Edit tour

Windows Analysis Report
RemoteDelProf.exe

Overview

General Information

Sample name:	RemoteDelProf.exe
Analysis ID:	1566857
MD5:	8614f771d622fd11ecf75a01fa2373b1
SHA1:	8425e4813d0fe74f30f4dfbbad9721a3fca7b143
SHA256:	a32555ec55b0918b0d67e2cd28c29b7dd55571535ec63bfa0c683851a6f4a0db
Infos:

Detection

Score:	5
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Detected potential crypto function

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Program does not show much activity (idle)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

RemoteDelProf.exe (PID: 7540 cmdline: "C:\Users\user\Desktop\RemoteDelProf.exe" MD5: 8614F771D622FD11ECF75A01FA2373B1)

conhost.exe (PID: 7548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: RemoteDelProf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: RemoteDelProf.exe

Static PE information: certificate valid

Source: RemoteDelProf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: RemoteDelProf.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: RemoteDelProf.exe	String found in binary or memory: http://www.autoitscript.com/atools/
Source: RemoteDelProf.exe, ConDrv.0.dr	String found in binary or memory: http://www.autoitscript.com/tools
Source: RemoteDelProf.exe	String found in binary or memory: http://www.autoitscript.com/tools:
Source: RemoteDelProf.exe	String found in binary or memory: http://www.autoitscript.com/toolsB
Source: RemoteDelProf.exe	String found in binary or memory: http://www.autoitscript.com/toolsThis

Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: 0_2_00BB9381	0_2_00BB9381
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: 0_2_00BC155F	0_2_00BC155F
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: 0_2_00BB86CC	0_2_00BB86CC
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: 0_2_00BB97A1	0_2_00BB97A1
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: 0_2_00BBEAA0	0_2_00BBEAA0
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: 0_2_00BA1AE9	0_2_00BA1AE9
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: 0_2_00BB8BA1	0_2_00BB8BA1
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: 0_2_00BB8F75	0_2_00BB8F75

Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: String function: 00BBA6CE appears 36 times
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: String function: 00BBF6E4 appears 49 times
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: String function: 00BA7D43 appears 34 times
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: String function: 00BBA69B appears 177 times

Source: RemoteDelProf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: clean5.winEXE@2/1@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7548:120:WilError_03

Source: RemoteDelProf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\RemoteDelProf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RemoteDelProf.exe	String found in binary or memory: ERROR: exception of unknown type! Try --help
Source: RemoteDelProf.exe	String found in binary or memory: ERROR: exception of unknown type! Try --help
Source: RemoteDelProf.exe	String found in binary or memory: Try --help
Source: RemoteDelProf.exe	String found in binary or memory: Try --help
Source: RemoteDelProf.exe	String found in binary or memory: Try --help
Source: RemoteDelProf.exe	String found in binary or memory: Try --help
Source: RemoteDelProf.exe	String found in binary or memory: Try --help
Source: RemoteDelProf.exe	String found in binary or memory: Try --help

Source: unknown	Process created: C:\Users\user\Desktop\RemoteDelProf.exe "C:\Users\user\Desktop\RemoteDelProf.exe"
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\RemoteDelProf.exe

Section loaded: apphelp.dll

Jump to behavior

Source: RemoteDelProf.exe

Static PE information: certificate valid

Source: RemoteDelProf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: RemoteDelProf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: RemoteDelProf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: RemoteDelProf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: RemoteDelProf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: RemoteDelProf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\RemoteDelProf.exe

Code function: 0_2_00BC6133 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_00BC6133

Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: 0_2_00BBB000 push dword ptr [ecx-75h]; iretd	0_2_00BBB008
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: 0_2_00BBF729 push ecx; ret	0_2_00BBF73C
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: 0_2_00BBA773 push ecx; ret	0_2_00BBA786

Source: C:\Users\user\Desktop\RemoteDelProf.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_0-23715

Source: C:\Users\user\Desktop\RemoteDelProf.exe

API coverage: 9.3 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\RemoteDelProf.exe

API call chain: ExitProcess graph end node

graph_0-24530

Source: C:\Users\user\Desktop\RemoteDelProf.exe

Code function: 0_2_00BB8554 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00BB8554

Source: C:\Users\user\Desktop\RemoteDelProf.exe

0_2_00BC6133

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: 0_2_00BC04DA SetUnhandledExceptionFilter,	0_2_00BC04DA
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: 0_2_00BBD4C1 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BBD4C1
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: 0_2_00BB8554 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00BB8554
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: 0_2_00BAB6F9 _abort,__NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BAB6F9
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: 0_2_00BB7FAA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00BB7FAA

Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,	0_2_00BC00E1
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,	0_2_00BC5065
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,	0_2_00BC62E7
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	0_2_00BC72C5
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,__alloca_probe_16,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,	0_2_00BC631B
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	0_2_00BC54FD
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_00BC645A
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	0_2_00BC56AC
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	0_2_00BC5614
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_00BC479F
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	0_2_00BC5720
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	0_2_00BC58F2
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: GetLocaleInfoA,	0_2_00BBE87F
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_00BC59B3
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_00BC5A1A
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,	0_2_00BC5A56
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	0_2_00BBBBAE
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,	0_2_00BC4E0D
Source: C:\Users\user\Desktop\RemoteDelProf.exe	Code function: GetLocaleInfoA,	0_2_00BC3F6A

Source: C:\Users\user\Desktop\RemoteDelProf.exe

Code function: 0_2_00BC0C52 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00BC0C52

Source: C:\Users\user\Desktop\RemoteDelProf.exe

Code function: 0_2_00BA204B LookupAccountNameW,GetLastError,LookupAccountNameW,IsValidSid,ConvertSidToStringSidW,LocalFree,

0_2_00BA204B

Source: C:\Users\user\Desktop\RemoteDelProf.exe

Code function: 0_2_00BA81A0 GetVersionExW,

0_2_00BA81A0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Process Injection	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
RemoteDelProf.exe	0%	ReversingLabs

Name	Source	Malicious	Reputation
http://www.autoitscript.com/toolsB	RemoteDelProf.exe	false	high
http://www.autoitscript.com/atools/	RemoteDelProf.exe	false	high
http://www.autoitscript.com/tools:	RemoteDelProf.exe	false	high
http://www.autoitscript.com/tools	RemoteDelProf.exe, ConDrv.0.dr	false	high
http://www.autoitscript.com/toolsThis	RemoteDelProf.exe	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1566857
Start date and time:	2024-12-02 18:58:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 1m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RemoteDelProf.exe
Detection:	CLEAN
Classification:	clean5.winEXE@2/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 13 Number of non-executed functions: 50
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: RemoteDelProf.exe

Process:	C:\Users\user\Desktop\RemoteDelProf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.7417016568034605
Encrypted:	false
SSDEEP:	12:zIiLpVYWywUUNHwlAqqSzrhjBHf9rldmflIKwNovYL7aYWyeDGDDzonyu23:zzFSYqZzrhjBludIv6vQ7aPFi/ET0
MD5:	86152C522ED21FBA89907A9B2D6D3208
SHA1:	167E408EBAA83F24DE3638A289AF902DC3EAD9AD
SHA-256:	59B28389B0EDC210D3950F466CE031DA0B714143CB8B614290540B689E6C71E3
SHA-512:	9151D995FFDF3835B8A586216BC3463BEE279908CFAC2BE017CDD1F11BB59177AAB373151885E7E731B9793B0848A03F98A2CD253787A11C148A136C0F0774CB
Malicious:	false
Reputation:	low
Preview:	..RemoteDelProf v1.0.0 - Remote Profile Deletion Utility..Copyright (C) 2009 Jonathan Bennett..http://www.autoitscript.com/tools....Options:.. -h [ --help ] This help message... -u [ --user ] arg Username in 'user' or 'domain\user' format... -w [ --workstation ] arg Workstation name in NETBIOS or FQDN format... -l [ --local ] Delete the cached roaming profile from the specified.. workstation... -n [ --network ] Delete the central roaming profile from the network.....Examples:.. DelProf.exe --user Jonathan --workstation WORKSTATION1.. DelProf.exe --u DOMAIN\Jonathan -w WORKSTATION1 --local.. DelProf.exe -u Jonathan -w WORKSTATION1 --local --network....Notes:.. - The user must not be logged onto the target workstation... - The c$ share and remote registry must be accessible on the target workstation...

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.394461592159801
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RemoteDelProf.exe
File size:	249'712 bytes
MD5:	8614f771d622fd11ecf75a01fa2373b1
SHA1:	8425e4813d0fe74f30f4dfbbad9721a3fca7b143
SHA256:	a32555ec55b0918b0d67e2cd28c29b7dd55571535ec63bfa0c683851a6f4a0db
SHA512:	2953f38a2d6f1a1180c40392911dad93196984badb73d59d4dfa12c349e334fb1e0d031d2a8ef6a8afa6e8caa82af52ad34b34490f1e7e4db33ba0b8800dc2e5
SSDEEP:	6144:yIx8FPvgN6IGOi8NqOeL+wtI/HxfOS9+a:3xkgOOOOeJtI/H0St
TLSH:	3E347B223BC5C477C25322768CC8D77AA6F9F8709D30960BBBD5076E9F75A92CA11312
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-A..L/..L/..L/..4...L/..4...L/..4...L/...T..L/..L...L/..4...L/......L/..4...L/.Rich.L/.................PE..L...N..J...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41a25f
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x4A1CF24E [Wed May 27 07:57:02 2009 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	bb24c91dde7f346f9afa0c834a0adafb

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	08/02/2009 19:00:00 09/02/2012 18:59:59
Subject Chain	CN=Jonathan Bennett, O=Jonathan Bennett, STREET=19 Linnet Close, L=Birmingham, S=West Midlands, PostalCode=B30 1XB, C=GB
Version:	3
Thumbprint MD5:	5FE91C20B3DE6BA483BF3C8D461FAB8B
Thumbprint SHA-1:	B1B968D50B0BED69315EFCE51D307D8DCBEBD584
Thumbprint SHA-256:	771CA562615F9F128FF3993D079825DA87F8800358B67E52172DEA5691E6E4A4
Serial:	00FF3628AC973FD4AF789D25697A20B243

Entrypoint Preview

Instruction
call 00007F8530F37743h
jmp 00007F8530F30BFAh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0042AB8Ch
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007F8530F30D5Eh
test byte ptr [eax], 00000008h
je 00007F8530F30D59h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [0042A084h]
leave
retn 0008h
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword ptr [ebp+0Ch]
add eax, 0Ch
mov dword ptr [ebp-04h], eax
mov ebx, dword ptr fs:[00000000h]
mov eax, dword ptr [ebx]
mov dword ptr fs:[00000000h], eax
mov eax, dword ptr [ebp+08h]
mov ebx, dword ptr [ebp+0Ch]
mov ebp, dword ptr [ebp-04h]
mov esp, dword ptr [ebx-04h]
jmp eax
pop ebx
leave
retn 0008h
pop eax
pop ecx
xchg dword ptr [esp], eax
jmp eax
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov esi, dword ptr fs:[00000000h]
mov dword ptr [ebp-04h], esi
mov dword ptr [ebp-08h], 0041A319h
push 00000000h
push dword ptr [ebp+0Ch]
push dword ptr [ebp-08h]
push dword ptr [ebp+08h]
call 00007F8530F3E27Ah
mov eax, dword ptr [ebp+0Ch]
mov eax, dword ptr [eax+04h]
and eax, FFFFFFFDh
mov ecx, dword ptr [ebp+0Ch]
mov dword ptr [ecx+00h], eax

Rich Headers

Programming Language:

[ASM] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x33e58	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3b000	0x584	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3ba00	0x1570
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3c000	0x29c8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2d9d8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a000	0x178	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28f3a	0x29000	4b62bdbfd72255ee52001d2c36248719	False	0.5371212842987805	MPEG-4 LOAS, single stream	6.559933314783063	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2a000	0xa6e4	0xa800	5b401e3d032b8d811d1911f5e7a9504a	False	0.3277994791666667	COM executable for DOS	4.5698855375708645	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x35000	0x53c8	0x3400	8abed0343d2a33e8a204d11e9a2dd15c	False	0.15895432692307693	data	4.416996255355425	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3b000	0x584	0x600	64fd7f8dbf35ba906d9ac036c2f80a5c	False	0.40234375	data	4.3367779800646815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3c000	0x431c	0x4400	a2a1b48e2da619d0c0da11616c6b46dd	False	0.45358455882352944	data	4.857845741570547	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x3b0a0	0x388	data	English	Great Britain	0.415929203539823
RT_MANIFEST	0x3b428	0x15a	ASCII text, with CRLF line terminators	English	United States	0.5491329479768786

Imports

DLL	Import
KERNEL32.dll	GetFileAttributesW, GetVersionExW, LocalFree, GetLastError, CreateFileA, SetStdHandle, InterlockedIncrement, InterlockedDecrement, WideCharToMultiByte, InterlockedCompareExchange, InterlockedExchange, MultiByteToWideChar, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, RaiseException, RtlUnwind, HeapFree, GetCPInfo, LCMapStringA, LCMapStringW, GetStringTypeW, GetModuleHandleW, GetProcAddress, ExitProcess, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, HeapSize, HeapAlloc, WriteFile, GetStdHandle, GetModuleFileNameA, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, VirtualAlloc, HeapReAlloc, GetConsoleCP, GetConsoleMode, FlushFileBuffers, ReadFile, SetFilePointer, CloseHandle, GetStringTypeA, GetACP, GetOEMCP, IsValidCodePage, GetLocaleInfoA, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, LoadLibraryA, InitializeCriticalSectionAndSpinCount, GetLocaleInfoW, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW
USER32.dll	CharUpperBuffW
ADVAPI32.dll	RegCloseKey, RegEnumKeyExW, RegDeleteKeyW, RegQueryValueExW, RegOpenKeyExW, LookupAccountSidW, ConvertSidToStringSidW, IsValidSid, RegConnectRegistryW, LookupAccountNameW
SHELL32.dll	SHFileOperationW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain
English	United States

Target ID:	0
Start time:	12:59:22
Start date:	02/12/2024
Path:	C:\Users\user\Desktop\RemoteDelProf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RemoteDelProf.exe"
Imagebase:	0xba0000
File size:	249'712 bytes
MD5 hash:	8614F771D622FD11ECF75A01FA2373B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:59:22
Start date:	02/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.5%
Total number of Nodes:	1483
Total number of Limit Nodes:	8

Executed Functions

Function 00BA132E Relevance: 30.0, APIs: 1, Strings: 16, Instructions: 274
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 00BA1350

Part of subcall function 00BA17DB: __EH_prolog3_GS.LIBCMT ref: 00BA17E2

Part of subcall function 00BA18E6: __EH_prolog3_GS.LIBCMT ref: 00BA18ED

Strings

help,h, xrefs: 00BA1438
user, xrefs: 00BA153C
network,n, xrefs: 00BA147E
This help message., xrefs: 00BA1433
Workstation name in NETBIOS or FQDN format., xrefs: 00BA1456
local, xrefs: 00BA15EE
Username in 'user' or 'domain\user' format., xrefs: 00BA1444
network, xrefs: 00BA162A
Delete the central roaming profile from the network., xrefs: 00BA1479
user,u, xrefs: 00BA144A
workstation, xrefs: 00BA1566
Delete the cached roaming profile from the specified workstation., xrefs: 00BA1468
workstation,w, xrefs: 00BA145C
help, xrefs: 00BA14DB
Options, xrefs: 00BA13BE
local,l, xrefs: 00BA146D

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: H_prolog3_$H_prolog3_catch
String ID: Delete the cached roaming profile from the specified workstation.$Delete the central roaming profile from the network.$Options$This help message.$Username in 'user' or 'domain\user' format.$Workstation name in NETBIOS or FQDN format.$help$help,h$local$local,l$network$network,n$user$user,u$workstation$workstation,w
API String ID: 756925408-3822090977
Opcode ID: 241691663c8fa0a05cb40b551285c00121f1ff7cc897c4064640a192b6ffe130
Instruction ID: de74d1a2542977e0982b7d2c0a328e2ea106d96bb046fd0a26c136b9343a1848
Opcode Fuzzy Hash: 241691663c8fa0a05cb40b551285c00121f1ff7cc897c4064640a192b6ffe130
Instruction Fuzzy Hash: 6BA1A271D48288AEDB15EBA8CC52FEE7BF89F16300F1040D9F549A7192DB705B49CBA1

Function 00BAAE79 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 171
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00BAAE80
_Fputc.LIBCPMT ref: 00BAB031

Strings

, xrefs: 00BAAFA4

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: FputcH_prolog3_
String ID:
API String ID: 4013897487-3916222277
Opcode ID: 27f62b66f4b889290ed3bb9bb6f72dc6c3cf31a7e7b9722d3a0d5537185b4598
Instruction ID: 3dafcd733f7a709e25e40d34cfbe553f0b3ed2059ce95654c260a8ef33ece4fa
Opcode Fuzzy Hash: 27f62b66f4b889290ed3bb9bb6f72dc6c3cf31a7e7b9722d3a0d5537185b4598
Instruction Fuzzy Hash: DC5196329042049FCF25EBA4D891DEFB3F5EF5A300F5084AAF512A7581EF70A945DB61

Function 00BA973D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00BA9744
_Fputc.LIBCPMT ref: 00BA9798
_Fputc.LIBCPMT ref: 00BA98C6

Strings

, xrefs: 00BA9850

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: Fputc$H_prolog3_
String ID:
API String ID: 2569218679-3916222277
Opcode ID: ed640bd50ebc7c88e887b76f1f2fd8bdebbd9d7d5f073e58900269c6e6ede340
Instruction ID: b4a6c32a7161b67ff74d9232a91ff074f5918f5cec78b292ebcee346065017b3
Opcode Fuzzy Hash: ed640bd50ebc7c88e887b76f1f2fd8bdebbd9d7d5f073e58900269c6e6ede340
Instruction Fuzzy Hash: 2351A3329082049FCF15DFA4C891DEEB7F5EF5B710F1085AAE112A7281EF70A844DB61

Function 00BB819A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00BB81B4

Part of subcall function 00BBF91B: __FF_MSGBANNER.LIBCMT ref: 00BBF93E
Part of subcall function 00BBF91B: __NMSG_WRITE.LIBCMT ref: 00BBF945
Part of subcall function 00BBF91B: RtlAllocateHeap.NTDLL(00000000,58928523,00000001,00000000,00000000,?,00BBD3F3,58928532,00000001,58928532,?,00BC0FB8,00000018,00BD2610,0000000C,00BC1049), ref: 00BBF992

std::bad_alloc::bad_alloc.LIBCMT ref: 00BB81D7

Part of subcall function 00BB817F: std::exception::exception.LIBCMT ref: 00BB818B

Strings

Pk , xrefs: 00BB81F8

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: AllocateHeap_mallocstd::bad_alloc::bad_allocstd::exception::exception
String ID: Pk
API String ID: 3447465555-574118001
Opcode ID: ce9ab568fcbca4f5be71cf109b1448fadf83bea065ab212413b2bb282c95de93
Instruction ID: 3a2764966a80637903da9fc25f0dce6df4c6fe434160f1b87439c0767ed88417
Opcode Fuzzy Hash: ce9ab568fcbca4f5be71cf109b1448fadf83bea065ab212413b2bb282c95de93
Instruction Fuzzy Hash: 7DF05E3190620563DB047769EC07AFD77ECCB04B64B1400E9A804661A1EEE0DA46C151

Function 00BB027B Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00BB0286

Strings

Only one tab per paragraph is allowed, xrefs: 00BB02F2

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: H_prolog3
String ID: Only one tab per paragraph is allowed
API String ID: 431132790-829416125
Opcode ID: 80b3b2fd140a6e4e53a11a3f97b87f6b951f518cbc1870eed2821e8c5f0b772c
Instruction ID: 910e74f35abbac2984f24375a57e8917d1c5c4afba5862e33a973a14295649d7
Opcode Fuzzy Hash: 80b3b2fd140a6e4e53a11a3f97b87f6b951f518cbc1870eed2821e8c5f0b772c
Instruction Fuzzy Hash: 1DA13B72504248AFCF15EFA4C895AEE3BE5FF19350F44019AF906A72A2EB71D944CB90

Function 00BA429F Relevance: 3.1, APIs: 2, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 00BA42A6
_wcslen.LIBCMT ref: 00BA42B6

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: H_prolog3_catch_wcslen
String ID:
API String ID: 1260878687-0
Opcode ID: 7a9cd3435b27ac6bdc0aee52cbcb782ca7d740a8bc9d3a58d62271c24e3012f7
Instruction ID: 6d1fe0e25d83a688084f489596ccd2cb0f81052dfc18c53569c62efef5946708
Opcode Fuzzy Hash: 7a9cd3435b27ac6bdc0aee52cbcb782ca7d740a8bc9d3a58d62271c24e3012f7
Instruction Fuzzy Hash: BF512674A082058FDB20DF58C595A6CBBF0EF99304F2581E9E1859B3A2CBB0DE45CB84

Function 00BA4161 Relevance: 3.1, APIs: 2, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 00BA4168
_strlen.LIBCMT ref: 00BA4175

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: H_prolog3_catch_strlen
String ID:
API String ID: 3133806014-0
Opcode ID: 9234fb91a51f69b6cb4ab8f1070a27081eb0f1cff0ca53a73c0fec864db6d5c6
Instruction ID: d22d71cd10dd53c16b97995c96329d022f8696d2b025eeee1b79dc98dbe6052c
Opcode Fuzzy Hash: 9234fb91a51f69b6cb4ab8f1070a27081eb0f1cff0ca53a73c0fec864db6d5c6
Instruction Fuzzy Hash: 93414E346082048FDB11CFA8C985BADBBF0EF59314F254598F551AB3A2C7B1DE44CB81

Function 00BBECE6 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00BBECEE

Part of subcall function 00BBECBB: GetModuleHandleW.KERNEL32(mscoree.dll,?,00BBECF3,58928532,?,00BBF954,000000FF,0000001E,?,00BBD3F3,58928532,00000001,58928532,?,00BC0FB8,00000018), ref: 00BBECC5
Part of subcall function 00BBECBB: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00BBECD5

ExitProcess.KERNEL32 ref: 00BBECF7

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: e6e7194ca13192279c09e1340c943430cf6cb0a054700d539839c6d523f6d96b
Instruction ID: f6fc9da4dd57da6d7da1f23d5df1845c0492109ad4ffbf14a481e76ef39f31af
Opcode Fuzzy Hash: e6e7194ca13192279c09e1340c943430cf6cb0a054700d539839c6d523f6d96b
Instruction Fuzzy Hash: 0CB0923100010CBFCB012F22DD0EC9D3F6AEB807A0B104020F8180A171DFB2EDD79A85

Function 00BB07DD Relevance: 1.7, APIs: 1, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00BB07E7

Part of subcall function 00BAF7D4: __EH_prolog3_catch.LIBCMT ref: 00BAF7DB

Part of subcall function 00BA4161: __EH_prolog3_catch.LIBCMT ref: 00BA4168
Part of subcall function 00BA4161: _strlen.LIBCMT ref: 00BA4175

Part of subcall function 00BB06B8: __EH_prolog3.LIBCMT ref: 00BB06C2

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: H_prolog3H_prolog3_catch$_strlen
String ID:
API String ID: 2084972985-0
Opcode ID: 21ce60ff9a3870c96b95afb7f12339499c61bc00c9c9987d223e0887e902a19f
Instruction ID: 66f876e791690e088a3fab09d125b9f2ec6d26508e056c466ada5941ded59858
Opcode Fuzzy Hash: 21ce60ff9a3870c96b95afb7f12339499c61bc00c9c9987d223e0887e902a19f
Instruction Fuzzy Hash: D0517271A08309AFDF05BBF0C846BFE7BE9AF46310F10009AF41167182EFB59A418755

Function 00BB06B8 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00BB06C2

Part of subcall function 00BAFE3B: __EH_prolog3.LIBCMT ref: 00BAFE42

Part of subcall function 00BAE8BD: __EH_prolog3.LIBCMT ref: 00BAE8C4

Part of subcall function 00BA4161: __EH_prolog3_catch.LIBCMT ref: 00BA4168
Part of subcall function 00BA4161: _strlen.LIBCMT ref: 00BA4175

Part of subcall function 00BAF7D4: __EH_prolog3_catch.LIBCMT ref: 00BAF7DB

Part of subcall function 00BAF9B7: __EH_prolog3_catch.LIBCMT ref: 00BAF9BE

Part of subcall function 00BAFCB2: __EH_prolog3_catch.LIBCMT ref: 00BAFCB9

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: H_prolog3_catch$H_prolog3$_strlen
String ID:
API String ID: 392102239-0
Opcode ID: 8e7edbd4fef893357a3637189f18f4ab24ca302ec1a3731f6f2732014f017770
Instruction ID: 0e9686b0fc4e8bb4fe1be2a4b9eb3d7da3d9b9b13a50fc92bc20150fd68b2aac
Opcode Fuzzy Hash: 8e7edbd4fef893357a3637189f18f4ab24ca302ec1a3731f6f2732014f017770
Instruction Fuzzy Hash: 57317E32908209AEEF15EBE0C856FEE7BE89F15320F1441D9F45967182EE74AE44CB61

Function 00BB0008 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00BB000F

Part of subcall function 00BB819A: _malloc.LIBCMT ref: 00BB81B4

Part of subcall function 00BB819A: std::bad_alloc::bad_alloc.LIBCMT ref: 00BB81D7

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: H_prolog3_mallocstd::bad_alloc::bad_alloc
String ID:
API String ID: 3856819035-0
Opcode ID: d5a8f6705695e69e5b91c53a27a85fba3a11790ca365938ff199cdb8bae08fb4
Instruction ID: 7af295401bdb15dfb04a8fd3793427e71cce3538ab71972369717bb3199b9738
Opcode Fuzzy Hash: d5a8f6705695e69e5b91c53a27a85fba3a11790ca365938ff199cdb8bae08fb4
Instruction Fuzzy Hash: D1019270A04209EBDB14FBB4C842BFF77F4AF00320F10419AB516A61D1DFB09A05C761

Function 00BC0C22 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00BC0C37

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: db746b688f7152dd76baf4f5fdba67671c7e3df2311452f0934f4af903e6a5fb
Instruction ID: 8fbbc6afd0c4ec4c99585d71013c2580f232b7814890288005c702da5fbb0b98
Opcode Fuzzy Hash: db746b688f7152dd76baf4f5fdba67671c7e3df2311452f0934f4af903e6a5fb
Instruction Fuzzy Hash: 9FD05E32590349AADB005FB1AD08B263BDDD384796F004876B90DC7150FA74C5408A00

Function 00BBEF02 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00BBEF0E

Part of subcall function 00BBEDD6: __lock.LIBCMT ref: 00BBEDE4
Part of subcall function 00BBEDD6: __decode_pointer.LIBCMT ref: 00BBEE1B
Part of subcall function 00BBEDD6: __decode_pointer.LIBCMT ref: 00BBEE30
Part of subcall function 00BBEDD6: __decode_pointer.LIBCMT ref: 00BBEE5A
Part of subcall function 00BBEDD6: __decode_pointer.LIBCMT ref: 00BBEE70
Part of subcall function 00BBEDD6: __decode_pointer.LIBCMT ref: 00BBEE7D
Part of subcall function 00BBEDD6: __initterm.LIBCMT ref: 00BBEEAC
Part of subcall function 00BBEDD6: __initterm.LIBCMT ref: 00BBEEBC

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: 025febcc2d33b0bd8a5cbd1bc2ccdab0277c2ac4a49775179d70cc9778c04dcf
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: AEB0923258020833EA212542AC03F963A4997C1B60E244070BA2C191A1A9E2A96180CA

Non-executed Functions

Function 00BC479F Relevance: 66.4, APIs: 44, Instructions: 432COMMONLIBRARYCODE

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 00BC47D6
___getlocaleinfo.LIBCMT ref: 00BC47EB
___getlocaleinfo.LIBCMT ref: 00BC4800
___getlocaleinfo.LIBCMT ref: 00BC4815
___getlocaleinfo.LIBCMT ref: 00BC482D
___getlocaleinfo.LIBCMT ref: 00BC4842
___getlocaleinfo.LIBCMT ref: 00BC4854
___getlocaleinfo.LIBCMT ref: 00BC4869
___getlocaleinfo.LIBCMT ref: 00BC4881
___getlocaleinfo.LIBCMT ref: 00BC4896

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 2d7e5d5b6e05d2ebdb8e189b33bf7355ddbb63fc27a1065a91b07e5b475de4b4
Instruction ID: 0daeb7ecc4289b4ddfd521409616530e45aa515ef80cfe4528b0fe2d264be735
Opcode Fuzzy Hash: 2d7e5d5b6e05d2ebdb8e189b33bf7355ddbb63fc27a1065a91b07e5b475de4b4
Instruction Fuzzy Hash: 70E1EDB295020DFEEB11EAE0CD81EFF77FDEB14744F01496AB255E2041EAB0AA159760

Function 00BA1AE9 Relevance: 23.1, APIs: 4, Strings: 9, Instructions: 334registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA4161: __EH_prolog3_catch.LIBCMT ref: 00BA4168
Part of subcall function 00BA4161: _strlen.LIBCMT ref: 00BA4175

RegConnectRegistryW.ADVAPI32(?,80000002,00000000), ref: 00BA1BFB

Part of subcall function 00BA2228: __EH_prolog3.LIBCMT ref: 00BA222F
Part of subcall function 00BA2228: RegOpenKeyExW.ADVAPI32(?,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020019,?,00000024,00BA1C5F,00000000,?,00000000,00000000), ref: 00BA2248

RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00BA1C69

Part of subcall function 00BA2E03: char_traits.LIBCPMT ref: 00BA2E28

RegCloseKey.ADVAPI32(?,?,?,?,58928532), ref: 00BA1D1E
RegCloseKey.ADVAPI32(?,?,?,?,58928532), ref: 00BA1ED1

Strings

ERROR: Unable to delete user's ProfileGuid entry from remote registry., xrefs: 00BA1E60
..., xrefs: 00BA1E8A, 00BA1EFF
WARNING: Unable to completely delete folder. Check access rights and manually delete., xrefs: 00BA1EBA, 00BA1F2F
Deleting user profile registry entries..., xrefs: 00BA1DE1
ERROR: Unable to delete user's ProfileList entry from remote registry., xrefs: 00BA1E16
Deleting , xrefs: 00BA1DD1, 00BA1E92, 00BA1F07
Querying remote registry..., xrefs: 00BA1BD1
ERROR: Unable to connect to remote registry., xrefs: 00BA1C05
Querying Active Directory..., xrefs: 00BA1B33

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: Close$ConnectH_prolog3H_prolog3_catchOpenRegistry_strlenchar_traits
String ID: Deleting $Deleting user profile registry entries...$Querying remote registry...$ ...$ERROR: Unable to connect to remote registry.$ERROR: Unable to delete user's ProfileGuid entry from remote registry.$ERROR: Unable to delete user's ProfileList entry from remote registry.$Querying Active Directory...$WARNING: Unable to completely delete folder. Check access rights and manually delete.
API String ID: 3494896214-1452430164
Opcode ID: 6857d707ebbb6109582e4f48f368e1ed5ff85a7b369754bf6e3a99db5d90d606
Instruction ID: f0487ed0871293dd617e25688683e83c4fccd452779447880be65afb54564311
Opcode Fuzzy Hash: 6857d707ebbb6109582e4f48f368e1ed5ff85a7b369754bf6e3a99db5d90d606
Instruction Fuzzy Hash: 28B1847150C340AAD624EF28DC46FEBBBE8EF97754F0009ADF88553152EB709A44C6A2

Function 00BA204B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

LookupAccountNameW.ADVAPI32(00000000,00000004,00000000,58928532,00000000,?,00000000), ref: 00BA2090
GetLastError.KERNEL32 ref: 00BA209A
LookupAccountNameW.ADVAPI32(00000000,00000004,00000000,?,00000000,?,?), ref: 00BA20E9
IsValidSid.ADVAPI32(00000000), ref: 00BA20F5
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00BA211D

Part of subcall function 00BA2C24: _wcslen.LIBCMT ref: 00BA2C29

LocalFree.KERNEL32(00000000), ref: 00BA2141

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: AccountLookupName$ConvertErrorFreeLastLocalStringValid_wcslen
String ID:
API String ID: 1389766527-0
Opcode ID: 29a0f7461c2ffd65a1dfa94236623317d3d2fd9e9c1c52d61e6e059a3d2fbde1
Instruction ID: fb2bb24e5350d02024f0652f5b2a052149ad5b6d8bc6a07d607a978f09b28996
Opcode Fuzzy Hash: 29a0f7461c2ffd65a1dfa94236623317d3d2fd9e9c1c52d61e6e059a3d2fbde1
Instruction Fuzzy Hash: 1D31807290420AAFDF15EFA8CC81EAEB7F8FF09350F2040A9E505A6151EB719E44CB10

Function 00BB7FAA Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00BBF058
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00BBF06D
UnhandledExceptionFilter.KERNEL32(00BCB520), ref: 00BBF078
GetCurrentProcess.KERNEL32(C0000409), ref: 00BBF094
TerminateProcess.KERNEL32(00000000), ref: 00BBF09B

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: c350327ab592acbf6db2de9e2ae28ffa3c88a04e9116e11bedecbcb2acb45327
Instruction ID: f145bc553968c95be1983ba0eff411b0c9e9f30f9852bd1b3f089db0ed38d88b
Opcode Fuzzy Hash: c350327ab592acbf6db2de9e2ae28ffa3c88a04e9116e11bedecbcb2acb45327
Instruction Fuzzy Hash: 1221CFB4903205DFD741DF29FC64AA4BBF4FB08306F60516BE41887261FFB199818B06

Function 00BA81A0 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00BA81C6

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: a183ab94be16c425c6fe06b7ac363cd1702d9a256380a67ba02b31b93a145e34
Instruction ID: 1065b7f04aeb75c0dc70adccb3abfac470ee015e0609d38cd4e3690b8899d994
Opcode Fuzzy Hash: a183ab94be16c425c6fe06b7ac363cd1702d9a256380a67ba02b31b93a145e34
Instruction Fuzzy Hash: 3441A73150DBC4CED732CEA889447A6BFE15F27308F188A8DC4D657A43D6A5E68CC762

Function 00BC04DA Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00020498), ref: 00BC04DF

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: d0dc283621a6925d192f24d2c1534877485c279697f111e71302802f8405e777
Instruction ID: 428ad1a85fa0a8a4005a18821a566bd179a22e9fcc33a998f20989b8d906b627
Opcode Fuzzy Hash: d0dc283621a6925d192f24d2c1534877485c279697f111e71302802f8405e777
Instruction Fuzzy Hash: 6C900264261104C686542B787D49D0A76E45A8C64674244E86122C5164DE7050005532

Function 00BB97A1 Relevance: .4, Instructions: 384COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 185af54e09021f16abcb2c0983cb9efe26612f003260af6f38c9424de99c066f
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 00D17073C0A9B34B8775812E44681BAEEE2AFD1B5031EC7E0DDD43F289D6A75D0195D0

Function 00BB9381 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 21075b79dcf5c71c9dd844e670ea6d8b09bb15a46241726fa9eed8d379cad05f
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: 78D16FB3C1A9B34B8736812D40681BAEBE2AFD1B5031EC7E1DDD42F289D6A79D0195D0

Function 00BB8F75 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: 4bf06aa78e6dab740a66769ec4bed7aa39462ec929ac79bfff6c5cd028751688
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 74C14BB3C0A9B34B8736813D40681BAEAA2AFD165131FC7E1CDD43F289D6A79D0595D0

Function 00BB8BA1 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 7c97bd2ab6ccc65cebd2da7ffb6a6dcfde2a0f1f3347328f352bb7fc9fdc1b25
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: 0BC17DB3D0A9B34B8736813D40681BAEEA6EFD174131EC7E1DC942F289DAA79D01D5D0

Function 00BBEAA0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 80f00d9e663767569ce5866c594c9936d650c0c01be294178f2a93ed0ad41711
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 0311087720109283D624CA3DC4F46F7E7D9FAD532072D83FAD0628F6B8D1E2E9459600

Function 00BBF20A Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00BD24E0,0000000C,00BBF345,00000000,00000000,?,00BA7D3F,?,00000000,?,00BA7D5F,58928532,00000000,?), ref: 00BBF21C
__crt_waiting_on_module_handle.LIBCMT ref: 00BBF227

Part of subcall function 00BBEC62: Sleep.KERNEL32(000003E8,00000000,?,00BBF16D,KERNEL32.DLL,?,00BBF1B9,?,00BA7D3F,?,00000000,?,00BA7D5F,58928532,00000000,?), ref: 00BBEC6E
Part of subcall function 00BBEC62: GetModuleHandleW.KERNEL32(58928532,?,00BBF16D,KERNEL32.DLL,?,00BBF1B9,?,00BA7D3F,?,00000000,?,00BA7D5F,58928532,00000000,?), ref: 00BBEC77

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00BBF250
GetProcAddress.KERNEL32(?,DecodePointer), ref: 00BBF260
__lock.LIBCMT ref: 00BBF282
InterlockedIncrement.KERNEL32(?), ref: 00BBF28F
__lock.LIBCMT ref: 00BBF2A3
___addlocaleref.LIBCMT ref: 00BBF2C1

Strings

EncodePointer, xrefs: 00BBF244
KERNEL32.DLL, xrefs: 00BBF216, 00BBF21B, 00BBF226
DecodePointer, xrefs: 00BBF258

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: d3ce16b40d9ba5fa1983b2fc2b86ccffe145b117c63e61149ffdf20a34b5d5ed
Instruction ID: fe7e2c19685231c9bb740618a56fcd51d1a5f19d42c4174def0e5d08919e6fd2
Opcode Fuzzy Hash: d3ce16b40d9ba5fa1983b2fc2b86ccffe145b117c63e61149ffdf20a34b5d5ed
Instruction Fuzzy Hash: EC119D75940B469FD7209F799C02FAEBBE0EF14315F1045AEF499A32A1DBB49A40CB11

Function 00BAC016 Relevance: 18.1, APIs: 12, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

____lc_handle_func.LIBCMT ref: 00BAC04A
____lc_codepage_func.LIBCMT ref: 00BAC052
__GetLocaleForCP.LIBCPMT ref: 00BAC07B
____mb_cur_max_l_func.LIBCMT ref: 00BAC091
MultiByteToWideChar.KERNEL32(?,00000009,?,00000002,00000000,00000000,?,?,?,?,00BAA0BC,?,00000000,00000001,00000000), ref: 00BAC0B0
____mb_cur_max_l_func.LIBCMT ref: 00BAC0BE
___pctype_func.LIBCMT ref: 00BAC0E3
____mb_cur_max_l_func.LIBCMT ref: 00BAC109
____mb_cur_max_l_func.LIBCMT ref: 00BAC121
____mb_cur_max_l_func.LIBCMT ref: 00BAC139
MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,00000000,?,?,?,?,00BAA0BC,?,00000000,00000001,00000000), ref: 00BAC146
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,00000000,00000000,?,?,?,?,00BAA0BC,?,00000000,00000001,00000000), ref: 00BAC177

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: ____mb_cur_max_l_func$ByteCharMultiWide$Locale____lc_codepage_func____lc_handle_func___pctype_func
String ID:
API String ID: 3819326198-0
Opcode ID: cae3d0126c229c31399daf19e3bb3fd348bd09e9b660a1fd55f6e6d6b630c1fd
Instruction ID: 398f4239339fccedfe2202186e0926a17581603f3cf1a78ae70f76635e5d8629
Opcode Fuzzy Hash: cae3d0126c229c31399daf19e3bb3fd348bd09e9b660a1fd55f6e6d6b630c1fd
Instruction Fuzzy Hash: A0419F31208245EFDB305F259C85B7A3FE5EF02361F2485A9F8659A192EBB4CC90EB50

Function 00BA249B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BA24A2
CharUpperBuffW.USER32(?,?,?,?,?,58928532), ref: 00BA2506
_wcslen.LIBCMT ref: 00BA2529
_wcslen.LIBCMT ref: 00BA25BA
_wcslen.LIBCMT ref: 00BA2618

Strings

ERROR: Unable to expand ProfileImagePath., xrefs: 00BA268E
%SYSTEMROOT%, xrefs: 00BA255C, 00BA2561, 00BA2569
%SYSTEMDRIVE%, xrefs: 00BA2523, 00BA2528, 00BA2530
ProfileImagePath:, xrefs: 00BA2650

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: _wcslen$BuffCharH_prolog3_Upper
String ID: ProfileImagePath:$%SYSTEMDRIVE%$%SYSTEMROOT%$ERROR: Unable to expand ProfileImagePath.
API String ID: 3525394599-2089877940
Opcode ID: b97c37840e48a8bf59cff6c754646490ffdfe0e23b57ee304a3d191010b9b203
Instruction ID: eff004382da29b6173f15b5a9fcea460a36d8b4f08ad0dffae3df2ef67216964
Opcode Fuzzy Hash: b97c37840e48a8bf59cff6c754646490ffdfe0e23b57ee304a3d191010b9b203
Instruction Fuzzy Hash: F2519471A08204BEDB14BB6CCC92EBD77F8EF56320F1002A9F415B72D2EEA05E458761

Function 00BA22B6 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 167registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BA22BD

Part of subcall function 00BA2C24: _wcslen.LIBCMT ref: 00BA2C29

Part of subcall function 00BA2FF7: std::_String_base::_Xlen.LIBCPMT ref: 00BA3032
Part of subcall function 00BA2FF7: char_traits.LIBCPMT ref: 00BA3083

RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,00000000,000000FF,0000006C,00BA1D11,?,?,?,?,00000000,00000000,00000000), ref: 00BA2310

Part of subcall function 00BA83D9: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,00000000,00000007,?,?,?,00BA2283,?,?,SystemRoot), ref: 00BA8410
Part of subcall function 00BA83D9: RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,?,?,?,00BA2283,?,?,SystemRoot), ref: 00BA8449

Part of subcall function 00BA2E03: char_traits.LIBCPMT ref: 00BA2E28

RegCloseKey.ADVAPI32(?,00000001,00000000,CentralProfile,00000001,00000000,Guid,00000000,00000001,00000000,ProfileImagePath,?,00000000,00020019,?,00000000), ref: 00BA2483

Part of subcall function 00BA4454: __EH_prolog3.LIBCMT ref: 00BA445B

Strings

Guid, xrefs: 00BA236F
ProfileGuid:, xrefs: 00BA23E6
CentralProfile:, xrefs: 00BA245D
ProfileImagePath, xrefs: 00BA2332
SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\, xrefs: 00BA22DC
ERROR: User does not have a registry-based profile on specified workstation., xrefs: 00BA231A
CentralProfile, xrefs: 00BA2413

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: QueryValuechar_traits$CloseH_prolog3H_prolog3_OpenString_base::_Xlen_wcslenstd::_
String ID: CentralProfile:$ ProfileGuid:$CentralProfile$ERROR: User does not have a registry-based profile on specified workstation.$Guid$ProfileImagePath$SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\
API String ID: 119362826-279320193
Opcode ID: 153edc3b05bfaeff1892b6d0548563761a7f3d7d00dfcd7871b046d251466097
Instruction ID: 2268d945d544a57502ea189dc061bb61b98dde08ad5842d220a73b0f2d76de82
Opcode Fuzzy Hash: 153edc3b05bfaeff1892b6d0548563761a7f3d7d00dfcd7871b046d251466097
Instruction Fuzzy Hash: 46517371D08208BFDF14EBA8DC86DDEBBF8EF56710B1444AAF415B7252EA706A04C760

Function 00BAB2A2 Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BAB2A9
std::_Lockit::_Lockit.LIBCPMT ref: 00BAB2B3
int.LIBCPMT ref: 00BAB2CA

Part of subcall function 00BA87E3: std::_Lockit::_Lockit.LIBCPMT ref: 00BA87F6

std::locale::_Getfacet.LIBCPMT ref: 00BAB2D3
codecvt.LIBCPMT ref: 00BAB2ED
std::bad_exception::bad_exception.LIBCMT ref: 00BAB301
__CxxThrowException@8.LIBCMT ref: 00BAB30F
std::locale::facet::_Incref.LIBCPMT ref: 00BAB31F
std::locale::facet::facet_Register.LIBCPMT ref: 00BAB325

Strings

bad cast, xrefs: 00BAB2F9

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8GetfacetH_prolog3IncrefRegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_std::locale::facet::facet_
String ID: bad cast
API String ID: 577375395-3145022300
Opcode ID: d64392833cbf819afa34d1acec0858069b39cee77950f9a630743ade98b98b2c
Instruction ID: e08ca208024eec6b6e881ef0571ae5b172c5b6a3e0d8bd4b803d211cf3a15d9d
Opcode Fuzzy Hash: d64392833cbf819afa34d1acec0858069b39cee77950f9a630743ade98b98b2c
Instruction Fuzzy Hash: C301843190921597CF01FBA4C852EFDB3F5AF55B21F640599F0206B2D2DF7499018795

Function 00BAB205 Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BAB20C
std::_Lockit::_Lockit.LIBCPMT ref: 00BAB216
int.LIBCPMT ref: 00BAB22D

Part of subcall function 00BA87E3: std::_Lockit::_Lockit.LIBCPMT ref: 00BA87F6

std::locale::_Getfacet.LIBCPMT ref: 00BAB236
ctype.LIBCPMT ref: 00BAB250
std::bad_exception::bad_exception.LIBCMT ref: 00BAB264
__CxxThrowException@8.LIBCMT ref: 00BAB272
std::locale::facet::_Incref.LIBCPMT ref: 00BAB282
std::locale::facet::facet_Register.LIBCPMT ref: 00BAB288

Strings

bad cast, xrefs: 00BAB25C

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8GetfacetH_prolog3IncrefRegisterThrowctypestd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_std::locale::facet::facet_
String ID: bad cast
API String ID: 2535038987-3145022300
Opcode ID: 3cc47ac11eb0d6519c960e1417cb0f6be1b0db1fd32f0efa6370ae9911481c17
Instruction ID: c20a79aa812828eca8e8b0187cbf6f40df0e536492502e2d82ce475d8dd3d5aa
Opcode Fuzzy Hash: 3cc47ac11eb0d6519c960e1417cb0f6be1b0db1fd32f0efa6370ae9911481c17
Instruction Fuzzy Hash: DA0184319092199BCB05FBA4C952FFDB3F5AF41B20F6402DAF0206B2E2DF7499018755

Function 00BA9A9B Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA9AA2
std::_Lockit::_Lockit.LIBCPMT ref: 00BA9AAC
int.LIBCPMT ref: 00BA9AC3

Part of subcall function 00BA87E3: std::_Lockit::_Lockit.LIBCPMT ref: 00BA87F6

std::locale::_Getfacet.LIBCPMT ref: 00BA9ACC
ctype.LIBCPMT ref: 00BA9AE6
std::bad_exception::bad_exception.LIBCMT ref: 00BA9AFA
__CxxThrowException@8.LIBCMT ref: 00BA9B08
std::locale::facet::_Incref.LIBCPMT ref: 00BA9B18
std::locale::facet::facet_Register.LIBCPMT ref: 00BA9B1E

Strings

bad cast, xrefs: 00BA9AF2

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8GetfacetH_prolog3IncrefRegisterThrowctypestd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_std::locale::facet::facet_
String ID: bad cast
API String ID: 2535038987-3145022300
Opcode ID: b2ce028b74b7efa5f1784e5d810629c4f7ea00b397795dea75330ad6dedfe580
Instruction ID: 6d938417d9fb44301e17489a550db40548ef504d55b8726c5e3fc8284dce4dc0
Opcode Fuzzy Hash: b2ce028b74b7efa5f1784e5d810629c4f7ea00b397795dea75330ad6dedfe580
Instruction Fuzzy Hash: ED01843190921A97CF05EBA4D852EFDB3F6EF55720F640199F0106B2E2DF749902D7A1

Function 00BA9CBA Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA9CC1
std::_Lockit::_Lockit.LIBCPMT ref: 00BA9CCB
int.LIBCPMT ref: 00BA9CE2

Part of subcall function 00BA87E3: std::_Lockit::_Lockit.LIBCPMT ref: 00BA87F6

std::locale::_Getfacet.LIBCPMT ref: 00BA9CEB
codecvt.LIBCPMT ref: 00BA9D05
std::bad_exception::bad_exception.LIBCMT ref: 00BA9D19
__CxxThrowException@8.LIBCMT ref: 00BA9D27
std::locale::facet::_Incref.LIBCPMT ref: 00BA9D37
std::locale::facet::facet_Register.LIBCPMT ref: 00BA9D3D

Strings

bad cast, xrefs: 00BA9D11

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8GetfacetH_prolog3IncrefRegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_std::locale::facet::facet_
String ID: bad cast
API String ID: 577375395-3145022300
Opcode ID: 779f5a10d9d5952402b5425842e269f35313b858a24c8f72375b67b968fc8670
Instruction ID: 1590c45d604736ab6e9c49130723f055a30d938bd3912df7a2fbe54836dd0f56
Opcode Fuzzy Hash: 779f5a10d9d5952402b5425842e269f35313b858a24c8f72375b67b968fc8670
Instruction Fuzzy Hash: 10018431908219ABCF01EBA4C852AFEB3F5AF51720F640199F0106B2E1DF749A019751

Function 00BBE4FA Relevance: 15.1, APIs: 10, Instructions: 95COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00BBE513

Part of subcall function 00BBD427: __calloc_impl.LIBCMT ref: 00BBD438
Part of subcall function 00BBD427: Sleep.KERNEL32(00000000), ref: 00BBD44F

__calloc_crt.LIBCMT ref: 00BBE537
__calloc_crt.LIBCMT ref: 00BBE553
__copytlocinfo_nolock.LIBCMT ref: 00BBE578
__setlocale_nolock.LIBCMT ref: 00BBE585
___removelocaleref.LIBCMT ref: 00BBE591
___freetlocinfo.LIBCMT ref: 00BBE598
__setmbcp_nolock.LIBCMT ref: 00BBE5B0
___removelocaleref.LIBCMT ref: 00BBE5C5
___freetlocinfo.LIBCMT ref: 00BBE5CC

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: __calloc_crt$___freetlocinfo___removelocaleref$Sleep__calloc_impl__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 2969281212-0
Opcode ID: 89990863f7819698b6000f2202cdba6e491c47b35ecda616b19f78a51d6e4533
Instruction ID: 7a3e8247f84d5f5cfec3f8c892c9ab365938aad412ceb60d0c3e543fc324e76c
Opcode Fuzzy Hash: 89990863f7819698b6000f2202cdba6e491c47b35ecda616b19f78a51d6e4533
Instruction Fuzzy Hash: 41210235104A01EBE7317F25DC02DFAB7E5EFA0724B2084A9F8A456672FFB5DD008A91

Function 00BA195D Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 123COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BA1964

Part of subcall function 00BA838E: __EH_prolog3.LIBCMT ref: 00BA8395

Part of subcall function 00BA2E03: char_traits.LIBCPMT ref: 00BA2E28

Strings

DelProf.exe -u Jonathan -w WORKSTATION1 --local --network, xrefs: 00BA19FF
Notes:, xrefs: 00BA1A53
Examples:, xrefs: 00BA197B
DelProf.exe --u DOMAIN\Jonathan -w WORKSTATION1 --local, xrefs: 00BA19D5
DelProf.exe --user Jonathan --workstation WORKSTATION1, xrefs: 00BA19AB
- The c$ share and remote registry must be accessible on the target workstation., xrefs: 00BA1AA7
- The user must not be logged onto the target workstation., xrefs: 00BA1A7D

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: H_prolog3H_prolog3_char_traits
String ID: - The c$ share and remote registry must be accessible on the target workstation.$ - The user must not be logged onto the target workstation.$ DelProf.exe --u DOMAIN\Jonathan -w WORKSTATION1 --local$ DelProf.exe --user Jonathan --workstation WORKSTATION1$ DelProf.exe -u Jonathan -w WORKSTATION1 --local --network$Examples:$Notes:
API String ID: 3685356560-1177095237
Opcode ID: 1801b531a6d24209e8232fb06b46831d8ce8bb86c5490370a5242f80c05b7050
Instruction ID: 831884f39f27e6e1f7a5ce97bdadfcf7acfccfdf96086734ff053bbf7d685d2f
Opcode Fuzzy Hash: 1801b531a6d24209e8232fb06b46831d8ce8bb86c5490370a5242f80c05b7050
Instruction Fuzzy Hash: E641E975C4914CAECB05E7E8D991EDEBBFCAF26300F0840DAE81173252DA745B4ACA61

Function 00BA7076 Relevance: 13.8, APIs: 9, Instructions: 340COMMON

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 00BA70C4
char_traits.LIBCPMT ref: 00BA7139
char_traits.LIBCPMT ref: 00BA7171
char_traits.LIBCPMT ref: 00BA71B4
char_traits.LIBCPMT ref: 00BA723E
char_traits.LIBCPMT ref: 00BA72B9
char_traits.LIBCPMT ref: 00BA732D
char_traits.LIBCPMT ref: 00BA7374
char_traits.LIBCPMT ref: 00BA73BA

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: char_traits$String_base::_Xlenstd::_
String ID:
API String ID: 1810552321-0
Opcode ID: e228d069cdba8bad5596e6f9d922bf989f0097d53428f9326e2ff53b5aa7e66c
Instruction ID: 76d30f524189e2f4605a5f9e9fa240f97d59986c60e14ac073eded65e4d108f8
Opcode Fuzzy Hash: e228d069cdba8bad5596e6f9d922bf989f0097d53428f9326e2ff53b5aa7e66c
Instruction Fuzzy Hash: ABD11CB064C50AAFCB08CF58CDD4CAAB7E6FB863007508659E81A87655DB30FA65CBD4

Function 00BA8507 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,00000000,?,Deleting ), ref: 00BA8552
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?), ref: 00BA8578
RegCloseKey.ADVAPI32(?), ref: 00BA859A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00BA85B5
RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00BA85E8

Strings

Deleting , xrefs: 00BA851D

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: Enum$CloseDeleteOpen
String ID: Deleting
API String ID: 2095303065-3793058071
Opcode ID: 46ad4c1597844e574ae92056b7065ec61f5835438ebc5bb9fb2e6cf22d77e0e2
Instruction ID: a0c54cb8680a29133ac17a3169295c24d58500264b77615eadc51a6f2d768340
Opcode Fuzzy Hash: 46ad4c1597844e574ae92056b7065ec61f5835438ebc5bb9fb2e6cf22d77e0e2
Instruction Fuzzy Hash: 5D2197B594111CAFDB21DF94DC88EFAB7FCEB28344F1001D6A919A2051DA305E888F60

Function 00BA2228 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA222F
RegOpenKeyExW.ADVAPI32(?,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020019,?,00000024,00BA1C5F,00000000,?,00000000,00000000), ref: 00BA2248
RegCloseKey.ADVAPI32(?,00000001,00000000,SystemRoot), ref: 00BA2297

Part of subcall function 00BA4161: __EH_prolog3_catch.LIBCMT ref: 00BA4168
Part of subcall function 00BA4161: _strlen.LIBCMT ref: 00BA4175

Strings

ERROR: Unable to open remote Windows information., xrefs: 00BA2252
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00BA2240
SystemRoot, xrefs: 00BA2267

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: CloseH_prolog3H_prolog3_catchOpen_strlen
String ID: ERROR: Unable to open remote Windows information.$SOFTWARE\Microsoft\Windows NT\CurrentVersion$SystemRoot
API String ID: 2245420635-285966602
Opcode ID: 66b54af25c2b464619507437a5c83cba7d537c5f8ddb84f8cb9db5e73d9a58c2
Instruction ID: afcb8760bd329636e5956e85027e6fb4c7b350df24ad1e936615d17240ec40d7
Opcode Fuzzy Hash: 66b54af25c2b464619507437a5c83cba7d537c5f8ddb84f8cb9db5e73d9a58c2
Instruction Fuzzy Hash: 3101B131A08218BBCB10EBA4EC46EEEBFF4EF02B10F5080A9F414660E1DF705A01D660

Function 00BC3AAD Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00BC3AB9

Part of subcall function 00BBF36A: __getptd_noexit.LIBCMT ref: 00BBF36D
Part of subcall function 00BBF36A: __amsg_exit.LIBCMT ref: 00BBF37A

__amsg_exit.LIBCMT ref: 00BC3AD9
__lock.LIBCMT ref: 00BC3AE9
InterlockedDecrement.KERNEL32(?), ref: 00BC3B06
InterlockedIncrement.KERNEL32(00E62CE0), ref: 00BC3B31

Strings

,, xrefs: 00BC3B1F, 00BC3B27

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID: ,
API String ID: 4271482742-4120420056
Opcode ID: c47b2941b33b2ba6cc01fb502528aee426a44e2ad1c56a456c504738fbf28d19
Instruction ID: d499691f6b610a4650d2d9744c9e78ef5f0689dd54f978997c7e6f85ab122ea7
Opcode Fuzzy Hash: c47b2941b33b2ba6cc01fb502528aee426a44e2ad1c56a456c504738fbf28d19
Instruction Fuzzy Hash: 1C018431A45A21ABCB11AF689805FADB7E0FF04B10F4581DAF80067291EF789E51CBD1

Function 00BB4CEE Relevance: 9.2, APIs: 6, Instructions: 199COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00BB4D0D
std::_String_base::_Xlen.LIBCPMT ref: 00BB4D51

Part of subcall function 00BA4F03: __EH_prolog3.LIBCMT ref: 00BA4F0A
Part of subcall function 00BA4F03: __CxxThrowException@8.LIBCMT ref: 00BA4F3C

ctype.LIBCPMT ref: 00BB4DC9
ctype.LIBCPMT ref: 00BB4DEC

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catchString_base::_ThrowXlenstd::_
String ID:
API String ID: 1217835658-0
Opcode ID: e3bdf83c1e5a867651f4324529af83377dba74211cd4b1bde2ef574284f6f3cf
Instruction ID: 72b45372ab4bf6db2316a2487532d88ee8b0e5f94e216532928f9e6eab29875e
Opcode Fuzzy Hash: e3bdf83c1e5a867651f4324529af83377dba74211cd4b1bde2ef574284f6f3cf
Instruction Fuzzy Hash: BC717E71A007099FDB24DFA4CD81AFEBBF6FB48710F10456DE41A97291DBB0AA08CB51

Function 00BB6C02 Relevance: 9.2, APIs: 6, Instructions: 199COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00BB6C21
std::_String_base::_Xlen.LIBCPMT ref: 00BB6C65

Part of subcall function 00BB3F6F: __EH_prolog3.LIBCMT ref: 00BB3F76
Part of subcall function 00BB3F6F: __CxxThrowException@8.LIBCMT ref: 00BB3FA1

ctype.LIBCPMT ref: 00BB6CDD
ctype.LIBCPMT ref: 00BB6D00

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catchString_base::_ThrowXlenstd::_
String ID:
API String ID: 1217835658-0
Opcode ID: 9c91dcc3b797cd9d73cfd399cb70bbd59e1a51ef27d15ab659e45226dbe3d8a3
Instruction ID: a46c6091d5661a045981a352fcdc995e27f7d6e98d457fc3bff8aa854fe65f24
Opcode Fuzzy Hash: 9c91dcc3b797cd9d73cfd399cb70bbd59e1a51ef27d15ab659e45226dbe3d8a3
Instruction Fuzzy Hash: 8B715F71A003099FDB24DFA4CD86AFEBBF6EB44310F10456DE51A97291DBB4AE08CB51

Function 00BA5B16 Relevance: 9.2, APIs: 6, Instructions: 181COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00BA5B1D
std::_String_base::_Xlen.LIBCPMT ref: 00BA5B58

Part of subcall function 00BA4F03: __EH_prolog3.LIBCMT ref: 00BA4F0A
Part of subcall function 00BA4F03: __CxxThrowException@8.LIBCMT ref: 00BA4F3C

ctype.LIBCPMT ref: 00BA5BC5
ctype.LIBCPMT ref: 00BA5BE5

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catch_String_base::_ThrowXlenstd::_
String ID:
API String ID: 1119708605-0
Opcode ID: 306450482ffcd53f087086c6f74c67c139f3e804e1170a8e496dc50d96eb2a4e
Instruction ID: dd47a1c6bac51a58c2e23d32dd2a9887686c49a414aeda2fdf0275546a6e9f5b
Opcode Fuzzy Hash: 306450482ffcd53f087086c6f74c67c139f3e804e1170a8e496dc50d96eb2a4e
Instruction Fuzzy Hash: 85519071A04708AFCF24DFA8C885E9EBBF6FB45310F14852DF4159B281EBB1EA049B10

Function 00BA5DA1 Relevance: 9.2, APIs: 6, Instructions: 181COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00BA5DA8
std::_String_base::_Xlen.LIBCPMT ref: 00BA5DE3

Part of subcall function 00BA4F03: __EH_prolog3.LIBCMT ref: 00BA4F0A
Part of subcall function 00BA4F03: __CxxThrowException@8.LIBCMT ref: 00BA4F3C

ctype.LIBCPMT ref: 00BA5E50
ctype.LIBCPMT ref: 00BA5E70

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catch_String_base::_ThrowXlenstd::_
String ID:
API String ID: 1119708605-0
Opcode ID: 78f29ec75afe40bb27c438f245e7f3348eae277e2cd424e1692ec99ef2f14c3a
Instruction ID: 2e929e06c919ca6a4cbe04eda7eb153feee2944e72a90ff3ba93ccc89892ab01
Opcode Fuzzy Hash: 78f29ec75afe40bb27c438f245e7f3348eae277e2cd424e1692ec99ef2f14c3a
Instruction Fuzzy Hash: A55161B1A04708AFDB24DFA8CD85AAEBBF6FF45310F54855DF4159B281DBB1A908CB10

Function 00BB438F Relevance: 9.2, APIs: 6, Instructions: 168COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00BB4396
std::_String_base::_Xlen.LIBCPMT ref: 00BB43CB

Part of subcall function 00BB3F6F: __EH_prolog3.LIBCMT ref: 00BB3F76
Part of subcall function 00BB3F6F: __CxxThrowException@8.LIBCMT ref: 00BB3FA1

ctype.LIBCPMT ref: 00BB443F
ctype.LIBCPMT ref: 00BB445F

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catchString_base::_ThrowXlenstd::_
String ID:
API String ID: 1217835658-0
Opcode ID: af8c2941da185ea3fd14659c36555b241a70ebb73c241041c1ae28dc7779626e
Instruction ID: 302fa85b141d3832d84fac764bb4f0c30b77a34c2659e0099b66cdc6ea7953c1
Opcode Fuzzy Hash: af8c2941da185ea3fd14659c36555b241a70ebb73c241041c1ae28dc7779626e
Instruction Fuzzy Hash: 065169B1A00609AFCF24DFA8C995ABEBBF5FF54310F11465CE416A7281DBB0AA04CB51

Function 00BAEEB1 Relevance: 9.2, APIs: 6, Instructions: 161COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00BAEEB8
std::_String_base::_Xlen.LIBCPMT ref: 00BAEEED

Part of subcall function 00BB3F6F: __EH_prolog3.LIBCMT ref: 00BB3F76
Part of subcall function 00BB3F6F: __CxxThrowException@8.LIBCMT ref: 00BB3FA1

ctype.LIBCPMT ref: 00BAEF5D
ctype.LIBCPMT ref: 00BAEF7B

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catchString_base::_ThrowXlenstd::_
String ID:
API String ID: 1217835658-0
Opcode ID: ad8830c48aee537508f050aaf632e9b9e68e54a7433197d09c58ea9f221d0ca7
Instruction ID: 886221ec243bed3f35aef0ac3a4819fbba2de1483c551b1ed85e310a8e095717
Opcode Fuzzy Hash: ad8830c48aee537508f050aaf632e9b9e68e54a7433197d09c58ea9f221d0ca7
Instruction Fuzzy Hash: 2A514A7190460AAFCF25DFA4C845ABEBBF5FF45310F10465DF426A7241EB70AA14CBA1

Function 00BAEAA0 Relevance: 9.1, APIs: 6, Instructions: 140COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00BAEAA7
std::_String_base::_Xlen.LIBCPMT ref: 00BAEADC

Part of subcall function 00BB3F6F: __EH_prolog3.LIBCMT ref: 00BB3F76
Part of subcall function 00BB3F6F: __CxxThrowException@8.LIBCMT ref: 00BB3FA1

ctype.LIBCPMT ref: 00BAEB3D
ctype.LIBCPMT ref: 00BAEB50

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: ctype$Exception@8H_prolog3H_prolog3_catchString_base::_ThrowXlenstd::_
String ID:
API String ID: 1217835658-0
Opcode ID: 333a45e9445a3ef7452f2bf83eb5db99b2646e293cfdca5cf16246907a7719e7
Instruction ID: 70acf2d1d08077b2656f133888c7329130151a4b8e74b99130aa2bd61372c8d2
Opcode Fuzzy Hash: 333a45e9445a3ef7452f2bf83eb5db99b2646e293cfdca5cf16246907a7719e7
Instruction Fuzzy Hash: 32517AB0A0420A9FCF15EF68C8959AF7BF5EF45300B10496DF82697601EB30EE14CBA1

Function 00BBC354 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00BBC37C

Part of subcall function 00BBA596: __getptd.LIBCMT ref: 00BBA5A4
Part of subcall function 00BBA596: __getptd.LIBCMT ref: 00BBA5B2

__getptd.LIBCMT ref: 00BBC386

Part of subcall function 00BBF36A: __getptd_noexit.LIBCMT ref: 00BBF36D
Part of subcall function 00BBF36A: __amsg_exit.LIBCMT ref: 00BBF37A

__getptd.LIBCMT ref: 00BBC394
__getptd.LIBCMT ref: 00BBC3A2
__getptd.LIBCMT ref: 00BBC3AD
_CallCatchBlock2.LIBCMT ref: 00BBC3D3

Part of subcall function 00BBA63B: __CallSettingFrame@12.LIBCMT ref: 00BBA687

Part of subcall function 00BBC47A: __getptd.LIBCMT ref: 00BBC489
Part of subcall function 00BBC47A: __getptd.LIBCMT ref: 00BBC497

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: bf01ef6683568cfa86e0e988b50197a58db2928f5bdb43054812afae3a3738ec
Instruction ID: f540ff048ee9dfee7bc0a1067d28057dc91b033e753d96445e720a0375a522b8
Opcode Fuzzy Hash: bf01ef6683568cfa86e0e988b50197a58db2928f5bdb43054812afae3a3738ec
Instruction Fuzzy Hash: 691194B1D0420AAFDF00EFA4D945AFDBBF0FB08314F1480AAF814A7251DBB89A159B54

Function 00BB2F92 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BB2F99
__CxxThrowException@8.LIBCMT ref: 00BB2FCA

Part of subcall function 00BBA269: RaiseException.KERNEL32(?,?,00BB81FE,?,?,?,?,?,00BB81FE,?,00BD2C30,00BD8688,?,00BA7E8E,58928532,ios_base::eofbit set), ref: 00BBA2AB

__EH_prolog3.LIBCMT ref: 00BB2FD7

Strings

multiple_occurrences, xrefs: 00BB2FEC
multiple_values, xrefs: 00BB3020

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: multiple_occurrences$multiple_values
API String ID: 1412866469-1208176579
Opcode ID: c93a165ed3254a7beaec6b2af16d0ee9c3c1277e21e2f30b7ffe6f92c593a1f8
Instruction ID: cfdee22282eb7f0f86afb9705e0f40031bd244fddec77971d650a4a1f593e7a7
Opcode Fuzzy Hash: c93a165ed3254a7beaec6b2af16d0ee9c3c1277e21e2f30b7ffe6f92c593a1f8
Instruction Fuzzy Hash: 0D214571C04208ABDB14FBA4C856BFDB7F9AF14304F5085D9F05AAA192CFB19B49CB61

Function 00BB7452 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BB7459
std::_Lockit::_Lockit.LIBCPMT ref: 00BB7465
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00BB74D3

Part of subcall function 00BA7C2A: __EH_prolog3.LIBCMT ref: 00BA7C31

__CxxThrowException@8.LIBCMT ref: 00BB74CA

Part of subcall function 00BBA269: RaiseException.KERNEL32(?,?,00BB81FE,?,?,?,?,?,00BB81FE,?,00BD2C30,00BD8688,?,00BA7E8E,58928532,ios_base::eofbit set), ref: 00BBA2AB

Strings

bad locale name, xrefs: 00BB74A4

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: H_prolog3std::_$ExceptionException@8Locinfo::_Locinfo_ctorLockitLockit::_RaiseThrow
String ID: bad locale name
API String ID: 4278901745-1405518554
Opcode ID: c65b8a1c1cc44f763118e5fc696d3e8d5f11ffc119660efb0ea073edb5c8f895
Instruction ID: be1bca2ceed48d38540be4ea609d4efc572ae26849a07ead4fd90c175944edf1
Opcode Fuzzy Hash: c65b8a1c1cc44f763118e5fc696d3e8d5f11ffc119660efb0ea073edb5c8f895
Instruction Fuzzy Hash: 42016D3184C288AADB05E7E4C946BEEBBF4AF25310F1084CDF14527182EFB55B08C7A2

Function 00BB407C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BB4083
__CxxThrowException@8.LIBCMT ref: 00BB40E2

Strings

style disallows parameters for long options, xrefs: 00BB409A
style disallows all characters for short options, xrefs: 00BB40BB
style disallows parameters for short options, xrefs: 00BB40AC, 00BB40C0

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: Exception@8H_prolog3Throw
String ID: style disallows all characters for short options$style disallows parameters for long options$style disallows parameters for short options
API String ID: 3670251406-2573483067
Opcode ID: d4865a67aa7ab119d4c249b05ea2458f9567c335a8c3a59b06fef41dae071a2c
Instruction ID: be9bef23c66db1e0faa1d8ead59d47a97fa84a8c2d544f1a8af583c219a8b26c
Opcode Fuzzy Hash: d4865a67aa7ab119d4c249b05ea2458f9567c335a8c3a59b06fef41dae071a2c
Instruction Fuzzy Hash: F2F04F7291410897DF15F598C646BFE63E8FF14318F4400E9FB42AB142CBE59D44C756

Function 00BA17DB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BA17E2

Part of subcall function 00BA838E: __EH_prolog3.LIBCMT ref: 00BA8395

Part of subcall function 00BA2E03: char_traits.LIBCPMT ref: 00BA2E28

Strings

http://www.autoitscript.com/tools, xrefs: 00BA187E
RemoteDelProf v1.0.0 - Remote Profile Deletion Utility, xrefs: 00BA182A

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: H_prolog3H_prolog3_char_traits
String ID: Copyright (C) 2009 Jonathan Bennett$RemoteDelProf v1.0.0 - Remote Profile Deletion Utility$http://www.autoitscript.com/tools
API String ID: 3685356560-3682555908
Opcode ID: fe045c929ecb325734ef8d6829d0af818df465d49c46c445a329c1e8a8324bec
Instruction ID: 169fd2cc6df85994b5c298389a01961b24cdc1c5e31d60db8a49947e8cc00ae9
Opcode Fuzzy Hash: fe045c929ecb325734ef8d6829d0af818df465d49c46c445a329c1e8a8324bec
Instruction Fuzzy Hash: E6310C75C4914CAEDB05E7E8D991EDEBBFCAF26300F0840D9E81173252DA345B4ACA71

Function 00BA78FB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 00BA7948

Strings

ios_base::failbit set, xrefs: 00BA7990
ios_base::badbit set, xrefs: 00BA7952
ios_base::eofbit set, xrefs: 00BA79CA

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: 55d0584324b0a4d923a2c45ad2c30fd977db96fa0edd3e64ffd634507b4a3959
Instruction ID: 24c2a2184f7d5b226b7a0019d309ef8b7309ed16a1edcf8fd444b2c0f2bc8176
Opcode Fuzzy Hash: 55d0584324b0a4d923a2c45ad2c30fd977db96fa0edd3e64ffd634507b4a3959
Instruction Fuzzy Hash: 602195B528C784AFC310DF24CC91F9BB3E8EB85710F5049AEF49586191EF759509CB52

Function 00BBC701 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00BBC714

Part of subcall function 00BBC66F: ___BuildCatchObjectHelper.LIBCMT ref: 00BBC6A5

_UnwindNestedFrames.LIBCMT ref: 00BBC72B
___FrameUnwindToState.LIBCMT ref: 00BBC739

Strings

csm, xrefs: 00BBC710, 00BBC725, 00BBC738, 00BBC756, 00BBC766

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm
API String ID: 2163707966-1018135373
Opcode ID: 897de3ac07446944308d15e80b2e02fed61e753b384f2a82f7a733087c59a827
Instruction ID: d32d4cab902aa4aa65c1362f0d47fea59a74719679ed445c5139e6b054ce3ff7
Opcode Fuzzy Hash: 897de3ac07446944308d15e80b2e02fed61e753b384f2a82f7a733087c59a827
Instruction Fuzzy Hash: F901F671400109BBDF12AF52CC85EFA7FAAEF19390F044094BD1959161DBB2D9B1EBA1

Function 00BC3200 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00BC3234
__isleadbyte_l.LIBCMT ref: 00BC3268
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,?,?,00000000,?,?,?), ref: 00BC3299
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,?,00000000,?,?,?), ref: 00BC3307

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: b0a63c13ecf7318dae00c013174c76551ab331e1be907678f2b39a375f01acb7
Instruction ID: da841fc7db6ec70e916677e06152b6c1d6b41b1b39ff2f08e82330091227e43d
Opcode Fuzzy Hash: b0a63c13ecf7318dae00c013174c76551ab331e1be907678f2b39a375f01acb7
Instruction Fuzzy Hash: 5031AA31A0428AEFDF20DFA4C880EAA3BE1EF01721B55C5ECE4659F191E731DA40DB50

Function 00BA8479 Relevance: 6.1, APIs: 4, Instructions: 52registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA8480
RegOpenKeyExW.ADVAPI32(?,?,00000000,0002001F,00000000,00000008,00BA1E0F,?), ref: 00BA84A5

Part of subcall function 00BA8507: RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,00000000,?,Deleting ), ref: 00BA8552

RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,?,?,58928532), ref: 00BA84D0
RegDeleteKeyW.ADVAPI32(?,?), ref: 00BA84E8

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: CloseDeleteEnumH_prolog3Open
String ID:
API String ID: 3097940968-0
Opcode ID: af766358e69d96e9f8e2f6c7d3a67fae0d58daf459d0cb6313aafcefd60d225a
Instruction ID: efac18de5617d91a1664bc97d4c78305e3e875716d4452e8d0e2c792d1f37fa7
Opcode Fuzzy Hash: af766358e69d96e9f8e2f6c7d3a67fae0d58daf459d0cb6313aafcefd60d225a
Instruction Fuzzy Hash: 44013930688109AADB11DF20CC49EEE3BE8FF5A744B408058F8159B241DF749A49DB55

Function 00BBD8CE Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00BBD8DA

Part of subcall function 00BBF36A: __getptd_noexit.LIBCMT ref: 00BBF36D
Part of subcall function 00BBF36A: __amsg_exit.LIBCMT ref: 00BBF37A

__getptd.LIBCMT ref: 00BBD8F1
__amsg_exit.LIBCMT ref: 00BBD8FF
__lock.LIBCMT ref: 00BBD90F

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 7c2aada6cb104e14e5b8cf270a7067495f18d7c1f4bba7d9aaf3d35d4b8ad73f
Instruction ID: a64abe94ee61de94676661fa2d0df4418651afb0904977100e1b51c4d7ee1165
Opcode Fuzzy Hash: 7c2aada6cb104e14e5b8cf270a7067495f18d7c1f4bba7d9aaf3d35d4b8ad73f
Instruction Fuzzy Hash: 0EF062319447059BD720BB649C027FDB3E0EB00B10F1045D9E48097291EFF89841CA51

Function 00BA3587 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 225COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA358E

Part of subcall function 00BA816B: __EH_prolog3.LIBCMT ref: 00BA8172

__CxxThrowException@8.LIBCMT ref: 00BA35CC

Part of subcall function 00BBA269: RaiseException.KERNEL32(?,?,00BB81FE,?,?,?,?,?,00BB81FE,?,00BD2C30,00BD8688,?,00BA7E8E,58928532,ios_base::eofbit set), ref: 00BBA2AB

Strings

invalid map/set<T> iterator, xrefs: 00BA359F

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: invalid map/set<T> iterator
API String ID: 1412866469-152884079
Opcode ID: fbd36baea7e8a05e5286121b762f0310055bdd137521dd2ef0e49711154a39f0
Instruction ID: 3e24b9f6a22703db75aa784ae3d9c383c062505de28215c41bd04fa9b824d686
Opcode Fuzzy Hash: fbd36baea7e8a05e5286121b762f0310055bdd137521dd2ef0e49711154a39f0
Instruction Fuzzy Hash: 84A137B0A0C281AFDB55DF28C0C4B65BBE2AF56714F6890CDE4464F6A2C7B1ED85CB50

Function 00BA383B Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 225COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA3842

Part of subcall function 00BA816B: __EH_prolog3.LIBCMT ref: 00BA8172

__CxxThrowException@8.LIBCMT ref: 00BA3880

Part of subcall function 00BBA269: RaiseException.KERNEL32(?,?,00BB81FE,?,?,?,?,?,00BB81FE,?,00BD2C30,00BD8688,?,00BA7E8E,58928532,ios_base::eofbit set), ref: 00BBA2AB

Strings

invalid map/set<T> iterator, xrefs: 00BA3853

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: invalid map/set<T> iterator
API String ID: 1412866469-152884079
Opcode ID: 409bfd5dd1107406629eb83a232dbc0b9898ec0be0a630ee7c1c11e9cfc27c28
Instruction ID: 257c45dd4325993f6debc30837fcce709ad4f1a848c698630bcff45bd8a074e6
Opcode Fuzzy Hash: 409bfd5dd1107406629eb83a232dbc0b9898ec0be0a630ee7c1c11e9cfc27c28
Instruction Fuzzy Hash: D0A15DB0A08291DFD715CF14C094B69BBE2AF5A714F2881DDF08A4F2A2C7B5ED85CB54

Function 00BB176E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BB1775
__CxxThrowException@8.LIBCMT ref: 00BB17AD

Part of subcall function 00BBA269: RaiseException.KERNEL32(?,?,00BB81FE,?,?,?,?,?,00BB81FE,?,00BD2C30,00BD8688,?,00BA7E8E,58928532,ios_base::eofbit set), ref: 00BBA2AB

Strings

map/set<T> too long, xrefs: 00BB1787

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrow
String ID: map/set<T> too long
API String ID: 1961742612-1285458680
Opcode ID: c84b648f592376363562751c81d6f73c2aefcf09197bd5b288dcc3b3ab6d7355
Instruction ID: b414ace1a6df128e6e934d17dd10c6fa2c302e405e7b7f66fb5f7fa4fea0f19d
Opcode Fuzzy Hash: c84b648f592376363562751c81d6f73c2aefcf09197bd5b288dcc3b3ab6d7355
Instruction Fuzzy Hash: 0E61DF70908244AFDB12BF24DC92BAD3BE6EF43710F5404E9F4416B2A2CFB59E509B61

Function 00BB1B14 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BB1B1B
__CxxThrowException@8.LIBCMT ref: 00BB1B53

Part of subcall function 00BBA269: RaiseException.KERNEL32(?,?,00BB81FE,?,?,?,?,?,00BB81FE,?,00BD2C30,00BD8688,?,00BA7E8E,58928532,ios_base::eofbit set), ref: 00BBA2AB

Strings

map/set<T> too long, xrefs: 00BB1B2D

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrow
String ID: map/set<T> too long
API String ID: 1961742612-1285458680
Opcode ID: 6fa332a4105da3acd2efe55a52f42e46a96dacfa0652c8b67c2f56b1af3af56c
Instruction ID: a0cc1b4a26dccfc46a58dc6cfa39a652c29ed6d814819d000f7bcce9257f316c
Opcode Fuzzy Hash: 6fa332a4105da3acd2efe55a52f42e46a96dacfa0652c8b67c2f56b1af3af56c
Instruction Fuzzy Hash: 8661B17050C204AFDB22BF78C8A2BAD7BE6EF56710F5404E5F4406B2A2DFB55E508B61

Function 00BA3EC2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00BA3EC9

Part of subcall function 00BA4872: __EH_prolog3.LIBCMT ref: 00BA4879

Part of subcall function 00BA48BD: __EH_prolog3.LIBCMT ref: 00BA48C4

Part of subcall function 00BA8116: char_traits.LIBCPMT ref: 00BA813B

Part of subcall function 00BA2AE1: std::_String_base::_Xlen.LIBCPMT ref: 00BA2B1E
Part of subcall function 00BA2AE1: char_traits.LIBCPMT ref: 00BA2B6D

Strings

(=, xrefs: 00BA3F37, 00BA3FA4
[=arg(=, xrefs: 00BA3EF4

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: H_prolog3char_traits$H_prolog3_String_base::_Xlenstd::_
String ID: (=$[=arg(=
API String ID: 3935908814-2804717308
Opcode ID: afced1e466169a4d7642ac69a23fc97837fa84b4637272daf3992a5146115a9e
Instruction ID: dd620adf47f9ee6a08cdd2809d07b43e5bc1b901c4b83349fca5614e328e21a1
Opcode Fuzzy Hash: afced1e466169a4d7642ac69a23fc97837fa84b4637272daf3992a5146115a9e
Instruction Fuzzy Hash: 7A318071C48244BEDB11EBA48C46EDEFBF8EB9AB00F4041EEF505B2182DBB65605C761

Function 00BA4F52 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 00BA4FF9

Strings

multiple values not allowed, xrefs: 00BA4FCB
at least one value required, xrefs: 00BA5025

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: Exception@8Throw
String ID: at least one value required$multiple values not allowed
API String ID: 2005118841-4090532116
Opcode ID: 8be602a2a11eabc988c45b478bf14538f1b6eb008997bd8bbf4b50810be9b399
Instruction ID: 0218ffac843cd29a7f4039d8ab8280dee774b295f290de3414d049e83b71beb4
Opcode Fuzzy Hash: 8be602a2a11eabc988c45b478bf14538f1b6eb008997bd8bbf4b50810be9b399
Instruction Fuzzy Hash: 5521F77164C384ABC324DF58D882FEAF7E8EB96720F1005BEF455871D0EBB095088792

Function 00BBC47A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BBA5E9: __getptd.LIBCMT ref: 00BBA5EF
Part of subcall function 00BBA5E9: __getptd.LIBCMT ref: 00BBA5FF

__getptd.LIBCMT ref: 00BBC489

Part of subcall function 00BBF36A: __getptd_noexit.LIBCMT ref: 00BBF36D
Part of subcall function 00BBF36A: __amsg_exit.LIBCMT ref: 00BBF37A

__getptd.LIBCMT ref: 00BBC497

Strings

csm, xrefs: 00BBC4A5

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 0b9afb5acb4bb7d54ecad8ad35f6e90ca45216c08752e6fb8ab4406847694c3b
Instruction ID: 853ae8b5c0a3a602652711c9fecc86e30d41cc67c8df5ad449b58b419a131023
Opcode Fuzzy Hash: 0b9afb5acb4bb7d54ecad8ad35f6e90ca45216c08752e6fb8ab4406847694c3b
Instruction Fuzzy Hash: 840112358012069BDF38EE64C4606FDBBF5FF20311F6584AEE445E62A2CBB08B81CA41

Function 00BA876C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00BA8773
__CxxThrowException@8.LIBCMT ref: 00BA879E

Part of subcall function 00BBA269: RaiseException.KERNEL32(?,?,00BB81FE,?,?,?,?,?,00BB81FE,?,00BD2C30,00BD8688,?,00BA7E8E,58928532,ios_base::eofbit set), ref: 00BBA2AB

Strings

invalid string position, xrefs: 00BA8778

Memory Dump Source

Source File: 00000000.00000002.1718358539.0000000000BA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BA0000, based on PE: true

Associated: 00000000.00000002.1718340043.0000000000BA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718385501.0000000000BCA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718403566.0000000000BD5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718419620.0000000000BDB000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ba0000_RemoteDelProf.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrow
String ID: invalid string position
API String ID: 1961742612-1799206989
Opcode ID: 7d2c62fdcd39119c9f1495f6c0788006e726c154d73cc1eb859fdb6806d09ab7
Instruction ID: 5d71fe7afc1d18f903aac46ce13332e5e0a5b4ecd90f3ded850f53867142bed8
Opcode Fuzzy Hash: 7d2c62fdcd39119c9f1495f6c0788006e726c154d73cc1eb859fdb6806d09ab7
Instruction Fuzzy Hash: 44D0127195815897CB00E7D0CC46FFDB3FCAF14700F0404E9B201BA091DEE49604CA25

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RemoteDelProf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: RemoteDelProf.exePID: 7540, Parent PID: 2580

General

Chronological Activities

Analysis Process: conhost.exePID: 7548, Parent PID: 7540

General

Chronological Activities

Disassembly

Analysis Process: RemoteDelProf.exePID: 7540, Parent PID: 2580COMMON

Execution Graph

Graph

Executed Functions

Windows Analysis Report
RemoteDelProf.exe

Function 00BA132E Relevance: 30.0, APIs: 1, Strings: 16, Instructions: 274
COMMON

Function 00BAAE79 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 171
COMMON

Function 00BA973D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 157
COMMON

Function 00BB819A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Function 00BB027B Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256
COMMON

Function 00BA429F Relevance: 3.1, APIs: 2, Instructions: 130
COMMON

Function 00BA4161 Relevance: 3.1, APIs: 2, Instructions: 96
COMMON

Function 00BBECE6 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Function 00BB07DD Relevance: 1.7, APIs: 1, Instructions: 158
COMMON

Function 00BB06B8 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Function 00BB0008 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Function 00BC0C22 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Function 00BBEF02 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON