2b65b3c59e127e488b9187d53813d90cb97c8ff3c6afda858a
Opcode Fuzzy Hash: 672d14124bb184f1c9c2756a3083c8ae9f096fb8427d6ebffd4f82831636a91c
Instruction Fuzzy Hash: CA616CB1D00228AFDF05DFE4D855AEDBBBAFF08300F104519E402AB395EB359A55CB94

Function 00633970 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00633977
_swprintf.LIBCMT ref: 006339EF

Part of subcall function 0061B7F0: std::_Lockit::_Lockit.LIBCPMT ref: 0061B81D
Part of subcall function 0061B7F0: std::_Lockit::_Lockit.LIBCPMT ref: 0061B840
Part of subcall function 0061B7F0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061B868
Part of subcall function 0061B7F0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061B911

Strings

%.0Lf, xrefs: 006339E7

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: a240b82bb2e42e8f23aa0a672b4e77e19c371661ccbd88fdaf30ef93bfce4062
Instruction ID: 30b036e7da9a3018eb6efffa882f7cfc35850bf42f159d842ac82424e0a2c1ee
Opcode Fuzzy Hash: a240b82bb2e42e8f23aa0a672b4e77e19c371661ccbd88fdaf30ef93bfce4062
Instruction Fuzzy Hash: 80617C71D00228AFCF09DFE4D844AEDBBBAFF48300F14451AE542AB395EB359A55CB94

Function 00638A0E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00638B75

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00638AD3, 00638B0A, 00638B0F
-, xrefs: 00638BA3

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: c46638e37d3bd029f09d82e648fa70ac9b1c36275ce30754558eafdc319be723
Instruction ID: c9e04c0a8542294a3f968a85be91e6e251eccad699f4ff2f50234f531680bb0b
Opcode Fuzzy Hash: c46638e37d3bd029f09d82e648fa70ac9b1c36275ce30754558eafdc319be723
Instruction Fuzzy Hash: D3518470A0434A9FDF25CEA988917EEFBF7AF45310F18446AF492D7341DA7489428BD1

Function 00638290 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00638297
_swprintf.LIBCMT ref: 0063830F

Part of subcall function 0061C840: std::_Lockit::_Lockit.LIBCPMT ref: 0061C86D
Part of subcall function 0061C840: std::_Lockit::_Lockit.LIBCPMT ref: 0061C890
Part of subcall function 0061C840: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C8B8
Part of subcall function 0061C840: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C961

Strings

%.0Lf, xrefs: 00638307

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3__swprintf
String ID: %.0Lf
API String ID: 1487807907-1402515088
Opcode ID: 165026bb76fb9a5e54baba3aaeeacf1937b405e4c6ddda5beca1e8140150ec97
Instruction ID: 2ce806c17e35f6ae994bb2ff35b1063f72b3f0c333f438e50bf0b78245d68843
Opcode Fuzzy Hash: 165026bb76fb9a5e54baba3aaeeacf1937b405e4c6ddda5beca1e8140150ec97
Instruction Fuzzy Hash: 6E618B71D00218AFCF09DFE4C845AEEBBBAFF08300F244519F406AB296EB359955CB94

Function 0061FD40 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0061FF1C

Strings

true, xrefs: 0061FE5B
false, xrefs: 0061FE45

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: false$true
API String ID: 118556049-2658103896
Opcode ID: ad2ce93b91889a3e3666e4671df5d0c052423420ea0e9b5954a235568aeea817
Instruction ID: 781b54a8cdd998c968d8a42b18da39d1bfabe0e98d13ee65c82ea85daeace3a6
Opcode Fuzzy Hash: ad2ce93b91889a3e3666e4671df5d0c052423420ea0e9b5954a235568aeea817
Instruction Fuzzy Hash: BF5183B1D007489FDB10DFA4C841BEEB7B9FF45304F14826EE845AB242E775A985CB91

Function 00619890 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 154COMMON

Download Yara Rule

Strings

\\?\UNC\, xrefs: 00619968, 006199C3
\\?\, xrefs: 006199DF, 00619A0C

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID:
String ID: \\?\$\\?\UNC\
API String ID: 0-3019864461
Opcode ID: ad7e86aae1cc10f3b9bc7f49c29c37ff70e794cd2f017710d5275f6417c1a8b4
Instruction ID: 2db7da9a917a1ffdedf90826548bc208b9ec29a603e2e30c3f87290b20bb7053
Opcode Fuzzy Hash: ad7e86aae1cc10f3b9bc7f49c29c37ff70e794cd2f017710d5275f6417c1a8b4
Instruction Fuzzy Hash: 9C518EB0D002059BDB24DF68C8A5BEEBBF6FF55314F18491DE441B7680D775AA88CBA0

Function 00653CFF Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0064CCB0: HeapFree.KERNEL32(00000000,00000000,?,00653726,?,00000000,?,?,006539C7,?,00000007,?,?,00653E96,?,?), ref: 0064CCC6
Part of subcall function 0064CCB0: GetLastError.KERNEL32(?,?,00653726,?,00000000,?,?,006539C7,?,00000007,?,?,00653E96,?,?), ref: 0064CCD1

___free_lconv_mon.LIBCMT ref: 00653D41

Strings

D!g, xrefs: 00653D13
("g, xrefs: 00653DEB

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ErrorFreeHeapLast___free_lconv_mon
String ID: ("g$D!g
API String ID: 4068849827-130177928
Opcode ID: bc5435321ec5d2454a630c68ab38f27dd88e2a79db51ea211d5677f63447c70a
Instruction ID: 6cee27f4c617128f3d495eae47a245829a0e4ae63c80cf5ebf125f63d9f23013
Opcode Fuzzy Hash: bc5435321ec5d2454a630c68ab38f27dd88e2a79db51ea211d5677f63447c70a
Instruction Fuzzy Hash: 88318F715007119FEB61AB78E945B9673FBAF007A1F10451EE859C7351EF31EE448B28

Function 0063D426 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0063D44B

Strings

RCC, xrefs: 0063D465
MOC, xrefs: 0063D45D

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 5fcfec15dcf6485889bc12b5547fbc0949ed65f83499c4d120252730e113aa77
Instruction ID: 312afd6fa257d09fd93c4d572e5238253429da9a87f5381d6da4e623375b0fa1
Opcode Fuzzy Hash: 5fcfec15dcf6485889bc12b5547fbc0949ed65f83499c4d120252730e113aa77
Instruction Fuzzy Hash: D1417C71900209AFCF16DF98ED81AEE7BB6FF48318F148199F905A7212D335EA50DB91

Function 00638160 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00638167

Part of subcall function 0061C840: std::_Lockit::_Lockit.LIBCPMT ref: 0061C86D
Part of subcall function 0061C840: std::_Lockit::_Lockit.LIBCPMT ref: 0061C890
Part of subcall function 0061C840: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C8B8
Part of subcall function 0061C840: std::_Lockit::~_Lockit.LIBCPMT ref: 0061C961

Strings

0123456789-, xrefs: 006381B7
0123456789-, xrefs: 006381B2

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 2088892359-2494171821
Opcode ID: 018edd25fe4a4a50197f9683d4c8152adc708d9cb011d31aea491cfd73dda364
Instruction ID: 14d5606a8bb5270f3f243aa597683a332eeb2a1799822506f8a46ac16a17f22a
Opcode Fuzzy Hash: 018edd25fe4a4a50197f9683d4c8152adc708d9cb011d31aea491cfd73dda364
Instruction Fuzzy Hash: 92418C31D00219EFCF15EFA4D8819EEBBB6BF08310F10005AF811AB251DB30AE46CB95

Function 00633510 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00633517

Part of subcall function 0062A71C: __EH_prolog3.LIBCMT ref: 0062A723
Part of subcall function 0062A71C: std::_Lockit::_Lockit.LIBCPMT ref: 0062A72D

Strings

0123456789-, xrefs: 00633567
%.0Lf, xrefs: 00633562

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: H_prolog3H_prolog3_LockitLockit::_std::_
String ID: %.0Lf$0123456789-
API String ID: 79917597-3094241602
Opcode ID: 8b27967aa2be584fe7cb137ff23e8ef4c1668f15346dc37c57de417ebae546d3
Instruction ID: de79563a2ac750f7afa11430e7e591b699ee909fd89cff661b68776c8acfa185
Opcode Fuzzy Hash: 8b27967aa2be584fe7cb137ff23e8ef4c1668f15346dc37c57de417ebae546d3
Instruction Fuzzy Hash: F4413871900228DFCF15EFE4D9819EEBBB6FF08324F100169E811AB355DB309A56CB95

Function 00633840 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00633847

Part of subcall function 0061B7F0: std::_Lockit::_Lockit.LIBCPMT ref: 0061B81D
Part of subcall function 0061B7F0: std::_Lockit::_Lockit.LIBCPMT ref: 0061B840
Part of subcall function 0061B7F0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061B868
Part of subcall function 0061B7F0: std::_Lockit::~_Lockit.LIBCPMT ref: 0061B911

Strings

0123456789-, xrefs: 00633897
0123456789-, xrefs: 00633892

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 2088892359-2494171821
Opcode ID: fe57e02c5c0ef3931913cd7c98f2f2d9a554dc4735180c1abea987fd3a5f452f
Instruction ID: f745fbdf64f06c855935a287435100d7a76db6aba8b53fab64c8a9f7c89d9764
Opcode Fuzzy Hash: fe57e02c5c0ef3931913cd7c98f2f2d9a554dc4735180c1abea987fd3a5f452f
Instruction Fuzzy Hash: 3C414771900229DFCF55EFE4D9819EDBBB6BF08314F14006AF811AB351DB30AA55CB95

Function 0061D9A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0061DA38

Strings

+, xrefs: 0061D9D0
%, xrefs: 0061D9C1

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: _swprintf
String ID: %$+
API String ID: 589789837-2626897407
Opcode ID: 6acd36a89160e31c879e0e668bdf7e43ba476d3047189623385b83df250e570f
Instruction ID: 2cbbec5d35e2c265e0ceb5c39d590b49db79bd3512ecd7e23b6f0e21594acd12
Opcode Fuzzy Hash: 6acd36a89160e31c879e0e668bdf7e43ba476d3047189623385b83df250e570f
Instruction Fuzzy Hash: 6E2124720082859FD715CF18CC85BDBBBEAAF99304F088519F99557292C739D918C7A2

Function 0061DA80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0061DB10

Strings

%, xrefs: 0061DAA6
+, xrefs: 0061DAB0

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: _swprintf
String ID: %$+
API String ID: 589789837-2626897407
Opcode ID: 1bb55f2305f11ec564d02fcc4ad59b645a5a2c6b02d70eb5dddd9763efa58177
Instruction ID: 80049f0bc955820727569a7fe403acf130d005c02dc9f44563006c5e0a766efd
Opcode Fuzzy Hash: 1bb55f2305f11ec564d02fcc4ad59b645a5a2c6b02d70eb5dddd9763efa58177
Instruction Fuzzy Hash: 9821F2312083449FD711CE28CC45BDBBBEAAF89314F08855DF98587381C775E91ACBA2

Function 0061DB50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0061DBE0

Strings

+, xrefs: 0061DB80
%, xrefs: 0061DB76

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: _swprintf
String ID: %$+
API String ID: 589789837-2626897407
Opcode ID: d27ca3064327963ffc647acdb8d0d7d530c5afc139bd726904e00bd12137c82a
Instruction ID: 3db852e39d87024d2b60c58ff5888a7abb61cf0a0189d08fb2a50897671f27ef
Opcode Fuzzy Hash: d27ca3064327963ffc647acdb8d0d7d530c5afc139bd726904e00bd12137c82a
Instruction Fuzzy Hash: 032104712083459FD711CE28CC85BDBBBEBAB99314F08851DF98687381C775D91ACBA2

Function 00618310 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ConvertSidToStringSidW.ADVAPI32(?,00000000), ref: 00618356
LocalFree.KERNEL32(00000000,Invalid SID,0000000B,?,00000000,C1C81EE7), ref: 006183C5

Strings

Invalid SID, xrefs: 006183A3

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ConvertFreeLocalString
String ID: Invalid SID
API String ID: 3201929900-130637731
Opcode ID: 57bfdbffe18ed27c26608d9a709dcc3098c39cf97932f778dc998e879aa074bd
Instruction ID: 82abc4ec5a6606d8bc0c234d1955242d4e5efaeadf040bc814543a9c0b3cd0c8
Opcode Fuzzy Hash: 57bfdbffe18ed27c26608d9a709dcc3098c39cf97932f778dc998e879aa074bd
Instruction Fuzzy Hash: A9218175A047059BDB14CF94C8157EFBBBAFF44B14F18461EE812A7380DBB56A848BD0

Function 0061C3E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0061C40B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0061C46E

Strings

bad locale name, xrefs: 0061C491

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: b4384143a07f7113a681204ed873cd03691c53ed0c58dd0d7124db069951b476
Instruction ID: 4825311cfabec3302ef7b0caabe7caa9cfd543fcc643bbda61ff58c2b3c05e13
Opcode Fuzzy Hash: b4384143a07f7113a681204ed873cd03691c53ed0c58dd0d7124db069951b476
Instruction Fuzzy Hash: 1C210270804B84EED721CF68C90478BBFF4EF15714F10869DE49597B81D3B9A604CBA1

Function 00624625 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0062462C

Strings

true, xrefs: 00624696
false, xrefs: 00624683

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: H_prolog3_
String ID: false$true
API String ID: 2427045233-2658103896
Opcode ID: 96f2781bc80bca2465d0e511220c75ea5e0d9f2ecdeea9ae074df882f2ae7ca1
Instruction ID: 8b713ee107f142a55d65f3b40bd66b9f84773aae0228caa93f2c56db9fe067c9
Opcode Fuzzy Hash: 96f2781bc80bca2465d0e511220c75ea5e0d9f2ecdeea9ae074df882f2ae7ca1
Instruction Fuzzy Hash: F411D071900B40AED761EFB4E811B8ABBF5AF09300F00851EF0A29B342EB30E508DF95

Function 006395A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(00673B74,?,?,?,00612646,00674714,C1C81EE7,?,?,0065B16D,000000FF,?,00611A07), ref: 006395B3
ReleaseSRWLockExclusive.KERNEL32(00673B74,?,?,00612646,00674714,C1C81EE7,?,?,0065B16D,000000FF,?,00611A07,?,?,?,C1C81EE7), ref: 006395ED

Strings

t;g, xrefs: 006395AD

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: t;g
API String ID: 17069307-1138557533
Opcode ID: 583d9b446258a028004b3be30f5b013784e240b62a7d96cf98a90ff6dc5f48a3
Instruction ID: 221a1713986beb14b5e31c46114c4a4398434fa80283be37267990839abf85ae
Opcode Fuzzy Hash: 583d9b446258a028004b3be30f5b013784e240b62a7d96cf98a90ff6dc5f48a3
Instruction Fuzzy Hash: 76F0A031900211DBC7259F19D844A68BBBBFB45735F24022EE86A833A0C7B058C2DEB1

Function 00622345 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00621020: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,C1C81EE7,?,0065B110,000000FF), ref: 00621047
Part of subcall function 00621020: GetLastError.KERNEL32(?,00000000,00000000,C1C81EE7,?,0065B110,000000FF), ref: 00621051

IsDebuggerPresent.KERNEL32(?,?,0066ECF8), ref: 00622378
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,0066ECF8), ref: 00622387

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00622382

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: cf314d2438863e5e6969549f9ce6926bb5c753ec108a5ddbbce8bfab297555c4
Instruction ID: 3e8ac36bf114a8d1cc748433d2ab5ade2d5fd7386784625425d90c0eaabbe8e2
Opcode Fuzzy Hash: cf314d2438863e5e6969549f9ce6926bb5c753ec108a5ddbbce8bfab297555c4
Instruction Fuzzy Hash: 11E06D70200B628FD360DF24E5187467BE2AF05341F00892CE885CB650EBB4D4888F51

Function 00616D20 Relevance: 5.2, APIs: 4, Instructions: 198memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000028,C1C81EE7,?,00000000,?,?,?,0065BB00,000000FF,?,006164FE,00000000,?), ref: 00616DD4
LocalFree.KERNEL32(?,?,?,?,?,00000000,?,?,?,0065BB00,000000FF,?,006164FE,00000000), ref: 00616E8A
LocalFree.KERNEL32(?,C1C81EE7,00000000,0065B110,000000FF,?,00000000,00000000,0065BB00,?,C1C81EE7), ref: 00616F1D

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Local$Free$Alloc
String ID:
API String ID: 3098330729-0
Opcode ID: a1ca54649a2b0d9ef22be8d5017ea92335228d48bff8e4c3827b0c19ad62cb82
Instruction ID: ebdefe28c6254e85d07c821ba8dedb5ff8a567f9bf894c07e519f43191a82afa
Opcode Fuzzy Hash: a1ca54649a2b0d9ef22be8d5017ea92335228d48bff8e4c3827b0c19ad62cb82
Instruction Fuzzy Hash: 455192B9A006059FDB18CF68C985AEEBBB6FB48310F14872DF815E7380D731A941CB90

Function 00614B00 Relevance: 5.2, APIs: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,80000022,?,?,?,00000000,?,?,00000000,?), ref: 00614B56
LocalAlloc.KERNEL32(00000040,7FFFFFFF,?,?,?,00000000,?,?,00000000,?), ref: 00614BA0
LocalFree.KERNEL32(7FFFFFFE,?,?,?,?,?,00000000,?,?,00000000,?), ref: 00614C22
LocalFree.KERNEL32(00000000,C1C81EE7,00000000,00000000,Function_0004B020,000000FF,?,?,00000000,?,?,00000000,?), ref: 00614CAD

Memory Dump Source

Source File: 00000005.00000002.2101438624.0000000000611000.00000020.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true

Associated: 00000005.00000002.2101408919.0000000000610000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101487234.000000000065F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101512688.0000000000672000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.2101538256.0000000000677000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_610000_MSICE10.jbxd

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: 151f35342c8c465cb82c1be3aa71550e92b5223cedd148046338d9c2440f592e
Instruction ID: 9dadd57a6c725d33d0be025101f42cfd9a954e2dc961eff3ade17bd147f9f217
Opcode Fuzzy Hash: 151f35342c8c465cb82c1be3aa71550e92b5223cedd148046338d9c2440f592e
Instruction Fuzzy Hash: AC51E2726052159FC714EF28DC81AAAB7EAEB89710F14066EF855D7390EB30ED44CB91

Analysis Process: GUP.exePID: 3720, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.5%
Total number of Nodes:	1612
Total number of Limit Nodes:	14

Executed Functions

Function 0074B210 Relevance: 152.8, APIs: 41, Strings: 45, Instructions: 2267windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00748A60: lstrlenW.KERNEL32(?,FFBCC9E0), ref: 00748A9A
Part of subcall function 00748A60: lstrcpyW.KERNEL32(00000000,?), ref: 00748ABC
Part of subcall function 00748A60: lstrlenW.KERNEL32(?), ref: 00748ACA

Part of subcall function 007486A0: lstrcmpW.KERNEL32(?), ref: 007486FF

Part of subcall function 007486A0: DialogBoxParamW.USER32(000003E9,00000000,007493C0,00000000), ref: 00748764

Part of subcall function 00747EC0: lstrlenW.KERNEL32(?,007AA988,00000000,00000000,?,?), ref: 00747F34

MessageBoxW.USER32(00000000,Usage :gup --helpgup -optionsgup [-verbose] [-vVERSION_VALUE] [-pCUSTOM_PARAM]gup -clean FOLDER_TO_ACTIONgup -unzipTo [-clea,GUP Command Argument Help,00000000), ref: 0074B3C1
DialogBoxParamW.USER32(000003EA,00000000,Function_00019580,00000000,gupOptions.xml), ref: 0074C8B8

Strings

0.0.0.0, xrefs: 0074C88E, 0074C8C9, 0074C8D0, 0074C8E1
-clean, xrefs: 0074B31C
nativeLang.xml, xrefs: 0074B56D
MSGID_DOWNLOADSTOPPED, xrefs: 0074C14F, 0074D375
MSGID_VERSIONNEW, xrefs: 0074D01A
GUP Command Argument Help, xrefs: 0074B3B5
X:|, xrefs: 0074CA72
MSGID_UPDATENo, xrefs: 0074D225
gup.xml, xrefs: 0074B372
open, xrefs: 0074B9D2, 0074C635, 0074D64E
MSGID_UPDATEAVAILABLE, xrefs: 0074CE5D
.zip, xrefs: 0074C099, 0074C0AB
MSGID_UPDATETITLE, xrefs: 0074CE06
p:|, xrefs: 0074C9C2
-verbose, xrefs: 0074B2EE
Current version is :, xrefs: 0074CEF7
-options, xrefs: 0074B2DB
Available version is :, xrefs: 0074D05F
Can't unzip:Operation not permitted or decompression failed, xrefs: 0074C3CE
GUP_NativeLangue, xrefs: 0074B581
is opened.Updater will close it in order to process the installation.Continue?, xrefs: 0074D546
MSGID_UPDATEYESSILENT, xrefs: 0074D1D2
-unzipTo, xrefs: 0074B333
explorer.exe, xrefs: 0074B9CD, 0074C630
(:|, xrefs: 0074C0ED
^t, xrefs: 0074BFB3
Usage :gup --helpgup -optionsgup [-verbose] [-vVERSION_VALUE] [-pCUSTOM_PARAM]gup -clean FOLDER_TO_ACTIONgup -unzipTo [-clea, xrefs: 0074B3BA
MSGID_UPDATENEVER, xrefs: 0074D12C
@, xrefs: 0074BDB2
Download is stopped by user. Update is aborted., xrefs: 0074C20B, 0074D3C9
.backup4RestoreInCaseOfFailed, xrefs: 0074BF61
gupOptions.xml, xrefs: 0074B54E, 0074C8E2
An update package is available, do you want to download and install it?, xrefs: 0074CEA2
MSGID_ABORTORNOT, xrefs: 0074CA18
MSGID_UPDATEYES, xrefs: 0074D17F
@:|, xrefs: 0074D624
MSGID_VERSIONCURRENT, xrefs: 0074CEB2
--help, xrefs: 0074B305
<, xrefs: 0074D525
/closeRunningNpp /S /runNppAfterSilentInstall, xrefs: 0074D2C6
MSGID_UNZIPFAILED, xrefs: 0074C31A
(:|, xrefs: 0074D36B
.exe, xrefs: 0074D33F, 0074D34F
@:|, xrefs: 0074D2CB
MSGID_CLOSEAPP, xrefs: 0074D4EE

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: lstrlen$DialogParam$Messagelstrcmplstrcpy
String ID: is opened.Updater will close it in order to process the installation.Continue?$(:|$(:|$--help$-clean$-options$-unzipTo$-verbose$.backup4RestoreInCaseOfFailed$.exe$.zip$/closeRunningNpp /S /runNppAfterSilentInstall$0.0.0.0$<$@$@:|$@:|$An update package is available, do you want to download and install it?$Available version is :$Can't unzip:Operation not permitted or decompression failed$Current version is :$Download is stopped by user. Update is aborted.$GUP Command Argument Help$GUP_NativeLangue$MSGID_ABORTORNOT$MSGID_CLOSEAPP$MSGID_DOWNLOADSTOPPED$MSGID_UNZIPFAILED$MSGID_UPDATEAVAILABLE$MSGID_UPDATENEVER$MSGID_UPDATENo$MSGID_UPDATETITLE$MSGID_UPDATEYES$MSGID_UPDATEYESSILENT$MSGID_VERSIONCURRENT$MSGID_VERSIONNEW$Usage :gup --helpgup -optionsgup [-verbose] [-vVERSION_VALUE] [-pCUSTOM_PARAM]gup -clean FOLDER_TO_ACTIONgup -unzipTo [-clea$X:|$explorer.exe$gup.xml$gupOptions.xml$nativeLang.xml$open$p:|$^t
API String ID: 550644434-3411580215
Opcode ID: 454cb4ad4da23a2f15b1f769ae9930d3b49434f8ae1d0770787920921877ba06
Instruction ID: 68f8a7583d89595917a0c79d4264f94d8f1ceded05823d3856285f4d9ddd5d0a
Opcode Fuzzy Hash: 454cb4ad4da23a2f15b1f769ae9930d3b49434f8ae1d0770787920921877ba06
Instruction Fuzzy Hash: B9236DB0D01268DBDB25EB24CD99BEDB7B8AF54304F5041D9E509A3292DB386F88CF51

Function 00799DF4 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccfd59cbac37008b382aa5f69d17f215cbe88755c862350af0fab43e58b4431c
Instruction ID: 4bcb6ad1812098b442cbef348b0650aa77f87dda1091390c42e3bde439518ee5
Opcode Fuzzy Hash: ccfd59cbac37008b382aa5f69d17f215cbe88755c862350af0fab43e58b4431c
Instruction Fuzzy Hash: AD414E322102049FDF14DF1CE885A99BBA5EF4A371B199158F959CF3A2C739DD82CB90

Function 00748080 Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 383
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

curl_easy_init.LIBCURL ref: 007480E5
curl_easy_setopt.LIBCURL(00000000,00002712,00000000,?version=,00000009), ref: 00748277
curl_easy_setopt.LIBCURL(00000000,00000034,00000001,?,?,?,?version=,00000009), ref: 00748350
curl_easy_setopt.LIBCURL(00000000,00004E2B,007485D0,00000000,00000034,00000001,?,?,?,?version=,00000009), ref: 00748360
curl_easy_setopt.LIBCURL(00000000,00002711,?,00000000,00004E2B,007485D0,00000000,00000034,00000001,?,?,?,?version=,00000009), ref: 00748371
curl_easy_setopt.LIBCURL(00000000,00002722,00000000,?,?,00000003,?), ref: 00748479
curl_easy_setopt.LIBCURL(00000000,0000271A,?,?,?,?,?,?,00000003,?), ref: 007484C8
curl_easy_setopt.LIBCURL(00000000,00002714,00000000,?,?,?,?,?,?,?,?,?,?,00000003,?), ref: 00748507
curl_easy_setopt.LIBCURL(00000000,0000003B,000000FF), ref: 00748523
curl_easy_setopt.LIBCURL(00000000,0000006F,000000EF,00000000,0000003B,000000FF), ref: 0074852D
curl_easy_setopt.LIBCURL(00000000,000000D8,00000003,?,?,?,?,?,?,?,?,00000003,?), ref: 0074853D
curl_easy_perform.LIBCURL(00000000,00000000,000000D8,00000003,?,?,?,?,?,?,?,?,00000003,?), ref: 00748543
curl_easy_cleanup.LIBCURL(00000000,00000000,00000000,000000D8,00000003,?,?,?,?,?,?,?,?,00000003,?), ref: 0074854B
MessageBoxA.USER32(00000000,?,curl error,00000000), ref: 00748590

Strings

5.3, xrefs: 0074838D
?version=, xrefs: 0074811E
curl error, xrefs: 00748582
&param=, xrefs: 00748193, 007482CB

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: curl_easy_setopt$Messagecurl_easy_cleanupcurl_easy_initcurl_easy_perform
String ID: &param=$5.3$?version=$curl error
API String ID: 118074606-4088956901
Opcode ID: 508a8ff07aea1b1699b5d909ceed3626688284c883364e212a5a106f2a336cf9
Instruction ID: 4d1f3ea45307b7f634b1fc4c75ce6d31a7646b50cd958223205247e4d1994fa7
Opcode Fuzzy Hash: 508a8ff07aea1b1699b5d909ceed3626688284c883364e212a5a106f2a336cf9
Instruction Fuzzy Hash: D2E1B471900218DBCB65DF64CC89FEDB3B4AB45700F004199FA49AB292EB789E94CF61

Function 007A0F7F Relevance: 13.8, APIs: 9, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007A0C38: CreateFileW.KERNEL32(?,00000000,?,007A1028,?,?,00000000,?,007A1028,?,0000000C), ref: 007A0C55

GetLastError.KERNEL32 ref: 007A1093
__dosmaperr.LIBCMT ref: 007A109A
GetFileType.KERNEL32(00000000), ref: 007A10A6
GetLastError.KERNEL32 ref: 007A10B0
__dosmaperr.LIBCMT ref: 007A10B9
CloseHandle.KERNEL32(00000000), ref: 007A10D9
CloseHandle.KERNEL32(?), ref: 007A1226
GetLastError.KERNEL32 ref: 007A1258
__dosmaperr.LIBCMT ref: 007A125F

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 9c7c7cabb9f2392fff27d6e80199664fdcb2b617804f49e59daa5fc27903a0bc
Instruction ID: eff437937b4db03278e6e1281c0b2c8e9359225759203c4106358f0479a97074
Opcode Fuzzy Hash: 9c7c7cabb9f2392fff27d6e80199664fdcb2b617804f49e59daa5fc27903a0bc
Instruction Fuzzy Hash: 36A13732A141549FDF199F68EC55BAE3BB1AB87320F18024DF811EB391D7398C52CB95

Function 00797193 Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ae94140f657551f066c40bb49fa46a1bc6bf5380c6164ddbc17645d9ee6174
Instruction ID: 85a295df3babe40df313d0a49f877457b36b47fd1f643a14d39ab2df267259b4
Opcode Fuzzy Hash: 22ae94140f657551f066c40bb49fa46a1bc6bf5380c6164ddbc17645d9ee6174
Instruction Fuzzy Hash: ADB10570A18288AFDF19DFA8E881BBE7BB1BF46310F144158E4009B292D7799D42CB64

Function 6BED3EB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32(00000000,cmd.exe /C echo HiddenProcess,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 6BED3EEB
CloseHandle.KERNEL32(?), ref: 6BED3EFE
CloseHandle.KERNEL32(?), ref: 6BED3F08

Strings

cmd.exe /C echo HiddenProcess, xrefs: 6BED3EE4
D, xrefs: 6BED3EB6

Memory Dump Source

Source File: 00000006.00000002.2292258011.000000006BEB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6BEB0000, based on PE: true

Associated: 00000006.00000002.2292241036.000000006BEB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292289619.000000006BEE6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292309996.000000006BEF4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292425687.000000006C109000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292558037.000000006C35B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292594857.000000006C35C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6beb0000_GUP.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID: D$cmd.exe /C echo HiddenProcess
API String ID: 2922976086-260405473
Opcode ID: d40c3cd9822c6279a114857f3d8efebb75619760a0eb1a2666786a91c65dc2fa
Instruction ID: b702ac21adb8482f7e3798f85ef364c29e40c65a22fb8986e99430a55fc49721
Opcode Fuzzy Hash: d40c3cd9822c6279a114857f3d8efebb75619760a0eb1a2666786a91c65dc2fa
Instruction Fuzzy Hash: 4AF01DB1A40308AFEB20DBE09C0AFAD7738AB04B05F200104F7067A1C0D7B4B605CB65

Function 6BED4A80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNEL32(80000001,Software\MyApp\TempKey,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 6BED4AA3
RegSetValueExW.KERNEL32(?,TempValue,00000000,00000004,00000000,00000004), ref: 6BED4AC5
RegCloseKey.ADVAPI32(?), ref: 6BED4ACF

Strings

TempValue, xrefs: 6BED4ABC
Software\MyApp\TempKey, xrefs: 6BED4A99

Memory Dump Source

Source File: 00000006.00000002.2292258011.000000006BEB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6BEB0000, based on PE: true

Associated: 00000006.00000002.2292241036.000000006BEB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292289619.000000006BEE6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292309996.000000006BEF4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292425687.000000006C109000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292558037.000000006C35B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292594857.000000006C35C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6beb0000_GUP.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: Software\MyApp\TempKey$TempValue
API String ID: 1818849710-1576047821
Opcode ID: aa7b8a1b15455c4adf8a40eb352558a6465efd76273f82f9d1fc29762ca33529
Instruction ID: 79a7d793e09726f1c544c24f137bba36b4d01fe302986449b4bfcbd58df48a41
Opcode Fuzzy Hash: aa7b8a1b15455c4adf8a40eb352558a6465efd76273f82f9d1fc29762ca33529
Instruction Fuzzy Hash: 1BF01274A80318BFEF20DB908C4AF997779A704B15F200544BB02761C4D7F47A558769

Function 00796A5F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,007846E4,00000000,00000002,00000000,00000000,00000000,00000000,Fx,00796B99,00000000,?,Fx,00000002,00000000), ref: 00796A9B
GetLastError.KERNEL32(00000000,?,00799C7D,00000000,00000000,00000000,00000002,007846E4,00000000,00000000,?,0073E60C,?,00784604,0073E60C,?), ref: 00796AA8

Strings

Fx, xrefs: 00796A61

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Fx
API String ID: 2976181284-483165457
Opcode ID: 9938175cdc8b00ea7f253a991898fda17c3dd0372318be0ab3464f00c360f736
Instruction ID: a6d4a715810a36e52a4cf8164b01bc995a9950247894ebf288c4f0c099a2bf6e
Opcode Fuzzy Hash: 9938175cdc8b00ea7f253a991898fda17c3dd0372318be0ab3464f00c360f736
Instruction Fuzzy Hash: AC01D272610515AFCF05CF69EC09DAE3B69EB85320B288208F811AB291E679ED51CBD0

Function 00795D16 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(00000000,00000000,CF830579,?,00795BFD,00000000,CF830579,007BFF10,0000000C,00795CB9,0078469A,?), ref: 00795D6C
GetLastError.KERNEL32(?,00795BFD,00000000,CF830579,007BFF10,0000000C,00795CB9,0078469A,?), ref: 00795D76

Strings

06e, xrefs: 00795D30

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID: 06e
API String ID: 918212764-1877882912
Opcode ID: f11b569432eea38fb1c4477e77b1cc1ccaea021b4e96f9d1f5c47de351aed4ba
Instruction ID: 31256e7d687211a81787aa9631464c99c44c5ee3a783504346aca1a4ddd6b4c1
Opcode Fuzzy Hash: f11b569432eea38fb1c4477e77b1cc1ccaea021b4e96f9d1f5c47de351aed4ba
Instruction Fuzzy Hash: 1111293270493067DE236674BCCD76D27559B83734F290249F8048B1D2DB2D9C818355

Function 0078509B Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

cVx, xrefs: 007851EC, 007851BA, 00785204, 00785220

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID:
String ID: cVx
API String ID: 0-133148599
Opcode ID: 157d5542b766162758047ecbf84cafd18d09039370da79f05eee85f888635f5d
Instruction ID: 25b77752bd6bc2b1fef718113d556d545a53fce5e8c6d17d8865e1d3111ae9f3
Opcode Fuzzy Hash: 157d5542b766162758047ecbf84cafd18d09039370da79f05eee85f888635f5d
Instruction Fuzzy Hash: CC519374A40608EFDF14EF58CC89AA97FB2EF49324F288158E8499B252D775DE41CB90

Function 007965E3 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 0079661D

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 4844ae01fd0b260788dee2d70dbc29f4758d96f24b20a56041b7a2c541f609e1
Instruction ID: e98f09cea1558874bd5ab4eacd2ec907f78f703d04128d4b1e66e9a460ad8d2c
Opcode Fuzzy Hash: 4844ae01fd0b260788dee2d70dbc29f4758d96f24b20a56041b7a2c541f609e1
Instruction Fuzzy Hash: 60112A71A0410AAFCF05DF58E945D9B7BF9EF48304F054159F809EB251D634EE25CB64

Function 0079751E Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,007311B0,?), ref: 00797550

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 60c1899d2bc212eed1a50dce630413f8c65bd4eb52dd4f607812c261099c1a96
Instruction ID: 2f73bbe1a0116ed47d940ed9b70f469a9579006604f191b4ab1b39476c8fde9c
Opcode Fuzzy Hash: 60c1899d2bc212eed1a50dce630413f8c65bd4eb52dd4f607812c261099c1a96
Instruction Fuzzy Hash: 67E06521169212BBDF6537697C05B5B3A49DF413B0F578121FC0596192DB1CDC20D6E5

Function 007A0C38 Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,00000000,?,007A1028,?,?,00000000,?,007A1028,?,0000000C), ref: 007A0C55

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6856c38a86113bd51940b4eca1f2692a4871111905d85dc4133bfe24fef40186
Instruction ID: de0effdef972f9d367878281f2a15580849257586b83a3145e1952032e8fe161
Opcode Fuzzy Hash: 6856c38a86113bd51940b4eca1f2692a4871111905d85dc4133bfe24fef40186
Instruction Fuzzy Hash: 1AD06C3200010DBBDF128F84DD06EDA3BAAFB88714F018000BA1856020D736E821EB95

Function 00731066 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32(00000004,Function_00014FE0,00000000), ref: 00731070

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 5fbc8ed7bd69d4086af814a0920ebae06f2233c54e93683453cdb047fce32710
Instruction ID: 8a38ee09642367994f6306250d9e115a6867c7df73823353eaa0cd74e6b80ec6
Opcode Fuzzy Hash: 5fbc8ed7bd69d4086af814a0920ebae06f2233c54e93683453cdb047fce32710
Instruction Fuzzy Hash: E3C08CF0280300AAD60017603C0BF9422106380B02F204105B70A480D0C7BC5028821C

Non-executed Functions

Function 0078C7D0 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 455COMMONLIBRARYCODE

Download Yara Rule

Strings

'z, xrefs: 0078CC31, 0078CA20
'z, xrefs: 0078C7EE, 0078C986, 0078CB51, 0078CBA6

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID:
String ID: 'z$'z
API String ID: 0-1980562239
Opcode ID: 45468e45ab8a165942ea38b9536c6f797f4e9bb33eac9e20965c121ace4b64dc
Instruction ID: c664da69a1e59ae9ad020d4a3bf9b3db4bd50e3b2be5df91bcc76d3b4909c18d
Opcode Fuzzy Hash: 45468e45ab8a165942ea38b9536c6f797f4e9bb33eac9e20965c121ace4b64dc
Instruction Fuzzy Hash: 25025A71E412199BDF15DFA9D8806AEBBF1FF48314F248269D919E7340D735A9018BA0

Function 0079E907 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00795866: GetLastError.KERNEL32(00000000,00000000,0079C1C3), ref: 0079586A
Part of subcall function 00795866: SetLastError.KERNEL32(00000000,00000000,00000004,00000008,000000FF), ref: 0079590C

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 0079EA0F
IsValidCodePage.KERNEL32(00000000), ref: 0079EA4D
IsValidLocale.KERNEL32(?,00000001), ref: 0079EA60
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 0079EAA8
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 0079EAC3

Strings

LW{, xrefs: 0079E96C

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID: LW{
API String ID: 415426439-3035418257
Opcode ID: 6bfcdc4f65796b69e647a20a48cee57d8df607c44ff2bfe2fdaa687e6e9e3907
Instruction ID: 37b829623869f71e4ca87412334f6315e15ac9563802751671edba2f4e0ea9a8
Opcode Fuzzy Hash: 6bfcdc4f65796b69e647a20a48cee57d8df607c44ff2bfe2fdaa687e6e9e3907
Instruction Fuzzy Hash: 0B516D71A00615EFDF20DFA5EC45ABA77B8FF44700F048529F901E7191E778A944CB62

Function 0079E72B Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,=y,00000002,00000000,?,?,?,0079EA3D,?,00000000), ref: 0079E7C4
GetLocaleInfoW.KERNEL32(?,20001004,=y,00000002,00000000,?,?,?,0079EA3D,?,00000000), ref: 0079E7ED
GetACP.KERNEL32(?,?,0079EA3D,?,00000000), ref: 0079E802

Strings

=y, xrefs: 0079E7DE, 0079E7FB, 0079E7B5, 0079E7CE, 0079E7B8, 0079E7E1
OCP, xrefs: 0079E77F
ACP, xrefs: 0079E749

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: InfoLocale
String ID: =y$ACP$OCP
API String ID: 2299586839-1416475334
Opcode ID: 22e6692e84fd18e3a6f759793de69c494803ee4c8ee72271f93b08afcb080057
Instruction ID: af180c62d2fdff07a5d6f07fca0565526463e51e8e8ef252ead9ec10e81c6f0f
Opcode Fuzzy Hash: 22e6692e84fd18e3a6f759793de69c494803ee4c8ee72271f93b08afcb080057
Instruction Fuzzy Hash: 41219526600100FAEF34CFE4E905FA773A7EB54B61B568474E909D7204E73ADD81C352

Function 0079DF92 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00795866: GetLastError.KERNEL32(00000000,00000000,0079C1C3), ref: 0079586A
Part of subcall function 00795866: SetLastError.KERNEL32(00000000,00000000,00000004,00000008,000000FF), ref: 0079590C

GetACP.KERNEL32(?,?,?,?,?,?,00791367,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 0079E051
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00791367,?,?,?,00000055,?,-00000050,?,?), ref: 0079E088
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 0079E1EB

Strings

utf8, xrefs: 0079E15A
LW{, xrefs: 0079DFD0

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: LW{$utf8
API String ID: 607553120-3162132393
Opcode ID: 6c00886cdce27b2c41e7c8d19bd0675263bc4bd0a23815147c6321e871cc28aa
Instruction ID: c32948cfda0f9529990c536034639f13890de844fa119c60a3f0b273beef9943
Opcode Fuzzy Hash: 6c00886cdce27b2c41e7c8d19bd0675263bc4bd0a23815147c6321e871cc28aa
Instruction Fuzzy Hash: F0711472A00606EADF25EB74EC4ABAA73A8EF45710F240529F615D7181FBBCED408761

Function 00767836 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00767842
IsDebuggerPresent.KERNEL32 ref: 0076790E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00767927
UnhandledExceptionFilter.KERNEL32(?), ref: 00767931

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: a3b3a1884eb5b8124e5b3fcec157c8ea34e9c1b7c054352de566018fe70e9a93
Instruction ID: f6d3dc413879b3c13d7a6a71987c01cc1b5913c07a44c60a07732a8be1f70048
Opcode Fuzzy Hash: a3b3a1884eb5b8124e5b3fcec157c8ea34e9c1b7c054352de566018fe70e9a93
Instruction Fuzzy Hash: E1310575D05218EADB61EFA4D8497CDBBB8BF08304F1081AAE40DAB250EB749A84CF45

Function 0074F310 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 481COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0074F8A8

Strings

bad conversion, xrefs: 0074F8A3
^t, xrefs: 0074F3EB, 0074F3EE

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: bad conversion$^t
API String ID: 909987262-827438407
Opcode ID: eafb0a16b86a806a9c6823dcfaa699804106209098181a07e14c4a57bbf02e76
Instruction ID: 8e0add34065421746edaf971f8415ec03612940122e2f0433af152e471e67703
Opcode Fuzzy Hash: eafb0a16b86a806a9c6823dcfaa699804106209098181a07e14c4a57bbf02e76
Instruction Fuzzy Hash: 0E026C71E00219DFCB04DFA8C885AEDBBB5FF49314F24412AE515EB751E738A985CB90

Function 00746F40 Relevance: 54.7, APIs: 22, Strings: 9, Instructions: 477windowthreadCOMMON

Download Yara Rule

APIs

curl_easy_init.LIBCURL ref: 00746FD1
CreateThread.KERNEL32(00000000,00000000,00748750,00000000,00000000,00000000), ref: 00746FE7
curl_easy_setopt.LIBCURL(00000000,00002712,00000000), ref: 00747019
curl_easy_setopt.LIBCURL(00000000,00000034,00000001), ref: 00747031
curl_easy_setopt.LIBCURL(00000000,00004E2B,00747B70,00000000,00000034,00000001), ref: 00747041
curl_easy_setopt.LIBCURL(00000000,00002711,00000000,00000000,00004E2B,00747B70,00000000,00000034,00000001), ref: 0074704D
curl_easy_setopt.LIBCURL(00000000,0000002B,00000000,00000000,00002711,00000000,00000000,00004E2B,00747B70,00000000,00000034,00000001), ref: 00747057
curl_easy_setopt.LIBCURL(00000000,00004E58,00749D20,00000000,0000002B,00000000,00000000,00002711,00000000,00000000,00004E2B,00747B70,00000000,00000034,00000001), ref: 00747067
curl_easy_setopt.LIBCURL(00000000,00002749,00000000,00004E58,00749D20,00000000,0000002B,00000000,00000000,00002711,00000000,00000000,00004E2B,00747B70,00000000,00000034), ref: 00747078
curl_easy_setopt.LIBCURL(00000000,00002722,00000000), ref: 007470A3
curl_easy_setopt.LIBCURL(00000000,0000271A,?), ref: 007470C3
curl_easy_setopt.LIBCURL(00000000,00002714,00000000), ref: 007470F9
curl_easy_setopt.LIBCURL(00000000,0000003B,000000FF), ref: 00747112
curl_easy_setopt.LIBCURL(00000000,0000006F,000000EF,00000000,0000003B,000000FF), ref: 0074711C
curl_easy_setopt.LIBCURL(00000000,000000D8,00000003), ref: 0074712C
curl_easy_perform.LIBCURL(00000000,00000000,000000D8,00000003), ref: 00747132
curl_easy_cleanup.LIBCURL(00000000,00000000,00000000,000000D8,00000003), ref: 0074713A
MessageBoxW.USER32(?,The plugin package is not found.,Plugin cannot be found,?), ref: 007471DA
PathFindFileNameW.SHLWAPI(?,?,?), ref: 007473AB
MessageBoxW.USER32(00000000,?,Plugin package hash mismatched,00000000), ref: 00747506
MessageBoxA.USER32(00000000,?,curl error,00000000), ref: 00747551
MessageBoxW.USER32(00000000,?,?,00000000), ref: 0074757B

Strings

The plugin package is not found., xrefs: 007471D4
" is not correct. Expected:, xrefs: 00747465
This plugin won't be installed., xrefs: 007474D7
Plugin package hash mismatched, xrefs: 007474FE
Plugin cannot be found, xrefs: 007471CF
The hash of plugin package ", xrefs: 00747404
curl error, xrefs: 00747543
%02x, xrefs: 0074721A
<> Found:, xrefs: 0074749E

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: curl_easy_setopt$Message$CreateFileFindNamePathThreadcurl_easy_cleanupcurl_easy_initcurl_easy_perform
String ID: <> Found:$This plugin won't be installed.$" is not correct. Expected:$%02x$Plugin cannot be found$Plugin package hash mismatched$The hash of plugin package "$The plugin package is not found.$curl error
API String ID: 729063368-1193151834
Opcode ID: 5830479304e62a3198805bc18ec5baa936fc15d24bb67b71742dbe11209b878d
Instruction ID: c0a0721dcc9c34d65e0895db764288a6e5bfa306f7ced3f4b754c2d48d8a915b
Opcode Fuzzy Hash: 5830479304e62a3198805bc18ec5baa936fc15d24bb67b71742dbe11209b878d
Instruction Fuzzy Hash: A40270B1D44258EBDB24EF24CD49BEDB7B4AB55304F0041D9E909A7282EB785F84CFA1

Function 00775951 Relevance: 44.2, APIs: 16, Strings: 9, Instructions: 438COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00775958
int.LIBCPMT ref: 00775B4B
int.LIBCPMT ref: 00775BA1
int.LIBCPMT ref: 00775BE6
int.LIBCPMT ref: 00775C29
int.LIBCPMT ref: 00775C95
int.LIBCPMT ref: 00775D16

Part of subcall function 00774B78: __Getctype.LIBCPMT ref: 00774B87

Part of subcall function 00770EDC: __EH_prolog3.LIBCMT ref: 00770EE3
Part of subcall function 00770EDC: std::_Lockit::_Lockit.LIBCPMT ref: 00770EED
Part of subcall function 00770EDC: int.LIBCPMT ref: 00770F04

Part of subcall function 00771006: __EH_prolog3.LIBCMT ref: 0077100D
Part of subcall function 00771006: std::_Lockit::_Lockit.LIBCPMT ref: 00771017
Part of subcall function 00771006: int.LIBCPMT ref: 0077102E

Part of subcall function 0077125A: __EH_prolog3.LIBCMT ref: 00771261
Part of subcall function 0077125A: std::_Lockit::_Lockit.LIBCPMT ref: 0077126B
Part of subcall function 0077125A: int.LIBCPMT ref: 00771282
Part of subcall function 0077125A: std::_Lockit::~_Lockit.LIBCPMT ref: 007712DC

Part of subcall function 007711C5: __EH_prolog3.LIBCMT ref: 007711CC
Part of subcall function 007711C5: std::_Lockit::_Lockit.LIBCPMT ref: 007711D6
Part of subcall function 007711C5: int.LIBCPMT ref: 007711ED
Part of subcall function 007711C5: std::_Lockit::~_Lockit.LIBCPMT ref: 00771247

Part of subcall function 0076AB18: __EH_prolog3.LIBCMT ref: 0076AB1F
Part of subcall function 0076AB18: std::_Lockit::_Lockit.LIBCPMT ref: 0076AB29
Part of subcall function 0076AB18: std::_Lockit::~_Lockit.LIBCPMT ref: 0076ABD0

numpunct.LIBCPMT ref: 00775D3D

Part of subcall function 007719E5: __EH_prolog3.LIBCMT ref: 007719EC

Part of subcall function 00771702: __EH_prolog3.LIBCMT ref: 00771709
Part of subcall function 00771702: std::_Lockit::_Lockit.LIBCPMT ref: 00771713
Part of subcall function 00771702: int.LIBCPMT ref: 0077172A
Part of subcall function 00771702: std::_Lockit::~_Lockit.LIBCPMT ref: 00771784

Part of subcall function 0077182C: __EH_prolog3.LIBCMT ref: 00771833
Part of subcall function 0077182C: std::_Lockit::_Lockit.LIBCPMT ref: 0077183D
Part of subcall function 0077182C: int.LIBCPMT ref: 00771854
Part of subcall function 0077182C: std::_Lockit::~_Lockit.LIBCPMT ref: 007718AE

Part of subcall function 0076AB18: Concurrency::cancel_current_task.LIBCPMT ref: 0076ABDB
Part of subcall function 0076AB18: __EH_prolog3.LIBCMT ref: 0076ABE8

Part of subcall function 00770A34: __EH_prolog3.LIBCMT ref: 00770A3B
Part of subcall function 00770A34: std::_Lockit::_Lockit.LIBCPMT ref: 00770A45
Part of subcall function 00770A34: int.LIBCPMT ref: 00770A5C
Part of subcall function 00770A34: std::_Lockit::~_Lockit.LIBCPMT ref: 00770AB6

int.LIBCPMT ref: 00775D65
int.LIBCPMT ref: 00775975

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

int.LIBCPMT ref: 007759DB
int.LIBCPMT ref: 00775A20
int.LIBCPMT ref: 00775A63
int.LIBCPMT ref: 00775AE7
__Getcoll.LIBCPMT ref: 00775B0D
int.LIBCPMT ref: 00775DC9

Strings

xA|, xrefs: 00775BE1
dA|, xrefs: 00775A1B
`A|, xrefs: 007759D6
\A|, xrefs: 00775D60
|A|, xrefs: 00775C24
hA|, xrefs: 00775A5E
tA|, xrefs: 00775B9C
lA|, xrefs: 00775AE2
pA|, xrefs: 00775B46

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3$Lockit::_$Lockit::~_$Concurrency::cancel_current_taskGetcollGetctypenumpunct
String ID: \A|$`A|$dA|$hA|$lA|$pA|$tA|$xA|$|A|
API String ID: 2958531307-1867378249
Opcode ID: c4e098c3fb54a9e6830c3744563ea207737525455c9e91b165faaf628fc21958
Instruction ID: 5193d945cf14d66f5f741e3d8832ecaaa6e59d67fb8050b046b17672ae608ac8
Opcode Fuzzy Hash: c4e098c3fb54a9e6830c3744563ea207737525455c9e91b165faaf628fc21958
Instruction Fuzzy Hash: EDD1F6B1D00715EBDF216BA4885AA7F7AA5EF81390F14C92DF85D67241EBBC8D0087E1

Function 0074A690 Relevance: 37.1, APIs: 8, Strings: 13, Instructions: 374stringCOMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,?), ref: 0074A73A
lstrcmpW.KERNEL32(?,id_download), ref: 0074AB35
lstrcmpW.KERNEL32(?,id_moreinfo), ref: 0074AB52
ShellExecuteW.SHELL32(00000000,open,https://npp-user-manual.org/docs/upgrading/#new-version-available-but-auto-updater-find-nothing,00000000,00000000,00000001), ref: 0074AB68
EndDialog.USER32(?,?), ref: 0074AB70

Strings

</a>, xrefs: 0074A9A7, 0074AA34
id_download, xrefs: 0074AB2F
$MSGID_DOWNLOADPAGE$, xrefs: 0074AA44
id_moreinfo, xrefs: 0074AB46
MSGID_MOREINFO, xrefs: 0074A80F
MSGID_GOTODOWNLOADPAGETEXT, xrefs: 0074A8E1
https://notepad-plus-plus.org/downloads/, xrefs: 0074AB3F
$MSGID_MOREINFO$, xrefs: 0074A9B7
open, xrefs: 0074AB61
<a id="id_moreinfo">, xrefs: 0074A978
https://npp-user-manual.org/docs/upgrading/#new-version-available-but-auto-updater-find-nothing, xrefs: 0074AB5C
MSGID_DOWNLOADPAGE, xrefs: 0074A77C
<a id="id_download">, xrefs: 0074AA05

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: lstrcmp$DialogExecuteShellTextWindow
String ID: $MSGID_DOWNLOADPAGE$$$MSGID_MOREINFO$$</a>$<a id="id_download">$<a id="id_moreinfo">$MSGID_DOWNLOADPAGE$MSGID_GOTODOWNLOADPAGETEXT$MSGID_MOREINFO$https://notepad-plus-plus.org/downloads/$https://npp-user-manual.org/docs/upgrading/#new-version-available-but-auto-updater-find-nothing$id_download$id_moreinfo$open
API String ID: 1981440648-1039618901
Opcode ID: 17160f3c7f2dca0e7c1faced2da600825d79ff8698d2ab080fbd49a4bb5ddcce
Instruction ID: bfaf32da213a6509c3edfaf845c0caba7ce5ab6ede55cf75a36746401f3b1175
Opcode Fuzzy Hash: 17160f3c7f2dca0e7c1faced2da600825d79ff8698d2ab080fbd49a4bb5ddcce
Instruction Fuzzy Hash: E1E192B0D00208EFDB14DFA4DD85BEDBBB8EF49300F10416AE515E7292D7789A84CB61

Function 0077DF20 Relevance: 31.8, APIs: 11, Strings: 7, Instructions: 277COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0077DF27

Part of subcall function 0077CBFE: __EH_prolog3_GS.LIBCMT ref: 0077CC05
Part of subcall function 0077CBFE: __Getcoll.LIBCPMT ref: 0077CC69

__Getcoll.LIBCPMT ref: 0077DF76

Part of subcall function 0077CA62: __EH_prolog3.LIBCMT ref: 0077CA69
Part of subcall function 0077CA62: std::_Lockit::_Lockit.LIBCPMT ref: 0077CA73
Part of subcall function 0077CA62: int.LIBCPMT ref: 0077CA8A
Part of subcall function 0077CA62: std::_Lockit::~_Lockit.LIBCPMT ref: 0077CAE4

Part of subcall function 0076AB18: __EH_prolog3.LIBCMT ref: 0076AB1F
Part of subcall function 0076AB18: std::_Lockit::_Lockit.LIBCPMT ref: 0076AB29
Part of subcall function 0076AB18: std::_Lockit::~_Lockit.LIBCPMT ref: 0076ABD0

int.LIBCPMT ref: 0077DF50

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

int.LIBCPMT ref: 0077DFB4
int.LIBCPMT ref: 0077E00A
int.LIBCPMT ref: 0077E04F
int.LIBCPMT ref: 0077E092
int.LIBCPMT ref: 0077E0FE
int.LIBCPMT ref: 0077E17F
numpunct.LIBCPMT ref: 0077E1A6
int.LIBCPMT ref: 0077E1CE

Strings

(B|, xrefs: 0077E04A
B|, xrefs: 0077DFAF
,B|, xrefs: 0077E08D
0B|, xrefs: 0077E0F9
8B|, xrefs: 0077E1C9
4B|, xrefs: 0077E17A
$B|, xrefs: 0077E005

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3Lockit::_Lockit::~_$Getcoll$H_prolog3_numpunct
String ID: B|$$B|$(B|$,B|$0B|$4B|$8B|
API String ID: 3873313002-1485173696
Opcode ID: 99ed7485f2f6b0eaa808a4c8a8b19acbddeacc631ac374bf6119a9e66a00e14e
Instruction ID: eb3f4c3cec23ff65d055a6676ac259a0e2329d2dfef64e622c2f1a855b46663a
Opcode Fuzzy Hash: 99ed7485f2f6b0eaa808a4c8a8b19acbddeacc631ac374bf6119a9e66a00e14e
Instruction Fuzzy Hash: 8F91FCB1D00215EEDF216BB4481AA7F76B9FF853A0F10C56DF85EA7241DA7C8D0087A2

Function 0077547F Relevance: 24.4, APIs: 16, Instructions: 438COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00775486
int.LIBCPMT ref: 00775679
int.LIBCPMT ref: 007756CF
int.LIBCPMT ref: 00775714
int.LIBCPMT ref: 00775757
int.LIBCPMT ref: 007757C3
int.LIBCPMT ref: 00775844

Part of subcall function 00774B78: __Getctype.LIBCPMT ref: 00774B87

Part of subcall function 00770E47: __EH_prolog3.LIBCMT ref: 00770E4E
Part of subcall function 00770E47: std::_Lockit::_Lockit.LIBCPMT ref: 00770E58
Part of subcall function 00770E47: int.LIBCPMT ref: 00770E6F

Part of subcall function 00770F71: __EH_prolog3.LIBCMT ref: 00770F78
Part of subcall function 00770F71: std::_Lockit::_Lockit.LIBCPMT ref: 00770F82
Part of subcall function 00770F71: int.LIBCPMT ref: 00770F99

Part of subcall function 00771130: __EH_prolog3.LIBCMT ref: 00771137
Part of subcall function 00771130: std::_Lockit::_Lockit.LIBCPMT ref: 00771141
Part of subcall function 00771130: int.LIBCPMT ref: 00771158
Part of subcall function 00771130: std::_Lockit::~_Lockit.LIBCPMT ref: 007711B2

Part of subcall function 0077109B: __EH_prolog3.LIBCMT ref: 007710A2
Part of subcall function 0077109B: std::_Lockit::_Lockit.LIBCPMT ref: 007710AC
Part of subcall function 0077109B: int.LIBCPMT ref: 007710C3

Part of subcall function 0076AB18: __EH_prolog3.LIBCMT ref: 0076AB1F
Part of subcall function 0076AB18: std::_Lockit::_Lockit.LIBCPMT ref: 0076AB29
Part of subcall function 0076AB18: std::_Lockit::~_Lockit.LIBCPMT ref: 0076ABD0

numpunct.LIBCPMT ref: 0077586B

Part of subcall function 007719B2: __EH_prolog3.LIBCMT ref: 007719B9

Part of subcall function 0077166D: __EH_prolog3.LIBCMT ref: 00771674
Part of subcall function 0077166D: std::_Lockit::_Lockit.LIBCPMT ref: 0077167E
Part of subcall function 0077166D: int.LIBCPMT ref: 00771695
Part of subcall function 0077166D: std::_Lockit::~_Lockit.LIBCPMT ref: 007716EF

Part of subcall function 00771797: __EH_prolog3.LIBCMT ref: 0077179E
Part of subcall function 00771797: std::_Lockit::_Lockit.LIBCPMT ref: 007717A8
Part of subcall function 00771797: int.LIBCPMT ref: 007717BF
Part of subcall function 00771797: std::_Lockit::~_Lockit.LIBCPMT ref: 00771819

Part of subcall function 0076AB18: Concurrency::cancel_current_task.LIBCPMT ref: 0076ABDB
Part of subcall function 0076AB18: __EH_prolog3.LIBCMT ref: 0076ABE8

Part of subcall function 0077099F: __EH_prolog3.LIBCMT ref: 007709A6
Part of subcall function 0077099F: std::_Lockit::_Lockit.LIBCPMT ref: 007709B0
Part of subcall function 0077099F: int.LIBCPMT ref: 007709C7
Part of subcall function 0077099F: std::_Lockit::~_Lockit.LIBCPMT ref: 00770A21

int.LIBCPMT ref: 00775893
int.LIBCPMT ref: 007754A3

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

int.LIBCPMT ref: 00775509
int.LIBCPMT ref: 0077554E
int.LIBCPMT ref: 00775591
int.LIBCPMT ref: 00775615
__Getcoll.LIBCPMT ref: 0077563B
int.LIBCPMT ref: 007758F7

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3$Lockit::_$Lockit::~_$Concurrency::cancel_current_taskGetcollGetctypenumpunct
String ID:
API String ID: 2958531307-0
Opcode ID: 54582613772d3cb153265deea8112badabddea343f57c881713596284facfc80
Instruction ID: 355f6dbe7f99e52edeea5d8508ecc4c0c9073f759952e179b95f276bb2ab42e1
Opcode Fuzzy Hash: 54582613772d3cb153265deea8112badabddea343f57c881713596284facfc80
Instruction Fuzzy Hash: 7ED1F8B1D00615EBDF116BB4881AA7F7BA6EF907A0F54C41DF85E67241EABC8D0087D2

Function 00747800 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 309windowCOMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(?,\Notepad++,0000000A), ref: 0074795D
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00747AD2
MessageBoxW.USER32(00000000,?,?,00000010), ref: 00747AFA

Strings

^t, xrefs: 0074795D
Can't find any folder for downloading.Please check your environment variables"%TMP%", "%TEMP%" and "%APPDATA%", xrefs: 00747ACA
MSGID_NODOWNLOADFOLDER, xrefs: 00747A26
\Notepad++, xrefs: 00747943
TMP, xrefs: 00747882
AppData, xrefs: 007478CD
TEMP, xrefs: 00747837

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: ExistsFileMessagePathSimpleString::operator=
String ID: AppData$Can't find any folder for downloading.Please check your environment variables"%TMP%", "%TEMP%" and "%APPDATA%"$MSGID_NODOWNLOADFOLDER$TEMP$TMP$\Notepad++$^t
API String ID: 1960100283-1928378560
Opcode ID: 87a709ff76dfe1f30a28c5f8f04a5aabadbdeb7f0133ef85306f5c7e4aa621e6
Instruction ID: c0e635505414036f6583b051b95eda7f92106e2666d536b1a8f6c8a66f700970
Opcode Fuzzy Hash: 87a709ff76dfe1f30a28c5f8f04a5aabadbdeb7f0133ef85306f5c7e4aa621e6
Instruction Fuzzy Hash: B3B16DB1D00208DFCB18DFA8D855BAEBBF5BF88310F14852DE45AE7641E738A945CB61

Function 6BECDDA0 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 106threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6BECDF29

Strings

4, xrefs: 6BECDDD5
d, xrefs: 6BECDDD9
t, xrefs: 6BECDDC1
P, xrefs: 6BECDE30
N, xrefs: 6BECDE46
L., xrefs: 6BECDEE4
H, xrefs: 6BECDF22
9, xrefs: 6BECDE5B

Memory Dump Source

Source File: 00000006.00000002.2292258011.000000006BEB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6BEB0000, based on PE: true

Associated: 00000006.00000002.2292241036.000000006BEB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292289619.000000006BEE6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292309996.000000006BEF4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292425687.000000006C109000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292558037.000000006C35B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292594857.000000006C35C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6beb0000_GUP.jbxd

Yara matches

Similarity

API ID: CurrentThread
String ID: 4$9$H$L.$N$P$d$t
API String ID: 2882836952-3246358163
Opcode ID: ecf5a35b2e81a17f7d2c0b433ac65e776b65fe46d51b056defd758c49a0e68ae
Instruction ID: 5a6831937ee15d0fc1caae4858da2db9aee9dbb17f2e3f29005bcb2bbdfeb021
Opcode Fuzzy Hash: ecf5a35b2e81a17f7d2c0b433ac65e776b65fe46d51b056defd758c49a0e68ae
Instruction Fuzzy Hash: 91516AB0D052A88EDB11CF68D9543DEBFB5BF9A304F1080EAE158AB341D3794A85CF56

Function 00778763 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0077876A

Part of subcall function 00770BF3: __EH_prolog3.LIBCMT ref: 00770BFA
Part of subcall function 00770BF3: std::_Lockit::_Lockit.LIBCPMT ref: 00770C04
Part of subcall function 00770BF3: int.LIBCPMT ref: 00770C1B

Strings

:AM:am:PM:pm, xrefs: 00778AFF
%m / %d / %y, xrefs: 00778866
%b %d %H : %M : %S %Y, xrefs: 00778A22
%I : %M : %S %p, xrefs: 00778AF4
%d / %m / %y, xrefs: 00778ACD
%H : %M : %S, xrefs: 00778926
%H : %M, xrefs: 007788AF

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: H_prolog3$LockitLockit::_std::_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 2181796688-2891247106
Opcode ID: e5a8fd0b7fbedefb86b158c4991ec272591d7ad52951c1a68aae9d8ba53a50b3
Instruction ID: 3ac1aa0549040cf96075c958721ee18ee14940ea05568710354815fff1e4414f
Opcode Fuzzy Hash: e5a8fd0b7fbedefb86b158c4991ec272591d7ad52951c1a68aae9d8ba53a50b3
Instruction Fuzzy Hash: 9DC194B2540109EFCF58DF98CD5DDFA77B8FB09340F15811AFA0AA6151EA34DA10CB62

Function 0077EACD Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0077EAD4

Part of subcall function 0073B390: std::_Lockit::_Lockit.LIBCPMT ref: 0073B3BD
Part of subcall function 0073B390: std::_Lockit::_Lockit.LIBCPMT ref: 0073B3E0
Part of subcall function 0073B390: std::_Lockit::~_Lockit.LIBCPMT ref: 0073B400
Part of subcall function 0073B390: std::_Lockit::~_Lockit.LIBCPMT ref: 0073B48D

Strings

:AM:am:PM:pm, xrefs: 0077EE69
%m / %d / %y, xrefs: 0077EBD0
%b %d %H : %M : %S %Y, xrefs: 0077ED8C
%I : %M : %S %p, xrefs: 0077EE5E
%d / %m / %y, xrefs: 0077EE37
%H : %M : %S, xrefs: 0077EC90
%H : %M, xrefs: 0077EC19

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: 009017c3b6ac86ebef4322f55e3ad4b6a1ec1c74c020704462e2f8fc59ccb154
Instruction ID: 64056dd1041d56e3abb98907eb19b38d7f1304a07dacd514eb9b0d63c10f45f3
Opcode Fuzzy Hash: 009017c3b6ac86ebef4322f55e3ad4b6a1ec1c74c020704462e2f8fc59ccb154
Instruction Fuzzy Hash: 9CC1A2B6500109AFDF19DF58CD95DFE3BE8EB0D380F148559FA0AA6251D638DE10CB21

Function 00778B53 Relevance: 14.4, APIs: 1, Strings: 7, Instructions: 351COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00778B5A

Part of subcall function 00770C88: __EH_prolog3.LIBCMT ref: 00770C8F
Part of subcall function 00770C88: std::_Lockit::_Lockit.LIBCPMT ref: 00770C99
Part of subcall function 00770C88: int.LIBCPMT ref: 00770CB0

Strings

:AM:am:PM:pm, xrefs: 00778EEF
%m / %d / %y, xrefs: 00778C56
%b %d %H : %M : %S %Y, xrefs: 00778E12
%I : %M : %S %p, xrefs: 00778EE4
%d / %m / %y, xrefs: 00778EBD
%H : %M : %S, xrefs: 00778D16
%H : %M, xrefs: 00778C9F

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: H_prolog3$LockitLockit::_std::_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 2181796688-2891247106
Opcode ID: e24d8d6b2c784ef32d69d589417f4dd821dd12309bf8236f4187ac880ea56a58
Instruction ID: c0b2aea51619069b7bb25253cc188d4d0e569095946043cbdce07182c4c0b9ff
Opcode Fuzzy Hash: e24d8d6b2c784ef32d69d589417f4dd821dd12309bf8236f4187ac880ea56a58
Instruction Fuzzy Hash: 27C1A37294010AEBCF68DF58CD5DDFB37A9EB09340F148519FA4AE6151DA38DE10CB62

Function 6BED7AC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6BED7AF7
___except_validate_context_record.LIBVCRUNTIME ref: 6BED7AFF
_ValidateLocalCookies.LIBCMT ref: 6BED7B88
__IsNonwritableInCurrentImage.LIBCMT ref: 6BED7BB3
_ValidateLocalCookies.LIBCMT ref: 6BED7C08

Strings

csm, xrefs: 6BED7B9D
5mk, xrefs: 6BED7BCC, 6BED7CA7
csm, xrefs: 6BED7C31

Memory Dump Source

Source File: 00000006.00000002.2292258011.000000006BEB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6BEB0000, based on PE: true

Associated: 00000006.00000002.2292241036.000000006BEB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292289619.000000006BEE6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292309996.000000006BEF4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292425687.000000006C109000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292558037.000000006C35B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292594857.000000006C35C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6beb0000_GUP.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: 5mk$csm$csm
API String ID: 1170836740-1169753632
Opcode ID: a26419bb06e15eae5397556dec9b0e989170e37890d44d51014dc3775200fd8b
Instruction ID: 1b3f878ec9b057237793774c6e3d10ae0cb69ea40ab2b00fc956e483ef8f48c5
Opcode Fuzzy Hash: a26419bb06e15eae5397556dec9b0e989170e37890d44d51014dc3775200fd8b
Instruction Fuzzy Hash: 3D517334A002099FCF04DF68C844B9E7BB6FF45319F6081A9E9259B391D7B9DA13CB91

Function 00749D20 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90windowsleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00749D48
SendMessageW.USER32(00000403,00000000,00000000), ref: 00749D69
SendMessageW.USER32(00000404,?,00000000), ref: 00749DEA
SendMessageW.USER32(00000405,00000000,00000000), ref: 00749DFB
SetWindowTextW.USER32(?), ref: 00749E3C
SendMessageW.USER32(00000111,00000001,00000000), ref: 00749E57

Strings

Downloading %s: %Iu %%, xrefs: 00749E16
(:|, xrefs: 00749E08

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: MessageSend$SleepTextWindow
String ID: (:|$Downloading %s: %Iu %%
API String ID: 3045854461-888542592
Opcode ID: 9800e9cb2e34273f241f399e52c82ccbf83531db283bfb8d16fa56d2fd756451
Instruction ID: 936fd0aeff8be5cf6c2bb4796b460f9ad4d1c2a2fa15de9db6347061176ce9da
Opcode Fuzzy Hash: 9800e9cb2e34273f241f399e52c82ccbf83531db283bfb8d16fa56d2fd756451
Instruction Fuzzy Hash: 78314F71E40228B7DB21AF21ED05F9A7BB8FB44710F11C099F784665A0DB795AA4CF88

Function 00774BC6 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00774BCD
_Maklocstr.LIBCPMT ref: 00774C36
_Maklocstr.LIBCPMT ref: 00774C48
_Maklocchr.LIBCPMT ref: 00774C60
_Maklocchr.LIBCPMT ref: 00774C70
_Getvals.LIBCPMT ref: 00774C92

Part of subcall function 0076E2A3: _Maklocchr.LIBCPMT ref: 0076E2D2
Part of subcall function 0076E2A3: _Maklocchr.LIBCPMT ref: 0076E2E8

Strings

false, xrefs: 00774C31
true, xrefs: 00774C43

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Maklocchr$Maklocstr$GetvalsH_prolog3_
String ID: false$true
API String ID: 3549167292-2658103896
Opcode ID: 31084af4b23d38a610b780df0ed9bce30f5400b86ffa54c2eb5c31c6ab532629
Instruction ID: f068891baeb249c779e5d2c6ab0d9bbd2c44ea373b3f47355f2246b8f3982f72
Opcode Fuzzy Hash: 31084af4b23d38a610b780df0ed9bce30f5400b86ffa54c2eb5c31c6ab532629
Instruction Fuzzy Hash: 1E216DB2D00358EADF15AFA4D849ADE7B78AF05710F00815AB9099F182DF788940CBB1

Function 0078001C Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00780022
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00780030
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00780041
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00780052

Strings

GetTempPath2W, xrefs: 00780047
GetCurrentPackageId, xrefs: 0078002A
kernel32.dll, xrefs: 0078001D
GetSystemTimePreciseAsFileTime, xrefs: 00780036

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: d5f7d53b2f65d7a4a844cdb05d3084e65b77b32e516470341e9438475d335ce7
Instruction ID: 048b82c6b31eb4d295b1c20929cdee0d7d21fe446398ba443388e7a61b836a04
Opcode Fuzzy Hash: d5f7d53b2f65d7a4a844cdb05d3084e65b77b32e516470341e9438475d335ce7
Instruction Fuzzy Hash: CEE0ECB15463A4BB87009FB1FC2EDE63BB8FB8A721780C016B401D2160D77C5440CB9A

Function 00749580 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 007495B9
GetDlgItemTextW.USER32(?,000003EB,?,00000104), ref: 007495D6
GetDlgItemInt.USER32(?,000003EC,00000000,00000000), ref: 00749610
EndDialog.USER32(?,00000001), ref: 0074961E
SetDlgItemTextW.USER32(?,000003EB,0.0.0.0), ref: 00749653
SetDlgItemInt.USER32(?,000003EC,00000000), ref: 00749667

Strings

0.0.0.0, xrefs: 007495FC, 00749640, 00749647, 0074964C

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Item$DialogText
String ID: 0.0.0.0
API String ID: 1417051379-3771769585
Opcode ID: 75f8e05bb8408cf1e5a1b27b6d6c8962520315a8122c39f4c657267d6f28d025
Instruction ID: 1bd9987e1ef5375cb90d4d4eacd3f53fa5c583a0f83d399868d2fd09da656a94
Opcode Fuzzy Hash: 75f8e05bb8408cf1e5a1b27b6d6c8962520315a8122c39f4c657267d6f28d025
Instruction Fuzzy Hash: C721B071600108ABDB11EF68DC4AFEF3768EB45300F008259FA06965D1DBBEAA10CB5A

Function 00774C9F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00774CA6
_Maklocstr.LIBCPMT ref: 00774D0D
_Maklocstr.LIBCPMT ref: 00774D1F
_Maklocchr.LIBCPMT ref: 00774D37
_Maklocchr.LIBCPMT ref: 00774D47

Strings

false, xrefs: 00774D08
true, xrefs: 00774D1A

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: MaklocchrMaklocstr$H_prolog3_
String ID: false$true
API String ID: 2404127365-2658103896
Opcode ID: b6daaa8e223c0c1459c259461bb7348067f3417e1412544585bc993d317d8c12
Instruction ID: 6cec3a3b627d5e83e4af3543ed87b2e67152f90d251b0b8e42b686afd2adfa41
Opcode Fuzzy Hash: b6daaa8e223c0c1459c259461bb7348067f3417e1412544585bc993d317d8c12
Instruction Fuzzy Hash: 2A213DB5D00388EADF14EFA5D84999EBBB8AF45700F00815AF9159F252EB78D540CB71

Function 0076A1A7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0076A1AE
std::_Lockit::_Lockit.LIBCPMT ref: 0076A1B8
int.LIBCPMT ref: 0076A1CF

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

numpunct.LIBCPMT ref: 0076A1F2
std::_Facet_Register.LIBCPMT ref: 0076A209
std::_Lockit::~_Lockit.LIBCPMT ref: 0076A229

Strings

d?|, xrefs: 0076A1C3

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID: d?|
API String ID: 743221004-2985471429
Opcode ID: 902c444c8b8282d1990a366c9b4a7e1af642f3b4a62bc4c103a27a7b90cbebac
Instruction ID: 4843025f2943e941f63580c3762e9541b1e97ff69f03b73a3add299743eaded4
Opcode Fuzzy Hash: 902c444c8b8282d1990a366c9b4a7e1af642f3b4a62bc4c103a27a7b90cbebac
Instruction Fuzzy Hash: 1F01A132D00116EBCB05EB64D859AAD77B6BFC5310F24850CE81267291DF3C9E02CB52

Function 0077125A Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00771261
std::_Lockit::_Lockit.LIBCPMT ref: 0077126B
int.LIBCPMT ref: 00771282

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

moneypunct.LIBCPMT ref: 007712A5
std::_Facet_Register.LIBCPMT ref: 007712BC
std::_Lockit::~_Lockit.LIBCPMT ref: 007712DC

Strings

|A|, xrefs: 00771276

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID: |A|
API String ID: 419941038-310053749
Opcode ID: 758b40487340c573506d48a2dd2326f12fb7dfee24b6a5e52767a2e0dc295471
Instruction ID: 53177a94326bd3a444a4512e7f9a38b4b52368c49b5f317c5659dbc887856d60
Opcode Fuzzy Hash: 758b40487340c573506d48a2dd2326f12fb7dfee24b6a5e52767a2e0dc295471
Instruction Fuzzy Hash: C5012672A00115DBCF05EBA4C859ABD77A6BFC4310F648409F816A7282DF3C9E01CB81

Function 007715D8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 007715DF
std::_Lockit::_Lockit.LIBCPMT ref: 007715E9
int.LIBCPMT ref: 00771600

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

numpunct.LIBCPMT ref: 00771623
std::_Facet_Register.LIBCPMT ref: 0077163A
std::_Lockit::~_Lockit.LIBCPMT ref: 0077165A

Strings

hA|, xrefs: 007715F4

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID: hA|
API String ID: 743221004-156500185
Opcode ID: 85dc940abb0c93d72c13be06fcb19c58d3d404692c9da696185c187029f1da9d
Instruction ID: d8c6bcd433845d7848e51d63bba4e577aeb6d71b29330a6bd17178bdb83a0078
Opcode Fuzzy Hash: 85dc940abb0c93d72c13be06fcb19c58d3d404692c9da696185c187029f1da9d
Instruction Fuzzy Hash: C4010031900119DFCF05EBA4C869AAD77B2BF81350F688508E815A7281DF3D9E01CB81

Function 0077C6E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0077C6EB
std::_Lockit::_Lockit.LIBCPMT ref: 0077C6F5
int.LIBCPMT ref: 0077C70C

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

messages.LIBCPMT ref: 0077C72F
std::_Facet_Register.LIBCPMT ref: 0077C746
std::_Lockit::~_Lockit.LIBCPMT ref: 0077C766

Strings

B|, xrefs: 0077C700

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermessages
String ID: B|
API String ID: 2750803064-1559269218
Opcode ID: 1c726cfaf21e1cdce51706330dd00426378917eb69e57b2c7e6482efb1ec11e2
Instruction ID: 80af84a0ed1d756ea41b812fe067d6d02bb2816ff3b3619d4ec3f0cb170e2945
Opcode Fuzzy Hash: 1c726cfaf21e1cdce51706330dd00426378917eb69e57b2c7e6482efb1ec11e2
Instruction Fuzzy Hash: 4001C435900115DBDF0AEB64D85AAADB7B6FF84750F24850CF815A7291DF3C9E01CB91

Function 0077C8A3 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0077C8AA
std::_Lockit::_Lockit.LIBCPMT ref: 0077C8B4
int.LIBCPMT ref: 0077C8CB

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

moneypunct.LIBCPMT ref: 0077C8EE
std::_Facet_Register.LIBCPMT ref: 0077C905
std::_Lockit::~_Lockit.LIBCPMT ref: 0077C925

Strings

0B|, xrefs: 0077C8BF

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID: 0B|
API String ID: 419941038-1087777810
Opcode ID: a577b47879bfa7d68e032713f000d10e7e18f6bb0e4da28641973cb190f9ed06
Instruction ID: 51279b83acf80cdfbe8f0aa4294cebeeb543c91918c5eab67b7e910aec55d36f
Opcode Fuzzy Hash: a577b47879bfa7d68e032713f000d10e7e18f6bb0e4da28641973cb190f9ed06
Instruction Fuzzy Hash: E5012231900515DBCF06EB60D85AAADB7B6BFC8320F24850CF816A7281DF3C9E01CB81

Function 0077C938 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0077C93F
std::_Lockit::_Lockit.LIBCPMT ref: 0077C949
int.LIBCPMT ref: 0077C960

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

moneypunct.LIBCPMT ref: 0077C983
std::_Facet_Register.LIBCPMT ref: 0077C99A
std::_Lockit::~_Lockit.LIBCPMT ref: 0077C9BA

Strings

,B|, xrefs: 0077C954

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID: ,B|
API String ID: 419941038-1441428998
Opcode ID: 52f428a045b6e9ff9de7f609093825091fb59504a2ffcd92dbd8d2a6e99c5226
Instruction ID: a021d260065b63ac7e948f298bcc38a48a2de156a9def673c78e68ad663dea51
Opcode Fuzzy Hash: 52f428a045b6e9ff9de7f609093825091fb59504a2ffcd92dbd8d2a6e99c5226
Instruction Fuzzy Hash: 52010432900115DBCF06EBA4C85AABD77A2BF88350F24850DF81567291DF3C9E01CB91

Function 007992EE Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(FFBCC9E0,00000000,00000000,007846E4), ref: 00799351

Part of subcall function 0079B90B: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,007987C2,?,00000000,-00000008), ref: 0079B96C

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 007995A3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 007995E9
GetLastError.KERNEL32 ref: 0079968C

Strings

Fx, xrefs: 00799320
Fx, xrefs: 007996A4

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID: Fx$Fx
API String ID: 2112829910-1866101241
Opcode ID: ff4ddb90ddacb1254c2599d92c0027c9ee830a162eaf4de95aa87c263d753dfb
Instruction ID: fa3767ab0bb60d182422fc2ec91c7670995a2462a6885fc736952860bf832d2a
Opcode Fuzzy Hash: ff4ddb90ddacb1254c2599d92c0027c9ee830a162eaf4de95aa87c263d753dfb
Instruction Fuzzy Hash: FBD18BB5D00258DFDF15CFA8E8809EDBBB4FF49300F24856EE556EB251D634A942CB50

Function 0079772D Relevance: 10.8, APIs: 7, Instructions: 329COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 007977B3

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 1292b4344b8cbd0f9a7173a655dd7d6fcee73348a648dd9e1cdd4dc8e59592c4
Instruction ID: 689dda64e13294b14b4e6f73b815a2803cd31571f902e595329f5fb2d55433bc
Opcode Fuzzy Hash: 1292b4344b8cbd0f9a7173a655dd7d6fcee73348a648dd9e1cdd4dc8e59592c4
Instruction Fuzzy Hash: 23B16932A28355DFDF19CF68DC86BAE7BA5EF55320F148155E904AF382D278AD01C7A0

Function 00783254 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00783373
___TypeMatch.LIBVCRUNTIME ref: 00783481
CallUnexpected.LIBVCRUNTIME ref: 007835EE

Strings

csm, xrefs: 007832FE
csm, xrefs: 007833AA
csm, xrefs: 00783291

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: 7e95d5370dd3cdac2540ea5bd74b5bcfb7c69d0aa5cf23b68b5a647996bac622
Instruction ID: 2198cd768fdd05a0ed13900e93b3bb709030bb79e6b3dd897d54b8f6cdcc00f4
Opcode Fuzzy Hash: 7e95d5370dd3cdac2540ea5bd74b5bcfb7c69d0aa5cf23b68b5a647996bac622
Instruction Fuzzy Hash: D0B18C71880209EFCF15FFA8C8899AEBBB5FF04B11F14415AE8156B212D739DB61CB91

Function 0074D840 Relevance: 10.7, APIs: 7, Instructions: 229COMMON

Download Yara Rule

APIs

Part of subcall function 00767F8D: __EH_prolog3.LIBCMT ref: 00767F94
Part of subcall function 00767F8D: std::_Lockit::_Lockit.LIBCPMT ref: 00767F9F
Part of subcall function 00767F8D: std::locale::_Setgloballocale.LIBCPMT ref: 00767FBA
Part of subcall function 00767F8D: _Yarn.LIBCPMT ref: 00767FD0
Part of subcall function 00767F8D: std::_Lockit::~_Lockit.LIBCPMT ref: 0076800D

std::_Lockit::_Lockit.LIBCPMT ref: 0074D8F5
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0074D93D

Part of subcall function 0076808B: _Yarn.LIBCPMT ref: 007680AA
Part of subcall function 0076808B: _Yarn.LIBCPMT ref: 007680CE

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0074D972
std::_Lockit::~_Lockit.LIBCPMT ref: 0074DA07
std::locale::_Locimp::_New_Locimp.LIBCPMT ref: 0074DA31
std::_Lockit::_Lockit.LIBCPMT ref: 0074DA51
std::_Lockit::~_Lockit.LIBCPMT ref: 0074DA72

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_Yarn$Locinfo::_std::locale::_$H_prolog3LocimpLocimp::_Locinfo_ctorLocinfo_dtorNew_Setgloballocale
String ID:
API String ID: 3466485411-0
Opcode ID: f33df2cfb4743208b6dbe7799ef55b184f403c2fae18d27002553f425b3821b6
Instruction ID: 505fa258c251e7f56839889f2271e8c19d67d93ffed5d17346f2acfc0d6b4027
Opcode Fuzzy Hash: f33df2cfb4743208b6dbe7799ef55b184f403c2fae18d27002553f425b3821b6
Instruction Fuzzy Hash: 55914BB0A04245DFDB15DFA4C889B9ABBF4FF14304F148169E849AB282E779DD44CBA1

Function 0073EB30 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0073EBB1
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0073EBFD
__Getctype.LIBCPMT ref: 0073EC1A
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 0073EC5B
std::_Lockit::~_Lockit.LIBCPMT ref: 0073ECF0

Strings

bad locale name, xrefs: 0073ED0C

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Locinfo::_Lockit$GetctypeLocinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1840309910-1405518554
Opcode ID: a801cae393665a2308a4f9ca3b147b6ead1941ddb5c1c3f097e618075d8157dc
Instruction ID: 331d68d62225b7c65643e651aa44aab0c9101f967b49cd981afe00bef60ad257
Opcode Fuzzy Hash: a801cae393665a2308a4f9ca3b147b6ead1941ddb5c1c3f097e618075d8157dc
Instruction Fuzzy Hash: 7F512AB1D00258DFEF11DFA4C949B8EBBB4BF04314F148565E809A7382E779A909CBA1

Function 00781650 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00781687
___except_validate_context_record.LIBVCRUNTIME ref: 0078168F
_ValidateLocalCookies.LIBCMT ref: 00781718
__IsNonwritableInCurrentImage.LIBCMT ref: 00781743
_ValidateLocalCookies.LIBCMT ref: 00781798

Strings

csm, xrefs: 0078172D

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b957cf7a86e9f551547f4ce90a88c5f4edf5a724564cfbb4a42e2fdd5cc6d155
Instruction ID: b3c59b79d8654d9eb4836a53abe8233e0dc178b844e24b2890e82d0d9f62ecb6
Opcode Fuzzy Hash: b957cf7a86e9f551547f4ce90a88c5f4edf5a724564cfbb4a42e2fdd5cc6d155
Instruction Fuzzy Hash: E941D634A40209DBCF10EF68C884A9E7BB9FF45324F548159E815AB352D739EE12CB91

Function 0074B0C0 Relevance: 10.6, APIs: 7, Instructions: 100COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32(?,000003F0,?), ref: 0074B140
SetWindowTextW.USER32(?,?), ref: 0074B154
SetDlgItemTextW.USER32(?,00000002,?), ref: 0074B16F
SetDlgItemTextW.USER32(?,00000006,?), ref: 0074B186
SetDlgItemTextW.USER32(?,00000001,?), ref: 0074B19D
SetDlgItemTextW.USER32(?,00000007,?), ref: 0074B1B7

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Text$Item$Window
String ID:
API String ID: 820206838-0
Opcode ID: ffd9c9b42d85b41fa678ac0d6d48d81da7b078a453581bd76cfc24cdc4db7ea6
Instruction ID: 2bcd1a807a08d86d8bb9dc04974c4cdd3cd1bd52ade2e71ec8a339a335ce6161
Opcode Fuzzy Hash: ffd9c9b42d85b41fa678ac0d6d48d81da7b078a453581bd76cfc24cdc4db7ea6
Instruction Fuzzy Hash: AE316871500618EFD731CF68DC98B7A73F8EB41709F04092AE496865A1C7B9FC95CBA1

Function 00798A29 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,FFBCC9E0,?,00798B38,?,?,00000000,?), ref: 00798AEA

Strings

ext-ms-, xrefs: 00798A94
api-ms-, xrefs: 00798A80

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 33f3ec16f146782fa2eb6c38e8bfba5a54de7ba94329dea828e22c1d029a6446
Instruction ID: ba93b7123fc0816b696450512eba09310f708c44a2f64427db058cd802b3ddfd
Opcode Fuzzy Hash: 33f3ec16f146782fa2eb6c38e8bfba5a54de7ba94329dea828e22c1d029a6446
Instruction Fuzzy Hash: 5C210531A01651ABCF629B24FC45F6A3768EB43364F258112ED16E7290EF3CED01C796

Function 0076A07D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0076A084
std::_Lockit::_Lockit.LIBCPMT ref: 0076A08E
int.LIBCPMT ref: 0076A0A5

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 0076A0DF
std::_Lockit::~_Lockit.LIBCPMT ref: 0076A0FF

Strings

\?|, xrefs: 0076A099

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: \?|
API String ID: 2854358121-2609519085
Opcode ID: 916db1290deb6ba6aed07e3f0305a2bcdaadad2cc13c64071c6ba29d4220f74f
Instruction ID: 805a699a600e36154e87e35a5222c41757e1ef657a171e02e9f24b3142b4d129
Opcode Fuzzy Hash: 916db1290deb6ba6aed07e3f0305a2bcdaadad2cc13c64071c6ba29d4220f74f
Instruction Fuzzy Hash: EB01C431900116EBDB05EB64C859AAD77B2AFC5310F24850DEC16772D1DF3C9E41CB52

Function 0076A112 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0076A119
std::_Lockit::_Lockit.LIBCPMT ref: 0076A123
int.LIBCPMT ref: 0076A13A

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 0076A174
std::_Lockit::~_Lockit.LIBCPMT ref: 0076A194

Strings

`?|, xrefs: 0076A12E

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: `?|
API String ID: 2854358121-3069904153
Opcode ID: 382d3949da7710d814e4a604617a35172ef2ab9b24f649c465249cb6e976a14b
Instruction ID: fb18f0993894a1b36f0755490d8e78a18f6133267dacdfc3dbebe02eb6ae7c13
Opcode Fuzzy Hash: 382d3949da7710d814e4a604617a35172ef2ab9b24f649c465249cb6e976a14b
Instruction Fuzzy Hash: D801C071900119EBDF09EB68C859AAD77B6AFC5310F24850DEC1677291DF3C9E01CB92

Function 00771384 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0077138B
std::_Lockit::_Lockit.LIBCPMT ref: 00771395
int.LIBCPMT ref: 007713AC

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 007713E6
std::_Lockit::~_Lockit.LIBCPMT ref: 00771406

Strings

`A|, xrefs: 007713A0

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: `A|
API String ID: 2854358121-122114401
Opcode ID: 0f7260447580fa5db1cdde5b5291545503fedae3a1ab6e512776433487a81f40
Instruction ID: abeb0890c84568caf9b252f20bbd665220665003cb9a77282866bfb6929106d7
Opcode Fuzzy Hash: 0f7260447580fa5db1cdde5b5291545503fedae3a1ab6e512776433487a81f40
Instruction Fuzzy Hash: A2012271800219DFCF05EB64D859AAD77B2BFC0720F698408E815672C1DF3C9E02CB81

Function 007714AE Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 007714B5
std::_Lockit::_Lockit.LIBCPMT ref: 007714BF
int.LIBCPMT ref: 007714D6

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 00771510
std::_Lockit::~_Lockit.LIBCPMT ref: 00771530

Strings

dA|, xrefs: 007714CA

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: dA|
API String ID: 2854358121-5175741
Opcode ID: 2df3293763905d46ed3e74631cab23ac57654872d444f3769661d9a5c40dbd09
Instruction ID: ba93049335b5d513d8fe939d9b6bc28c157b10cf0addc07f26a887c3cf8fc1a3
Opcode Fuzzy Hash: 2df3293763905d46ed3e74631cab23ac57654872d444f3769661d9a5c40dbd09
Instruction Fuzzy Hash: EC01DB72900115DBCF09EB64C859AAD77B6BFC4350F54850DE81667291DF3CDE01CB81

Function 0077C779 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0077C780
std::_Lockit::_Lockit.LIBCPMT ref: 0077C78A
int.LIBCPMT ref: 0077C7A1

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 0077C7DB
std::_Lockit::~_Lockit.LIBCPMT ref: 0077C7FB

Strings

$B|, xrefs: 0077C795

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: $B|
API String ID: 2854358121-1543055294
Opcode ID: 5c0ad8f4dfdbd765f9ec5416cb40c3738a1339a44f5b00a636e2c4422f3c08ce
Instruction ID: ac77e146489a35a7f589b2a1e143c91645556693825130dade3405dc7cdcc2fa
Opcode Fuzzy Hash: 5c0ad8f4dfdbd765f9ec5416cb40c3738a1339a44f5b00a636e2c4422f3c08ce
Instruction Fuzzy Hash: AF01D231900116DBDF0AEB64C89AAAD77A6FF89350F24850DF81977291DF3C9E02CB81

Function 0077182C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00771833
std::_Lockit::_Lockit.LIBCPMT ref: 0077183D
int.LIBCPMT ref: 00771854

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 0077188E
std::_Lockit::~_Lockit.LIBCPMT ref: 007718AE

Strings

\A|, xrefs: 00771848

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: \A|
API String ID: 2854358121-708201877
Opcode ID: 6b4c0c5b9c643a6270867f38f23476cb6a893b859153dce21da03aa9ef12c71d
Instruction ID: 10110cbb1402fcb36c59a81727c8362e2cdda88948d9e1b5c4318513ef052490
Opcode Fuzzy Hash: 6b4c0c5b9c643a6270867f38f23476cb6a893b859153dce21da03aa9ef12c71d
Instruction Fuzzy Hash: 90012635C00119DFCF05EB68D859AAD77B2BF84360F648509E81567391DF3C9E01CB82

Function 0077C80E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0077C815
std::_Lockit::_Lockit.LIBCPMT ref: 0077C81F
int.LIBCPMT ref: 0077C836

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 0077C870
std::_Lockit::~_Lockit.LIBCPMT ref: 0077C890

Strings

(B|, xrefs: 0077C82A

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: (B|
API String ID: 2854358121-1390665434
Opcode ID: 0fd6831cceb9d3a81f90dde521af3ee86fcf7c7a0d1f5130c0da88d8c925ae1a
Instruction ID: 631c03f8119a8632f84b5aec79e41e699c3d0eb6577766b39ae8b33f69a80138
Opcode Fuzzy Hash: 0fd6831cceb9d3a81f90dde521af3ee86fcf7c7a0d1f5130c0da88d8c925ae1a
Instruction Fuzzy Hash: F701C435900115DBCF0AEB64D85AAAD77A2FF84350F25851DF81567291DF3C9E01CB82

Function 0077C9CD Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0077C9D4
std::_Lockit::_Lockit.LIBCPMT ref: 0077C9DE
int.LIBCPMT ref: 0077C9F5

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 0077CA2F
std::_Lockit::~_Lockit.LIBCPMT ref: 0077CA4F

Strings

4B|, xrefs: 0077C9E9

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 4B|
API String ID: 2854358121-1205830862
Opcode ID: 2f5f9f5dfead726e36af52bcb5e416c989ba2262343e960f18a0890b33aaaa91
Instruction ID: 4925edc4370e30a99d86de7b2a4835683b3b96c0c14d5f60da5058361f02580a
Opcode Fuzzy Hash: 2f5f9f5dfead726e36af52bcb5e416c989ba2262343e960f18a0890b33aaaa91
Instruction Fuzzy Hash: 4301A131900119DBDF06EB64C859AAD77A6BF88350F25C50CF8196B291DF3C9E058B91

Function 0077CA62 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0077CA69
std::_Lockit::_Lockit.LIBCPMT ref: 0077CA73
int.LIBCPMT ref: 0077CA8A

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 0077CAC4
std::_Lockit::~_Lockit.LIBCPMT ref: 0077CAE4

Strings

8B|, xrefs: 0077CA7E

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: 8B|
API String ID: 2854358121-1321565610
Opcode ID: 8559204d09d53772b66464b6e3a5c2548f4e37feb697b33b001ba8f53b9f7ee9
Instruction ID: ef22f788bd1eb4aa4a6e841892da379b94ddcd553902400bb6a74d071612ca60
Opcode Fuzzy Hash: 8559204d09d53772b66464b6e3a5c2548f4e37feb697b33b001ba8f53b9f7ee9
Instruction Fuzzy Hash: B901C431900119DBCF06EB64C85AAAD77A6BFC4350F26C54DF815AB291DF7C9E01CB81

Function 00770B5E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00770B65
std::_Lockit::_Lockit.LIBCPMT ref: 00770B6F
int.LIBCPMT ref: 00770B86

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 00770BC0
std::_Lockit::~_Lockit.LIBCPMT ref: 00770BE0

Strings

lA|, xrefs: 00770B7A

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID: lA|
API String ID: 2854358121-241018885
Opcode ID: 3c66cdb5aa622cbefab7ebd2603251e0af1173522fed07eeabd365e57f57b1de
Instruction ID: b37fb9211c6d922f9c21cbfedcc7415ec38760b14fcdebb53578de5716979632
Opcode Fuzzy Hash: 3c66cdb5aa622cbefab7ebd2603251e0af1173522fed07eeabd365e57f57b1de
Instruction Fuzzy Hash: BB010071804119DBCF05EB64C859AADB7A2BFC4314F688508E856672E1DF3C9E01CB81

Function 00770DB2 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00770DB9
std::_Lockit::_Lockit.LIBCPMT ref: 00770DC3
int.LIBCPMT ref: 00770DDA

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

messages.LIBCPMT ref: 00770DFD
std::_Lockit::~_Lockit.LIBCPMT ref: 00770E34

Strings

pA|, xrefs: 00770DCE

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3messages
String ID: pA|
API String ID: 50917705-459403793
Opcode ID: 6d1b09e1e09e3ea65336e7c43692319c1c0f2b769424196356d71230f77a629d
Instruction ID: ebe36820c0204834463e9c43057e7e0152f6afef0a7f40309529768d4e82e2c4
Opcode Fuzzy Hash: 6d1b09e1e09e3ea65336e7c43692319c1c0f2b769424196356d71230f77a629d
Instruction Fuzzy Hash: E3F09631900206DFDF15F7A0C86AA6E2366AF50760F648518F8156B2D1EF7C9E058791

Function 007804EE Relevance: 9.2, APIs: 6, Instructions: 225COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 00780579
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00780605
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00780670
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 0078068C
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 007806EF
CompareStringEx.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0078070C

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: c192e3a5dbfb280b7ba99f960162cbd232bfad41e50a9ca434f823bdaa13d017
Instruction ID: 37baecabb8eb75144e2f48adde170467e19d214a03c999a3fb30737508ef7de5
Opcode Fuzzy Hash: c192e3a5dbfb280b7ba99f960162cbd232bfad41e50a9ca434f823bdaa13d017
Instruction Fuzzy Hash: E571DE72A80259AFEF61AF64CC45BEE7BB5AF05710F190015E845A7191E73D9C18CFE0

Function 0076CB8D Relevance: 9.2, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 0076CBD6
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 0076CC41
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0076CC5E
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0076CC9D
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0076CCFC
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0076CD1F

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: e1da4ca8bb2a138c97fc24a656284795ed1619f23d8c0d0897195e145970e768
Instruction ID: b9e9384751a334f4e9042cda83a76ba55ad2f33fefb92ca78733c423c312d2b3
Opcode Fuzzy Hash: e1da4ca8bb2a138c97fc24a656284795ed1619f23d8c0d0897195e145970e768
Instruction Fuzzy Hash: 33517CB260020ABBEB225F64CC45FBA7BA9EF45740F154529FD4AE6190DB3C9D10DB60

Function 0079424B Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 370COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 007943C5
__freea.LIBCMT ref: 007943E1

Strings

SQy, xrefs: 00794624
am/pm, xrefs: 00794443
a/p, xrefs: 007944A7

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: __freea
String ID: SQy$a/p$am/pm
API String ID: 240046367-2249958009
Opcode ID: 218dee6d563bd2aa04b97f99b7b55dfcca3b5e1e2511a0fb0420481655762362
Instruction ID: fac353e258f927b860061148993c6208657437ffb769a14aa354b28e3ce444c5
Opcode Fuzzy Hash: 218dee6d563bd2aa04b97f99b7b55dfcca3b5e1e2511a0fb0420481655762362
Instruction Fuzzy Hash: FDC1DEB5900216DBCF248FA8E899FBAB7B0FF5A700F244159E901AB254D33D9D43CB61

Function 0074ABC0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 312COMMON

Download Yara Rule

Strings

ios_base::eofbit set, xrefs: 0074AD0E
ios_base::failbit set, xrefs: 0074AD05, 0074AD69
ios_base::badbit set, xrefs: 0074ACFE, 0074AD25

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID:
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 0-1866435925
Opcode ID: 3a90997295b74ea9de6fff7564eac5d67e942e40cada1a441ca4390d0f1893ee
Instruction ID: b7b4f64ba65431d00c5c46743659d5126da6b60f3115640e666a158be25cc4ea
Opcode Fuzzy Hash: 3a90997295b74ea9de6fff7564eac5d67e942e40cada1a441ca4390d0f1893ee
Instruction Fuzzy Hash: 19B1AA72B4021AEFDB14CF68C881AAAB7B5FF48310F14826AE815DB751D738ED50CB91

Function 00782EE6 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00782EDD,007810A9,00767A13), ref: 00782EF4
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00782F02
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00782F1B
SetLastError.KERNEL32(00000000,00782EDD,007810A9,00767A13), ref: 00782F6D

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ec8f756e31565125c462c868cdb3e1a0303de67c683d155f94dba59eb2183d10
Instruction ID: f72265a15dd41b7ef66d88a5b57c8852f9b69d2d0e59c1bd8301a4f2a103d5cb
Opcode Fuzzy Hash: ec8f756e31565125c462c868cdb3e1a0303de67c683d155f94dba59eb2183d10
Instruction Fuzzy Hash: C801B536248726AD97253674BC8D92B2BA4FB16772720427EF614810E3EB5D4C02D35C

Function 00771130 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00771137
std::_Lockit::_Lockit.LIBCPMT ref: 00771141
int.LIBCPMT ref: 00771158

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

moneypunct.LIBCPMT ref: 0077117B
std::_Facet_Register.LIBCPMT ref: 00771192
std::_Lockit::~_Lockit.LIBCPMT ref: 007711B2

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: 62a79f9e5bc53fbb085f6666964fbfdfc251d01b7f4f4a5a643af9b6cc0e3861
Instruction ID: dfca1e71a991b283f1198184a6b838cfbfd35c5cb7800b021283234e6c9ba16c
Opcode Fuzzy Hash: 62a79f9e5bc53fbb085f6666964fbfdfc251d01b7f4f4a5a643af9b6cc0e3861
Instruction Fuzzy Hash: 1701D63190011ADBDF05EB64C859AAD77A2BF85350F658509F9196B391DF3C9E01CB81

Function 007711C5 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 007711CC
std::_Lockit::_Lockit.LIBCPMT ref: 007711D6
int.LIBCPMT ref: 007711ED

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

moneypunct.LIBCPMT ref: 00771210
std::_Facet_Register.LIBCPMT ref: 00771227
std::_Lockit::~_Lockit.LIBCPMT ref: 00771247

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registermoneypunct
String ID:
API String ID: 419941038-0
Opcode ID: c2396ebc7a9191338f79c870e0cfd223b8a0f7e60ba25975edf71e92036a070b
Instruction ID: 69c4358dd08976f49621d390a618d5a0b527d8a18a6e2779c9775790aeaa37b9
Opcode Fuzzy Hash: c2396ebc7a9191338f79c870e0cfd223b8a0f7e60ba25975edf71e92036a070b
Instruction Fuzzy Hash: 99012631900119DFCF05EBA4C859ABD77B6BFC0310F658509E829A7282DF3C9E01CB41

Function 00771543 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0077154A
std::_Lockit::_Lockit.LIBCPMT ref: 00771554
int.LIBCPMT ref: 0077156B

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

numpunct.LIBCPMT ref: 0077158E
std::_Facet_Register.LIBCPMT ref: 007715A5
std::_Lockit::~_Lockit.LIBCPMT ref: 007715C5

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Registernumpunct
String ID:
API String ID: 743221004-0
Opcode ID: d80575e5fbae247653c9c32c5824cf96ae9fdf5d46c8cadce779bcb0151ecf94
Instruction ID: de7717bbc6d2fc2cca1dc348bcaf89022c950b2af73c8885cd6d8b1308cc57af
Opcode Fuzzy Hash: d80575e5fbae247653c9c32c5824cf96ae9fdf5d46c8cadce779bcb0151ecf94
Instruction Fuzzy Hash: 2501263190011ADFDF09EB64C859AAD77B2BFD0710F688408E8166B281DF3C9E12CB91

Function 00774A71 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00774A78
_Getvals.LIBCPMT ref: 00774AD5
_Mpunct.LIBCPMT ref: 00774B10
_Mpunct.LIBCPMT ref: 00774B2A

Strings

$+xv, xrefs: 00774B35

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Mpunct$GetvalsH_prolog3
String ID: $+xv
API String ID: 2204710431-1686923651
Opcode ID: df3898b1cd4ee81cf8c8041db26010539f56f720b065ee2d97e35e389ff18d21
Instruction ID: 1a6dd081bcd0ae96cb9619aa147334284af67bc8b9b0bd0c7a4a6ac906ae436d
Opcode Fuzzy Hash: df3898b1cd4ee81cf8c8041db26010539f56f720b065ee2d97e35e389ff18d21
Instruction Fuzzy Hash: 2621B1B1804B56AFDF21DF74C84476BBAF8AB09340F04861AE55DC7A41D778EA01CB94

Function 0078FDC7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,FFBCC9E0,00000002,?,00000000,007A66D0,000000FF,?,0078FDA3,?,?,0078FD77,00000016), ref: 0078FDFC
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0078FE0E
FreeLibrary.KERNEL32(00000000,?,00000000,007A66D0,000000FF,?,0078FDA3,?,?,0078FD77,00000016), ref: 0078FE30

Strings

mscoree.dll, xrefs: 0078FDF5
CorExitProcess, xrefs: 0078FE06

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a4ed85f8e377493c8ca4fab39fbacad90c9291b4e6243b89f5afcc5ea805a0a7
Instruction ID: eb59b5472c09720ff62eed0bcd66b03dc13288ac3ad6a8434cf6a35b9324222d
Opcode Fuzzy Hash: a4ed85f8e377493c8ca4fab39fbacad90c9291b4e6243b89f5afcc5ea805a0a7
Instruction Fuzzy Hash: AF018F71940629BBDB129F50DC09FAFBBB8FB85B11F004129F811A22A0DB7C9940CB91

Function 00771006 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0077100D
std::_Lockit::_Lockit.LIBCPMT ref: 00771017
int.LIBCPMT ref: 0077102E

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Lockit::~_Lockit.LIBCPMT ref: 00771088

Strings

xA|, xrefs: 00771022

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: xA|
API String ID: 1383202999-359834537
Opcode ID: 522e43c0062b64f1bb5553308872b5f6ec6f55cc17312bd989597518e230f77c
Instruction ID: 5ec105dc4040247b9e4d3dcbb940fc8805833da1b3f0ba513859ea5ce9e49173
Opcode Fuzzy Hash: 522e43c0062b64f1bb5553308872b5f6ec6f55cc17312bd989597518e230f77c
Instruction Fuzzy Hash: C5F09071800509DBDF09E7A4C86ABBE2366BF50750FA88518F815AB1D1EF3C9E55C742

Function 00770EDC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00770EE3
std::_Lockit::_Lockit.LIBCPMT ref: 00770EED
int.LIBCPMT ref: 00770F04

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Lockit::~_Lockit.LIBCPMT ref: 00770F5E

Strings

tA|, xrefs: 00770EF8

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: tA|
API String ID: 1383202999-476601037
Opcode ID: 0f041944d564b0ac0d049176fabc54bbf5e158e750183c0011bba3f09bd3d3b2
Instruction ID: 0d216f4aae205c1820a985499a3451fcf46bef4fe4b0dee5ce059b546cb4fcee
Opcode Fuzzy Hash: 0f041944d564b0ac0d049176fabc54bbf5e158e750183c0011bba3f09bd3d3b2
Instruction Fuzzy Hash: 0DF0B43290051AEBDF19E7B0C86ABBD7366AF40750F64C618F8196B1D1EF3C9E058781

Function 00743EA0 Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00743ED1
std::_Lockit::_Lockit.LIBCPMT ref: 00743EEF
std::_Lockit::~_Lockit.LIBCPMT ref: 00743F0F
std::_Facet_Register.LIBCPMT ref: 00743FD6
std::_Lockit::~_Lockit.LIBCPMT ref: 00743FEE

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 8b6b1dd9a15f7a7616008144c407dc9c48e753507d73fc1f6883a5cb87da99c2
Instruction ID: 8d7d9c2039302b6c27528ba11a71f9b99f7befe5827e87e0c2901dccea9560cd
Opcode Fuzzy Hash: 8b6b1dd9a15f7a7616008144c407dc9c48e753507d73fc1f6883a5cb87da99c2
Instruction Fuzzy Hash: 8741BAB1E01215CFDB14DF58D885AAEBBB4FB04754F148269E85AAB381D738EE05CBD0

Function 0076C6FE Relevance: 7.6, APIs: 5, Instructions: 116threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0076C712
AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,00000000,?,ios_base::failbit set), ref: 0076C731
AcquireSRWLockExclusive.KERNEL32(?,?,74E15EE0,?,?,?,?,?,?,00000000,?,ios_base::failbit set), ref: 0076C75F
TryAcquireSRWLockExclusive.KERNEL32(?,?,74E15EE0,?,?,?,?,?,?,00000000,?,ios_base::failbit set), ref: 0076C7BA
TryAcquireSRWLockExclusive.KERNEL32(?,?,74E15EE0,?,?,?,?,?,?,00000000,?,ios_base::failbit set), ref: 0076C7D1

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: AcquireExclusiveLock$CurrentThread
String ID:
API String ID: 66001078-0
Opcode ID: a6ba3c1ba11cbd88fc49b47ce9c86fd9fde95b915e9360bc90821144ad841814
Instruction ID: 05fdf7df01a386569b127c7467e55e2ba809f1dd3ab148a3ce58b5a022785767
Opcode Fuzzy Hash: a6ba3c1ba11cbd88fc49b47ce9c86fd9fde95b915e9360bc90821144ad841814
Instruction Fuzzy Hash: BB41377190060AEBCB22DF65C48597AB3F8FB09350B50892AD89797A40E738F984CF65

Function 0073B390 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0073B3BD
std::_Lockit::_Lockit.LIBCPMT ref: 0073B3E0
std::_Lockit::~_Lockit.LIBCPMT ref: 0073B400
std::_Facet_Register.LIBCPMT ref: 0073B475
std::_Lockit::~_Lockit.LIBCPMT ref: 0073B48D

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: f4fa049ded75eba5000a47ef659838dfb3da3461b13fd5fddb16e85af60756f6
Instruction ID: 77fdaf5d0a0ec0ff54760766f25e9c1f00db23962f9f87842656924c2e4d5af6
Opcode Fuzzy Hash: f4fa049ded75eba5000a47ef659838dfb3da3461b13fd5fddb16e85af60756f6
Instruction Fuzzy Hash: A531F071900259DFDB14CF58D885AAEBBB4FB04324F14861DE906AB392D779AE40CBD4

Function 0076AB18 Relevance: 7.6, APIs: 5, Instructions: 94COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0076AB1F
std::_Lockit::_Lockit.LIBCPMT ref: 0076AB29
std::_Lockit::~_Lockit.LIBCPMT ref: 0076ABD0
Concurrency::cancel_current_task.LIBCPMT ref: 0076ABDB
__EH_prolog3.LIBCMT ref: 0076ABE8

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$Concurrency::cancel_current_taskLockit::_Lockit::~_
String ID:
API String ID: 845066630-0
Opcode ID: adcc54a0f456c4a9ffd9ed12111f9075a3d087303e4585fbab8ba471ac6bf93b
Instruction ID: e7fe1a14bf809d7d01b4b5e56125ee2246f705e536e12495c798b8706f1231a7
Opcode Fuzzy Hash: adcc54a0f456c4a9ffd9ed12111f9075a3d087303e4585fbab8ba471ac6bf93b
Instruction Fuzzy Hash: 68318B71A00616EFCF08EF54C895AACB776FF85310F408559E816AB2A1DB78EE10CF91

Function 0076E211 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 0076E231
_Maklocstr.LIBCPMT ref: 0076E24E
_Maklocstr.LIBCPMT ref: 0076E26B
_Maklocchr.LIBCPMT ref: 0076E27D
_Maklocchr.LIBCPMT ref: 0076E290

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Maklocstr$Maklocchr
String ID:
API String ID: 2020259771-0
Opcode ID: 8448704dd7f48b9c3d8b2284b863b27a7160c6b4a9371c245447fe220523da4e
Instruction ID: fb6c6e6aaf31af4901af8918713f563cb4312f4f53af74d7d17f516d5a9277b5
Opcode Fuzzy Hash: 8448704dd7f48b9c3d8b2284b863b27a7160c6b4a9371c245447fe220523da4e
Instruction Fuzzy Hash: BF118FB5500B84BFE720DBA5D845F12BBACFF08710F04452AFA4A8BA40D669F85487B4

Function 007712EF Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 007712F6
std::_Lockit::_Lockit.LIBCPMT ref: 00771300
int.LIBCPMT ref: 00771317

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 00771351
std::_Lockit::~_Lockit.LIBCPMT ref: 00771371

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 90a607ebfc6f8a1f6dda44e77ed68a5b0787d8aa39b15586789c860630c7b970
Instruction ID: 065c146d3b25d395ccf0ec82e33549a99b9105bc2a74b313965e6a0a8bc240ea
Opcode Fuzzy Hash: 90a607ebfc6f8a1f6dda44e77ed68a5b0787d8aa39b15586789c860630c7b970
Instruction Fuzzy Hash: A6016235900109DBCF08EBA8C859ABD73B6BF80310F69C108F81567281EF3C8E02CB81

Function 00771419 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00771420
std::_Lockit::_Lockit.LIBCPMT ref: 0077142A
int.LIBCPMT ref: 00771441

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 0077147B
std::_Lockit::~_Lockit.LIBCPMT ref: 0077149B

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 1c2392a483da56a5057f295c6433c5677f0a8d0c6eb12d704f375a2a2601a009
Instruction ID: f280184d158f05c302c31653400f2a31735b365f1ddc8901051bd1dace87e7a6
Opcode Fuzzy Hash: 1c2392a483da56a5057f295c6433c5677f0a8d0c6eb12d704f375a2a2601a009
Instruction Fuzzy Hash: C001003190011ADBDF05EB68D85AABD77B6BFC4710F688108E82967291DF3C9E02CB91

Function 0077166D Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00771674
std::_Lockit::_Lockit.LIBCPMT ref: 0077167E
int.LIBCPMT ref: 00771695

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 007716CF
std::_Lockit::~_Lockit.LIBCPMT ref: 007716EF

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 5010aefc5979f0e7781f2863ad2ac10ae654ae135af2d22fffb4bfaf5f0c5259
Instruction ID: d6cb5f93ed05888c45b53478dbf8deab46dd34e791b922abc49ce7fda2c3e9a2
Opcode Fuzzy Hash: 5010aefc5979f0e7781f2863ad2ac10ae654ae135af2d22fffb4bfaf5f0c5259
Instruction Fuzzy Hash: 2B012276800115DBDF05EBA8D859AADB7B6BF84310F68C508F815A7292DF3C9E05CB81

Function 0077C64F Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0077C656
std::_Lockit::_Lockit.LIBCPMT ref: 0077C660
int.LIBCPMT ref: 0077C677

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 0077C6B1
std::_Lockit::~_Lockit.LIBCPMT ref: 0077C6D1

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: bb01a913fe08ef625b702a5370cbbac0f3c24d2122aa5b52b1da80a355fb41fb
Instruction ID: c8104cf0a26b862908e2996d1d2ad39205ae43dee339b9a88cdc34b51f83966b
Opcode Fuzzy Hash: bb01a913fe08ef625b702a5370cbbac0f3c24d2122aa5b52b1da80a355fb41fb
Instruction Fuzzy Hash: F701D636900115DBCF06EBA4C89AABD77B6BF88750F24851DF815A7291DF3C9E01DB81

Function 00771702 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00771709
std::_Lockit::_Lockit.LIBCPMT ref: 00771713
int.LIBCPMT ref: 0077172A

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 00771764
std::_Lockit::~_Lockit.LIBCPMT ref: 00771784

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 71f7f5271310e2868dd530fc16ed2d1642f06914324cd44910de98d3c66247fc
Instruction ID: 87feed39435ce34c1eda95ba803320fbdc0dd6fb246e1eece01110ceb5842a60
Opcode Fuzzy Hash: 71f7f5271310e2868dd530fc16ed2d1642f06914324cd44910de98d3c66247fc
Instruction Fuzzy Hash: E1010471800115DFCF09EB64C859ABDB7A2AF80350F68C518E81567281EF3C9E01CB81

Function 00771797 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0077179E
std::_Lockit::_Lockit.LIBCPMT ref: 007717A8
int.LIBCPMT ref: 007717BF

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 007717F9
std::_Lockit::~_Lockit.LIBCPMT ref: 00771819

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 37f4097a4439b2c61b95df47c0e3aec6bc3e8c01ff574e14e5ddaeab6c68db45
Instruction ID: 7e2fa3d2bc1f3bd39353e36e686d7baa4786dab00ccfbdca178045ef2be6d198
Opcode Fuzzy Hash: 37f4097a4439b2c61b95df47c0e3aec6bc3e8c01ff574e14e5ddaeab6c68db45
Instruction Fuzzy Hash: 65012672800115DFCF05EB64D859AAD77B2BF80760F64840CF81A67292EF3C9E01CB92

Function 0077099F Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 007709A6
std::_Lockit::_Lockit.LIBCPMT ref: 007709B0
int.LIBCPMT ref: 007709C7

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 00770A01
std::_Lockit::~_Lockit.LIBCPMT ref: 00770A21

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 8ebd2c974c3287bf030581d18ae746a11cfc29715ea210d3f51607c9f6100e71
Instruction ID: 323b90243211e31936d129e4806ae7633680e5f0b85a53f7c2076532c2d3d63f
Opcode Fuzzy Hash: 8ebd2c974c3287bf030581d18ae746a11cfc29715ea210d3f51607c9f6100e71
Instruction Fuzzy Hash: 6101C431904219DBDF05EB64C859AAD77B2BFC4750F25C508F8156B291DF3C9E41CB91

Function 00770A34 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00770A3B
std::_Lockit::_Lockit.LIBCPMT ref: 00770A45
int.LIBCPMT ref: 00770A5C

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 00770A96
std::_Lockit::~_Lockit.LIBCPMT ref: 00770AB6

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: 4169bbe816420b37fd1b5501e28cfe87a222cf0b7b75712482301762b0e9c2db
Instruction ID: 6d1a26b085a2d841def15b3d4386cc80f0c03a6aad0015b8830377d55b1f1f2b
Opcode Fuzzy Hash: 4169bbe816420b37fd1b5501e28cfe87a222cf0b7b75712482301762b0e9c2db
Instruction Fuzzy Hash: 4001D236D00219DBCF05EB64C869AAE77B2BFC5350F2AC509E81567291DF7C9E01CB91

Function 00770AC9 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00770AD0
std::_Lockit::_Lockit.LIBCPMT ref: 00770ADA
int.LIBCPMT ref: 00770AF1

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Facet_Register.LIBCPMT ref: 00770B2B
std::_Lockit::~_Lockit.LIBCPMT ref: 00770B4B

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_H_prolog3Register
String ID:
API String ID: 2854358121-0
Opcode ID: d41fa9e7e8b02a1321ba88d2db0c1800f958eed16f3898bb41bf19291f83c402
Instruction ID: cc73bfecac6cac4175fd92429f85f8cf9ba58cbb7e8a5094a14e9a2a4b790f48
Opcode Fuzzy Hash: d41fa9e7e8b02a1321ba88d2db0c1800f958eed16f3898bb41bf19291f83c402
Instruction Fuzzy Hash: 70010471900119DBDF05EB64C859AADB7A2BF94314F258408F82967291DF3C9F02CB81

Function 00767F8D Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00767F94
std::_Lockit::_Lockit.LIBCPMT ref: 00767F9F
std::_Lockit::~_Lockit.LIBCPMT ref: 0076800D

Part of subcall function 00768120: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00768138

std::locale::_Setgloballocale.LIBCPMT ref: 00767FBA
_Yarn.LIBCPMT ref: 00767FD0

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: a0eedd08056cf901480bcdfe5e27cf73d4d588ad11c8f2f0948a882586cac9b8
Instruction ID: f849f2deb29c17f135d8dcc9d5901724bf8285e0ac72404e74255b61a037b470
Opcode Fuzzy Hash: a0eedd08056cf901480bcdfe5e27cf73d4d588ad11c8f2f0948a882586cac9b8
Instruction Fuzzy Hash: F7019A76A05111DBCB0AEB20E86997C7762BFC6340B18810DEC1217381DF7CAE46CBC6

Function 00770BF3 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00770BFA
std::_Lockit::_Lockit.LIBCPMT ref: 00770C04
int.LIBCPMT ref: 00770C1B

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

ctype.LIBCPMT ref: 00770C3E
std::_Lockit::~_Lockit.LIBCPMT ref: 00770C75

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3ctype
String ID:
API String ID: 3358926169-0
Opcode ID: 11e25daac32d7f9e296601add8403f7f77b34ec45af369680d30e3cf28bec76c
Instruction ID: 1215c843a8705808a16dc437c56369d74865b618831172d79d135db79726db1a
Opcode Fuzzy Hash: 11e25daac32d7f9e296601add8403f7f77b34ec45af369680d30e3cf28bec76c
Instruction Fuzzy Hash: B7F09631800115DBDF05E760C86AABD3366AF41750F658618F515671D2EF3C9E058791

Function 00770C88 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00770C8F
std::_Lockit::_Lockit.LIBCPMT ref: 00770C99
int.LIBCPMT ref: 00770CB0

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

ctype.LIBCPMT ref: 00770CD3
std::_Lockit::~_Lockit.LIBCPMT ref: 00770D0A

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3ctype
String ID:
API String ID: 3358926169-0
Opcode ID: c7ef2ebcab9c503abad1bb3bded58c1d91bf4fa18ec860e54082ed0a1eeafce0
Instruction ID: bc0c81d98f4dc8ef472a6a3430cd6182a325a1fde0ed7f97eb0018987dbc3f54
Opcode Fuzzy Hash: c7ef2ebcab9c503abad1bb3bded58c1d91bf4fa18ec860e54082ed0a1eeafce0
Instruction Fuzzy Hash: DEF09631900205DBDF05E7A0C85AABE2366AF40750F658518F8156B1D1EF3C9E058791

Function 00770D1D Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00770D24
std::_Lockit::_Lockit.LIBCPMT ref: 00770D2E
int.LIBCPMT ref: 00770D45

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

messages.LIBCPMT ref: 00770D68
std::_Lockit::~_Lockit.LIBCPMT ref: 00770D9F

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3messages
String ID:
API String ID: 50917705-0
Opcode ID: 64b1ff6bd35e18479b98c9d3b805157ae67f47973335297a23df3a062bb333c7
Instruction ID: 7e5755f65159617b47c85eba7287dc0bb2131f974edbad5936f0cb86205fc71f
Opcode Fuzzy Hash: 64b1ff6bd35e18479b98c9d3b805157ae67f47973335297a23df3a062bb333c7
Instruction Fuzzy Hash: A8F0BB31900605DBDF15E7A0C86ABBD3366AF50754F548518F8156B2D1EF3C9E058781

Function 0077109B Relevance: 7.5, APIs: 5, Instructions: 28COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 007710A2
std::_Lockit::_Lockit.LIBCPMT ref: 007710AC
int.LIBCPMT ref: 007710C3

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

moneypunct.LIBCPMT ref: 007710E6
std::_Lockit::~_Lockit.LIBCPMT ref: 0077111D

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3moneypunct
String ID:
API String ID: 3160146232-0
Opcode ID: b806c040d098050e48c7549b3069c84e02c86d053c559f2000f00d3981ef8448
Instruction ID: 5c38942a262d943d4c234e522931065143fa1e14c2cc21dd7a55125c09ca859b
Opcode Fuzzy Hash: b806c040d098050e48c7549b3069c84e02c86d053c559f2000f00d3981ef8448
Instruction Fuzzy Hash: 70F08271900109DBDF05EBA4C86ABAD7366BF90740F95C018F8156B281DF3C9E05CB51

Function 6BED16E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 142COMMON

Download Yara Rule

Strings

k, xrefs: 6BED1854
>, xrefs: 6BED176A
E, xrefs: 6BED1A9C

Memory Dump Source

Source File: 00000006.00000002.2292258011.000000006BEB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6BEB0000, based on PE: true

Associated: 00000006.00000002.2292241036.000000006BEB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292289619.000000006BEE6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292309996.000000006BEF4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292425687.000000006C109000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292558037.000000006C35B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292594857.000000006C35C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6beb0000_GUP.jbxd

Yara matches

Similarity

API ID:
String ID: >$E$k
API String ID: 0-2864373710
Opcode ID: b4cf61d3dbd2c2fb8546ed99db491a40c5771d8bba3a6465a9ac2eacee50f42e
Instruction ID: 33b5fa2a6d8800cf6ae27ae4b470c48dd396983b23540a1416d62c0aa248173c
Opcode Fuzzy Hash: b4cf61d3dbd2c2fb8546ed99db491a40c5771d8bba3a6465a9ac2eacee50f42e
Instruction Fuzzy Hash: 39714870D052A88FDB15CFA9D9817DDBBB9BF9A300F1480DAD488A7351E7748A85CF11

Function 0073F430 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 123COMMON

Download Yara Rule

APIs

std::ios_base::_Addstd.LIBCPMT ref: 0073F54D

Part of subcall function 00767F8D: __EH_prolog3.LIBCMT ref: 00767F94
Part of subcall function 00767F8D: std::_Lockit::_Lockit.LIBCPMT ref: 00767F9F
Part of subcall function 00767F8D: std::locale::_Setgloballocale.LIBCPMT ref: 00767FBA
Part of subcall function 00767F8D: _Yarn.LIBCPMT ref: 00767FD0
Part of subcall function 00767F8D: std::_Lockit::~_Lockit.LIBCPMT ref: 0076800D

Strings

ios_base::eofbit set, xrefs: 0073F57F, 0073F596
ios_base::failbit set, xrefs: 0073F575
ios_base::badbit set, xrefs: 0073F56E

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Lockitstd::_$AddstdH_prolog3Lockit::_Lockit::~_SetgloballocaleYarnstd::ios_base::_std::locale::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 90104431-1866435925
Opcode ID: 43c89af48e7a2abb1706aea5466534d24af8fd1206e6dce656ed029b801a1685
Instruction ID: 68574d26f9ec4108f75f76f64ffeb9651ce7327120cec060a9b7b178be6a01dc
Opcode Fuzzy Hash: 43c89af48e7a2abb1706aea5466534d24af8fd1206e6dce656ed029b801a1685
Instruction Fuzzy Hash: 7941AFB19007049FEB20DF14C449B5AFBF4FF44314F14862DE8569B682E7B9E904CB91

Function 0073BCC0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0073BDCE

Strings

]s, xrefs: 0073BCF0
ios_base::failbit set, xrefs: 0073BCDF
]s, xrefs: 0073BCE2, 0073BD80

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: ___std_exception_copy
String ID: ]s$]s$ios_base::failbit set
API String ID: 2659868963-3138870619
Opcode ID: 459c784194e8295dd00a9d8033b0ce842defeaa273f3146cfad6c59780ae3e0d
Instruction ID: 9b4ecb1c400649a3fb577cf022e0b0de342ea6bec4770054fe18e015cf0b3f89
Opcode Fuzzy Hash: 459c784194e8295dd00a9d8033b0ce842defeaa273f3146cfad6c59780ae3e0d
Instruction Fuzzy Hash: FA3152B1A002089FDB04DF68D845AEEBBF8EF49710F54822EE515E7741E774A944CBA4

Function 0077499B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 007749A2

Part of subcall function 0076E211: _Maklocstr.LIBCPMT ref: 0076E231
Part of subcall function 0076E211: _Maklocstr.LIBCPMT ref: 0076E24E
Part of subcall function 0076E211: _Maklocstr.LIBCPMT ref: 0076E26B
Part of subcall function 0076E211: _Maklocchr.LIBCPMT ref: 0076E27D
Part of subcall function 0076E211: _Maklocchr.LIBCPMT ref: 0076E290

_Mpunct.LIBCPMT ref: 00774A3A
_Mpunct.LIBCPMT ref: 00774A54

Strings

$+xv, xrefs: 00774A5F

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Maklocstr$MaklocchrMpunct$H_prolog3
String ID: $+xv
API String ID: 2939335142-1686923651
Opcode ID: 1c10217a0915d5863ab0711b672167b41fe0b243f1159122e396cb0b5307173b
Instruction ID: 445da595c4dbc28955ce69f5139d0d4340f8b36e58010515a29f2e379b70b290
Opcode Fuzzy Hash: 1c10217a0915d5863ab0711b672167b41fe0b243f1159122e396cb0b5307173b
Instruction Fuzzy Hash: 6D21B1B1904B56AFDB21DF74C844B6BBAF8AB09340F04861AE55DD7A41E778EA01CB90

Function 0077DDE9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0077DDF0
_Mpunct.LIBCPMT ref: 0077DE88
_Mpunct.LIBCPMT ref: 0077DEA2

Strings

$+xv, xrefs: 0077DEAD

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Mpunct$H_prolog3
String ID: $+xv
API String ID: 4281374311-1686923651
Opcode ID: 8fad970cc637572bd68ed70b035bb732b10dda5ea81dc6159973bca404ef2ffa
Instruction ID: 0ae0801cecfe4054aa535218996fa3b740eb747144ffc7381ae2fcf763c42965
Opcode Fuzzy Hash: 8fad970cc637572bd68ed70b035bb732b10dda5ea81dc6159973bca404ef2ffa
Instruction Fuzzy Hash: 0721B1B1904B55AFDB22DF74C844B6BBAF8AF09740F04461AE49DCBA41D778EA01CB90

Function 0076E305 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00772BF1: _Yarn.LIBCPMT ref: 00772C04

_Maklocstr.LIBCPMT ref: 0076E341

Part of subcall function 007748DB: _Yarn.LIBCPMT ref: 007748EE

_Maklocstr.LIBCPMT ref: 0076E35A

Part of subcall function 0076E489: Concurrency::cancel_current_task.LIBCPMT ref: 0076E52B

_Maklocstr.LIBCPMT ref: 0076E369

Strings

:AM:am:PM:pm, xrefs: 0076E361

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Maklocstr$Yarn$Concurrency::cancel_current_task
String ID: :AM:am:PM:pm
API String ID: 3924990383-1966799564
Opcode ID: 53eabd9f1bdec8631f42c1ec987a26171d71f441f0056cf343d10f924b7cf4ee
Instruction ID: cf55062043663a021091705847ae90a144307e37ce61f2c3fdf7e3f1d9b4abec
Opcode Fuzzy Hash: 53eabd9f1bdec8631f42c1ec987a26171d71f441f0056cf343d10f924b7cf4ee
Instruction Fuzzy Hash: 5F0184B2D00208BBDB00EFB5AC8AD9F77ACEB85754B10441AF905A7242DA78AD0187A0

Function 00784032 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00783FE3,00000000,?,007C4298,?,?,?,00784186,00000004,InitializeCriticalSectionEx,007B24CC,InitializeCriticalSectionEx), ref: 0078403F
GetLastError.KERNEL32(?,00783FE3,00000000,?,007C4298,?,?,?,00784186,00000004,InitializeCriticalSectionEx,007B24CC,InitializeCriticalSectionEx,00000000,?,00783F3D), ref: 00784049
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00784071

Strings

api-ms-, xrefs: 00784056

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: a50f9a06bcfc44365dd76f469e7e5326c9ba3e8e5a23a574fc79c60f13591a6a
Instruction ID: 713a8b550f8ac569ff031ce639e04f78bff158dd0401ada77aabde2198a84a62
Opcode Fuzzy Hash: a50f9a06bcfc44365dd76f469e7e5326c9ba3e8e5a23a574fc79c60f13591a6a
Instruction Fuzzy Hash: 68E01230280609BAEA212B71EC06B6A3B65AB41B44F108060FA4DE44E1D7AA9851C78A

Function 00767237 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(007C3AEC,?,?,?,0075429C,007C3AA8,00753E63,00000000,FFBCC9E0,?,?,74E15EE0), ref: 00767242
ReleaseSRWLockExclusive.KERNEL32(007C3AEC,?,0075429C,007C3AA8,00753E63,00000000,FFBCC9E0,?,?,74E15EE0), ref: 0076727C

Strings

:|, xrefs: 0076723C
c>u, xrefs: 00767248

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: c>u$:|
API String ID: 17069307-1875169475
Opcode ID: 24566802696e5b38b344151b894a24407d651fc19c761d6236cdda1e931cce6e
Instruction ID: 63e0fe5102f9e32e31a66db1ed74b3f3f8915cbd775f990b02b6acbb77dc0623
Opcode Fuzzy Hash: 24566802696e5b38b344151b894a24407d651fc19c761d6236cdda1e931cce6e
Instruction Fuzzy Hash: C5F0A031504105EFC724EF15D855E69BBB8FB867B4F21822EFDA7832A1D73C5882CA61

Function 007671E6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(007C3AEC,?,?,007542BC,007C3AA8,00000000,FFBCC9E0,?,?,74E15EE0), ref: 007671F0
ReleaseSRWLockExclusive.KERNEL32(007C3AEC,?,007542BC,007C3AA8,00000000,FFBCC9E0,?,?,74E15EE0), ref: 00767223
WakeAllConditionVariable.KERNEL32(007C3AE8,?,007542BC,007C3AA8,00000000,FFBCC9E0,?,?,74E15EE0), ref: 0076722E

Strings

:|, xrefs: 007671EA

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariableWake
String ID: :|
API String ID: 1466638765-2552985586
Opcode ID: 39f67654f28926fdde40f4a685446b6cb6b013916728dc949f0a3cdda24b295e
Instruction ID: dd3ca152fba340508ad91cf449d2e3e81855254b99271f88d2fe0f10faa77cf8
Opcode Fuzzy Hash: 39f67654f28926fdde40f4a685446b6cb6b013916728dc949f0a3cdda24b295e
Instruction Fuzzy Hash: B1F0C075900214EFC305DF58E849D5977A8FB4A740B15C47DF90687311D77D9910CBA9

Function 0076D1F7 Relevance: 6.3, APIs: 4, Instructions: 347COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0076D1FE
_strcspn.LIBCMT ref: 0076D26C
_strcspn.LIBCMT ref: 0076D28C
ctype.LIBCPMT ref: 0076D2FC

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: 3c3c59af042038109731589ff269b009d020e5ed0582ca51725bb792a49d3eb7
Instruction ID: b9ee066ccd73084cf25e5fa1168cb91e82978924805333839f44a0ad9e2a9252
Opcode Fuzzy Hash: 3c3c59af042038109731589ff269b009d020e5ed0582ca51725bb792a49d3eb7
Instruction Fuzzy Hash: D1D19B71E10259DFDF24DFA4C884AEEBBB9FF08310F144119E816AB251D738AE45CBA1

Function 0076D5A0 Relevance: 6.3, APIs: 4, Instructions: 347COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0076D5A7
_strcspn.LIBCMT ref: 0076D615
_strcspn.LIBCMT ref: 0076D635
ctype.LIBCPMT ref: 0076D6A5

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: f39928ae571f5c3130b05f96f719007dd9b2b6bf287c2afb9577b77e73b91650
Instruction ID: cadc6a711a81e160ba9cd6dd599af25356142cc4a1d5a94a7cb09fb79b0f3308
Opcode Fuzzy Hash: f39928ae571f5c3130b05f96f719007dd9b2b6bf287c2afb9577b77e73b91650
Instruction Fuzzy Hash: 48D19E75E10209DFDF25DFA8C884AEEBBB5FF08310F144119E816AB251D738AD45CBA1

Function 00768A29 Relevance: 6.3, APIs: 4, Instructions: 343COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00768A30
_strcspn.LIBCMT ref: 00768A9E
_strcspn.LIBCMT ref: 00768ABE
ctype.LIBCPMT ref: 00768B2E

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: 22983cb95d84cc1f911a9b11deacb31f3f837d97e6374ca9dc3b68cc19acd0ae
Instruction ID: 0dc17d4e203c7b64aa0da30bccb9119b330826fdc64b9fce10d235e408803dd6
Opcode Fuzzy Hash: 22983cb95d84cc1f911a9b11deacb31f3f837d97e6374ca9dc3b68cc19acd0ae
Instruction Fuzzy Hash: 4BD13CB1D00649EFDF55DFA4C884AEEBBB5FF08310F14411AE856AB241DB38AD45CBA1

Function 00782FFD Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 007830C4
___AdjustPointer.LIBCMT ref: 007830E7
___AdjustPointer.LIBCMT ref: 00783183

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 8f365940f19f406f187efd5acbce8f33bfcb334827f194f5d1f5cbb6a9e1fb36
Instruction ID: a4293a49f08322a400af2eecebf3417c0cc14341d6d52e42f4c9927779dfa357
Opcode Fuzzy Hash: 8f365940f19f406f187efd5acbce8f33bfcb334827f194f5d1f5cbb6a9e1fb36
Instruction Fuzzy Hash: 6051F371A80A4AEFDB29AF58D849B7AB7A5EF00F10F10402DE80547291E73DEE81C790

Function 00793160 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a4a0f80b19523bb74eb9433d4e2f7cee984f38b686b9f4b5f3d42608807c321
Instruction ID: 1f3239261624777a3fe87fb825bf898975b43a25f316195177adac9741b0fd16
Opcode Fuzzy Hash: 1a4a0f80b19523bb74eb9433d4e2f7cee984f38b686b9f4b5f3d42608807c321
Instruction Fuzzy Hash: 2721DE31200609FFCF20AFA5FD8486B77A9FF453647104519F925C7122E738EE008BA0

Function 00749CA0 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00000010), ref: 00749CCA
LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00749CE1
SendMessageW.USER32(00000110,00000080,00000001,00000000), ref: 00749CFF
SendMessageW.USER32(00000110,00000080,00000000,00000000), ref: 00749D0A

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: ImageLoadMessageSend
String ID:
API String ID: 2779929661-0
Opcode ID: 45b5d874ed723ddaa44486602e36fc7d75f1e4b4702d20a7649464ca3f2fe656
Instruction ID: 7e33218309f491d3b716221c2a63cc60a3468210a3770600a2f57289f154911b
Opcode Fuzzy Hash: 45b5d874ed723ddaa44486602e36fc7d75f1e4b4702d20a7649464ca3f2fe656
Instruction Fuzzy Hash: 4A016231780314B7E6305A559C86FA777E8AB89F58F000515F7846F5C1C7E5BC84CBA9

Function 00770E47 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00770E4E
std::_Lockit::_Lockit.LIBCPMT ref: 00770E58
int.LIBCPMT ref: 00770E6F

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Lockit::~_Lockit.LIBCPMT ref: 00770EC9

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID:
API String ID: 1383202999-0
Opcode ID: 15573f93979c0a7b8b98a18dd6cea8332461e76cf830dca95624e966ee9462e9
Instruction ID: 687178fdc26e06de0d9e59510e404b0dcc1778ca9fb34b0ff7aedab4a35f816d
Opcode Fuzzy Hash: 15573f93979c0a7b8b98a18dd6cea8332461e76cf830dca95624e966ee9462e9
Instruction Fuzzy Hash: 02F09031800606EBDF09F7A0D86AAAE2366BF50751F648A18F8256B1D1EF3C9E058781

Function 00770F71 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00770F78
std::_Lockit::_Lockit.LIBCPMT ref: 00770F82
int.LIBCPMT ref: 00770F99

Part of subcall function 0076A296: std::_Lockit::_Lockit.LIBCPMT ref: 0076A2A7
Part of subcall function 0076A296: std::_Lockit::~_Lockit.LIBCPMT ref: 0076A2C1

std::_Lockit::~_Lockit.LIBCPMT ref: 00770FF3

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID:
API String ID: 1383202999-0
Opcode ID: 64beeb72b5c221137ea541a5cf1e16cfe15d8772f347ad27875c0f288d680339
Instruction ID: f930934489d04038fdac5130ddf17dbe1d2010bc2603107a055269d685707e2d
Opcode Fuzzy Hash: 64beeb72b5c221137ea541a5cf1e16cfe15d8772f347ad27875c0f288d680339
Instruction Fuzzy Hash: A1F09631800505DFDF05E760C86ABAD2366AF41750F548518F915671D1EF3C9E058B91

Function 007A4569 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,007A33BB,00000000,00000001,?,007846E4,?,007996E0,007846E4,00000000,00000000), ref: 007A4580
GetLastError.KERNEL32(?,007A33BB,00000000,00000001,?,007846E4,?,007996E0,007846E4,00000000,00000000,007846E4,007846E4,?,00799CBA,0073E60C), ref: 007A458C

Part of subcall function 007A4552: CloseHandle.KERNEL32(FFFFFFFE,007A459C,?,007A33BB,00000000,00000001,?,007846E4,?,007996E0,007846E4,00000000,00000000,007846E4,007846E4), ref: 007A4562

___initconout.LIBCMT ref: 007A459C

Part of subcall function 007A4514: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,007A4543,007A33A8,007846E4,?,007996E0,007846E4,00000000,00000000,007846E4), ref: 007A4527

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,007A33BB,00000000,00000001,?,007846E4,?,007996E0,007846E4,00000000,00000000,007846E4), ref: 007A45B1

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 1913a7eb892437c597aef6850917618c415ab08c5db2df8199fcbdb70c441504
Instruction ID: 53ad6a4c89a7bf3b5f7ef46e2faa109c461feb5ac0e032983b6fd762f2015c9d
Opcode Fuzzy Hash: 1913a7eb892437c597aef6850917618c415ab08c5db2df8199fcbdb70c441504
Instruction Fuzzy Hash: A3F01C36540128BBCF222F95DC0899A3F66FB8B3A0F048124FA1986131DB768831DB95

Function 00731090 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00731093
GetDeviceCaps.GDI32(00000000,00000058), ref: 007310A2
GetDeviceCaps.GDI32(00000000,0000005A), ref: 007310B0
ReleaseDC.USER32(00000000,00000000), ref: 007310BE

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 6589928c6f4b095b87dbec05cd7e0107c067d6e4f6aaba251812cd7a5faee9e6
Instruction ID: 7ee14734c41651f1704627b3281c373c0bb7265aa6c6449bd1c0111943873fc4
Opcode Fuzzy Hash: 6589928c6f4b095b87dbec05cd7e0107c067d6e4f6aaba251812cd7a5faee9e6
Instruction Fuzzy Hash: 71E0EC36540681B7D2511B75AC0DF5B7B74B7C6B02F00C019F2069A5E0DB7C8085CF1A

Function 0077B938 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 193COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0077B93F
__cftoe.LIBCMT ref: 0077B9D2

Strings

!%x, xrefs: 0077B94D

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: bb411082a65a871c3739a8d53d83e6c704f31ba8bf2f9610bc421f155625e50c
Instruction ID: ad5901e4ede91c4a24a694d59d6712adaa2418d4d30b03f6cb1f49eb73e6503d
Opcode Fuzzy Hash: bb411082a65a871c3739a8d53d83e6c704f31ba8bf2f9610bc421f155625e50c
Instruction Fuzzy Hash: 5E716871D00109EFDF18EFA8E885AEDB7B5FF48344F108529F919A7251EB39A941CB50

Function 0077A1E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0077A1EF
swprintf.LIBCMT ref: 0077A267

Part of subcall function 00770BF3: __EH_prolog3.LIBCMT ref: 00770BFA
Part of subcall function 00770BF3: std::_Lockit::_Lockit.LIBCPMT ref: 00770C04
Part of subcall function 00770BF3: int.LIBCPMT ref: 00770C1B

Part of subcall function 0076D0F1: _wmemset.LIBCMT ref: 0076D11A

Strings

%.0Lf, xrefs: 0077A25F

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: H_prolog3H_prolog3_LockitLockit::__wmemsetstd::_swprintf
String ID: %.0Lf
API String ID: 2528782737-1402515088
Opcode ID: 134a20cd0d2a10a795c212ac6f997de2d83c4908c6575c95669ea0aa567d1434
Instruction ID: ef5abc887bf6a7423fdd1269c148223d3ff953ffd6d995577a1f6fb5aaec3f6f
Opcode Fuzzy Hash: 134a20cd0d2a10a795c212ac6f997de2d83c4908c6575c95669ea0aa567d1434
Instruction Fuzzy Hash: E5617971D00218EFDF09DFE4C854AEDBBB9FF88340F208519E406AB295EB399915CB91

Function 0077A515 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0077A51C
swprintf.LIBCMT ref: 0077A594

Part of subcall function 00770C88: __EH_prolog3.LIBCMT ref: 00770C8F
Part of subcall function 00770C88: std::_Lockit::_Lockit.LIBCPMT ref: 00770C99
Part of subcall function 00770C88: int.LIBCPMT ref: 00770CB0

Part of subcall function 0076D0F1: _wmemset.LIBCMT ref: 0076D11A

Strings

%.0Lf, xrefs: 0077A58C

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: H_prolog3H_prolog3_LockitLockit::__wmemsetstd::_swprintf
String ID: %.0Lf
API String ID: 2528782737-1402515088
Opcode ID: beb36f58484c42bf0763b9a8b2656e88cae227f4c764fd3467360182f22b29b6
Instruction ID: 500841f9fad8448b906fb273db2620ce45d58057d366beaa31db562e9b608f98
Opcode Fuzzy Hash: beb36f58484c42bf0763b9a8b2656e88cae227f4c764fd3467360182f22b29b6
Instruction Fuzzy Hash: 94616E71D00218EFDF09DFE4C854AEDBBB5FF88340F208519E506AB295EB399915CB91

Function 0077FE58 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 184COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0077FFBF

Strings

-, xrefs: 0077FFED
0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 0077FF1D, 0077FF54, 0077FF59

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: c010679d29f9655bc12a8e97adec78f3d4dd17cf2024504a2a462cf27fbb48bf
Instruction ID: 121257431593824823585c4cffaa14d8046c5f3d371b0217b848b893d82c498a
Opcode Fuzzy Hash: c010679d29f9655bc12a8e97adec78f3d4dd17cf2024504a2a462cf27fbb48bf
Instruction Fuzzy Hash: 4B512530A04289AFDF25CE7C85417BEBBF5AF46380F54847AE488D7292D6BC8941CB61

Function 0077F6F2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0077F6F9
swprintf.LIBCMT ref: 0077F771

Part of subcall function 0073B390: std::_Lockit::_Lockit.LIBCPMT ref: 0073B3BD
Part of subcall function 0073B390: std::_Lockit::_Lockit.LIBCPMT ref: 0073B3E0
Part of subcall function 0073B390: std::_Lockit::~_Lockit.LIBCPMT ref: 0073B400
Part of subcall function 0073B390: std::_Lockit::~_Lockit.LIBCPMT ref: 0073B48D

Strings

%.0Lf, xrefs: 0077F769

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3_swprintf
String ID: %.0Lf
API String ID: 898875175-1402515088
Opcode ID: 93a4162822ddd4187072e9da22c8076a5d64227b5d2b77ba178c1bcd88d7b543
Instruction ID: f160c492c02ad3d82b4910a0e388afbd22058a588a639ec850c6f1d94b4b8ed8
Opcode Fuzzy Hash: 93a4162822ddd4187072e9da22c8076a5d64227b5d2b77ba178c1bcd88d7b543
Instruction Fuzzy Hash: ED617D71D00218EFCF09DFE4C955AEDBBB9FF48340F108529E506AB291EB39A915CB91

Function 007835F9 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 0078361E

Strings

MOC, xrefs: 00783630
RCC, xrefs: 00783638

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: aba62d10cd0a4648ebe97a358dbe6ebfeda22035a14ff324f20a90d820fc22f1
Instruction ID: a9f70edca925edbc1ee42b6fba9b6e86babd41bf0f1697aadacef666786c1209
Opcode Fuzzy Hash: aba62d10cd0a4648ebe97a358dbe6ebfeda22035a14ff324f20a90d820fc22f1
Instruction Fuzzy Hash: DA4159B1A40209EFCF15EF98CC85AAEBBB5FF48700F188059F90566261E3399A51DB50

Function 0077A0BA Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0077A0C1

Part of subcall function 00770BF3: __EH_prolog3.LIBCMT ref: 00770BFA
Part of subcall function 00770BF3: std::_Lockit::_Lockit.LIBCPMT ref: 00770C04
Part of subcall function 00770BF3: int.LIBCPMT ref: 00770C1B

Strings

%.0Lf, xrefs: 0077A10C
0123456789-, xrefs: 0077A111

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: H_prolog3H_prolog3_LockitLockit::_std::_
String ID: %.0Lf$0123456789-
API String ID: 79917597-3094241602
Opcode ID: 71a5ced580ddb92974de68be31d7da1fd985d4e026019e9c21ccb05fce9958e5
Instruction ID: 222a87a687ba745a729ae17b8f5e1d6cae0218b39315839b5ef3b9ca89202bd8
Opcode Fuzzy Hash: 71a5ced580ddb92974de68be31d7da1fd985d4e026019e9c21ccb05fce9958e5
Instruction Fuzzy Hash: 32419C71A0011DEFDF05EFE8C8949EEBBB5BF48310F504129E809AB251DB389D46CB91

Function 0077A3E7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0077A3EE

Part of subcall function 00770C88: __EH_prolog3.LIBCMT ref: 00770C8F
Part of subcall function 00770C88: std::_Lockit::_Lockit.LIBCPMT ref: 00770C99
Part of subcall function 00770C88: int.LIBCPMT ref: 00770CB0

Strings

0123456789-, xrefs: 0077A439
0123456789-, xrefs: 0077A43E

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: H_prolog3H_prolog3_LockitLockit::_std::_
String ID: 0123456789-$0123456789-
API String ID: 79917597-2494171821
Opcode ID: 19203cefdc03691654e55aee394032d6354a7c09344e96dde7803eb00b133f60
Instruction ID: 4bd1cd2ad2a731751c9b2cfdcc0ff09117150150bf64c905ddc94d10c6c385bb
Opcode Fuzzy Hash: 19203cefdc03691654e55aee394032d6354a7c09344e96dde7803eb00b133f60
Instruction Fuzzy Hash: 3841CD31D00258EFCF15DFE8C8849EEBBB1BF48310F104129E805AB251DB399D55CB66

Function 0077F5C6 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0077F5CD

Part of subcall function 0073B390: std::_Lockit::_Lockit.LIBCPMT ref: 0073B3BD
Part of subcall function 0073B390: std::_Lockit::_Lockit.LIBCPMT ref: 0073B3E0
Part of subcall function 0073B390: std::_Lockit::~_Lockit.LIBCPMT ref: 0073B400
Part of subcall function 0073B390: std::_Lockit::~_Lockit.LIBCPMT ref: 0073B48D

Strings

0123456789-, xrefs: 0077F618
0123456789-, xrefs: 0077F61D

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 2088892359-2494171821
Opcode ID: a0113320e4a37a7a6cb549b8cf327b221003991b348dc75ffa4e6c27c28c0a21
Instruction ID: 738ed31785c29c1af7875284c0857503e4f31c583fe9464d786e0379fe97158d
Opcode Fuzzy Hash: a0113320e4a37a7a6cb549b8cf327b221003991b348dc75ffa4e6c27c28c0a21
Instruction Fuzzy Hash: F1418B31E00219EFCF05EFA4D9959EEBBB5BF08310F108069F915AB262DB389E15CB51

Function 0076C8EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83threadCOMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 0076C90F
GetCurrentThreadId.KERNEL32 ref: 0076C940

Strings

x?|, xrefs: 0076C93B

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Cpp_errorCurrentThreadThrow_std::_
String ID: x?|
API String ID: 350343453-2765027281
Opcode ID: c5902ec3fd4b208ad89f243786abf58cbddf79cb23baeb0aae43710ef9b2443d
Instruction ID: 2a1c9aad46b7e4c453c05449383d81ae9cc105b63bde5951a344241fff617d3f
Opcode Fuzzy Hash: c5902ec3fd4b208ad89f243786abf58cbddf79cb23baeb0aae43710ef9b2443d
Instruction Fuzzy Hash: 3821CF31600B06DBDB269B95D816BBAB3A4EF45760F00052EEDD797681DB7DBC008A94

Function 007442D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 007442FB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0074434A

Part of subcall function 0076808B: _Yarn.LIBCPMT ref: 007680AA
Part of subcall function 0076808B: _Yarn.LIBCPMT ref: 007680CE

Strings

bad locale name, xrefs: 00744366

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 7694b1b9affbce199d3ab9c839e1ebde364beed857df23edb3c85a4ae0db695d
Instruction ID: d6b59c9cd54e11ee7dab5c5b1b6382ce4c2287b45fcb9df515feee532e3933cd
Opcode Fuzzy Hash: 7694b1b9affbce199d3ab9c839e1ebde364beed857df23edb3c85a4ae0db695d
Instruction Fuzzy Hash: C1117CB1904B84EFD720CF68C805B46BBE4EF19714F048A5EE84A87A41D77AA604CB92

Function 00796012 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0079605E
GetFileType.KERNEL32(00000000), ref: 00796070

Strings

@Le, xrefs: 007960A1

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: FileHandleType
String ID: @Le
API String ID: 3000768030-4006592780
Opcode ID: f55cddc32c6e65112c70349715ae87a42f6eb7fad3e52b4627f351cfdbd4581d
Instruction ID: d10a1e1b1ba3baff20e77225ec8abb02ddd9d0314683596a22a28eff69ce7f32
Opcode Fuzzy Hash: f55cddc32c6e65112c70349715ae87a42f6eb7fad3e52b4627f351cfdbd4581d
Instruction Fuzzy Hash: 931103311047418ACF308F3EAED8E227A95A792370B38070ED2F6865F5D33DD986D245

Function 0076A748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0076A74F

Strings

false, xrefs: 0076A7A6
true, xrefs: 0076A7B9

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: H_prolog3_
String ID: false$true
API String ID: 2427045233-2658103896
Opcode ID: 1a6cd49d776f5900fc4d8789363cdb3fabaa652aef3c4f298ee64308a2703645
Instruction ID: bd1f7a8865322b53587dca99473321fc5fe7665391009c8d378ba491ab4060a7
Opcode Fuzzy Hash: 1a6cd49d776f5900fc4d8789363cdb3fabaa652aef3c4f298ee64308a2703645
Instruction Fuzzy Hash: C4118175900745EEC725EF74D405E8ABBF4AF05300F04862AF592DB642EB78A504CB61

Function 0074D767 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,00000000,Xml Exception,00000000), ref: 0074D785
___std_exception_destroy.LIBVCRUNTIME ref: 0074D79C

Strings

Xml Exception, xrefs: 0074D772

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Message___std_exception_destroy
String ID: Xml Exception
API String ID: 1031581076-3835875383
Opcode ID: 05f70b2be547f2622f30e33094713aecb575e0b5ebda34d2d79f7fc1f3e5c258
Instruction ID: 602d929f8ea949bee35e4e283be5f2c0f7298e724f89fd3a4fd07ec455aa61a5
Opcode Fuzzy Hash: 05f70b2be547f2622f30e33094713aecb575e0b5ebda34d2d79f7fc1f3e5c258
Instruction Fuzzy Hash: F9E0C2B4E4324D6EFBB0A7108C1AFA87278ABE1700F4000F0F08462091DBBD2E948F12

Function 0074D7AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Unknown,Unknown Exception,00000000), ref: 0074D7C1

Strings

Unknown, xrefs: 0074D7BA
Unknown Exception, xrefs: 0074D7B5

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: Message
String ID: Unknown$Unknown Exception
API String ID: 2030045667-3978676936
Opcode ID: 48950a4bb603a81466ffcf2c5dc08dab21718873605cd531f203a1fb89124325
Instruction ID: 8968832e1667b4e7e4465a9e805812968bcc288fdd6e91e459ceaf77a274e0bd
Opcode Fuzzy Hash: 48950a4bb603a81466ffcf2c5dc08dab21718873605cd531f203a1fb89124325
Instruction Fuzzy Hash: DAC09B657893497FF77113508C07B18192057D3F15F444190F1C4741C18BEC3C408A05

Function 6BED4AE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 7COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(TEMP,C:\NonExistentPath), ref: 6BED4AED

Strings

TEMP, xrefs: 6BED4AE8
C:\NonExistentPath, xrefs: 6BED4AE3

Memory Dump Source

Source File: 00000006.00000002.2292258011.000000006BEB1000.00000020.00000001.01000000.00000006.sdmp, Offset: 6BEB0000, based on PE: true

Associated: 00000006.00000002.2292241036.000000006BEB0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292289619.000000006BEE6000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292309996.000000006BEF4000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292425687.000000006C109000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292558037.000000006C35B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000006.00000002.2292594857.000000006C35C000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6beb0000_GUP.jbxd

Yara matches

Similarity

API ID: EnvironmentVariable
String ID: C:\NonExistentPath$TEMP
API String ID: 1431749950-4013690577
Opcode ID: 2fa9dc6567dad3a3970d881007e942ad6a72eeb228ca50e039fb6e0c34df3ae0
Instruction ID: b9a689e1c357150181ad338e608716a936c44da8be828d31bf94377230143439
Opcode Fuzzy Hash: 2fa9dc6567dad3a3970d881007e942ad6a72eeb228ca50e039fb6e0c34df3ae0
Instruction Fuzzy Hash: 47A0223200022CBF0E002FCABC08C003B0CF282838F308000F30E00000BB0AB00300BB

Function 00765D00 Relevance: 5.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00766BE0: WaitForSingleObject.KERNEL32(00000001,000000FF,?,00766A37,?,?,007531AE,00000000,?,?,007668CB,?,?,?), ref: 00766BE8

Part of subcall function 00766B70: SetEvent.KERNEL32(007668E1,?,007668E1,007531AE), ref: 00766B78

EnterCriticalSection.KERNEL32(?), ref: 00765D61
EnterCriticalSection.KERNEL32(?), ref: 00765D6E
LeaveCriticalSection.KERNEL32(?), ref: 00765DA8
LeaveCriticalSection.KERNEL32(?), ref: 00765DAB

Part of subcall function 00766C30: ReleaseSemaphore.KERNEL32(00000001,00000001,00000000,?,00766A2F,?,007531AE,00000000,?,?,007668CB,?,?,?), ref: 00766C3C

Memory Dump Source

Source File: 00000006.00000002.2291694030.0000000000731000.00000020.00000001.01000000.00000005.sdmp, Offset: 00730000, based on PE: true

Associated: 00000006.00000002.2291675530.0000000000730000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291749166.00000000007AA000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291774463.00000000007C1000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291791096.00000000007C2000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291807812.00000000007C3000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.2291825173.00000000007C5000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_730000_GUP.jbxd

Similarity

API ID: CriticalSection$EnterLeave$EventObjectReleaseSemaphoreSingleWait
String ID:
API String ID: 3648152314-0
Opcode ID: 4654bd09cd81b6537577db0727db09b3f8f05d90bdf475bb652a5e77a2dc5c18
Instruction ID: e70da259e04214e8c550fd59e398f661ad86a9f855d1dceee67c32d6b3d3e54d
Opcode Fuzzy Hash: 4654bd09cd81b6537577db0727db09b3f8f05d90bdf475bb652a5e77a2dc5c18
Instruction Fuzzy Hash: 9B519071A00A09EFC700DF74C888ADAB7B8FF05304F544569E85A87211EB39FA65DB90

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report j45EY4ovxx.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\63c9f6.rbs

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_GUP.exe_a61eb08bcc5c98b02e1c13c2b9cdcc6b17be1e1_a2f457c8_1c6a3c9d-6464-446d-81a2-db12f6d21b9e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD119.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD1F5.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD215.tmp.xml

C:\Users\user\AppData\Local\Temp\MSI3bd62.LOG

C:\Users\user\AppData\Local\Temp\MSIBBCC.tmp

C:\Users\user\AppData\Local\Temp\MSIBC4A.tmp

C:\Users\user\AppData\Local\Temp\MSIBC99.tmp

C:\Users\user\AppData\Local\Temp\MSIBCE8.tmp

C:\Users\user\AppData\Local\Temp\MSIBD09.tmp

C:\Users\user\AppData\Local\Temp\MSIBD48.tmp

C:\Users\user\AppData\Local\Temp\MSIC96F.tmp

C:\Users\user\AppData\Local\Temp\MSIC99E.tmp

C:\Users\user\AppData\Local\Temp\MSIC9CE.tmp

C:\Users\user\AppData\Roaming\op\GUP.exe

C:\Users\user\AppData\Roaming\op\gup.xml

C:\Users\user\AppData\Roaming\op\libcurl.dll

Windows Analysis Report
j45EY4ovxx.msi

Function 00616FE0 Relevance: 46.1, APIs: 25, Strings: 1, Instructions: 559
comCOMMON

Function 0064D0AE Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 62
COMMONLIBRARYCODE

Function 0064F02D Relevance: 6.1, APIs: 4, Instructions: 83
memorylibraryloaderCOMMONLIBRARYCODE

Function 00616050 Relevance: 6.0, APIs: 4, Instructions: 35
COMMON

Function 00621EE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre