Edit tour

Windows Analysis Report
7zba89tklZ.exe

Overview

General Information

Sample name:	7zba89tklZ.exe renamed because original name is a hash value
Original sample name:	2b5e1dfe4e4db4e886b079f054182055.exe
Analysis ID:	1579669
MD5:	2b5e1dfe4e4db4e886b079f054182055
SHA1:	d90e2828ea0082917583975f4a054f7c85d45053
SHA256:	92382cc3402b6fb7cbd68fe7fa49a00ae204682a90fe0b4e69a6ef2c6d324793
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking mutex)

Machine Learning detection for dropped file

Machine Learning detection for sample

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

7zba89tklZ.exe (PID: 5700 cmdline: "C:\Users\user\Desktop\7zba89tklZ.exe" MD5: 2B5E1DFE4E4DB4E886B079F054182055)

7zba89tklZ.exe (PID: 4836 cmdline: "C:\Users\user\Desktop\7zba89tklZ.exe" MD5: 2B5E1DFE4E4DB4E886B079F054182055)

svcapp.exe (PID: 5416 cmdline: "C:\Users\user\AppData\Local\Microsoft\svcapp.exe" MD5: 2B5E1DFE4E4DB4E886B079F054182055)

cleanup

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Desktop\7zba89tklZ.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\7zba89tklZ.exe, ProcessId: 5700, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemHandler

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Virustotal: Detection: 62%			Perma Link

Multi AV Scanner detection for submitted file

Source: 7zba89tklZ.exe	Virustotal: Detection: 62%			Perma Link
Source: 7zba89tklZ.exe	ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 7zba89tklZ.exe

Joe Sandbox ML: detected

Source: 7zba89tklZ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 7zba89tklZ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\7zba89tklZ.exe

Code function: 0_2_004F184C __ehhandler$?_ScheduleContinuationTask@_Task_impl_base@details@Concurrency@@QAEXPAU_ContinuationTaskHandleBase@23@@Z,__EH_prolog3,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_004F184C

Source: C:\Users\user\Desktop\7zba89tklZ.exe

0_2_004F184C

Source: C:\Users\user\Desktop\7zba89tklZ.exe

Code function: 0_2_004F17EC OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,

0_2_004F17EC

Source: C:\Users\user\Desktop\7zba89tklZ.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: 0_2_004F7529	0_2_004F7529
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: 0_2_004F19DF	0_2_004F19DF
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: 0_2_004FB464	0_2_004FB464
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: 0_2_004FBC1E	0_2_004FBC1E
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: 0_2_004FB836	0_2_004FB836
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: 0_2_004FAC31	0_2_004FAC31
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: 0_2_004FB0C6	0_2_004FB0C6
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: 3_2_0037B836	3_2_0037B836
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: 3_2_0037AC31	3_2_0037AC31
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: 3_2_0037BC1E	3_2_0037BC1E
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: 3_2_0037B464	3_2_0037B464
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: 3_2_0037B0C6	3_2_0037B0C6
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: 3_2_00377529	3_2_00377529
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: 3_2_003719DF	3_2_003719DF

Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: String function: 00371000 appears 40 times
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: String function: 004F1000 appears 40 times

Source: 7zba89tklZ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal76.evad.winEXE@3/2@0/0

Source: C:\Users\user\Desktop\7zba89tklZ.exe

File created: C:\Users\user\AppData\Local\Microsoft\svcapp.exe

Jump to behavior

Source: C:\Users\user\Desktop\7zba89tklZ.exe

Mutant created: \Sessions\1\BaseNamedObjects\DiamoTrix

Source: C:\Users\user\Desktop\7zba89tklZ.exe	Command line argument: DiamoTrix		0_2_004F2235
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Command line argument: DiamoTrix		3_2_00372235

Source: 7zba89tklZ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7zba89tklZ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7zba89tklZ.exe	Virustotal: Detection: 62%
Source: 7zba89tklZ.exe	ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\7zba89tklZ.exe

File read: C:\Users\user\Desktop\7zba89tklZ.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\7zba89tklZ.exe "C:\Users\user\Desktop\7zba89tklZ.exe"
Source: unknown	Process created: C:\Users\user\Desktop\7zba89tklZ.exe "C:\Users\user\Desktop\7zba89tklZ.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Microsoft\svcapp.exe "C:\Users\user\AppData\Local\Microsoft\svcapp.exe"

Source: C:\Users\user\Desktop\7zba89tklZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Section loaded: netutils.dll	Jump to behavior

Source: 7zba89tklZ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 7zba89tklZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 7zba89tklZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 7zba89tklZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 7zba89tklZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 7zba89tklZ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\7zba89tklZ.exe

Code function: 0_2_004F1000 LoadLibraryA,GetProcAddress,

0_2_004F1000

Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: 0_2_004F982B push ecx; ret	0_2_004F983E
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: 0_2_004FDB85 push ecx; ret	0_2_004FDB98
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: 3_2_0037982B push ecx; ret	3_2_0037983E
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: 3_2_0037DB85 push ecx; ret	3_2_0037DB98

Source: C:\Users\user\Desktop\7zba89tklZ.exe

File created: C:\Users\user\AppData\Local\Microsoft\svcapp.exe

Jump to dropped file

Source: C:\Users\user\Desktop\7zba89tklZ.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SystemHandler	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SystemHandler	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SystemHandler	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SystemHandler	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess			graph_3-11755
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess			graph_0-11367

Source: C:\Users\user\Desktop\7zba89tklZ.exe	Window / User API: threadDelayed 596	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Window / User API: threadDelayed 5050	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Window / User API: threadDelayed 3903	Jump to behavior

Source: C:\Users\user\Desktop\7zba89tklZ.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-10465
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_3-10457

Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe

API coverage: 9.9 %

Source: C:\Users\user\Desktop\7zba89tklZ.exe TID: 1996	Thread sleep count: 596 > 30	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe TID: 1996	Thread sleep time: -29800000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe TID: 5568	Thread sleep count: 5050 > 30	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe TID: 5568	Thread sleep time: -4646000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe TID: 5568	Thread sleep count: 3903 > 30	Jump to behavior
Source: C:\Users\user\Desktop\7zba89tklZ.exe TID: 5568	Thread sleep time: -3590760s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\7zba89tklZ.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\7zba89tklZ.exe

Thread delayed: delay time: 50000

Jump to behavior

Source: C:\Users\user\Desktop\7zba89tklZ.exe	API call chain: ExitProcess graph end node	graph_0-10466
Source: C:\Users\user\Desktop\7zba89tklZ.exe	API call chain: ExitProcess graph end node	graph_0-10558
Source: C:\Users\user\Desktop\7zba89tklZ.exe	API call chain: ExitProcess graph end node	graph_0-11246
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	API call chain: ExitProcess graph end node	graph_3-10458
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	API call chain: ExitProcess graph end node	graph_3-10551

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\7zba89tklZ.exe

Debugger detection routine: IsDebuggerPresent or CheckRemoteDebuggerPresent, DecisionNodes, ExitProcess or Sleep

graph_0-11242

Source: C:\Users\user\Desktop\7zba89tklZ.exe

Code function: 0_2_004F2235 CreateMutexA,GetLastError,CloseHandle,ExitProcess,IsDebuggerPresent,CreateThread,Sleep,

0_2_004F2235

Source: C:\Users\user\Desktop\7zba89tklZ.exe

Code function: 0_2_004F1000 LoadLibraryA,GetProcAddress,

0_2_004F1000

Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: 0_2_004FCA46 SetUnhandledExceptionFilter,	0_2_004FCA46
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: 0_2_004F8A8F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004F8A8F
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: 0_2_005002B8 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_005002B8
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: 3_2_0037CA46 SetUnhandledExceptionFilter,	3_2_0037CA46
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: 3_2_003802B8 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_003802B8
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: 3_2_00378A8F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00378A8F

Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	0_2_00501453
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,__alloca_probe_16,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	0_2_00502CBB
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_00502D95
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0050125C
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	0_2_00502A77
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	0_2_00501624
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_005016E4
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	0_2_00501351
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_0050174B
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	0_2_00501BCC
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	0_2_005013F8
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	0_2_00501787
Source: C:\Users\user\Desktop\7zba89tklZ.exe	Code function: GetLocaleInfoA,	0_2_00502BAC
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	3_2_00381453
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,__alloca_probe_16,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	3_2_00382CBB
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_00382D95
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	3_2_00381624
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	3_2_00382A77
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_0038125C
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_003816E4
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	3_2_00381351
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	3_2_0038174B
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: GetLocaleInfoA,	3_2_00382BAC
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	3_2_00381787
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	3_2_003813F8
Source: C:\Users\user\AppData\Local\Microsoft\svcapp.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	3_2_00381BCC

Source: C:\Users\user\Desktop\7zba89tklZ.exe

Code function: 0_2_004FDD2F GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004FDD2F

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	111 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	3 Clipboard Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Process Injection	Security Account Manager	111 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
7zba89tklZ.exe	62%	Virustotal		Browse
7zba89tklZ.exe	61%	ReversingLabs	Win32.Trojan.Doina
7zba89tklZ.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\svcapp.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\svcapp.exe	61%	ReversingLabs	Win32.Trojan.Doina
C:\Users\user\AppData\Local\Microsoft\svcapp.exe	62%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579669
Start date and time:	2024-12-23 07:19:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	7zba89tklZ.exe renamed because original name is a hash value
Original Sample Name:	2b5e1dfe4e4db4e886b079f054182055.exe
Detection:	MAL
Classification:	mal76.evad.winEXE@3/2@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 17 Number of non-executed functions: 77
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com

Simulations

Behavior and APIs

Time	Type	Description
01:20:29	API Interceptor	13922588x Sleep call for process: 7zba89tklZ.exe modified
07:20:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SystemHandler C:\Users\user\Desktop\7zba89tklZ.exe
07:20:36	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SystemHandler C:\Users\user\AppData\Local\Microsoft\svcapp.exe

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\svcapp.exe

Download File

Process:	C:\Users\user\Desktop\7zba89tklZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112640
Entropy (8bit):	6.3674970206945
Encrypted:	false
SSDEEP:	1536:XkhBm8BvFsJMAjrUTXqKgcs5Btdyhy3NZRgYDnRQKlw2LWeSMD+/G:0rjBvKrUbqKgRTHvRgYVQKlw2SeSJO
MD5:	2B5E1DFE4E4DB4E886B079F054182055
SHA1:	D90E2828EA0082917583975F4A054F7C85D45053
SHA-256:	92382CC3402B6FB7CBD68FE7FA49A00AE204682A90FE0B4E69A6EF2C6D324793
SHA-512:	954F56680E32E5AFB7F70596C10AC74416CC2DDA93F1835BFE330660792B8CE9591C56B43A40A3A36B6434AEB59FD0D5C6E189547161DB3F9A7F81605F83C087
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61% Antivirus: Virustotal, Detection: 62%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0F..t'..t'..t'..}_[.w'..t'..='...QV.e'...Qc.W'...Qb.='...Qg.w'...QU.u'..Richt'..........PE..L....jdg.....................................@....@.......................................@.....................................(....................................................................w..@............@...............................text...\-.......................... ..`.rdata...U...@...V...2..............@..@.data.... ..........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\svcapp.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\7zba89tklZ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.3674970206945
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7zba89tklZ.exe
File size:	112'640 bytes
MD5:	2b5e1dfe4e4db4e886b079f054182055
SHA1:	d90e2828ea0082917583975f4a054f7c85d45053
SHA256:	92382cc3402b6fb7cbd68fe7fa49a00ae204682a90fe0b4e69a6ef2c6d324793
SHA512:	954f56680e32e5afb7f70596c10ac74416cc2dda93f1835bfe330660792b8ce9591c56b43a40a3a36b6434aeb59fd0d5c6e189547161db3f9a7f81605f83c087
SSDEEP:	1536:XkhBm8BvFsJMAjrUTXqKgcs5Btdyhy3NZRgYDnRQKlw2LWeSMD+/G:0rjBvKrUbqKgRTHvRgYVQKlw2SeSJO
TLSH:	8CB39E21B2C5C4F3D11211308DA69BE28EBFFCB15EB125AF6BD9066D0F696C1CA58353
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0F..t'..t'..t'..}_[.w'..t'..='...QV.e'...Qc.W'...Qb.='...Qg.w'...QU.u'..Richt'..........PE..L....jdg...........................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x408a85
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x67646AD3 [Thu Dec 19 18:49:55 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	ebb56531f9710b9a467b3b47d8223424

Entrypoint Preview

Instruction
call 00007FE1F8E177AAh
jmp 00007FE1F8E1238Eh
cmp ecx, dword ptr [0041A2F0h]
jne 00007FE1F8E12504h
rep ret
jmp 00007FE1F8E17831h
mov edi, edi
push ebp
mov ebp, esp
mov eax, ecx
mov ecx, dword ptr [ebp+08h]
mov dword ptr [eax], 00414210h
mov ecx, dword ptr [ecx]
mov dword ptr [eax+04h], ecx
mov byte ptr [eax+08h], 00000000h
pop ebp
retn 0008h
mov eax, dword ptr [ecx+04h]
test eax, eax
jne 00007FE1F8E12507h
mov eax, 00414218h
ret
mov edi, edi
push ebp
mov ebp, esp
cmp dword ptr [ebp+08h], 00000000h
push edi
mov edi, ecx
je 00007FE1F8E1252Fh
push esi
push dword ptr [ebp+08h]
call 00007FE1F8E17956h
lea esi, dword ptr [eax+01h]
push esi
call 00007FE1F8E1420Eh
pop ecx
pop ecx
mov dword ptr [edi+04h], eax
test eax, eax
je 00007FE1F8E12513h
push dword ptr [ebp+08h]
push esi
push eax
call 00007FE1F8E178DAh
add esp, 0Ch
mov byte ptr [edi+08h], 00000001h
pop esi
pop edi
pop ebp
retn 0004h
mov edi, edi
push esi
mov esi, ecx
cmp byte ptr [esi+08h], 00000000h
je 00007FE1F8E1250Bh
push dword ptr [esi+04h]
call 00007FE1F8E1296Bh
pop ecx
and dword ptr [esi+04h], 00000000h
mov byte ptr [esi+08h], 00000000h
pop esi
ret
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov esi, ecx
and dword ptr [esi+04h], 00000000h
mov dword ptr [esi], 00414210h
mov byte ptr [esi+08h], 00000000h
push dword ptr [eax]
call 00007FE1F8E12487h
mov eax, esi
pop esi
pop ebp
retn 0004h

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729
[ASM] VS2010 build 30319
[C++] VS2010 build 30319
[ C ] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18fa4	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1d000	0x2b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1e000	0x1210	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x17710	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x14000	0x110	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x12d5c	0x12e00	0c92ac62242b124a32252ddc926ef20c	False	0.5768832781456954	data	6.610430575360831	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x14000	0x55c4	0x5600	bb84a75048842581960fa9790cb583fd	False	0.35846656976744184	data	4.822094045067747	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1a000	0x20c0	0x1000	7bfb1ee1a98f05a772f0fc0aea792a8f	False	0.258056640625	data	3.4184107185858905	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1d000	0x2b8	0x400	7cc9e164c83cbadc629bacfeff29fda1	False	0.3203125	data	5.171342193183488	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1e000	0x1ba4	0x1c00	3e08707dc6e8c85e5f4b7ee4e18ad05c	False	0.5330636160714286	data	5.052251546929224	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x1d058	0x25f	ASCII text, with very long lines (607), with no line terminators	English	United States	0.43492586490939045

Imports

DLL

Import

KERNEL32.dll

GetProcAddress, LoadLibraryA, ExitProcess, GlobalLock, GlobalAlloc, Sleep, GlobalUnlock, GetLastError, IsDebuggerPresent, CreateThread, InterlockedIncrement, InterlockedDecrement, EncodePointer, DecodePointer, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetCommandLineW, HeapSetInformation, GetStartupInfoW, HeapFree, HeapReAlloc, RaiseException, RtlUnwind, HeapAlloc, CompareStringW, MultiByteToWideChar, GetCPInfo, WideCharToMultiByte, LCMapStringW, SetUnhandledExceptionFilter, GetModuleHandleW, WriteFile, GetStdHandle, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, HeapCreate, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, IsProcessorFeaturePresent, HeapSize, GetACP, GetOEMCP, IsValidCodePage, GetUserDefaultLCID, GetLocaleInfoW, GetLocaleInfoA, EnumSystemLocalesA, IsValidLocale, GetStringTypeW, LoadLibraryW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	01:20:28
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\7zba89tklZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7zba89tklZ.exe"
Imagebase:	0x4f0000
File size:	112'640 bytes
MD5 hash:	2B5E1DFE4E4DB4E886B079F054182055
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	01:20:36
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\7zba89tklZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7zba89tklZ.exe"
Imagebase:	0x4f0000
File size:	112'640 bytes
MD5 hash:	2B5E1DFE4E4DB4E886B079F054182055
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:20:44
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Microsoft\svcapp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Microsoft\svcapp.exe"
Imagebase:	0x370000
File size:	112'640 bytes
MD5 hash:	2B5E1DFE4E4DB4E886B079F054182055
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 61%, ReversingLabs Detection: 62%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.7%
Total number of Nodes:	1683
Total number of Limit Nodes:	25

Executed Functions

Function 004F19DF Relevance: 27.6, APIs: 1, Strings: 17, Instructions: 550
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004F17CA: LoadLibraryA.KERNEL32(User32.dll,?,004F1A20,SetClipboardData,402896FC), ref: 004F17D2
Part of subcall function 004F17CA: GetProcAddress.KERNEL32(00000000,?), ref: 004F17E0

Part of subcall function 004F17EC: OpenClipboard.USER32(00000000), ref: 004F17FA
Part of subcall function 004F17EC: GetClipboardData.USER32(00000001), ref: 004F1807
Part of subcall function 004F17EC: GlobalLock.KERNEL32(00000000), ref: 004F1814
Part of subcall function 004F17EC: GlobalUnlock.KERNEL32(00000000), ref: 004F1821
Part of subcall function 004F17EC: CloseClipboard.USER32 ref: 004F1827

Part of subcall function 004F23A4: __EH_prolog3.LIBCMT ref: 004F23AB

Part of subcall function 004F18BF: __EH_prolog3.LIBCMT ref: 004F18C6

Part of subcall function 004F197A: __EH_prolog3.LIBCMT ref: 004F1981

Part of subcall function 004F184C: __EH_prolog3.LIBCMT ref: 004F1853
Part of subcall function 004F184C: GlobalAlloc.KERNEL32(00000002,?,00000000,004F1B3D,?), ref: 004F1863
Part of subcall function 004F184C: GlobalLock.KERNEL32(00000000), ref: 004F187A
Part of subcall function 004F184C: _memmove.LIBCMT ref: 004F1881
Part of subcall function 004F184C: GlobalUnlock.KERNEL32(00000000), ref: 004F188A
Part of subcall function 004F184C: OpenClipboard.USER32(00000000), ref: 004F1892
Part of subcall function 004F184C: EmptyClipboard.USER32 ref: 004F1898
Part of subcall function 004F184C: SetClipboardData.USER32(00000001,00000000), ref: 004F18A1
Part of subcall function 004F184C: CloseClipboard.USER32 ref: 004F18A7

Part of subcall function 004F2520: _memmove.LIBCMT ref: 004F2539

Sleep.KERNELBASE(00000398), ref: 004F2215

Strings

$, xrefs: 004F21E3
1B4GDAxGV7Vqa9Lav4EfypTxgrAhCFMQrs, xrefs: 004F1AE4
addr18kvGyaCauRTSejv3qoSvmsXBGn77NhdfFjj3s9l2ccgr2fqzs9p7cl8rr2ckq4c7emm9uaa0s7ynk32ysaxmr5xaazqj4gex0, xrefs: 004F1F1C
TMjbm61ctPtZqDVxeZHgXRw4Tq8gzZo9Jq, xrefs: 004F1C94
0xe082eae973143a32d82db061b6c8885ceba72b87, xrefs: 004F1BBC
XuLskqV3efHE8eaJDu8oeeLoUn6hHpUAyH, xrefs: 004F21A4
#, xrefs: 004F21B1
GetClipboardData, xrefs: 004F1A47
rNcd1L9tTLohuJh45vUtcisKcgGJTCtnTv, xrefs: 004F1FF4
OpenClipboard, xrefs: 004F1A36
CloseClipboard, xrefs: 004F1A58
DU8bbCYGxj3be3XDMiipMJdFFGHgwDzLB5, xrefs: 004F20CC
SetClipboardData, xrefs: 004F1A16
", xrefs: 004F2196
EmptyClipboard, xrefs: 004F1A25
LRjCGBFrHsFFehN2kCNc6ds8icUCgLZ6KP, xrefs: 004F1D6C
bitcoincash:qr7r9w340hvnxqjm2cjpj3kd0s7kfz02ks5su6hrze, xrefs: 004F1E44

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: Clipboard$Global$H_prolog3$CloseDataLockOpenUnlock_memmove$AddressAllocEmptyLibraryLoadProcSleep
String ID: "$#$$$0xe082eae973143a32d82db061b6c8885ceba72b87$1B4GDAxGV7Vqa9Lav4EfypTxgrAhCFMQrs$CloseClipboard$DU8bbCYGxj3be3XDMiipMJdFFGHgwDzLB5$EmptyClipboard$GetClipboardData$LRjCGBFrHsFFehN2kCNc6ds8icUCgLZ6KP$OpenClipboard$SetClipboardData$TMjbm61ctPtZqDVxeZHgXRw4Tq8gzZo9Jq$XuLskqV3efHE8eaJDu8oeeLoUn6hHpUAyH$addr18kvGyaCauRTSejv3qoSvmsXBGn77NhdfFjj3s9l2ccgr2fqzs9p7cl8rr2ckq4c7emm9uaa0s7ynk32ysaxmr5xaazqj4gex0$bitcoincash:qr7r9w340hvnxqjm2cjpj3kd0s7kfz02ks5su6hrze$rNcd1L9tTLohuJh45vUtcisKcgGJTCtnTv
API String ID: 1247621152-3269600870
Opcode ID: 1c5e210374b824fc73e49898a562c7a74b85d1e38bc0068773f5f2d3adc2b476
Instruction ID: c75b175faf10bd6c568dd84017b4160ca604bd98d59e4da9ad3986ef8eb9c789
Opcode Fuzzy Hash: 1c5e210374b824fc73e49898a562c7a74b85d1e38bc0068773f5f2d3adc2b476
Instruction Fuzzy Hash: 78227375918384ABD320BB3E8907B9F7FD4AF56314F450A4EF9C843242DB7995088BA7

Function 004F7529 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 205
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 004F7533
GetModuleFileNameW.KERNEL32(00000000,?,00000104,000004F8,004F227C), ref: 004F7546

Part of subcall function 004F744F: __EH_prolog3_GS.LIBCMT ref: 004F7456
Part of subcall function 004F744F: RegOpenKeyExA.KERNELBASE(80000001,?,00000000,00000002,?,00000001,00000001,FyYnOTg1ICwkGCQIDh0bAQYeMDU9OgYaFgYPNzU9LhoGAAwWMD8EHxwdHQckGDsUAw==,Diamotrix,00000060,004F756E,?), ref: 004F74C5

Part of subcall function 004F7918: _memmove.LIBCMT ref: 004F7934

SHGetFolderPathW.SHELL32(00000000,0000001C,00000000,00000000,?,00000001), ref: 004F7592

Part of subcall function 004F73C3: __EH_prolog3_GS.LIBCMT ref: 004F73CA

Part of subcall function 004F2520: _memmove.LIBCMT ref: 004F2539

CopyFileW.KERNELBASE(?,?,00000000,00000001), ref: 004F76B2
Sleep.KERNELBASE(000001F4), ref: 004F76C1
MoveFileW.KERNEL32(?,?), ref: 004F77EF

Strings

GCQIDh0bAQYeMDUSGwwVAhlWIREE, xrefs: 004F75B0
Diamotrix, xrefs: 004F75A0, 004F7701
GBoXDg4EAkcdPAw=, xrefs: 004F7711

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: FileH_prolog3_$_memmove$CopyFolderModuleMoveNameOpenPathSleep
String ID: Diamotrix$GBoXDg4EAkcdPAw=$GCQIDh0bAQYeMDUSGwwVAhlWIREE
API String ID: 3945932230-3474619492
Opcode ID: 380581bcfd1c49fff2a534a2b9bc249304f93be8cbb499b08f1b3429cbcec060
Instruction ID: 552a3a9ac062d41c59a139b95348efec5e0895f2b18c64ce4736b3d1f871165e
Opcode Fuzzy Hash: 380581bcfd1c49fff2a534a2b9bc249304f93be8cbb499b08f1b3429cbcec060
Instruction Fuzzy Hash: F28141B290412C9EDB60DB65CD85FEEB7B8AB14314F4000DAA709B3141DB786F89CF69

Function 004F2235 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 32
sleepsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNELBASE(00000000,00000001,DiamoTrix), ref: 004F2246
GetLastError.KERNEL32 ref: 004F2252
CloseHandle.KERNEL32(00000000), ref: 004F2260
ExitProcess.KERNEL32 ref: 004F2267
IsDebuggerPresent.KERNEL32 ref: 004F226D
CreateThread.KERNELBASE(00000000,00000000,Function_000019DF,00507314,00000000,00000000), ref: 004F228A
Sleep.KERNELBASE(0000C350), ref: 004F2295

Strings

DiamoTrix, xrefs: 004F223C

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: Create$CloseDebuggerErrorExitHandleLastMutexPresentProcessSleepThread
String ID: DiamoTrix
API String ID: 2699360975-3521203031
Opcode ID: 554d1864169b1af3b86912d41b8b1d3602ff93f9deebe997ddec8e0ea3b2efe5
Instruction ID: f41f815d1cba37649138cc3aa841793f8687d986cf602a6504a1728712aa553d
Opcode Fuzzy Hash: 554d1864169b1af3b86912d41b8b1d3602ff93f9deebe997ddec8e0ea3b2efe5
Instruction Fuzzy Hash: 3EF0A731505228B7D22127619D4DEBF3E18EF1AB51B114001F305A41A0CF9C5646FAEA

Function 004F1000 Relevance: 3.0, APIs: 2, Instructions: 14
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 004F1006
GetProcAddress.KERNEL32(00000000,?), ref: 004F1014

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 147d7d23de5b48658afefcf4c500257473637c2aa556bcff573b0bb91ffc8c49
Instruction ID: 7aba46e64d3c47912547b0726fd7c69f2cd55a7b19fc19f3137a4cbbd707c8f8
Opcode Fuzzy Hash: 147d7d23de5b48658afefcf4c500257473637c2aa556bcff573b0bb91ffc8c49
Instruction Fuzzy Hash: 70C0127520020CFBCF102FA1FC0CA6A3F6CEB14260B044021FB0CE8421EB3AC820AA54

Function 004F744F Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 004F7456

Part of subcall function 004F73C3: __EH_prolog3_GS.LIBCMT ref: 004F73CA

Part of subcall function 004F2520: _memmove.LIBCMT ref: 004F2539

RegOpenKeyExA.KERNELBASE(80000001,?,00000000,00000002,?,00000001,00000001,FyYnOTg1ICwkGCQIDh0bAQYeMDU9OgYaFgYPNzU9LhoGAAwWMD8EHxwdHQckGDsUAw==,Diamotrix,00000060,004F756E,?), ref: 004F74C5
RegSetValueExW.KERNELBASE(?,SystemHandler,00000000,00000001,?,?), ref: 004F7502
RegCloseKey.KERNELBASE(?), ref: 004F750F

Strings

FyYnOTg1ICwkGCQIDh0bAQYeMDU9OgYaFgYPNzU9LhoGAAwWMD8EHxwdHQckGDsUAw==, xrefs: 004F7472
SystemHandler, xrefs: 004F74FA
Diamotrix, xrefs: 004F745E

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: H_prolog3_$CloseOpenValue_memmove
String ID: Diamotrix$FyYnOTg1ICwkGCQIDh0bAQYeMDU9OgYaFgYPNzU9LhoGAAwWMD8EHxwdHQckGDsUAw==$SystemHandler
API String ID: 1044828830-2798639340
Opcode ID: 5c161c8563c58b2b0cb39250f2f5ddf664a607ebbee98b8b22c6b03dcb0c12f2
Instruction ID: 3e0efd1626ad9d057bae547a50c5de0250fc93a889915d4fd7fb950d7a99b08d
Opcode Fuzzy Hash: 5c161c8563c58b2b0cb39250f2f5ddf664a607ebbee98b8b22c6b03dcb0c12f2
Instruction Fuzzy Hash: 9A214C71A4420CAEEB00DBA5CD46FEE7BB4EB04304F10405AF7056B281DAA9AD49DB65

Function 004F91DE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 004F91EC

Part of subcall function 004FA7F1: __FF_MSGBANNER.LIBCMT ref: 004FA80A
Part of subcall function 004FA7F1: __NMSG_WRITE.LIBCMT ref: 004FA811
Part of subcall function 004FA7F1: RtlAllocateHeap.NTDLL(00000000,00000001,?,00000001,?,?,004F8AE8,00000001,00000000,?,00000003,?,004F8B46,S(O,?), ref: 004FA836

_free.LIBCMT ref: 004F91FF

Strings

H=P, xrefs: 004F91F5, 004F91E9, 004F9211, 004F9231, 004F9241

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID: H=P
API String ID: 1020059152-2152406048
Opcode ID: 891600771f8cd8def6ae5f1a7704627dbe4d654d490aa51312bb29c9ae21f766
Instruction ID: 178bff2c1f8ee889acdfd2238e4280d0403c5af6bae49dec68974f57d2c4e365
Opcode Fuzzy Hash: 891600771f8cd8def6ae5f1a7704627dbe4d654d490aa51312bb29c9ae21f766
Instruction Fuzzy Hash: 4F112E7280010DBACF213B759C04B3E37589F803A4B214D6BFB089A151DF3CCC56965D

Function 004F92DC Relevance: 6.0, APIs: 4, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 004F92F6

Part of subcall function 004FA7F1: __FF_MSGBANNER.LIBCMT ref: 004FA80A
Part of subcall function 004FA7F1: __NMSG_WRITE.LIBCMT ref: 004FA811
Part of subcall function 004FA7F1: RtlAllocateHeap.NTDLL(00000000,00000001,?,00000001,?,?,004F8AE8,00000001,00000000,?,00000003,?,004F8B46,S(O,?), ref: 004FA836

std::exception::exception.LIBCMT ref: 004F932B
std::exception::exception.LIBCMT ref: 004F9345
__CxxThrowException@8.LIBCMT ref: 004F9356

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: 37a9533a45f24ec5b5433943664cc37aeff8c51f3fd54b1a80f61809a41c5c83
Instruction ID: aaa802467e00722f1f8d0c47c809aad8e35f1e841fbdf56a491206bdcd9a00b9
Opcode Fuzzy Hash: 37a9533a45f24ec5b5433943664cc37aeff8c51f3fd54b1a80f61809a41c5c83
Instruction Fuzzy Hash: F2F0F47190020EB6EB10EB96CC96A7F3BA9BB00718F14041FFF149A1D1DF799E458759

Function 004F2B41 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 004F2B48

Part of subcall function 004F7F85: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 004F7F93
Part of subcall function 004F7F85: __CxxThrowException@8.LIBCMT ref: 004F7FA1
Part of subcall function 004F7F85: std::exception::exception.LIBCMT ref: 004F7FB4

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8H_prolog3_catchThrowstd::exception::exception
String ID:
API String ID: 1558761032-0
Opcode ID: 2f74549861232e83aea7c95a1caa336d65a21dcf6d65ffd0eba5852b6b759564
Instruction ID: e8a7a9f6770e58ee14113b6ea32eb5d038edf340a4b6b2bf55a98eef50b1658e
Opcode Fuzzy Hash: 2f74549861232e83aea7c95a1caa336d65a21dcf6d65ffd0eba5852b6b759564
Instruction Fuzzy Hash: 7BF09071100308ABC714FF26C982E2A77E5AF84344B40484EF7469B352CE38E941C758

Function 004F234F Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 004F2356

Part of subcall function 004F242A: std::locale::_Init.LIBCPMT ref: 004F2431
Part of subcall function 004F242A: std::locale::facet::_Incref.LIBCPMT ref: 004F2440

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: H_prolog3IncrefInitstd::locale::_std::locale::facet::_
String ID:
API String ID: 2441394073-0
Opcode ID: 6bb86fdc5e68b37f88ee75b101e7f8ac7227b65a9601e302b651767fb542864f
Instruction ID: 61e7610b9e6ccfe7db1e5598605188d16a0f143642a0b8966d453df0f9f4b1e1
Opcode Fuzzy Hash: 6bb86fdc5e68b37f88ee75b101e7f8ac7227b65a9601e302b651767fb542864f
Instruction Fuzzy Hash: A2F0207230420A9BEB02AF29C9567B97691AF50308F14813ABF049F245DBBCCE098299

Function 004F5076 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004F91DE: _malloc.LIBCMT ref: 004F91EC

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004F5096

Part of subcall function 004F7F52: std::exception::exception.LIBCMT ref: 004F7F6A
Part of subcall function 004F7F52: __CxxThrowException@8.LIBCMT ref: 004F7F7F

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Exception@8Internal_throw_exceptionThrow_mallocstd::exception::exception
String ID:
API String ID: 4204326809-0
Opcode ID: 883a0bd67c2d40cd78a423c91a8c0d624f6316e23ecca44dc0849041ac370a47
Instruction ID: b3b500541178690acc5d4f222dd28ac3291887b8bb0346b99af362f3adf8b24f
Opcode Fuzzy Hash: 883a0bd67c2d40cd78a423c91a8c0d624f6316e23ecca44dc0849041ac370a47
Instruction Fuzzy Hash: 20F0307510874A8FD3309F5AD580827F7E9EF55714310882EEAD987712DA70B841CB54

Non-executed Functions

Function 00501BCC Relevance: 21.2, APIs: 14, Instructions: 155COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetLocaleInfoA.LIBCMT ref: 00501C16

Part of subcall function 00502D95: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00502DA3
Part of subcall function 00502D95: __crtGetLocaleInfoA_stat.LIBCMT ref: 00502DB8

GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00501C24
___crtGetLocaleInfoA.LIBCMT ref: 00501C3D
___crtGetLocaleInfoA.LIBCMT ref: 00501C78
__calloc_crt.LIBCMT ref: 00501C52

Part of subcall function 004FC937: Sleep.KERNEL32(00000000), ref: 004FC95F

__calloc_crt.LIBCMT ref: 00501C89
_free.LIBCMT ref: 00501CA1
_free.LIBCMT ref: 00501CD5
__invoke_watson.LIBCMT ref: 00501CE4
GetLocaleInfoW.KERNEL32(?,00001004,00000000,00000000,?,?,00000000), ref: 00501D01
__calloc_crt.LIBCMT ref: 00501D0C
GetLocaleInfoW.KERNEL32(?,00001004,00000000,00000000,?,?,00000000), ref: 00501D21
_free.LIBCMT ref: 00501D29
GetLocaleInfoW.KERNEL32(?,00001004,00000000,00000002,?,?,00000000), ref: 00501D5D

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: Locale$Info$___crt__calloc_crt_free$A_statErrorLastSleepUpdateUpdate::___crt__invoke_watson
String ID:
API String ID: 2728192355-0
Opcode ID: 9d3a820547be2341c63943f81d04c880c16982a54ddd5c7a963f4b87db7fc97d
Instruction ID: 4c6891022a8e14d3d4f922097a02391e509e21f728b4e6672a6a450b0c425da0
Opcode Fuzzy Hash: 9d3a820547be2341c63943f81d04c880c16982a54ddd5c7a963f4b87db7fc97d
Instruction Fuzzy Hash: 9941DE7290061AAFEF219F22CC45BAE3FA9FF14364F504469F904A6191EB36CC50DF69

Function 004F184C Relevance: 13.5, APIs: 9, Instructions: 36clipboardmemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004F1853
GlobalAlloc.KERNEL32(00000002,?,00000000,004F1B3D,?), ref: 004F1863
GlobalLock.KERNEL32(00000000), ref: 004F187A
_memmove.LIBCMT ref: 004F1881
GlobalUnlock.KERNEL32(00000000), ref: 004F188A
OpenClipboard.USER32(00000000), ref: 004F1892
EmptyClipboard.USER32 ref: 004F1898
SetClipboardData.USER32(00000001,00000000), ref: 004F18A1
CloseClipboard.USER32 ref: 004F18A7

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: Clipboard$Global$AllocCloseDataEmptyH_prolog3LockOpenUnlock_memmove
String ID:
API String ID: 2493768046-0
Opcode ID: 69ec527a6eee4af1c08ea559ce96c274ce9df4c6ea6e8637b55224d567f9db88
Instruction ID: 458b6952b7616f6cd90bf5c148581c3fb17af33d20630d8cc5a2f37eb7f74d35
Opcode Fuzzy Hash: 69ec527a6eee4af1c08ea559ce96c274ce9df4c6ea6e8637b55224d567f9db88
Instruction Fuzzy Hash: 71F04FB2400108EBEB10BFA1DC4DBEF3E78EF55741F044018F70A9A0A1CBB55949EBA1

Function 004F17EC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 004F17FA
GetClipboardData.USER32(00000001), ref: 004F1807
GlobalLock.KERNEL32(00000000), ref: 004F1814
GlobalUnlock.KERNEL32(00000000), ref: 004F1821
CloseClipboard.USER32 ref: 004F1827

Strings

SetClipboardData, xrefs: 004F17EF

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock
String ID: SetClipboardData
API String ID: 1006321803-803054430
Opcode ID: 25d952ab0baaa7abef0b5fc48bc57f66575620c6b57afe22d5499ecd05a02180
Instruction ID: e8e4c0441ba958bcc6648e13904a35684b669902b8360823f9891238046b2b79
Opcode Fuzzy Hash: 25d952ab0baaa7abef0b5fc48bc57f66575620c6b57afe22d5499ecd05a02180
Instruction Fuzzy Hash: A8F05B71700208ABE7113BB69DC9D7F766CEB65BD5B14003AB701D1361DBB8CC055664

Function 0050125C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00501899,00000002,?,?,00501899), ref: 0050129B
GetLocaleInfoW.KERNEL32(?,20001004,00501899,00000002,?,?,00501899), ref: 005012C4
GetACP.KERNEL32(?,?), ref: 005012D8

Strings

ACP, xrefs: 0050126B
OCP, xrefs: 0050127C

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: a462691a907fae3f1d2a48739443a8b804e044c1204534f4c3b98dbc02ea40fe
Instruction ID: 333128d6e73f208c88257f3771cc865158a79cb71d3ada1208b8eebbb57b67f3
Opcode Fuzzy Hash: a462691a907fae3f1d2a48739443a8b804e044c1204534f4c3b98dbc02ea40fe
Instruction Fuzzy Hash: 0601D434600A0BBBEB218B63ED0AB5E3EA8BF00359F200419FB01E10C1EB60CA41965A

Function 004F8A8F Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004FDE85
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004FDE9A
UnhandledExceptionFilter.KERNEL32(0050568C), ref: 004FDEA5
GetCurrentProcess.KERNEL32(C0000409), ref: 004FDEC1
TerminateProcess.KERNEL32(00000000), ref: 004FDEC8

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8ac856fb09ed220b548b9ebddbb79ebbdf0da1dd561a1b67d41ab084ac35f0da
Instruction ID: d13f1a00dbd4292e11271dac325429e9d18d1740abdc8936bc456e691333622c
Opcode Fuzzy Hash: 8ac856fb09ed220b548b9ebddbb79ebbdf0da1dd561a1b67d41ab084ac35f0da
Instruction Fuzzy Hash: C321E5B480230ADFE700DF55F9CA65C3BB4FB28310F00491AE71897361E7B15888AF45

Function 004FCA46 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(004FCA04), ref: 004FCA4B

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e2317df8d1208993c660b68f78dfd88c8657948d1fb3d3873181eb7624103978
Instruction ID: 8e0267c90b3135f43a3173d7ff6e12225979466d77a184111ccf68186767dc73
Opcode Fuzzy Hash: e2317df8d1208993c660b68f78dfd88c8657948d1fb3d3873181eb7624103978
Instruction Fuzzy Hash: C59002A0A9514D8AD6005BB06F5D61A66906B5C64275144516311D8054DB6450046926

Function 004FBC1E Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction ID: a29845cb8e418bfa069a223df42f4f215de5462b419b53102929b4ac38a04e8a
Opcode Fuzzy Hash: f02dcea883d10451d84a59732baab65edb0b568fbd8ca007beb23fa60eef1400
Instruction Fuzzy Hash: 4BC19073D0A5B6098736452D841823FEE62EE82B4031FC396DED03F38AC72BAD4196D4

Function 004FB836 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction ID: 83e4d279a28273d64441eeb617d616628069a6a0210f6101ff5405e81a4bbcdd
Opcode Fuzzy Hash: 0c69e47d847606dd43a020a10b245ffd8c98205713db3c8f796c6159738d0b06
Instruction Fuzzy Hash: 45C19173D0E5B6098736462D841823FEE62AE82B4031FC396DED03F38AC72B6D4196D4

Function 004FB464 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction ID: eee57ed2afef8eaa9f5925b7ae31a1a46eb730875f0224759a6801b608f99a5e
Opcode Fuzzy Hash: 21018234ac6c65dce347e9eb3c09d9e563dc327998c84d170fb29f747537f1fa
Instruction Fuzzy Hash: 90C18473D0A5B6498B36452D851823FEEA2AE83B4131FC392DDD03F38AC72B6D4596D4

Function 004FB0C6 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction ID: 62fc18d00c322207b2220bb7069a521eeee0eab4fb487979f9c775918c828736
Opcode Fuzzy Hash: 21b74c51e355f1ada917146b454bba93dbff062365e48e41ecc74cc68dac6f4d
Instruction Fuzzy Hash: 4DB19173D0A5B6098736452D855823FEE62AE83B8031FC396CDD03F38AC72BAD4596D4

Function 004FD99F Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004F89A2), ref: 004FD9A7
__mtterm.LIBCMT ref: 004FD9B3

Part of subcall function 004FD6EC: DecodePointer.KERNEL32(00000001,004FDB15,?,004F89A2), ref: 004FD6FD
Part of subcall function 004FD6EC: TlsFree.KERNEL32(00000001,004FDB15,?,004F89A2), ref: 004FD717
Part of subcall function 004FD6EC: DeleteCriticalSection.KERNEL32(00000000,00000000,76EE5810,?,004FDB15,?,004F89A2), ref: 005007E3
Part of subcall function 004FD6EC: _free.LIBCMT ref: 005007E6
Part of subcall function 004FD6EC: DeleteCriticalSection.KERNEL32(00000001,76EE5810,?,004FDB15,?,004F89A2), ref: 0050080D

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004FD9C9
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004FD9D6
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 004FD9E3
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004FD9F0
TlsAlloc.KERNEL32(?,004F89A2), ref: 004FDA40
TlsSetValue.KERNEL32(00000000,?,004F89A2), ref: 004FDA5B
__init_pointers.LIBCMT ref: 004FDA65
EncodePointer.KERNEL32(?,004F89A2), ref: 004FDA76
EncodePointer.KERNEL32(?,004F89A2), ref: 004FDA83
EncodePointer.KERNEL32(?,004F89A2), ref: 004FDA90
EncodePointer.KERNEL32(?,004F89A2), ref: 004FDA9D
DecodePointer.KERNEL32(004FD870,?,004F89A2), ref: 004FDABE
__calloc_crt.LIBCMT ref: 004FDAD3
DecodePointer.KERNEL32(00000000,?,004F89A2), ref: 004FDAED
GetCurrentThreadId.KERNEL32 ref: 004FDAFF

Strings

KERNEL32.DLL, xrefs: 004FD9A2
FlsFree, xrefs: 004FD9E5
FlsSetValue, xrefs: 004FD9D8
FlsAlloc, xrefs: 004FD9C3
FlsGetValue, xrefs: 004FD9CB

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 873a78d4027d9d05ce75d79b37d8a8d3a7fce59eedd4e398274e2a3730cc39f7
Instruction ID: f2dffd0b26720d22c6f5338f12766ac000605aea52c01cfd3ff1a9028d25a7fa
Opcode Fuzzy Hash: 873a78d4027d9d05ce75d79b37d8a8d3a7fce59eedd4e398274e2a3730cc39f7
Instruction Fuzzy Hash: 9131B170D007499AE711AF75BC48A2E3FE9FF24360B05852BE604D72B0DB799408EF98

Function 004FC185 Relevance: 34.8, APIs: 23, Instructions: 290COMMON

Download Yara Rule

APIs

__malloc_crt.LIBCMT ref: 004FC1E6
__calloc_crt.LIBCMT ref: 004FC1F6
__calloc_crt.LIBCMT ref: 004FC201
__calloc_crt.LIBCMT ref: 004FC20C
__calloc_crt.LIBCMT ref: 004FC21B
GetCPInfo.KERNEL32(?,?), ref: 004FC26E
___crtGetStringTypeA.LIBCMT ref: 004FC2DC
___crtLCMapStringA.LIBCMT ref: 004FC30F

Part of subcall function 00501BCC: ___crtGetLocaleInfoA.LIBCMT ref: 00501C16
Part of subcall function 00501BCC: GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00501C24
Part of subcall function 00501BCC: ___crtGetLocaleInfoA.LIBCMT ref: 00501C3D
Part of subcall function 00501BCC: __calloc_crt.LIBCMT ref: 00501C52
Part of subcall function 00501BCC: ___crtGetLocaleInfoA.LIBCMT ref: 00501C78
Part of subcall function 00501BCC: __calloc_crt.LIBCMT ref: 00501C89
Part of subcall function 00501BCC: _free.LIBCMT ref: 00501CA1

___crtLCMapStringA.LIBCMT ref: 004FC33C

Part of subcall function 004FC785: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004FC793
Part of subcall function 004FC785: __crtLCMapStringA_stat.LIBCMT ref: 004FC7B4

_memmove.LIBCMT ref: 004FC3E7
_memmove.LIBCMT ref: 004FC3F6
_memmove.LIBCMT ref: 004FC408
InterlockedDecrement.KERNEL32(?), ref: 004FC41B
_free.LIBCMT ref: 004FC431
_free.LIBCMT ref: 004FC444
_free.LIBCMT ref: 004FC452
_free.LIBCMT ref: 004FC45D
_free.LIBCMT ref: 004FC4A4
_free.LIBCMT ref: 004FC4B1
_free.LIBCMT ref: 004FC4B9
_free.LIBCMT ref: 004FC4C1
_free.LIBCMT ref: 004FC4C9
InterlockedDecrement.KERNEL32(?), ref: 004FC4E1

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: _free$___crt__calloc_crt$Locale$InfoString$_memmove$DecrementInterlocked$A_statErrorLastTypeUpdateUpdate::___crt__malloc_crt
String ID:
API String ID: 2149289317-0
Opcode ID: a30b79fbd6548ee0cbcbb7c38b578d6f961ab5cb0163775a0ab912b717d35593
Instruction ID: 41318256b57fc5e8eede1dc7f335ef72bcc04acdbe79f97ab9f79da2ab0b6e9a
Opcode Fuzzy Hash: a30b79fbd6548ee0cbcbb7c38b578d6f961ab5cb0163775a0ab912b717d35593
Instruction Fuzzy Hash: 0DB177B1D0020D9FDB20DFA5C991BFEBBB9BF08304F04412EE655A7241DB79A845CB28

Function 004FC103 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 306COMMON

Download Yara Rule

APIs

__malloc_crt.LIBCMT ref: 004FC1E6
__calloc_crt.LIBCMT ref: 004FC1F6
__calloc_crt.LIBCMT ref: 004FC201
__calloc_crt.LIBCMT ref: 004FC20C
__calloc_crt.LIBCMT ref: 004FC21B
GetCPInfo.KERNEL32(?,?), ref: 004FC26E
___crtGetStringTypeA.LIBCMT ref: 004FC2DC
___crtLCMapStringA.LIBCMT ref: 004FC30F

Part of subcall function 00501BCC: ___crtGetLocaleInfoA.LIBCMT ref: 00501C16
Part of subcall function 00501BCC: GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00501C24
Part of subcall function 00501BCC: ___crtGetLocaleInfoA.LIBCMT ref: 00501C3D
Part of subcall function 00501BCC: __calloc_crt.LIBCMT ref: 00501C52
Part of subcall function 00501BCC: ___crtGetLocaleInfoA.LIBCMT ref: 00501C78
Part of subcall function 00501BCC: __calloc_crt.LIBCMT ref: 00501C89
Part of subcall function 00501BCC: _free.LIBCMT ref: 00501CA1

_free.LIBCMT ref: 004FC4A4
_free.LIBCMT ref: 004FC4B1
_free.LIBCMT ref: 004FC4B9
_free.LIBCMT ref: 004FC4C1
_free.LIBCMT ref: 004FC4C9
InterlockedDecrement.KERNEL32(?), ref: 004FC4E1

Strings

O, xrefs: 004FC172

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: __calloc_crt_free$___crt$Info$Locale$String$DecrementErrorInterlockedLastType__malloc_crt
String ID: O
API String ID: 1207360155-878818188
Opcode ID: c80db5eb9d08cde8b48b95e95ed751b8ae03dbeafc600324a1716e3d410ad14f
Instruction ID: fda6a0235d92bf1ab40e93cead1e6b12b50e913029fa328b51f2869b9cea16f8
Opcode Fuzzy Hash: c80db5eb9d08cde8b48b95e95ed751b8ae03dbeafc600324a1716e3d410ad14f
Instruction Fuzzy Hash: F4B1BCB1E0424D9FDB20DFA4C9A1AFEBBB4FF58304F04406EE685AB241D7389845CB25

Function 004F286C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004F2873
std::_Lockit::_Lockit.LIBCPMT ref: 004F287D

Part of subcall function 004F1430: std::_Lockit::_Lockit.LIBCPMT ref: 004F143E

std::bad_exception::bad_exception.LIBCMT ref: 004F28CC
__CxxThrowException@8.LIBCMT ref: 004F28DA
std::locale::facet::_Incref.LIBCPMT ref: 004F28EA
std::locale::facet::_Facet_Register.LIBCPMT ref: 004F28F0

Strings

bad cast, xrefs: 004F28C4

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: LockitLockit::_std::_std::locale::facet::_$Exception@8Facet_H_prolog3IncrefRegisterThrowstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 158301680-3145022300
Opcode ID: 8bc9a3c7b798276e34410fbfe5c00e027c36236c4d456d53d1554f9c0923aea3
Instruction ID: e1a1618d1bc02681de1110113488bd350de00b1e5f57cfa27de60cc4eaa9c7ca
Opcode Fuzzy Hash: 8bc9a3c7b798276e34410fbfe5c00e027c36236c4d456d53d1554f9c0923aea3
Instruction Fuzzy Hash: 0601823181062E9BCF00FB64C9429BE77647F44768F54021EE6207B2E1DF7C9E059B98

Function 004F4102 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004F4109
std::_Lockit::_Lockit.LIBCPMT ref: 004F4115

Part of subcall function 004F1430: std::_Lockit::_Lockit.LIBCPMT ref: 004F143E

std::bad_exception::bad_exception.LIBCMT ref: 004F415D
__CxxThrowException@8.LIBCMT ref: 004F416B
std::locale::facet::_Incref.LIBCPMT ref: 004F417B
std::locale::facet::_Facet_Register.LIBCPMT ref: 004F4181

Strings

bad cast, xrefs: 004F4155

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: LockitLockit::_std::_std::locale::facet::_$Exception@8Facet_H_prolog3IncrefRegisterThrowstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 158301680-3145022300
Opcode ID: f9cb6150894d302d984bc91e458451cafa95c17d47aeb4f566f66f10bfefa25e
Instruction ID: 0137f96e0f3f61ff36bc1a5ef8f7a28cda9b7d6f903357cc2701dc9a1ddfd9b3
Opcode Fuzzy Hash: f9cb6150894d302d984bc91e458451cafa95c17d47aeb4f566f66f10bfefa25e
Instruction Fuzzy Hash: 1C01D23191062E87CF10FB658D42ABE7260BF94368F54021EF621772E1DF3C5E058B98

Function 004F714C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004F7171

Part of subcall function 004F8329: std::exception::exception.LIBCMT ref: 004F833E
Part of subcall function 004F8329: __CxxThrowException@8.LIBCMT ref: 004F8353
Part of subcall function 004F8329: std::exception::exception.LIBCMT ref: 004F8364

_memmove.LIBCMT ref: 004F71A6
_memmove.LIBCMT ref: 004F71B2
_memmove.LIBCMT ref: 004F71C4
_memmove.LIBCMT ref: 004F71FA

Strings

vector<T> too long, xrefs: 004F716C

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: _memmove$std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 4034224661-3788999226
Opcode ID: 6c789f1500a478209974c5f5b48b25548c9d174683b8fb45ddb9110af4c62b4c
Instruction ID: b82075dc14e1faca616a5cb4b995c51e4cdbbf76a809cb3bfdf92e6d7cff561c
Opcode Fuzzy Hash: 6c789f1500a478209974c5f5b48b25548c9d174683b8fb45ddb9110af4c62b4c
Instruction Fuzzy Hash: 37219271A00209AFCB14EF79DD8597EBBE9EF48344701882EF646D7341DA38E904CB68

Function 004FD729 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,005081B8,00000008,004FD831,00000000,00000000,?,004F8AE8,00000001,00000000,?,00000003,?,004F8B46,S(O,?), ref: 004FD73A
__lock.LIBCMT ref: 004FD76E

Part of subcall function 005008F6: __mtinitlocknum.LIBCMT ref: 0050090C
Part of subcall function 005008F6: __amsg_exit.LIBCMT ref: 00500918
Part of subcall function 005008F6: EnterCriticalSection.KERNEL32(00000000,00000000,?,004FD773,0000000D), ref: 00500920

InterlockedIncrement.KERNEL32(?), ref: 004FD77B
__lock.LIBCMT ref: 004FD78F
___addlocaleref.LIBCMT ref: 004FD7AD

Strings

KERNEL32.DLL, xrefs: 004FD735

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 8d8582a4dc632c28ce8ac011de320e0f366743b02124eaaaa8821146ea510273
Instruction ID: f5279fe150274c398f1353c7158c75c61d9210abf1b8a71518be04e6fa1f2d5a
Opcode Fuzzy Hash: 8d8582a4dc632c28ce8ac011de320e0f366743b02124eaaaa8821146ea510273
Instruction Fuzzy Hash: 5501A171840B00DFD720AF66C80A75EBBE0BF50325F10890EE6969A3E1DBB4A644CF15

Function 004F1323 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004F132A
std::_Lockit::_Lockit.LIBCPMT ref: 004F1337
std::exception::exception.LIBCMT ref: 004F136E

Part of subcall function 004F8B26: std::exception::_Copy_str.LIBCMT ref: 004F8B41

__CxxThrowException@8.LIBCMT ref: 004F1383

Part of subcall function 004F935C: RaiseException.KERNEL32(?,?,h(O,?,?,?,?,?,004F2868,?,00508518,00000000), ref: 004F939E

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 004F138C

Strings

bad locale name, xrefs: 004F1367

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: std::_$Copy_strExceptionException@8H_prolog3Locinfo::_Locinfo_ctorLockitLockit::_RaiseThrowstd::exception::_std::exception::exception
String ID: bad locale name
API String ID: 637683493-1405518554
Opcode ID: ee3eb71497dc970fcc3bbe6fbff9a11a4b494d004e0c8ee070de2f43a1f7b7ca
Instruction ID: 3c7b9aeba95b412f6960976cab7557f63a7092ea51bcd3810d13ef7f92e1d09a
Opcode Fuzzy Hash: ee3eb71497dc970fcc3bbe6fbff9a11a4b494d004e0c8ee070de2f43a1f7b7ca
Instruction Fuzzy Hash: 6201A7B2401749DECB21EF5AC48159EBFF4BF28314B90C55FE28957641CB34A609CFA9

Function 004FE2C9 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004FE2EA

Part of subcall function 004FD856: __getptd_noexit.LIBCMT ref: 004FD859
Part of subcall function 004FD856: __amsg_exit.LIBCMT ref: 004FD866

__getptd.LIBCMT ref: 004FE2FB
__getptd.LIBCMT ref: 004FE309

Strings

csm, xrefs: 004FE2E3
MOC, xrefs: 004FE2DC
RCC, xrefs: 004FE2D5

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 66fe2ae8f2f944d596b07c7afcf23f70c7f6a3015fa94fec549782034b546478
Instruction ID: 6e484af4bae81bd75eb6257f867d298327cd418f385feffecfb5aa492fdeb9b7
Opcode Fuzzy Hash: 66fe2ae8f2f944d596b07c7afcf23f70c7f6a3015fa94fec549782034b546478
Instruction Fuzzy Hash: 9CE0123151010CCECB10AB66C04A7793295BB44359F1600FBEA1CCF332D73DD850859B

Function 004FE57B Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 004FE5A3

Part of subcall function 004F9687: __getptd.LIBCMT ref: 004F9695
Part of subcall function 004F9687: __getptd.LIBCMT ref: 004F96A3

__getptd.LIBCMT ref: 004FE5AD

Part of subcall function 004FD856: __getptd_noexit.LIBCMT ref: 004FD859
Part of subcall function 004FD856: __amsg_exit.LIBCMT ref: 004FD866

__getptd.LIBCMT ref: 004FE5BB
__getptd.LIBCMT ref: 004FE5C9
__getptd.LIBCMT ref: 004FE5D4
_CallCatchBlock2.LIBCMT ref: 004FE5FA

Part of subcall function 004F972C: __CallSettingFrame@12.LIBCMT ref: 004F9778

Part of subcall function 004FE6A1: __getptd.LIBCMT ref: 004FE6B0
Part of subcall function 004FE6A1: __getptd.LIBCMT ref: 004FE6BE

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 5d1f77e4179b7f5ec5b1565cf10787d6934920cb5fb2b830c4828216910461c5
Instruction ID: e6db9ecf770f832b5deb3de0753d98d21003c8706b87c4d312388b28d347a043
Opcode Fuzzy Hash: 5d1f77e4179b7f5ec5b1565cf10787d6934920cb5fb2b830c4828216910461c5
Instruction Fuzzy Hash: E411B4B1C102099FDB00EFA5C546BADBBB1FF08315F11816EF924A7251DB389A159B58

Function 00500B4C Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00500B58

Part of subcall function 004FD856: __getptd_noexit.LIBCMT ref: 004FD859
Part of subcall function 004FD856: __amsg_exit.LIBCMT ref: 004FD866

__amsg_exit.LIBCMT ref: 00500B78
__lock.LIBCMT ref: 00500B88
InterlockedDecrement.KERNEL32(?), ref: 00500BA5
_free.LIBCMT ref: 00500BB8
InterlockedIncrement.KERNEL32(00DF2D00), ref: 00500BD0

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: cd68e488735c28dc5f1bff0f5f7956eb666c2582e67153b0eced9cddbca5ef26
Instruction ID: bec9a4bfc21d8aec08291c80739008042e3417f0f6da5c282474455dd53a292a
Opcode Fuzzy Hash: cd68e488735c28dc5f1bff0f5f7956eb666c2582e67153b0eced9cddbca5ef26
Instruction Fuzzy Hash: EA01F932D01715DBCB21BF659946B6E7BA1FF04728F01511AE914A72D0CB38AC41DFD6

Function 004F139D Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004F13A4
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 004F13B4

Part of subcall function 004F8137: _setlocale.LIBCMT ref: 004F8149

_free.LIBCMT ref: 004F13C2

Part of subcall function 004F8F81: HeapFree.KERNEL32(00000000,00000000,?,004FD847,00000000,?,004F8AE8,00000001,00000000,?,00000003,?,004F8B46,S(O,?), ref: 004F8F97
Part of subcall function 004F8F81: GetLastError.KERNEL32(00000000,?,004FD847,00000000,?,004F8AE8,00000001,00000000,?,00000003,?,004F8B46,S(O,?), ref: 004F8FA9

_free.LIBCMT ref: 004F13D4
_free.LIBCMT ref: 004F13E6
_free.LIBCMT ref: 004F13F8

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: _free$ErrorFreeH_prolog3HeapLastLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 2259855018-0
Opcode ID: 5e16a3d4a2d370e945789577502df6e721163cb96fb20476701d4c620e64200c
Instruction ID: cb37c8fbc8f6c3b5ab95548c1debe3ccee37b3f2dcb8435cbcfbf3f0abc0b372
Opcode Fuzzy Hash: 5e16a3d4a2d370e945789577502df6e721163cb96fb20476701d4c620e64200c
Instruction Fuzzy Hash: C3016231B007099BEB24AE66C54676B73E8AF0072AF14460EE641DB9C1CF3CE945CB68

Function 004F3780 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 283COMMON

Download Yara Rule

Strings

xuP, xrefs: 004F3B17
AP, xrefs: 004F3B2E
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_, xrefs: 004F3852

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID:
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_$xuP$AP
API String ID: 0-2420211075
Opcode ID: 606cfba21e9f2a607b77a247581045512d8f8538a187477e2cd48e5759e937d7
Instruction ID: 1d215ad8371fa61e0099a4457b709ccace572947d84da6390dee831ace2eaa10
Opcode Fuzzy Hash: 606cfba21e9f2a607b77a247581045512d8f8538a187477e2cd48e5759e937d7
Instruction Fuzzy Hash: A9B1E331604248AFCB11DF15C4C4BB67BE0AF45315F4844AAEE898F346C378EA45CB6A

Function 004F5C04 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 280COMMON

Download Yara Rule

Strings

AP, xrefs: 004F5FA7
xuP, xrefs: 004F5F90
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_, xrefs: 004F5CD7

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID:
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_$xuP$AP
API String ID: 0-2420211075
Opcode ID: 7dde469b7a9fa7fd7ee67540c22a5245b4fd293bb1b214d48606271d71115d62
Instruction ID: b07d948968b991b87cc1050d15e1ec5720a61742a6bcd4fb497e4f81b85517df
Opcode Fuzzy Hash: 7dde469b7a9fa7fd7ee67540c22a5245b4fd293bb1b214d48606271d71115d62
Instruction Fuzzy Hash: ACB1D071204B499FD724CF28D484BBBBBE1EF45300F54484EE7DA87281C738A985DB6A

Function 004F6D00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004F6D07
std::_Xinvalid_argument.LIBCPMT ref: 004F6D2D

Part of subcall function 004F8329: std::exception::exception.LIBCMT ref: 004F833E
Part of subcall function 004F8329: __CxxThrowException@8.LIBCMT ref: 004F8353
Part of subcall function 004F8329: std::exception::exception.LIBCMT ref: 004F8364

_memmove.LIBCMT ref: 004F6D69
_memmove.LIBCMT ref: 004F6D8C

Strings

vector<T> too long, xrefs: 004F6D28

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: _memmovestd::exception::exception$Exception@8H_prolog3_catchThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 3478911975-3788999226
Opcode ID: 9d723c49ecab346a2f322a08e8cf035f527e376b9cc17a9fa840f04baaf13583
Instruction ID: e6c77c436beb778c98b9ab63383f530084b24cc48af8ca643ea68d9c6b3da75d
Opcode Fuzzy Hash: 9d723c49ecab346a2f322a08e8cf035f527e376b9cc17a9fa840f04baaf13583
Instruction Fuzzy Hash: 5321A271A00209AFCF04EF79CD4597E7BA2EF84304B11842EFA4597355DF39A910CB98

Function 004F7D4E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004F7D64

Part of subcall function 004F8376: std::exception::exception.LIBCMT ref: 004F838B
Part of subcall function 004F8376: __CxxThrowException@8.LIBCMT ref: 004F83A0
Part of subcall function 004F8376: std::exception::exception.LIBCMT ref: 004F83B1

std::_Xinvalid_argument.LIBCPMT ref: 004F7D83
_memmove.LIBCMT ref: 004F7DC6

Strings

string too long, xrefs: 004F7D7E
invalid string position, xrefs: 004F7D5F

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: 96d72a7cf4c7051ee6592279a88eedab71786ec2eb4578d6d5023395ed1fc7d6
Instruction ID: cdd46f9976adfa235369f17aa28963c3633117dcb640758e78eb8753b6fae0ac
Opcode Fuzzy Hash: 96d72a7cf4c7051ee6592279a88eedab71786ec2eb4578d6d5023395ed1fc7d6
Instruction Fuzzy Hash: 2411B13020860D9BCB24DE18D88187A73F5FF857187A0451EF956CB261EB38E915C799

Function 004F25E1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004F25F0

Part of subcall function 004F8376: std::exception::exception.LIBCMT ref: 004F838B
Part of subcall function 004F8376: __CxxThrowException@8.LIBCMT ref: 004F83A0
Part of subcall function 004F8376: std::exception::exception.LIBCMT ref: 004F83B1

std::_Xinvalid_argument.LIBCPMT ref: 004F2604
_memmove.LIBCMT ref: 004F263F

Strings

string too long, xrefs: 004F25FF
invalid string position, xrefs: 004F25EB

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: 6ae654f638285417a888961748c74f6b6e8c9c208dfc84b5c2f6fdaa9cce49ab
Instruction ID: 2123cb5e33aa2d40ed48082eb50561648e9e59b1768a149e98feb315d7360433
Opcode Fuzzy Hash: 6ae654f638285417a888961748c74f6b6e8c9c208dfc84b5c2f6fdaa9cce49ab
Instruction Fuzzy Hash: F80104307002095BEB08AF2C9A9097DB766FB81714B54061EF602CB2D2CBA9EC548399

Function 004FE928 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004FE93B

Part of subcall function 004FE896: ___BuildCatchObjectHelper.LIBCMT ref: 004FE8CC

_UnwindNestedFrames.LIBCMT ref: 004FE952
___FrameUnwindToState.LIBCMT ref: 004FE960

Strings

csm, xrefs: 004FE937, 004FE94C, 004FE95F, 004FE97D, 004FE98D
csm, xrefs: 004FE92A

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 25b235255ab6597edc552ed3ef3507b70867476e850620615844bf3548dffac4
Instruction ID: b77bf87e265692c95b4ca31b05a6f66ef11d260042055902f8074eedc51c6fa7
Opcode Fuzzy Hash: 25b235255ab6597edc552ed3ef3507b70867476e850620615844bf3548dffac4
Instruction Fuzzy Hash: C801127140020EBBDF126E52CC45EAF3E6AEF08359F04801ABE0815170D77A99A1EBA9

Function 00500703 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0050070F

Part of subcall function 004FD856: __getptd_noexit.LIBCMT ref: 004FD859
Part of subcall function 004FD856: __amsg_exit.LIBCMT ref: 004FD866

__getptd.LIBCMT ref: 00500726
__amsg_exit.LIBCMT ref: 00500734
__lock.LIBCMT ref: 00500744
__updatetlocinfoEx_nolock.LIBCMT ref: 00500758

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 989b6c55bcc827bf44c87ed26d4c6fff54ad843feeb133bfba2493063856a4ae
Instruction ID: a5fcf8620b624838aae9988f0fceb4b130d251ad54ce81e5a4715c00e3d12358
Opcode Fuzzy Hash: 989b6c55bcc827bf44c87ed26d4c6fff54ad843feeb133bfba2493063856a4ae
Instruction Fuzzy Hash: 72F09032D403049BDA21BB799907B6E3BA1FF40764F11525EF618AA2C3CB2C6841DA5A

Function 004F35E7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004F35EE
__Strxfrm.LIBCPMT ref: 004F36A3
std::_Xinvalid_argument.LIBCPMT ref: 004F36D2

Part of subcall function 004F266F: std::_Xinvalid_argument.LIBCPMT ref: 004F267E
Part of subcall function 004F266F: _memmove.LIBCMT ref: 004F26B4

Strings

string too long, xrefs: 004F36CD

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$H_prolog3Strxfrm_memmove
String ID: string too long
API String ID: 1992344758-2556327735
Opcode ID: e7ce6d4da7307c8ea1ed3deaf18bf9442433787e7d36edfdb5ddf2c8dc2cd09f
Instruction ID: a75f385b74b34e3ac838dcac841936b252bdf7c401b7cea2c2b1fc4ea3af845d
Opcode Fuzzy Hash: e7ce6d4da7307c8ea1ed3deaf18bf9442433787e7d36edfdb5ddf2c8dc2cd09f
Instruction Fuzzy Hash: 2731B83070020AABEF28EF38C59063EB7B2BF40315B54461EE612D7391DB78AE51C799

Function 004FD3BD Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(00000000,004F89D7), ref: 004FD3C0
__malloc_crt.LIBCMT ref: 004FD3EF
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004FD3FC

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: EnvironmentStrings$Free__malloc_crt
String ID:
API String ID: 237123855-0
Opcode ID: a6535584b024f1952fb776bf35587570ff2947c4bb8902fa99d33e22e97790d5
Instruction ID: cae0141c236fd89c6e707aa39bea335c20defa649b247b6539e059f7b78d87c1
Opcode Fuzzy Hash: a6535584b024f1952fb776bf35587570ff2947c4bb8902fa99d33e22e97790d5
Instruction Fuzzy Hash: A9F0E2B7D0411C5ACA21B734BC498BB233ADAE136930A401BFB46C3240F6689D4686A6

Function 004F787E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004F7897

Part of subcall function 004F8376: std::exception::exception.LIBCMT ref: 004F838B
Part of subcall function 004F8376: __CxxThrowException@8.LIBCMT ref: 004F83A0
Part of subcall function 004F8376: std::exception::exception.LIBCMT ref: 004F83B1

Part of subcall function 004F7A44: std::_Xinvalid_argument.LIBCPMT ref: 004F7A57

_memmove.LIBCMT ref: 004F78F2

Strings

invalid string position, xrefs: 004F7892

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position
API String ID: 3404309857-1799206989
Opcode ID: 76b81eb39d6435decddabd82dd83bf6e92b0c3ac7d7bfaa8dd90ff7686d0eb6b
Instruction ID: b057f9adae289e0f4efdc1a3c585cd7ac367a795c885064771de51214baa4309
Opcode Fuzzy Hash: 76b81eb39d6435decddabd82dd83bf6e92b0c3ac7d7bfaa8dd90ff7686d0eb6b
Instruction Fuzzy Hash: F411D07071820C9BCB20EE68D884C7AB3A5FB457A4710462FE6458B241E7BCE950C7A9

Function 004F7DEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004F7E2B
_memmove.LIBCMT ref: 004F7E5E

Strings

string too long, xrefs: 004F7E26

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: e6eac8d46658d0ee396d6514ae0a5fbc002877691f2905c65d2eff7c4eeaa7fb
Instruction ID: 6966830b93c35298a592386edb8a37e630b113b2a41009322d43d173376aad40
Opcode Fuzzy Hash: e6eac8d46658d0ee396d6514ae0a5fbc002877691f2905c65d2eff7c4eeaa7fb
Instruction Fuzzy Hash: B011917030860C9BCA30DF6CD88587BB3A9EF057487500A5FFA56CB651D73CAD158799

Function 004F2495 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004F24AB

Part of subcall function 004F8376: std::exception::exception.LIBCMT ref: 004F838B
Part of subcall function 004F8376: __CxxThrowException@8.LIBCMT ref: 004F83A0
Part of subcall function 004F8376: std::exception::exception.LIBCMT ref: 004F83B1

Part of subcall function 004F26D9: std::_Xinvalid_argument.LIBCPMT ref: 004F26E3

_memmove.LIBCMT ref: 004F24FD

Strings

invalid string position, xrefs: 004F24A6

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position
API String ID: 3404309857-1799206989
Opcode ID: a050055a2cf1a51971dbd99c204cd401fd832a35caccb34a47dde4e40cbe6f97
Instruction ID: 573d51ba048e22f61ae0b68f59a747df4c805d8057d1e40944b290f5b850b39a
Opcode Fuzzy Hash: a050055a2cf1a51971dbd99c204cd401fd832a35caccb34a47dde4e40cbe6f97
Instruction Fuzzy Hash: 3E11E17130021CABDB14DE1CDA809797765AF45328B44051BFA16DF242C7F8ED90C7EA

Function 004F5AD7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004F5ADE
std::_Xinvalid_argument.LIBCPMT ref: 004F5AF4

Part of subcall function 004F8329: std::exception::exception.LIBCMT ref: 004F833E
Part of subcall function 004F8329: __CxxThrowException@8.LIBCMT ref: 004F8353
Part of subcall function 004F8329: std::exception::exception.LIBCMT ref: 004F8364

Strings

vector<T> too long, xrefs: 004F5AEF

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: std::exception::exception$Exception@8H_prolog3_catchThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 1877048013-3788999226
Opcode ID: f1d6004d39f2308cd53786256895df2786a02e55da5ffd6cae9e46ba3dc207fc
Instruction ID: f8feeb3cee7ea505a7eeb01813ea37b442a9dc46b3c1f9573469ead2a8382ead
Opcode Fuzzy Hash: f1d6004d39f2308cd53786256895df2786a02e55da5ffd6cae9e46ba3dc207fc
Instruction Fuzzy Hash: B9117076A006098BC718EFA9D982A3EF7E1EF54710B21082FE395D7280DA75A9008B18

Function 004F79D3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004F79E2

Part of subcall function 004F8376: std::exception::exception.LIBCMT ref: 004F838B
Part of subcall function 004F8376: __CxxThrowException@8.LIBCMT ref: 004F83A0
Part of subcall function 004F8376: std::exception::exception.LIBCMT ref: 004F83B1

_memmove.LIBCMT ref: 004F7A1D

Strings

invalid string position, xrefs: 004F79DD

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: bb67a3563640b1f1bcc3fd7c380593832a456f6cc75bc75889718fc28be7344f
Instruction ID: 71f9446b2a273de93263785248289284212236768d4bc3bf37d5ea56938dab62
Opcode Fuzzy Hash: bb67a3563640b1f1bcc3fd7c380593832a456f6cc75bc75889718fc28be7344f
Instruction Fuzzy Hash: 7F0171717086198BC721CE28D98083FB3A6AFC5744321492ED282CB659EB39D95687A8

Function 004F266F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004F267E

Part of subcall function 004F8376: std::exception::exception.LIBCMT ref: 004F838B
Part of subcall function 004F8376: __CxxThrowException@8.LIBCMT ref: 004F83A0
Part of subcall function 004F8376: std::exception::exception.LIBCMT ref: 004F83B1

_memmove.LIBCMT ref: 004F26B4

Strings

invalid string position, xrefs: 004F2679

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: 2ded5381c2337a59aa7c46eac287cceda6ac647c0bae52eea87701d652758558
Instruction ID: 7ae9638e9a7487a90585d7d01063578f73fdc440ee85283d82209e548b2b186d
Opcode Fuzzy Hash: 2ded5381c2337a59aa7c46eac287cceda6ac647c0bae52eea87701d652758558
Instruction Fuzzy Hash: 2401D6313002198BE7248E689BC443BB3A2DB857053300D3ED682CB645DBF8E8468799

Function 004F7E83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004F7E8A
std::_Xinvalid_argument.LIBCPMT ref: 004F7EC4

Strings

string too long, xrefs: 004F7EBF

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: H_prolog3_catchXinvalid_argumentstd::_
String ID: string too long
API String ID: 4202626062-2556327735
Opcode ID: da6eb0fb2c7455791b6e00f9f0d80226e0d8019b7561e47b6723beb101907654
Instruction ID: d3796218d8a53f965387d86c69d8242f7512d5d5a8e238014f22b4e48e635a93
Opcode Fuzzy Hash: da6eb0fb2c7455791b6e00f9f0d80226e0d8019b7561e47b6723beb101907654
Instruction Fuzzy Hash: 51118B30218248DBCB20EF28C441A7E73B0FF05705B11098FFA929B691CB79EE04CB59

Function 004FE6A1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004F96DA: __getptd.LIBCMT ref: 004F96E0
Part of subcall function 004F96DA: __getptd.LIBCMT ref: 004F96F0

__getptd.LIBCMT ref: 004FE6B0

Part of subcall function 004FD856: __getptd_noexit.LIBCMT ref: 004FD859
Part of subcall function 004FD856: __amsg_exit.LIBCMT ref: 004FD866

__getptd.LIBCMT ref: 004FE6BE

Strings

csm, xrefs: 004FE6CC

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 6a44a58e31c99b426e54366fb5621d297f0f0e60a01b212659432dc75c0bdb3e
Instruction ID: 95ac7424f914e56daa457cec59eef65ed8a13a798e4507eb5559610e0619482e
Opcode Fuzzy Hash: 6a44a58e31c99b426e54366fb5621d297f0f0e60a01b212659432dc75c0bdb3e
Instruction Fuzzy Hash: C801243480030C8BDF34AFA2C540ABEB3F5AF10316F68442FE654966A1DB3E9980CE59

Function 004F17CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(User32.dll,?,004F1A20,SetClipboardData,402896FC), ref: 004F17D2
GetProcAddress.KERNEL32(00000000,?), ref: 004F17E0

Strings

User32.dll, xrefs: 004F17CD

Memory Dump Source

Source File: 00000000.00000002.4483173502.00000000004F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.4483153851.00000000004F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483194123.0000000000504000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483213044.000000000050A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4483229881.000000000050D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_7zba89tklZ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: User32.dll
API String ID: 2574300362-1293261179
Opcode ID: 9646d3d4acc1f37128dfbe4e2643dc35e77105b17a9aa86fd05f83018c5f4b02
Instruction ID: 55330552234c164fc6db5baf01e88bc7470a66335f1a1b3cee9af546ec3f44cc
Opcode Fuzzy Hash: 9646d3d4acc1f37128dfbe4e2643dc35e77105b17a9aa86fd05f83018c5f4b02
Instruction Fuzzy Hash: C3C08C7168420CEBDF002FF2BC0CABE7FDCEB14691B040412FB0CD4060EA36D410AA64

Analysis Process: svcapp.exePID: 5416, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1635
Total number of Limit Nodes:	22

Executed Functions

Function 00372235 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 32
sleepsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNELBASE(00000000,00000001,DiamoTrix), ref: 00372246
GetLastError.KERNEL32 ref: 00372252
CloseHandle.KERNEL32(00000000), ref: 00372260
ExitProcess.KERNEL32 ref: 00372267
CreateThread.KERNEL32(00000000,00000000,Function_000019DF,00387314,00000000,00000000), ref: 0037228A
Sleep.KERNEL32(0000C350), ref: 00372295

Strings

DiamoTrix, xrefs: 0037223C

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: Create$CloseErrorExitHandleLastMutexProcessSleepThread
String ID: DiamoTrix
API String ID: 3762534975-3521203031
Opcode ID: 2cef0c19eb311f498654bc1d0636007c02a02aee299f22897e6db93c607bfafc
Instruction ID: fd5586f64bd8efe40ebc895a679f3b8f9324e6c9d470b8dad1ac3cbe1e6363d5
Opcode Fuzzy Hash: 2cef0c19eb311f498654bc1d0636007c02a02aee299f22897e6db93c607bfafc
Instruction Fuzzy Hash: 0DF01232505321ABC2332771AC0DE9F7D2DEF46B51F118480F20DA5491CB58954297F6

Function 003791DE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 003791EC

Part of subcall function 0037A7F1: __FF_MSGBANNER.LIBCMT ref: 0037A80A
Part of subcall function 0037A7F1: __NMSG_WRITE.LIBCMT ref: 0037A811
Part of subcall function 0037A7F1: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,0037C903,00000000,00000001,00000000,?,00380881,00000018,003883C8,0000000C,00380911), ref: 0037A836

_free.LIBCMT ref: 003791FF

Strings

H=8, xrefs: 003791F5, 003791E9, 00379211, 00379231, 00379241

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID: H=8
API String ID: 1020059152-3273848138
Opcode ID: 555671ac5ba66b92c94c12146b7c7c5a36f04d376598bf34fd8a3fede4b2a564
Instruction ID: 2a0eb36a110b9f62c912f01ef51c5e85dfa169a76fa0a4474d5e70ac0de46443
Opcode Fuzzy Hash: 555671ac5ba66b92c94c12146b7c7c5a36f04d376598bf34fd8a3fede4b2a564
Instruction Fuzzy Hash: 6311C832804619BACF333B74AC05B5E3B989FC43A0F22CE66F91C9A552DE3C88429755

Function 003792DC Relevance: 6.0, APIs: 4, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 003792F6

Part of subcall function 0037A7F1: __FF_MSGBANNER.LIBCMT ref: 0037A80A
Part of subcall function 0037A7F1: __NMSG_WRITE.LIBCMT ref: 0037A811
Part of subcall function 0037A7F1: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,0037C903,00000000,00000001,00000000,?,00380881,00000018,003883C8,0000000C,00380911), ref: 0037A836

std::exception::exception.LIBCMT ref: 0037932B
std::exception::exception.LIBCMT ref: 00379345
__CxxThrowException@8.LIBCMT ref: 00379356

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: 3f5cb086c5b24fd47b4f921399280e632c9b024d43b209016a92ef5809b85ab1
Instruction ID: a46ae1f01d500e5a0585f0304942d97512e3ca0753d183af23d58df16a561f3e
Opcode Fuzzy Hash: 3f5cb086c5b24fd47b4f921399280e632c9b024d43b209016a92ef5809b85ab1
Instruction Fuzzy Hash: 3EF0787490030BBACB33FB54CC46AAE77AD6B00718F608496F81CAA0D2CF788B458751

Function 00371000 Relevance: 3.0, APIs: 2, Instructions: 14
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 00371006
GetProcAddress.KERNEL32(00000000,?), ref: 00371014

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 4a7616f3960a8df98072c01a3c4fc76226a10f86ed4a88b00e1d95637b02e275
Instruction ID: e3df4b6023f834ac4bbfe7c83daf22ee14034d27efcf7629ab4245b923cde6d2
Opcode Fuzzy Hash: 4a7616f3960a8df98072c01a3c4fc76226a10f86ed4a88b00e1d95637b02e275
Instruction Fuzzy Hash: E1C01276200209ABCF222FA1FC0895B7F6CEB04360B0480A0FA0CC4821EB3AC820AB50

Function 00372B41 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch.LIBCMT ref: 00372B48

Part of subcall function 00377F85: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCMT ref: 00377F93
Part of subcall function 00377F85: __CxxThrowException@8.LIBCMT ref: 00377FA1
Part of subcall function 00377F85: std::exception::exception.LIBCMT ref: 00377FB4

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8H_prolog3_catchThrowstd::exception::exception
String ID:
API String ID: 1558761032-0
Opcode ID: 525eec10023e59a2b693230524bb071f62611b779456d182800fe5d65e4ce9c2
Instruction ID: 775d101bfe5f8ca92b873e2fc0b90518ab83c2cad1f603369446e006377ee40b
Opcode Fuzzy Hash: 525eec10023e59a2b693230524bb071f62611b779456d182800fe5d65e4ce9c2
Instruction Fuzzy Hash: 21F0BEB5200700ABD73AFF34C882E5A73E5AF88300B40880DF24A9F352CA38F941DB90

Function 0037234F Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00372356

Part of subcall function 0037242A: std::locale::_Init.LIBCPMT ref: 00372431
Part of subcall function 0037242A: std::locale::facet::_Incref.LIBCPMT ref: 00372440

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: H_prolog3IncrefInitstd::locale::_std::locale::facet::_
String ID:
API String ID: 2441394073-0
Opcode ID: a5a5f805fdfc633a106b0cd574ecb6786a2478a0d41542d772c3f10858c833ba
Instruction ID: a303f3d06e790e231be8d2d72d61a2de79baa2cfd4ef365e47faecfd0ff2daeb
Opcode Fuzzy Hash: a5a5f805fdfc633a106b0cd574ecb6786a2478a0d41542d772c3f10858c833ba
Instruction Fuzzy Hash: C6F0A0366042029BEB23AF68C8567BA7691AF50300F18C274BD4C9F245DB6CCE199791

Function 00375076 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003791DE: _malloc.LIBCMT ref: 003791EC

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00375096

Part of subcall function 00377F52: std::exception::exception.LIBCMT ref: 00377F6A
Part of subcall function 00377F52: __CxxThrowException@8.LIBCMT ref: 00377F7F

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Exception@8Internal_throw_exceptionThrow_mallocstd::exception::exception
String ID:
API String ID: 4204326809-0
Opcode ID: 883a0bd67c2d40cd78a423c91a8c0d624f6316e23ecca44dc0849041ac370a47
Instruction ID: ab5136f801da2e66180133f7ab7e71524711763622e5eaadaab5a6d70c8ab6b2
Opcode Fuzzy Hash: 883a0bd67c2d40cd78a423c91a8c0d624f6316e23ecca44dc0849041ac370a47
Instruction Fuzzy Hash: 4AF0A0751087028F93359F5AD480812F7E9EF54710300C82EE8DD47611C7B0B840CB50

Non-executed Functions

Function 00381BCC Relevance: 21.2, APIs: 14, Instructions: 155COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetLocaleInfoA.LIBCMT ref: 00381C16

Part of subcall function 00382D95: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00382DA3
Part of subcall function 00382D95: __crtGetLocaleInfoA_stat.LIBCMT ref: 00382DB8

GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00381C24
___crtGetLocaleInfoA.LIBCMT ref: 00381C3D
___crtGetLocaleInfoA.LIBCMT ref: 00381C78
__calloc_crt.LIBCMT ref: 00381C52

Part of subcall function 0037C937: Sleep.KERNEL32(00000000), ref: 0037C95F

__calloc_crt.LIBCMT ref: 00381C89
_free.LIBCMT ref: 00381CA1
_free.LIBCMT ref: 00381CD5
__invoke_watson.LIBCMT ref: 00381CE4
GetLocaleInfoW.KERNEL32(?,00001004,00000000,00000000,?,?,00000000), ref: 00381D01
__calloc_crt.LIBCMT ref: 00381D0C
GetLocaleInfoW.KERNEL32(?,00001004,00000000,00000000,?,?,00000000), ref: 00381D21
_free.LIBCMT ref: 00381D29
GetLocaleInfoW.KERNEL32(?,00001004,00000000,00000002,?,?,00000000), ref: 00381D5D

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: Locale$Info$___crt__calloc_crt_free$A_statErrorLastSleepUpdateUpdate::___crt__invoke_watson
String ID:
API String ID: 2728192355-0
Opcode ID: 82654cf269cd7fdc2f8432a9bd98c763cfa76f82c1b9c3a14335a80751fcc80c
Instruction ID: 922950f829b8a9d462e0a3ee216d15ffc92da00d40ffd7ceae9b04300ef08e22
Opcode Fuzzy Hash: 82654cf269cd7fdc2f8432a9bd98c763cfa76f82c1b9c3a14335a80751fcc80c
Instruction Fuzzy Hash: 26419EB190031AAFEF23AF619C45BAB7BBDFF05350F2044A5F908EA141EB358C559B60

Function 00377529 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 205filesleepCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00377533
GetModuleFileNameW.KERNEL32(00000000,?,00000104,000004F8,0037227C), ref: 00377546

Part of subcall function 0037744F: __EH_prolog3_GS.LIBCMT ref: 00377456
Part of subcall function 0037744F: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00000002,?,00000001,00000001,FyYnOTg1ICwkGCQIDh0bAQYeMDU9OgYaFgYPNzU9LhoGAAwWMD8EHxwdHQckGDsUAw==,Diamotrix,00000060,0037756E,?), ref: 003774C5

Part of subcall function 00377918: _memmove.LIBCMT ref: 00377934

SHGetFolderPathW.SHELL32(00000000,0000001C,00000000,00000000,?,00000001), ref: 00377592

Part of subcall function 003773C3: __EH_prolog3_GS.LIBCMT ref: 003773CA

Part of subcall function 00372520: _memmove.LIBCMT ref: 00372539

CopyFileW.KERNEL32(?,?,00000000,00000001), ref: 003776B2
Sleep.KERNEL32(000001F4), ref: 003776C1
MoveFileW.KERNEL32(?,?), ref: 003777EF

Strings

GCQIDh0bAQYeMDUSGwwVAhlWIREE, xrefs: 003775B0
GBoXDg4EAkcdPAw=, xrefs: 00377711
Diamotrix, xrefs: 003775A0, 00377701

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: FileH_prolog3_$_memmove$CopyFolderModuleMoveNameOpenPathSleep
String ID: Diamotrix$GBoXDg4EAkcdPAw=$GCQIDh0bAQYeMDUSGwwVAhlWIREE
API String ID: 3945932230-3474619492
Opcode ID: 63660a427b93e9fcb9e1654a077134c358d3673c5bb46f1b89e5f81718dfd544
Instruction ID: f56578e09cc9a3ff3b4f10374f3f3ac527f0e81b281effb130b43a7407c97a10
Opcode Fuzzy Hash: 63660a427b93e9fcb9e1654a077134c358d3673c5bb46f1b89e5f81718dfd544
Instruction Fuzzy Hash: 488152B29052689EDB32DB64CC85BDEB7B8AB04310F4040D9E60DB7142DB746F89CF65

Function 0038125C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00381899,00000002,?,?,00381899), ref: 0038129B
GetLocaleInfoW.KERNEL32(?,20001004,00381899,00000002,?,?,00381899), ref: 003812C4
GetACP.KERNEL32(?,?), ref: 003812D8

Strings

OCP, xrefs: 0038127C
ACP, xrefs: 0038126B

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: dabff32f00f58bee5f473d5e448a657cbf18d961431f5d551358293f097629c6
Instruction ID: 4bb1a9781f3c95d744feea00c6f13479a4ee91fa5467c068986210aaf9e3f2c4
Opcode Fuzzy Hash: dabff32f00f58bee5f473d5e448a657cbf18d961431f5d551358293f097629c6
Instruction Fuzzy Hash: 6A01D430600307BAEB23AB60EC06F9B77AC9F00358F2008D5FA02E40C1EB60CA428754

Function 00378A8F Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0037DE85
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0037DE9A
UnhandledExceptionFilter.KERNEL32(0038568C), ref: 0037DEA5
GetCurrentProcess.KERNEL32(C0000409), ref: 0037DEC1
TerminateProcess.KERNEL32(00000000), ref: 0037DEC8

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 105df1a31cd25583e0fb1b9207a81643112ea164b97b08c27fb66edafcc6d64c
Instruction ID: 938defbac9b1f7ac9795386e4aef88818a700ef116fd6d8821e59639872e632e
Opcode Fuzzy Hash: 105df1a31cd25583e0fb1b9207a81643112ea164b97b08c27fb66edafcc6d64c
Instruction Fuzzy Hash: 6921CBB480230B9FDB53DF6AE985A54BBBCBB48310F1151DAE60887771E7B458848F42

Function 0037D99F Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,003789A2), ref: 0037D9A7
__mtterm.LIBCMT ref: 0037D9B3

Part of subcall function 0037D6EC: DecodePointer.KERNEL32(00000001,0037DB15,?,003789A2), ref: 0037D6FD
Part of subcall function 0037D6EC: TlsFree.KERNEL32(00000001,0037DB15,?,003789A2), ref: 0037D717
Part of subcall function 0037D6EC: DeleteCriticalSection.KERNEL32(00000000,00000000,76EE5810,?,0037DB15,?,003789A2), ref: 003807E3
Part of subcall function 0037D6EC: _free.LIBCMT ref: 003807E6
Part of subcall function 0037D6EC: DeleteCriticalSection.KERNEL32(00000001,76EE5810,?,0037DB15,?,003789A2), ref: 0038080D

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0037D9C9
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0037D9D6
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0037D9E3
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0037D9F0
TlsAlloc.KERNEL32(?,003789A2), ref: 0037DA40
TlsSetValue.KERNEL32(00000000,?,003789A2), ref: 0037DA5B
__init_pointers.LIBCMT ref: 0037DA65
EncodePointer.KERNEL32(?,003789A2), ref: 0037DA76
EncodePointer.KERNEL32(?,003789A2), ref: 0037DA83
EncodePointer.KERNEL32(?,003789A2), ref: 0037DA90
EncodePointer.KERNEL32(?,003789A2), ref: 0037DA9D
DecodePointer.KERNEL32(0037D870,?,003789A2), ref: 0037DABE
__calloc_crt.LIBCMT ref: 0037DAD3
DecodePointer.KERNEL32(00000000,?,003789A2), ref: 0037DAED
GetCurrentThreadId.KERNEL32 ref: 0037DAFF

Strings

KERNEL32.DLL, xrefs: 0037D9A2
FlsFree, xrefs: 0037D9E5
FlsGetValue, xrefs: 0037D9CB
FlsSetValue, xrefs: 0037D9D8
FlsAlloc, xrefs: 0037D9C3

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 97c01f64745aa157689b780ddf2f4fd9cc77ed9329e5e36eb7cc4c93143f235f
Instruction ID: 1b61d9b7f556b9416ade08441733acca930871936e44ab38c47311c1aead9dc3
Opcode Fuzzy Hash: 97c01f64745aa157689b780ddf2f4fd9cc77ed9329e5e36eb7cc4c93143f235f
Instruction Fuzzy Hash: 4E3130729003939AC763AF74AC19A16BBFCFF443A0F1A45ABE508971B1E7799440CF50

Function 0037C185 Relevance: 34.8, APIs: 23, Instructions: 290COMMON

Download Yara Rule

APIs

__malloc_crt.LIBCMT ref: 0037C1E6
__calloc_crt.LIBCMT ref: 0037C1F6
__calloc_crt.LIBCMT ref: 0037C201
__calloc_crt.LIBCMT ref: 0037C20C
__calloc_crt.LIBCMT ref: 0037C21B
GetCPInfo.KERNEL32(?,?), ref: 0037C26E
___crtGetStringTypeA.LIBCMT ref: 0037C2DC
___crtLCMapStringA.LIBCMT ref: 0037C30F

Part of subcall function 00381BCC: ___crtGetLocaleInfoA.LIBCMT ref: 00381C16
Part of subcall function 00381BCC: GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00381C24
Part of subcall function 00381BCC: ___crtGetLocaleInfoA.LIBCMT ref: 00381C3D
Part of subcall function 00381BCC: __calloc_crt.LIBCMT ref: 00381C52
Part of subcall function 00381BCC: ___crtGetLocaleInfoA.LIBCMT ref: 00381C78
Part of subcall function 00381BCC: __calloc_crt.LIBCMT ref: 00381C89
Part of subcall function 00381BCC: _free.LIBCMT ref: 00381CA1

___crtLCMapStringA.LIBCMT ref: 0037C33C

Part of subcall function 0037C785: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0037C793
Part of subcall function 0037C785: __crtLCMapStringA_stat.LIBCMT ref: 0037C7B4

_memmove.LIBCMT ref: 0037C3E7
_memmove.LIBCMT ref: 0037C3F6
_memmove.LIBCMT ref: 0037C408
InterlockedDecrement.KERNEL32(?), ref: 0037C41B
_free.LIBCMT ref: 0037C431
_free.LIBCMT ref: 0037C444
_free.LIBCMT ref: 0037C452
_free.LIBCMT ref: 0037C45D
_free.LIBCMT ref: 0037C4A4
_free.LIBCMT ref: 0037C4B1
_free.LIBCMT ref: 0037C4B9
_free.LIBCMT ref: 0037C4C1
_free.LIBCMT ref: 0037C4C9
InterlockedDecrement.KERNEL32(?), ref: 0037C4E1

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: _free$___crt__calloc_crt$Locale$InfoString$_memmove$DecrementInterlocked$A_statErrorLastTypeUpdateUpdate::___crt__malloc_crt
String ID:
API String ID: 2149289317-0
Opcode ID: 522ca97f879ca1712cb5cd934076aea788e5429224d25d818ca0354508fc827e
Instruction ID: 3c7bed37ea910e424cc6923666e50cc9e2c8aada0b6fddca770cc1b39f8d7efa
Opcode Fuzzy Hash: 522ca97f879ca1712cb5cd934076aea788e5429224d25d818ca0354508fc827e
Instruction Fuzzy Hash: 07B19BB1D102059FDB22DFA5C895BFEBBF8BF08300F04856DE559AB241DB39A845DB20

Function 0037C103 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 306COMMON

Download Yara Rule

APIs

__malloc_crt.LIBCMT ref: 0037C1E6
__calloc_crt.LIBCMT ref: 0037C1F6
__calloc_crt.LIBCMT ref: 0037C201
__calloc_crt.LIBCMT ref: 0037C20C
__calloc_crt.LIBCMT ref: 0037C21B
GetCPInfo.KERNEL32(?,?), ref: 0037C26E
___crtGetStringTypeA.LIBCMT ref: 0037C2DC
___crtLCMapStringA.LIBCMT ref: 0037C30F

Part of subcall function 00381BCC: ___crtGetLocaleInfoA.LIBCMT ref: 00381C16
Part of subcall function 00381BCC: GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00381C24
Part of subcall function 00381BCC: ___crtGetLocaleInfoA.LIBCMT ref: 00381C3D
Part of subcall function 00381BCC: __calloc_crt.LIBCMT ref: 00381C52
Part of subcall function 00381BCC: ___crtGetLocaleInfoA.LIBCMT ref: 00381C78
Part of subcall function 00381BCC: __calloc_crt.LIBCMT ref: 00381C89
Part of subcall function 00381BCC: _free.LIBCMT ref: 00381CA1

_free.LIBCMT ref: 0037C4A4
_free.LIBCMT ref: 0037C4B1
_free.LIBCMT ref: 0037C4B9
_free.LIBCMT ref: 0037C4C1
_free.LIBCMT ref: 0037C4C9
InterlockedDecrement.KERNEL32(?), ref: 0037C4E1

Strings

7, xrefs: 0037C172

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: __calloc_crt_free$___crt$Info$Locale$String$DecrementErrorInterlockedLastType__malloc_crt
String ID: 7
API String ID: 1207360155-1790921346
Opcode ID: 525c972aaa64f45874ea8425cf3937d37314957464ed4215b72fed4f5e169e43
Instruction ID: 995e02aabab79dd456b0fae475178bd7fea875e508feba1b5ee945ebb2732d01
Opcode Fuzzy Hash: 525c972aaa64f45874ea8425cf3937d37314957464ed4215b72fed4f5e169e43
Instruction Fuzzy Hash: 1BB19DB1D142459FDB32CFA4C895AEEBBF8BF19300F04856EE459AB242D7399845CB21

Function 0037744F Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00377456

Part of subcall function 003773C3: __EH_prolog3_GS.LIBCMT ref: 003773CA

Part of subcall function 00372520: _memmove.LIBCMT ref: 00372539

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00000002,?,00000001,00000001,FyYnOTg1ICwkGCQIDh0bAQYeMDU9OgYaFgYPNzU9LhoGAAwWMD8EHxwdHQckGDsUAw==,Diamotrix,00000060,0037756E,?), ref: 003774C5
RegSetValueExW.ADVAPI32(?,SystemHandler,00000000,00000001,?,?), ref: 00377502
RegCloseKey.ADVAPI32(?), ref: 0037750F

Strings

FyYnOTg1ICwkGCQIDh0bAQYeMDU9OgYaFgYPNzU9LhoGAAwWMD8EHxwdHQckGDsUAw==, xrefs: 00377472
Diamotrix, xrefs: 0037745E
SystemHandler, xrefs: 003774FA

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: H_prolog3_$CloseOpenValue_memmove
String ID: Diamotrix$FyYnOTg1ICwkGCQIDh0bAQYeMDU9OgYaFgYPNzU9LhoGAAwWMD8EHxwdHQckGDsUAw==$SystemHandler
API String ID: 1044828830-2798639340
Opcode ID: 665e8c58c7b0fe1cf1c89f21d12dbbe5942b7b75c098e4262d509d651c3ac584
Instruction ID: fa5ce6ba87247464ae7861afc3d62b4a0b732048c8cae9bd7980524064f96eea
Opcode Fuzzy Hash: 665e8c58c7b0fe1cf1c89f21d12dbbe5942b7b75c098e4262d509d651c3ac584
Instruction Fuzzy Hash: 3B216271A04308AFEB22DBA4DC46FDEB7B5EF05700F108054F6187B191DAB5AD45DB61

Function 0037286C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00372873
std::_Lockit::_Lockit.LIBCPMT ref: 0037287D

Part of subcall function 00371430: std::_Lockit::_Lockit.LIBCPMT ref: 0037143E

__CxxThrowException@8.LIBCMT ref: 003728DA
std::locale::facet::_Incref.LIBCPMT ref: 003728EA
std::locale::facet::_Facet_Register.LIBCPMT ref: 003728F0

Strings

xu8, xrefs: 0037287A, 003728FA
bad cast, xrefs: 003728C4

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: LockitLockit::_std::_std::locale::facet::_$Exception@8Facet_H_prolog3IncrefRegisterThrow
String ID: bad cast$xu8
API String ID: 2049877948-2309142124
Opcode ID: 28589f42d701f0bedffbca5a17ef5d57cfa364bcb0d0a74c5dd0567edc26b74d
Instruction ID: 899f34f55562318336ee4d10e945234ec27268de577b7800e72516527ac10b6a
Opcode Fuzzy Hash: 28589f42d701f0bedffbca5a17ef5d57cfa364bcb0d0a74c5dd0567edc26b74d
Instruction Fuzzy Hash: 5E018B3281062AABCF23FB74C842AAE73347F04760F558299E4287F291DF3C9E019791

Function 00374102 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00374109
std::_Lockit::_Lockit.LIBCPMT ref: 00374115

Part of subcall function 00371430: std::_Lockit::_Lockit.LIBCPMT ref: 0037143E

__CxxThrowException@8.LIBCMT ref: 0037416B
std::locale::facet::_Incref.LIBCPMT ref: 0037417B
std::locale::facet::_Facet_Register.LIBCPMT ref: 00374181

Strings

#H7, xrefs: 00374112, 0037418B
bad cast, xrefs: 00374155

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: LockitLockit::_std::_std::locale::facet::_$Exception@8Facet_H_prolog3IncrefRegisterThrow
String ID: #H7$bad cast
API String ID: 2049877948-4086602006
Opcode ID: 7e71fea3e2dfac5b1c23e8ccb67dc8402e716b25621118971eb6c3c7d77cde2b
Instruction ID: d8d6d1cc6f259ae6ab81ed698d89a2175acfca430ec0e2bf017aec2b4c10c182
Opcode Fuzzy Hash: 7e71fea3e2dfac5b1c23e8ccb67dc8402e716b25621118971eb6c3c7d77cde2b
Instruction Fuzzy Hash: FD01C03591062997CF33FB74CC42AAD73346F14760F958298E4287B2D1DB7C6E048790

Function 0037714C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00377171

Part of subcall function 00378329: std::exception::exception.LIBCMT ref: 0037833E
Part of subcall function 00378329: __CxxThrowException@8.LIBCMT ref: 00378353
Part of subcall function 00378329: std::exception::exception.LIBCMT ref: 00378364

_memmove.LIBCMT ref: 003771A6
_memmove.LIBCMT ref: 003771B2
_memmove.LIBCMT ref: 003771C4
_memmove.LIBCMT ref: 003771FA

Strings

vector<T> too long, xrefs: 0037716C

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: _memmove$std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 4034224661-3788999226
Opcode ID: 604c009bdf02242858cf1b781fedbeef7f82567b54ec96e55865313723b6d315
Instruction ID: 155c768fd29ded7f9d33266399f899d7fb7aa798396451be948f5a2e41ce6237
Opcode Fuzzy Hash: 604c009bdf02242858cf1b781fedbeef7f82567b54ec96e55865313723b6d315
Instruction Fuzzy Hash: EA218175A00205AFCB26EF78DC8596EBBE9EF44304700C82DF45AD7341DA34E900CBA0

Function 0037D729 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,003881B8,00000008,0037D831,00000000,00000000,?,?,0037A8CC,00378FA7,?,?,00378B1B,?,?,003712F0), ref: 0037D73A
__lock.LIBCMT ref: 0037D76E

Part of subcall function 003808F6: __mtinitlocknum.LIBCMT ref: 0038090C
Part of subcall function 003808F6: __amsg_exit.LIBCMT ref: 00380918
Part of subcall function 003808F6: EnterCriticalSection.KERNEL32(00000000,00000000,?,0037D773,0000000D), ref: 00380920

InterlockedIncrement.KERNEL32(?), ref: 0037D77B
__lock.LIBCMT ref: 0037D78F
___addlocaleref.LIBCMT ref: 0037D7AD

Strings

KERNEL32.DLL, xrefs: 0037D735

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 96590516bbe5dc3803e6951742a567ca0abaed541c3b42c03d3cd8f31ff7d371
Instruction ID: 95149ae5eba1e952f238e9d6d89a91086c48aec1d504e6298c0a02534ec89d19
Opcode Fuzzy Hash: 96590516bbe5dc3803e6951742a567ca0abaed541c3b42c03d3cd8f31ff7d371
Instruction Fuzzy Hash: E1016D75440B009FE722AF79D84674AFBF0AF50321F10898EE59A9A6A0CBB4A644CF51

Function 00371323 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0037132A
std::_Lockit::_Lockit.LIBCPMT ref: 00371337
std::exception::exception.LIBCMT ref: 0037136E

Part of subcall function 00378B26: std::exception::_Copy_str.LIBCMT ref: 00378B41

__CxxThrowException@8.LIBCMT ref: 00371383

Part of subcall function 0037935C: RaiseException.KERNEL32(?,00372868,h(7,?,?,?,?,?,00372868,?,00388518,00000000), ref: 0037939E

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0037138C

Strings

bad locale name, xrefs: 00371367

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: std::_$Copy_strExceptionException@8H_prolog3Locinfo::_Locinfo_ctorLockitLockit::_RaiseThrowstd::exception::_std::exception::exception
String ID: bad locale name
API String ID: 637683493-1405518554
Opcode ID: 562d1bcf8ba30a00fbb9cb3afadcd94f30f069cd2ec06d449813acf85e9848c1
Instruction ID: 5cd045337cdbfdb13f223f51cfb063d5e2b6eb9e3ee9d4b7e54ae58ec4b3ac3a
Opcode Fuzzy Hash: 562d1bcf8ba30a00fbb9cb3afadcd94f30f069cd2ec06d449813acf85e9848c1
Instruction Fuzzy Hash: 9A018475541745DECB32EF59C4815CEBFE0BF28310B90C55EE18D5B601CB74A609CBA5

Function 0037E2C9 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0037E2EA

Part of subcall function 0037D856: __getptd_noexit.LIBCMT ref: 0037D859
Part of subcall function 0037D856: __amsg_exit.LIBCMT ref: 0037D866

__getptd.LIBCMT ref: 0037E2FB
__getptd.LIBCMT ref: 0037E309

Strings

RCC, xrefs: 0037E2D5
csm, xrefs: 0037E2E3
MOC, xrefs: 0037E2DC

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 3595e75553568fa1a7dc9b2ad10d36955dc1367fb4177b3df410771cda05f294
Instruction ID: 783f7c01e0814c5da8637556e98200daa89620161c8c4db45bdfbc7a68c82995
Opcode Fuzzy Hash: 3595e75553568fa1a7dc9b2ad10d36955dc1367fb4177b3df410771cda05f294
Instruction Fuzzy Hash: 17E09239114104DEDB31A768C04A76836A9BF4D314F5684F9E54DCF223D73CD9509597

Function 0037E57B Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 0037E5A3

Part of subcall function 00379687: __getptd.LIBCMT ref: 00379695
Part of subcall function 00379687: __getptd.LIBCMT ref: 003796A3

__getptd.LIBCMT ref: 0037E5AD

Part of subcall function 0037D856: __getptd_noexit.LIBCMT ref: 0037D859
Part of subcall function 0037D856: __amsg_exit.LIBCMT ref: 0037D866

__getptd.LIBCMT ref: 0037E5BB
__getptd.LIBCMT ref: 0037E5C9
__getptd.LIBCMT ref: 0037E5D4
_CallCatchBlock2.LIBCMT ref: 0037E5FA

Part of subcall function 0037972C: __CallSettingFrame@12.LIBCMT ref: 00379778

Part of subcall function 0037E6A1: __getptd.LIBCMT ref: 0037E6B0
Part of subcall function 0037E6A1: __getptd.LIBCMT ref: 0037E6BE

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 31505768013823702ad4d14694dc82dd0c242db22febdfc1eaa0503b65b7b758
Instruction ID: 50d5e4d2c892c9658f557741a314d0f4504571db36cb0192c46445e73523dc0f
Opcode Fuzzy Hash: 31505768013823702ad4d14694dc82dd0c242db22febdfc1eaa0503b65b7b758
Instruction Fuzzy Hash: DE11D7B1D10209EFDB11EFA4C546BADBBB0FF08311F11C1A9F818AB251DB389A159F55

Function 00380B4C Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00380B58

Part of subcall function 0037D856: __getptd_noexit.LIBCMT ref: 0037D859
Part of subcall function 0037D856: __amsg_exit.LIBCMT ref: 0037D866

__amsg_exit.LIBCMT ref: 00380B78
__lock.LIBCMT ref: 00380B88
InterlockedDecrement.KERNEL32(?), ref: 00380BA5
_free.LIBCMT ref: 00380BB8
InterlockedIncrement.KERNEL32(00BC2D18), ref: 00380BD0

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: a741a39e6fc7c592f246307dc5d870936a6e815558c1a77940ce5bc88c55c745
Instruction ID: a160b0c1d20b7cc15b1a4d215c8ed7a5b2dc15607d5f7acf3a81abdd38d48786
Opcode Fuzzy Hash: a741a39e6fc7c592f246307dc5d870936a6e815558c1a77940ce5bc88c55c745
Instruction Fuzzy Hash: 6701D635D01B119BDB67BBA5984574EB3A4BF04724F0241C5F8146B6A0CB38DC85DBD2

Function 0037139D Relevance: 9.0, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003713A4
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 003713B4

Part of subcall function 00378137: _setlocale.LIBCMT ref: 00378149

_free.LIBCMT ref: 003713C2

Part of subcall function 00378F81: HeapFree.KERNEL32(00000000,00000000,?,00378B1B,?,?,003712F0), ref: 00378F97
Part of subcall function 00378F81: GetLastError.KERNEL32(?,?,00378B1B,?,?,003712F0), ref: 00378FA9

_free.LIBCMT ref: 003713D4
_free.LIBCMT ref: 003713E6
_free.LIBCMT ref: 003713F8

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: _free$ErrorFreeH_prolog3HeapLastLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 2259855018-0
Opcode ID: 8bf83d82cc2554b2413a2bf30fcbd7bfb660c55c2de1c6fbb0213c74f1cec3ea
Instruction ID: ca424a4c24ffd74fd12f05fd1c883b86c99e4d60bbe3c5fe7690884cebeb2252
Opcode Fuzzy Hash: 8bf83d82cc2554b2413a2bf30fcbd7bfb660c55c2de1c6fbb0213c74f1cec3ea
Instruction Fuzzy Hash: 51018F36640B019BEB32AF64D50AB4B73E89F00726F04CA0CE049DB9C1CF7CE5058B60

Function 00373780 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 283COMMON

Download Yara Rule

Strings

xu8, xrefs: 00373B17
A8, xrefs: 00373B2E
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_, xrefs: 00373852

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID:
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_$xu8$A8
API String ID: 0-1802606187
Opcode ID: 1a571e319f9e63047a56886a367350974b41259edd6d31f73a507b68040bc120
Instruction ID: 1f2c848b9db98849f98363fb37a3d5ec6f5cfcbc9540fe2560449f818eca5c60
Opcode Fuzzy Hash: 1a571e319f9e63047a56886a367350974b41259edd6d31f73a507b68040bc120
Instruction Fuzzy Hash: 22B18131204245AFDB26DF18C4C5BA57BE5AF46310F59C4A9EC8D8F246C378EA44EB62

Function 00375C04 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 280COMMON

Download Yara Rule

Strings

xu8, xrefs: 00375F90
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_, xrefs: 00375CD7
A8, xrefs: 00375FA7

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID:
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_$xu8$A8
API String ID: 0-1802606187
Opcode ID: 0f2f0a9f8533811a7c8001c4a1842df9374ae7bbd94d9fefc5704d072c76ddcd
Instruction ID: b03441cd446db6ce787f3248bea42eca23cc31d96abbb8a56bcb6047bd88e6a3
Opcode Fuzzy Hash: 0f2f0a9f8533811a7c8001c4a1842df9374ae7bbd94d9fefc5704d072c76ddcd
Instruction Fuzzy Hash: 3DB1C071204B42DFD73BCF28C085BAAB7E5AF49300F55884DE4DE8B681C7B8A984DB51

Function 00376D00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00376D07
std::_Xinvalid_argument.LIBCPMT ref: 00376D2D

Part of subcall function 00378329: std::exception::exception.LIBCMT ref: 0037833E
Part of subcall function 00378329: __CxxThrowException@8.LIBCMT ref: 00378353
Part of subcall function 00378329: std::exception::exception.LIBCMT ref: 00378364

_memmove.LIBCMT ref: 00376D69
_memmove.LIBCMT ref: 00376D8C

Strings

vector<T> too long, xrefs: 00376D28

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: _memmovestd::exception::exception$Exception@8H_prolog3_catchThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 3478911975-3788999226
Opcode ID: 709893b6add2088a32cba9ac0a4b65b3e50a6de1f3af4c2a12f5630ae943385a
Instruction ID: c550fc31a15f00d3d876c4a2bea864f598b34274c8ea3444fac5fb2c715acaca
Opcode Fuzzy Hash: 709893b6add2088a32cba9ac0a4b65b3e50a6de1f3af4c2a12f5630ae943385a
Instruction Fuzzy Hash: D5218575A00605AFCB26EF78CD569AE7BA2EF44300B14C42DF85D9B351DE35E910CB90

Function 00377D4E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00377D64

Part of subcall function 00378376: std::exception::exception.LIBCMT ref: 0037838B
Part of subcall function 00378376: __CxxThrowException@8.LIBCMT ref: 003783A0
Part of subcall function 00378376: std::exception::exception.LIBCMT ref: 003783B1

std::_Xinvalid_argument.LIBCPMT ref: 00377D83
_memmove.LIBCMT ref: 00377DC6

Strings

string too long, xrefs: 00377D7E
invalid string position, xrefs: 00377D5F

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: 4593194b4d58e0bc295e7d77278df2e7b7449f6f9d04cb0c35754f5dc429b064
Instruction ID: 403ca08cb31a3d4538888b9e1626e9c2bfc72eb9f2acfea7869ef39e53cd7883
Opcode Fuzzy Hash: 4593194b4d58e0bc295e7d77278df2e7b7449f6f9d04cb0c35754f5dc429b064
Instruction Fuzzy Hash: 7411DD302186049BCB36DF2CD885C6AB3F6FF807147218A5DF45ACB660EB34EA04CB90

Function 003725E1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 003725F0

Part of subcall function 00378376: std::exception::exception.LIBCMT ref: 0037838B
Part of subcall function 00378376: __CxxThrowException@8.LIBCMT ref: 003783A0
Part of subcall function 00378376: std::exception::exception.LIBCMT ref: 003783B1

std::_Xinvalid_argument.LIBCPMT ref: 00372604
_memmove.LIBCMT ref: 0037263F

Strings

string too long, xrefs: 003725FF
invalid string position, xrefs: 003725EB

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 3404309857-4289949731
Opcode ID: c8c2e0bb4935b81373c0cd4324870cfa712a3cbe529d5285b06042df0b4efc09
Instruction ID: e62eaa07bc947920c067b9e6e78ed7d8daf74878d60a8e2bc3962a197f59161f
Opcode Fuzzy Hash: c8c2e0bb4935b81373c0cd4324870cfa712a3cbe529d5285b06042df0b4efc09
Instruction Fuzzy Hash: 4C01D6703002019BD72BAF2C9895D6AF367AF91710F54861AF41ADB682DBA8ED548390

Function 0037E928 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 0037E93B

Part of subcall function 0037E896: ___BuildCatchObjectHelper.LIBCMT ref: 0037E8CC

_UnwindNestedFrames.LIBCMT ref: 0037E952
___FrameUnwindToState.LIBCMT ref: 0037E960

Strings

csm, xrefs: 0037E937, 0037E94C, 0037E95F, 0037E97D, 0037E98D
csm, xrefs: 0037E92A

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 25b235255ab6597edc552ed3ef3507b70867476e850620615844bf3548dffac4
Instruction ID: 27e573e4d8ec3cdc2e49ec6dc99ac4c6db73ecd699b89dc328eac2cbee2f4fec
Opcode Fuzzy Hash: 25b235255ab6597edc552ed3ef3507b70867476e850620615844bf3548dffac4
Instruction Fuzzy Hash: 5C01E836401109BBDF235F51CC45EEA7F6AEF0A354F048054FD1C19161D73A9971EBA1

Function 0037184C Relevance: 7.5, APIs: 5, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00371853
GlobalAlloc.KERNEL32(00000002,?,00000000,00371B3D,?), ref: 00371863
GlobalLock.KERNEL32(00000000), ref: 0037187A
_memmove.LIBCMT ref: 00371881
GlobalUnlock.KERNEL32(00000000), ref: 0037188A

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: Global$AllocH_prolog3LockUnlock_memmove
String ID:
API String ID: 2164542303-0
Opcode ID: baeb6bdfc46616442d242ffb53335b39678153d5316dbc22c3c47df5442dd526
Instruction ID: cb45063f8fc9e64f3483898b88574bab87da8f137aa85d0982ea6827ccabce47
Opcode Fuzzy Hash: baeb6bdfc46616442d242ffb53335b39678153d5316dbc22c3c47df5442dd526
Instruction Fuzzy Hash: E2F04F76401205EFDB12AFA0EC0DB9F7E2CEF55751F004054F60A9A191CBB56941DBA1

Function 00380703 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0038070F

Part of subcall function 0037D856: __getptd_noexit.LIBCMT ref: 0037D859
Part of subcall function 0037D856: __amsg_exit.LIBCMT ref: 0037D866

__getptd.LIBCMT ref: 00380726
__amsg_exit.LIBCMT ref: 00380734
__lock.LIBCMT ref: 00380744
__updatetlocinfoEx_nolock.LIBCMT ref: 00380758

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: dd5b12a0275ff284389f7ee8be1f1a09ee9dcee5aefc0f5937ce47c1839cbc27
Instruction ID: 57b586dc89eff2dfdb0ad6e53b7b9354063d75600d11341747894cc155ef1903
Opcode Fuzzy Hash: dd5b12a0275ff284389f7ee8be1f1a09ee9dcee5aefc0f5937ce47c1839cbc27
Instruction Fuzzy Hash: A3F096319407009BE77BBB74980374933A0AF00720F1281C9F4496E2D2DB686945CB56

Function 003735E7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003735EE
__Strxfrm.LIBCPMT ref: 003736A3
std::_Xinvalid_argument.LIBCPMT ref: 003736D2

Part of subcall function 0037266F: std::_Xinvalid_argument.LIBCPMT ref: 0037267E
Part of subcall function 0037266F: _memmove.LIBCMT ref: 003726B4

Strings

string too long, xrefs: 003736CD

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$H_prolog3Strxfrm_memmove
String ID: string too long
API String ID: 1992344758-2556327735
Opcode ID: c39e55a1c0b75a537e9da3f5760e18c41d49c23a91e239913151e5f7c0d72070
Instruction ID: d4216fc04f1dd798aff4f4a41dd49dd1db91de1782df8bdd8ef6b428823c5e13
Opcode Fuzzy Hash: c39e55a1c0b75a537e9da3f5760e18c41d49c23a91e239913151e5f7c0d72070
Instruction Fuzzy Hash: 8E31A770700202ABCB3AEF38C4D067EB772BF44310B65C61DE41A9B791D778AE50A791

Function 0037D3BD Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(00000000,003789D7), ref: 0037D3C0
__malloc_crt.LIBCMT ref: 0037D3EF
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0037D3FC

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: EnvironmentStrings$Free__malloc_crt
String ID:
API String ID: 237123855-0
Opcode ID: f2daf633ae3358b24cc1a37fd6714d6b9a0da05adabc4a1b971eca608bc7fa1b
Instruction ID: 1e2e7cdef2681c62fd46b126d87c7fd5444635a4468852ea8f060b9dd722d949
Opcode Fuzzy Hash: f2daf633ae3358b24cc1a37fd6714d6b9a0da05adabc4a1b971eca608bc7fa1b
Instruction Fuzzy Hash: 4BF0E2BB504110AAEA337734BC4986B6638DED132631BC055F58AD7240FA68CD4187A2

Function 0037787E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00377897

Part of subcall function 00378376: std::exception::exception.LIBCMT ref: 0037838B
Part of subcall function 00378376: __CxxThrowException@8.LIBCMT ref: 003783A0
Part of subcall function 00378376: std::exception::exception.LIBCMT ref: 003783B1

Part of subcall function 00377A44: std::_Xinvalid_argument.LIBCPMT ref: 00377A57

_memmove.LIBCMT ref: 003778F2

Strings

invalid string position, xrefs: 00377892

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position
API String ID: 3404309857-1799206989
Opcode ID: 59396cc7608f6fe53a81899a4f9d737761b2948f3bcb95f655673eb154d1c552
Instruction ID: c6e7088e08011bba319c646ea42f573bd3a075c151de5e39d651a9c5df5519ef
Opcode Fuzzy Hash: 59396cc7608f6fe53a81899a4f9d737761b2948f3bcb95f655673eb154d1c552
Instruction Fuzzy Hash: C311E631728309EBCB32EE2CD485869B3A9FB413243108529E55DDF201E774E940CB92

Function 00377DEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00377E2B
_memmove.LIBCMT ref: 00377E5E

Strings

string too long, xrefs: 00377E26

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: 7f5df2946be1776883a616938bb0e53246722e2b52f024bc2d8a6c2f1c1e92f3
Instruction ID: 5336e9204c88b55b1774ff93ed08fab710275438cb5ac9975b59799034930b67
Opcode Fuzzy Hash: 7f5df2946be1776883a616938bb0e53246722e2b52f024bc2d8a6c2f1c1e92f3
Instruction Fuzzy Hash: EC11A3703087049BCA32DE6CDC858AAB3E9EF057447218A5DF98ECBA51E738AD14C7D5

Function 00372495 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 003724AB

Part of subcall function 00378376: std::exception::exception.LIBCMT ref: 0037838B
Part of subcall function 00378376: __CxxThrowException@8.LIBCMT ref: 003783A0
Part of subcall function 00378376: std::exception::exception.LIBCMT ref: 003783B1

Part of subcall function 003726D9: std::_Xinvalid_argument.LIBCPMT ref: 003726E3

_memmove.LIBCMT ref: 003724FD

Strings

invalid string position, xrefs: 003724A6

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position
API String ID: 3404309857-1799206989
Opcode ID: 90bf30146eae2638dc23dc3557adb9b522d9a24e6c56cc07d95545fe2a4229a1
Instruction ID: c172ca3bbfdb90f8e1fd53a8ca191f35720117ba9b03dc51a68c45a8767f4dd9
Opcode Fuzzy Hash: 90bf30146eae2638dc23dc3557adb9b522d9a24e6c56cc07d95545fe2a4229a1
Instruction Fuzzy Hash: B911ED313002009BDB36EE2DC88496BB369AF45320B048619F81ECF642D778ED80CBE1

Function 00375AD7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00375ADE
std::_Xinvalid_argument.LIBCPMT ref: 00375AF4

Part of subcall function 00378329: std::exception::exception.LIBCMT ref: 0037833E
Part of subcall function 00378329: __CxxThrowException@8.LIBCMT ref: 00378353
Part of subcall function 00378329: std::exception::exception.LIBCMT ref: 00378364

Strings

vector<T> too long, xrefs: 00375AEF

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: std::exception::exception$Exception@8H_prolog3_catchThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 1877048013-3788999226
Opcode ID: c010e001247fe0058f213dcf292f4267de87281bd412054213632ab9f85586dd
Instruction ID: 7ed98a6bf21674ee3672a3a62954c8f7e7bf76681823ebc4ebce77925dbf8220
Opcode Fuzzy Hash: c010e001247fe0058f213dcf292f4267de87281bd412054213632ab9f85586dd
Instruction Fuzzy Hash: 0B117376A007018BC73AEFA9C582B2DF7E1EF54710B31842EE05DDB680DAB499008B10

Function 003779D3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 003779E2

Part of subcall function 00378376: std::exception::exception.LIBCMT ref: 0037838B
Part of subcall function 00378376: __CxxThrowException@8.LIBCMT ref: 003783A0
Part of subcall function 00378376: std::exception::exception.LIBCMT ref: 003783B1

_memmove.LIBCMT ref: 00377A1D

Strings

invalid string position, xrefs: 003779DD

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: 12d72bf8ea4d161c6d8ce699b09655e60acf928a016096f0dac1ca0d0a81fae6
Instruction ID: 18b47fc76de0d5a7b0f0b29cdb273d4f9714b7b20818b48b2701b028b5b71ae4
Opcode Fuzzy Hash: 12d72bf8ea4d161c6d8ce699b09655e60acf928a016096f0dac1ca0d0a81fae6
Instruction Fuzzy Hash: 23017C313186058BD773CE6CD98481FB3AAAFC57443208A2DD08ACBB19FB34DA46C790

Function 0037266F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0037267E

Part of subcall function 00378376: std::exception::exception.LIBCMT ref: 0037838B
Part of subcall function 00378376: __CxxThrowException@8.LIBCMT ref: 003783A0
Part of subcall function 00378376: std::exception::exception.LIBCMT ref: 003783B1

_memmove.LIBCMT ref: 003726B4

Strings

invalid string position, xrefs: 00372679

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: bb8be379d194b17ac7b8841cd7bd6ac3ba745ff0fb997a5c0bf46f18a39421c4
Instruction ID: 26bd7592bf2f14a72bd0feb52eca64239a3d2e62dd8da524563f90dff4f7ba43
Opcode Fuzzy Hash: bb8be379d194b17ac7b8841cd7bd6ac3ba745ff0fb997a5c0bf46f18a39421c4
Instruction Fuzzy Hash: B30181713106418BD7369E6899C481BB2F6DBC47013318D3ED48ACBA45DBF8E88697A0

Function 00377E83 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00377E8A
std::_Xinvalid_argument.LIBCPMT ref: 00377EC4

Strings

string too long, xrefs: 00377EBF

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: H_prolog3_catchXinvalid_argumentstd::_
String ID: string too long
API String ID: 4202626062-2556327735
Opcode ID: 3081f875d89ba89bc3e736e8ffc5ff373ccf4c4caee8f67ed365f5ff42215e8f
Instruction ID: 35dfb5c3771fcb40e79924c9c21a7b7132ff6238d99b3b67af9fc5945161f02d
Opcode Fuzzy Hash: 3081f875d89ba89bc3e736e8ffc5ff373ccf4c4caee8f67ed365f5ff42215e8f
Instruction Fuzzy Hash: C511AD34218244DBCB32EF28C481A6D73B1BF05701F118989F49A9FA91CB78EE04CB50

Function 0037E6A1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003796DA: __getptd.LIBCMT ref: 003796E0
Part of subcall function 003796DA: __getptd.LIBCMT ref: 003796F0

__getptd.LIBCMT ref: 0037E6B0

Part of subcall function 0037D856: __getptd_noexit.LIBCMT ref: 0037D859
Part of subcall function 0037D856: __amsg_exit.LIBCMT ref: 0037D866

__getptd.LIBCMT ref: 0037E6BE

Strings

csm, xrefs: 0037E6CC

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 2b657408d7d58b165f9881259de63ca9f2c423451cb0bacc366fca116bd4e8e8
Instruction ID: e7af5f36010194808629a878777299bfb99bdc8da1ee6a449541c68d6c759f3f
Opcode Fuzzy Hash: 2b657408d7d58b165f9881259de63ca9f2c423451cb0bacc366fca116bd4e8e8
Instruction Fuzzy Hash: CD016D38800304DBCF3A9FA4C5406ACB3B5AF58311F65C5AEE44D6A651DB389980CF51

Function 00379874 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

_strcat_s.LIBCMT ref: 00379893
__invoke_watson.LIBCMT ref: 003798AF

Strings

xC8, xrefs: 00379885, 0037988B

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: __invoke_watson_strcat_s
String ID: xC8
API String ID: 228796091-1458914466
Opcode ID: 5bd9e7f66acca802be05aafd13a64e3d15df58761cecbc98076716d1073d3281
Instruction ID: b3d2f5b4464a943e1f407e8ec334192916247ddc7f241c729913527c4c5aecbe
Opcode Fuzzy Hash: 5bd9e7f66acca802be05aafd13a64e3d15df58761cecbc98076716d1073d3281
Instruction Fuzzy Hash: 33E092735002097BCF221E56DC8199A771EFBC1365B024572FD1C56011D232D96297A1

Function 003717CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(User32.dll), ref: 003717D2
GetProcAddress.KERNEL32(00000000,?), ref: 003717E0

Strings

User32.dll, xrefs: 003717CD

Memory Dump Source

Source File: 00000003.00000002.2192516628.0000000000371000.00000020.00000001.01000000.00000004.sdmp, Offset: 00370000, based on PE: true

Associated: 00000003.00000002.2192495060.0000000000370000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192534368.0000000000384000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192547431.000000000038A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000003.00000002.2192558879.000000000038D000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_370000_svcapp.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: User32.dll
API String ID: 2574300362-1293261179
Opcode ID: e2240f867026b4e40be70e038f51955eaed80701a67e5cba25cc1da17c670945
Instruction ID: b1109889a97cc2c7fce4099ccd86b8eac67ae2a5ebd61ed73be4125bfcfbb601
Opcode Fuzzy Hash: e2240f867026b4e40be70e038f51955eaed80701a67e5cba25cc1da17c670945
Instruction Fuzzy Hash: 8EC08C76284309AB8F222FF5BC099977B9CEB00792B040091FA0CC0810EA76C41097A1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7zba89tklZ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\svcapp.exe

C:\Users\user\AppData\Local\Microsoft\svcapp.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: 7zba89tklZ.exePID: 5700, Parent PID: 1028

General

Chronological Activities

Analysis Process: 7zba89tklZ.exePID: 4836, Parent PID: 1028

Windows Analysis Report
7zba89tklZ.exe

Function 004F19DF Relevance: 27.6, APIs: 1, Strings: 17, Instructions: 550
sleepCOMMON

Function 004F7529 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 205
filesleepCOMMON

Function 004F2235 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 32
sleepsynchronizationthreadCOMMON

Function 004F1000 Relevance: 3.0, APIs: 2, Instructions: 14
libraryloaderCOMMON

Function 004F744F Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74
registryCOMMON

Function 004F91DE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
COMMONLIBRARYCODE

Function 004F92DC Relevance: 6.0, APIs: 4, Instructions: 41
COMMONLIBRARYCODE

Function 004F2B41 Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Function 004F234F Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Function 004F5076 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON