Edit tour

Windows Analysis Report
L8RabfF1Hu.exe

Overview

General Information

Sample name:	L8RabfF1Hu.exe renamed because original name is a hash value
Original sample name:	7dc3627f121e4ac23e7affcb9d4d39eb.exe
Analysis ID:	1581104
MD5:	7dc3627f121e4ac23e7affcb9d4d39eb
SHA1:	95e744683d218bb54e3a097c55105a83b14b28ba
SHA256:	4eed23e6951e180df044af350b6dbd83fb33de00d7c70ad9b23764f26d76a66d
Tags:	exeValleyRATuser-abuse_ch
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Contains functionality to capture and log keystrokes

Contains functionality to detect sleep reduction / modifications

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to detect virtual machines (SLDT)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to modify clipboard data

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found potential string decryption / allocating functions

Installs a global mouse hook

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Stores large binary data to the registry

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

L8RabfF1Hu.exe (PID: 7572 cmdline: "C:\Users\user\Desktop\L8RabfF1Hu.exe" MD5: 7DC3627F121E4AC23E7AFFCB9D4D39EB)

conhost.exe (PID: 7580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Suricata Signatures

ET MALWARE Anonymous RAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T00:12:04.230350+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49731	154.201.87.51	11111	TCP
2024-12-27T00:13:45.610653+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49836	154.201.87.51	6666	TCP
2024-12-27T00:14:50.078035+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49836	154.201.87.51	6666	TCP
2024-12-27T00:15:59.761533+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49930	154.201.87.51	11111	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: L8RabfF1Hu.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for sample

Source: L8RabfF1Hu.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Unpacked PE file: 0.2.L8RabfF1Hu.exe.400000.0.unpack

Source: L8RabfF1Hu.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: L8RabfF1Hu.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	File opened: [:	Jump to behavior

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_2_2BB780F0 wsprintfW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

0_2_2BB780F0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49731 -> 154.201.87.51:11111
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49836 -> 154.201.87.51:6666
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49930 -> 154.201.87.51:11111

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 154.201.87.51:11111

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 8.8.8.8:53

Source: Joe Sandbox View

ASN Name: PEGTECHINCUS PEGTECHINCUS

Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51
Source: unknown	TCP traffic detected without corresponding DNS query: 154.201.87.51

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_3_2D4D2FC0 recv,select,recv,

0_3_2D4D2FC0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: [esc]	0_2_2BB7E850
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: [esc]	0_2_2BB7E850
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: [esc]	0_2_2BB7E850
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: [esc]	0_2_2BB7E850

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_3_2D4D57A0 BlockInput,BlockInput,BlockInput,InterlockedExchange,SetEvent,InterlockedExchange,BlockInput,InterlockedExchange,OpenClipboard,

0_3_2D4D57A0

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_3_2D4D6120 EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalFree,CloseClipboard,

0_3_2D4D6120

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_3_2D4D6170 OpenClipboard,GetClipboardData,CloseClipboard,GlobalSize,GlobalLock,GlobalUnlock,CloseClipboard,

0_3_2D4D6170

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_2_2BB7BC70 GetDesktopWindow,GetDC,GetDC,CreateCompatibleDC,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateCompatibleBitmap,SelectObject,SetStretchBltMode,GetSystemMetrics,GetSystemMetrics,StretchBlt,_memset,GetDIBits,_memset,DeleteObject,DeleteObject,ReleaseDC,DeleteObject,DeleteObject,ReleaseDC,

0_2_2BB7BC70

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_2_2BB7E4F0 Sleep,CreateMutexW,GetLastError,SHGetFolderPathW,lstrcatW,CreateMutexW,WaitForSingleObject,CreateFileW,GetFileSize,CloseHandle,DeleteFileW,ReleaseMutex,DirectInput8Create,GetTickCount,GetKeyState,

0_2_2BB7E4F0

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Jump to behavior

Source: L8RabfF1Hu.exe

Binary or memory string: MB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointQyzylorda Standard TimeRegisterRawInputDevicesRtlGetNtVersionNumbers

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_2_00DA1960 NtWaitForSingleObject,

0_2_00DA1960

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB7B43F ExitWindowsEx,	0_2_2BB7B43F
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB7B41B ExitWindowsEx,	0_2_2BB7B41B
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB7B463 ExitWindowsEx,	0_2_2BB7B463

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4FE521	0_3_2D4FE521
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4EEDC7	0_3_2D4EEDC7
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4EE5E7	0_3_2D4EE5E7
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4EFD87	0_3_2D4EFD87
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4E0D80	0_3_2D4E0D80
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4EF5A7	0_3_2D4EF5A7
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4FDCC0	0_3_2D4FDCC0
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4D24B0	0_3_2D4D24B0
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4E2EE7	0_3_2D4E2EE7
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4DB6FD	0_3_2D4DB6FD
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4E1EFE	0_3_2D4E1EFE
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4EF847	0_3_2D4EF847
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4EF067	0_3_2D4EF067
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4E1822	0_3_2D4E1822
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4EE887	0_3_2D4EE887
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4EE344	0_3_2D4EE344
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4EF307	0_3_2D4EF307
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4EEB27	0_3_2D4EEB27
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4F3200	0_3_2D4F3200
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4E12D1	0_3_2D4E12D1
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4EFAE7	0_3_2D4EFAE7
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_00410120	0_2_00410120
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_0040FBCF	0_2_0040FBCF
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_0040F67E	0_2_0040F67E
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_00409F6C	0_2_00409F6C
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_00411731	0_2_00411731
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_004107FC	0_2_004107FC
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_00D75AD0	0_2_00D75AD0
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_00D8DB90	0_2_00D8DB90
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_00D51410	0_2_00D51410
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_00D4F530	0_2_00D4F530
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_00D4B520	0_2_00D4B520
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_00D50ED0	0_2_00D50ED0
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_00D47EC0	0_2_00D47EC0
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_00D47EC0	0_2_00D47EC0
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_00D57F40	0_2_00D57F40
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB76EE0	0_2_2BB76EE0
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB76C50	0_2_2BB76C50
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB88381	0_2_2BB88381
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB8E341	0_2_2BB8E341
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB8EA1D	0_2_2BB8EA1D
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB8F9FF	0_2_2BB8F9FF
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB78900	0_2_2BB78900
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB8D89F	0_2_2BB8D89F
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB8DDF0	0_2_2BB8DDF0
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB724B0	0_2_2BB724B0
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BA0F3BE	0_2_2BA0F3BE
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2B9F82BF	0_2_2B9F82BF
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BA0D25E	0_2_2BA0D25E
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2B9F689F	0_2_2B9F689F
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BA0D7AF	0_2_2BA0D7AF
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2B9F660F	0_2_2B9F660F
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2B9F1E6F	0_2_2B9F1E6F
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BA0DD00	0_2_2BA0DD00
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BA07D40	0_2_2BA07D40

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: String function: 2D4DABD0 appears 32 times
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: String function: 00D76FF0 appears 220 times
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: String function: 00D74F40 appears 228 times
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: String function: 2BB84300 appears 32 times

Source: L8RabfF1Hu.exe

Static PE information: Number of sections : 14 > 10

Source: L8RabfF1Hu.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: L8RabfF1Hu.exe	Static PE information: Section: /19 ZLIB complexity 0.9995365466101694
Source: L8RabfF1Hu.exe	Static PE information: Section: /32 ZLIB complexity 0.993195564516129
Source: L8RabfF1Hu.exe	Static PE information: Section: /65 ZLIB complexity 0.9999405139593909
Source: L8RabfF1Hu.exe	Static PE information: Section: /78 ZLIB complexity 0.9967559205840456
Source: L8RabfF1Hu.exe	Static PE information: Section: /90 ZLIB complexity 0.9889777131782945

Source: classification engine

Classification label: mal88.spyw.evad.winEXE@2/0@0/2

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB77B70 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	0_2_2BB77B70
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB77740 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,	0_2_2BB77740
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB77620 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,	0_2_2BB77620

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_2_2BB76C50 wsprintfW,MultiByteToWideChar,GetDriveTypeW,GetDiskFreeSpaceExW,_memset,GlobalMemoryStatusEx,swprintf,swprintf,

0_2_2BB76C50

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_2_2BB76050 _memset,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,CloseHandle,

0_2_2BB76050

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_2_2BB76150 wsprintfW,_memset,lstrcatW,lstrcatW,lstrcatW,CoCreateInstance,wsprintfW,RegOpenKeyExW,_memset,wsprintfW,RegOpenKeyExW,_memset,RegQueryValueExW,lstrcatW,lstrcatW,lstrcatW,RegCloseKey,lstrlenW,lstrcatW,

0_2_2BB76150

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7580:120:WilError_03
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Mutant created: \Sessions\1\BaseNamedObjects\??

Source: L8RabfF1Hu.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: L8RabfF1Hu.exe

ReversingLabs: Detection: 39%

Source: L8RabfF1Hu.exe

String found in binary or memory: C:/Program Files (x86)/Go/src/net/addrselect.go

Source: unknown	Process created: C:\Users\user\Desktop\L8RabfF1Hu.exe "C:\Users\user\Desktop\L8RabfF1Hu.exe"
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62BE5D10-60EB-11d0-BD3B-00A0C911CE86}\InprocServer32

Jump to behavior

Source: L8RabfF1Hu.exe

Static file information: File size 2926592 > 1048576

Source: L8RabfF1Hu.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Unpacked PE file: 0.2.L8RabfF1Hu.exe.400000.0.unpack

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_3_2D4DC57C LoadLibraryW,GetProcAddress,GetProcAddress,EncodePointer,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_3_2D4DC57C

Source: L8RabfF1Hu.exe	Static PE information: section name: /4
Source: L8RabfF1Hu.exe	Static PE information: section name: /19
Source: L8RabfF1Hu.exe	Static PE information: section name: /32
Source: L8RabfF1Hu.exe	Static PE information: section name: /46
Source: L8RabfF1Hu.exe	Static PE information: section name: /65
Source: L8RabfF1Hu.exe	Static PE information: section name: /78
Source: L8RabfF1Hu.exe	Static PE information: section name: /90
Source: L8RabfF1Hu.exe	Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4DAC15 push ecx; ret	0_3_2D4DAC28
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_00409395 push ecx; ret	0_2_004093A8
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_00411DB0 push eax; ret	0_2_00411DCE
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_00D5868F pushfd ; ret	0_2_00D58690
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB84345 push ecx; ret	0_2_2BB84358
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB92470 push ebp; retf	0_2_2BB92474
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB92450 push ebp; retf	0_2_2BB92474
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BA03D04 push ecx; ret	0_2_2BA03D17

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_2_2BB7B3C0 OpenEventLogW,OpenEventLogW,ClearEventLogW,CloseEventLog,

0_2_2BB7B3C0

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Key value created or modified: HKEY_CURRENT_USER\Console\0 d33f351a4aeea5e608853d1a56661059

Jump to behavior

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_3_2D4D6E00

0_3_2D4D6E00

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_3_2D4E9559 sldt word ptr [eax+eax]

0_3_2D4E9559

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Window / User API: threadDelayed 897	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Window / User API: threadDelayed 385	Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Window / User API: threadDelayed 4535	Jump to behavior

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-50144

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_3_2D4D6E00

0_3_2D4D6E00

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe TID: 7776	Thread sleep time: -897000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe TID: 7776	Thread sleep time: -4535000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_2_2BB780F0 wsprintfW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,__wcsnicmp,lstrcpyW,lstrcpyW,lstrcatW,

0_2_2BB780F0

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_2_2BB75430 _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,CloseHandle,GetTickCount,__time64,__localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,

0_2_2BB75430

Source: L8RabfF1Hu.exe, 00000000.00000002.4110572450.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllv

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

API call chain: ExitProcess graph end node

graph_0-50123

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_3_2D4D5CF0 WaitForSingleObject,Sleep,PostMessageW,SystemParametersInfoW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,SystemParametersInfoW,PostMessageW,SystemParametersInfoW,PostMessageW,BlockInput,Sleep,BlockInput,

0_3_2D4D5CF0

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_3_2D4D779B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_3_2D4D779B

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_2_2BB8054D VirtualProtect ?,-00000001,00000104,?

0_2_2BB8054D

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

0_3_2D4DC57C

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_2_2B9F00CD mov eax, dword ptr fs:[00000030h]

0_2_2B9F00CD

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_3_2D501C87 GetProcessHeap,

0_3_2D501C87

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4D779B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_3_2D4D779B
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_3_2D4D936D _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_3_2D4D936D
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_0040987E SetUnhandledExceptionFilter,	0_2_0040987E
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_004050C1 SetUnhandledExceptionFilter,GetConsoleWindow,ShowWindow,GetCurrentThreadId,PostThreadMessageA,GetInputState,CreateThread,WaitForSingleObject,CloseHandle,Sleep,	0_2_004050C1
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_0040B0F4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040B0F4
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_00406F48 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00406F48
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB7DF10 Sleep,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,EnumWindows,EnumWindows,Sleep,EnumWindows,Sleep,CreateEventA,Sleep,RegOpenKeyExW,RegQueryValueExW,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,	0_2_2BB7DF10
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB7F00A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_2BB7F00A
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: 0_2_2BB81F67 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_2BB81F67

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_2_00402B6E _memset,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,VirtualAllocEx,WriteProcessMemory,GetThreadContext,SetThreadContext,ResumeThread,

0_2_00402B6E

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_2_2BB777E0 Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread,

0_2_2BB777E0

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\SysWOW64\svchost.exe		0_2_2BB777E0
Source: C:\Users\user\Desktop\L8RabfF1Hu.exe	Code function: Sleep,OpenProcess,_memset,_memset,GetSystemDirectoryA,GetFileAttributesA,CreateProcessA,OpenProcess,_memset,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,_memset,GetModuleFileNameA,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\System32\svchost.exe		0_2_2BB777E0

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_3_2D4D5E10 BlockInput,BlockInput,GetDeviceCaps,GetDeviceCaps,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,mouse_event,mouse_event,mouse_event,mouse_event,mouse_event,

0_3_2D4D5E10

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

0_3_2D4D5E10

Source: L8RabfF1Hu.exe, 00000000.00000003.2009013747.000000002CCE2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0 minProgram Manager
Source: L8RabfF1Hu.exe, 00000000.00000003.2235702182.000000002CCE2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0 minProgram ManagerZ\:
Source: L8RabfF1Hu.exe, 00000000.00000002.4113657558.000000002CD55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: +inProgram Manager
Source: L8RabfF1Hu.exe, 00000000.00000002.4113964570.000000002D3B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HDD:1WW 223 Gb Free 168 Gb Mem: 8 Gb Free2 Gb Microsoft Basic Render Driver 0 5140 Microsoft Basic Render Driver 0 5140 Program Manager

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: _memset,_memset,_memset,gethostname,gethostbyname,inet_ntoa,_strcat_s,_strcat_s,inet_ntoa,_strcat_s,_strcat_s,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,CloseHandle,GetTickCount,__time64,__localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,

0_2_2BB75430

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_3_2D4DB5DE GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_3_2D4DB5DE

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_2_2BB85D22 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

0_2_2BB85D22

Source: C:\Users\user\Desktop\L8RabfF1Hu.exe

Code function: 0_2_2BB76A70 wsprintfW,GetCurrentProcessId,wsprintfW,_memset,GetVersionExW,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,wsprintfW,

0_2_2BB76A70

Source: L8RabfF1Hu.exe	Binary or memory string: acs.exe
Source: L8RabfF1Hu.exe	Binary or memory string: vsserv.exe
Source: L8RabfF1Hu.exe	Binary or memory string: avcenter.exe
Source: L8RabfF1Hu.exe	Binary or memory string: kxetray.exe
Source: L8RabfF1Hu.exe	Binary or memory string: cfp.exe
Source: L8RabfF1Hu.exe	Binary or memory string: avp.exe
Source: L8RabfF1Hu.exe	Binary or memory string: KSafeTray.exe
Source: L8RabfF1Hu.exe	Binary or memory string: 360Safe.exe
Source: L8RabfF1Hu.exe	Binary or memory string: rtvscan.exe
Source: L8RabfF1Hu.exe	Binary or memory string: 360tray.exe
Source: L8RabfF1Hu.exe	Binary or memory string: ashDisp.exe
Source: L8RabfF1Hu.exe	Binary or memory string: TMBMSRV.exe
Source: L8RabfF1Hu.exe	Binary or memory string: 360Tray.exe
Source: L8RabfF1Hu.exe	Binary or memory string: avgwdsvc.exe
Source: L8RabfF1Hu.exe	Binary or memory string: AYAgent.aye
Source: L8RabfF1Hu.exe	Binary or memory string: QUHLPSVC.EXE
Source: L8RabfF1Hu.exe	Binary or memory string: RavMonD.exe
Source: L8RabfF1Hu.exe	Binary or memory string: Mcshield.exe
Source: L8RabfF1Hu.exe	Binary or memory string: K7TSecurity.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	2 Disable or Modify Tools	131 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	212 Process Injection	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	131 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Software Packing	NTDS	16 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Modify Registry	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Indicator Removal	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
L8RabfF1Hu.exe	39%	ReversingLabs	Win32.Trojan.Generic
L8RabfF1Hu.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
8.8.8.8	unknown	United States		15169	GOOGLEUS	false
154.201.87.51	unknown	Seychelles		54600	PEGTECHINCUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581104
Start date and time:	2024-12-27 00:11:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	L8RabfF1Hu.exe renamed because original name is a hash value
Original Sample Name:	7dc3627f121e4ac23e7affcb9d4d39eb.exe
Detection:	MAL
Classification:	mal88.spyw.evad.winEXE@2/0@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 103 Number of non-executed functions: 262
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
VT rate limit hit for: L8RabfF1Hu.exe

Simulations

Behavior and APIs

Time	Type	Description
18:12:41	API Interceptor	3931726x Sleep call for process: L8RabfF1Hu.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PEGTECHINCUS	jklmips.elf	Get hash	malicious	Unknown	Browse	45.205.88.155
	1.elf	Get hash	malicious	Unknown	Browse	199.33.215.69
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	156.247.76.147
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	165.3.246.181
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	165.3.222.90
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	104.233.188.239
	T2dvU8f2xg.exe	Get hash	malicious	Unknown	Browse	107.148.51.200
	oiBxz37xUo.dll	Get hash	malicious	Unknown	Browse	107.148.51.200
	O16AWEA5iQ.exe	Get hash	malicious	Unknown	Browse	107.148.51.200
	T2dvU8f2xg.exe	Get hash	malicious	Unknown	Browse	107.148.51.200

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.998749053787742
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	L8RabfF1Hu.exe
File size:	2'926'592 bytes
MD5:	7dc3627f121e4ac23e7affcb9d4d39eb
SHA1:	95e744683d218bb54e3a097c55105a83b14b28ba
SHA256:	4eed23e6951e180df044af350b6dbd83fb33de00d7c70ad9b23764f26d76a66d
SHA512:	3e7ac8ec1f0fe5f312ca1426a44bdca142aa52be2ca5555bcd395fca0c3fb261908616e35e3efc0dfbb74ebc4899a7ab00259026f8ed7955b6a9ad669047af7c
SSDEEP:	49152:d8z+1tj2IvUoe/5o40iQmDb6qVLv/OnXh6KYb1OR8zKfjwkk41rfhas:d8OO/OnRB3fF/E
TLSH:	8DD57D41FCDB24F1E902163258A762AF2331AD091F39DFC7D940BA7EAC739E11932A55
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........)..................................P....@.........................../.....).,...@................................

File Icon


Icon Hash:	66e2a0a0b0aa92b6

Static PE Info

General

Entrypoint:	0x461700
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	9cbefe68f395e67356e2a5d8d1b285c0

Entrypoint Preview

Instruction
jmp 00007F908CB40020h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
sub esp, 28h
mov dword ptr [esp+1Ch], ebx
mov dword ptr [esp+10h], ebp
mov dword ptr [esp+14h], esi
mov dword ptr [esp+18h], edi
mov esi, eax
mov edx, dword ptr fs:[00000014h]
cmp edx, 00000000h
jne 00007F908CB42289h
mov eax, 00000000h
jmp 00007F908CB422E6h
mov edx, dword ptr [edx+00000000h]
cmp edx, 00000000h
jne 00007F908CB42287h
call 00007F908CB42379h
mov dword ptr [esp+20h], edx
mov dword ptr [esp+24h], esp
mov ebx, dword ptr [edx+18h]
mov ebx, dword ptr [ebx]
cmp edx, ebx
je 00007F908CB4229Ah
mov ebp, dword ptr fs:[00000014h]
mov dword ptr [ebp+00000000h], ebx
mov edi, dword ptr [ebx+1Ch]
sub edi, 28h
mov dword ptr [edi+24h], esp
mov esp, edi
mov ebx, dword ptr [ecx]
mov ecx, dword ptr [ecx+04h]
mov dword ptr [esp], ebx
mov dword ptr [esp+04h], ecx
mov dword ptr [esp+08h], edx
call esi
mov eax, dword ptr [esp+0Ch]
mov esp, dword ptr [esp+24h]
mov edx, dword ptr [esp+20h]
mov ebp, dword ptr fs:[00000014h]
mov dword ptr [ebp+00000000h], edx
mov edi, dword ptr [esp+18h]
mov esi, dword ptr [esp+14h]
mov ebp, dword ptr [esp+10h]
mov ebx, dword ptr [esp+1Ch]
add esp, 28h
retn 0004h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+04h]
mov edx, dword ptr [ecx]
mov eax, esp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2c2000	0x3dc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2f0000	0xb8e2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2c3000	0xab2e	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1c51a0	0xa0	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xd003c	0xd0200	4f8935f67b8b4c1b0a89157bbe842c9a	False	0.45346283783783786	data	6.14031343706074	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xd2000	0xf278c	0xf2800	e7a3f3b182e24ecb7ccca3489d50588e	False	0.48820272229381445	data	6.056408905050808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1c5000	0x3e808	0x15400	2f1d90f37e66f843c03a1b3d8a98054f	False	0.4896024816176471	data	5.487595977669943	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
/4	0x204000	0x127	0x200	43dc7a0ae5a7067502907db800396667	False	0.6171875	data	5.097874074212899	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/19	0x205000	0x2c355	0x2c400	f72eb435c88805178da2dc69bf166f13	False	0.9995365466101694	data	7.993377446074226	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/32	0x232000	0x7b13	0x7c00	bdf6836b73bbf872fe1a8f8e4c2a301a	False	0.993195564516129	data	7.971944122868698	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/46	0x23a000	0x36	0x200	47bddbac5524bb91437982b55229e4b7	False	0.115234375	data	0.9724165017923792	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/65	0x23b000	0x49d61	0x49e00	d444b0e510841d0d3dfeb2c20cfa1c9c	False	0.9999405139593909	data	7.9970433548702715	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/78	0x285000	0x2bcf2	0x2be00	a954876988bdd83628f6f4a2730409ac	False	0.9967559205840456	data	7.995522370696197	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/90	0x2b1000	0x100f1	0x10200	ef0e15778d8ed1d0217e3a957fb11bcd	False	0.9889777131782945	data	7.906745344805884	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x2c2000	0x3dc	0x400	3f72185577357a3caaa070746da5ea2d	False	0.490234375	data	4.662371670087523	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x2c3000	0xab2e	0xac00	b1e70b97a32ff72468845c60e07be0aa	False	0.6696493459302325	data	6.67539954288022	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.symtab	0x2ce000	0x219c9	0x21a00	51e4fbe1ae7e12a029e3372d37e29696	False	0.2628949814126394	data	5.2114259249719055	IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x2f0000	0xb8e2	0xba00	a34eb57664eeebd7574e8a1ff0386aa4	False	0.15192372311827956	data	3.889545129440551	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x2f01f8	0xeeb	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.8866195339094004
RT_ICON	0x2f10e4	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	0.061230514879546526
RT_ICON	0x2f530c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.09139004149377593
RT_ICON	0x2f78b4	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 0	0.11553254437869823
RT_ICON	0x2f931c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.1376641651031895
RT_ICON	0x2fa3c4	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	0.1918032786885246
RT_ICON	0x2fad4c	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 0	0.2779069767441861
RT_ICON	0x2fb404	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.30939716312056736
RT_GROUP_ICON	0x2fb86c	0x76	data	0.7542372881355932

Imports

DLL

Import

kernel32.dll

WriteFile, WriteConsoleW, WaitForMultipleObjects, WaitForSingleObject, VirtualQuery, VirtualFree, VirtualAlloc, SwitchToThread, SuspendThread, SetWaitableTimer, SetUnhandledExceptionFilter, SetProcessPriorityBoost, SetEvent, SetErrorMode, SetConsoleCtrlHandler, ResumeThread, PostQueuedCompletionStatus, LoadLibraryA, LoadLibraryW, SetThreadContext, GetThreadContext, GetSystemInfo, GetSystemDirectoryA, GetStdHandle, GetQueuedCompletionStatusEx, GetProcessAffinityMask, GetProcAddress, GetEnvironmentStringsW, GetConsoleMode, FreeEnvironmentStringsW, ExitProcess, DuplicateHandle, CreateWaitableTimerExW, CreateThread, CreateIoCompletionPort, CreateFileA, CreateEventA, CloseHandle, AddVectoredExceptionHandler

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T00:12:04.230350+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49731	154.201.87.51	11111	TCP
2024-12-27T00:13:45.610653+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49836	154.201.87.51	6666	TCP
2024-12-27T00:14:50.078035+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49836	154.201.87.51	6666	TCP
2024-12-27T00:15:59.761533+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49930	154.201.87.51	11111	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 00:11:57.917428017 CET	49730	53	192.168.2.4	8.8.8.8
Dec 27, 2024 00:11:58.038661003 CET	53	49730	8.8.8.8	192.168.2.4
Dec 27, 2024 00:11:58.038741112 CET	49730	53	192.168.2.4	8.8.8.8
Dec 27, 2024 00:12:01.003317118 CET	53	49730	8.8.8.8	192.168.2.4
Dec 27, 2024 00:12:01.003380060 CET	49730	53	192.168.2.4	8.8.8.8
Dec 27, 2024 00:12:04.105380058 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:04.226723909 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:04.229435921 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:04.230350018 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:04.351682901 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:05.840591908 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:05.890428066 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:05.892714024 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.012309074 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.012322903 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.012361050 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.654113054 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.654131889 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.654144049 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.654182911 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.654191971 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.654227018 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.655525923 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.655605078 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.655617952 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.655658007 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.655689001 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.655728102 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.658340931 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.658505917 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.658546925 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.664179087 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.709156036 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.773821115 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.773926973 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.773971081 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.866415024 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.866561890 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.866615057 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.868941069 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.869067907 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.869118929 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.877641916 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.877743959 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.877788067 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.886315107 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.886421919 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.886477947 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.894596100 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.894696951 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.894757986 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.903295994 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.903430939 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.903474092 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.911942005 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.912049055 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.912087917 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.920358896 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.920444012 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.920484066 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.928679943 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.928792000 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.928837061 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.937107086 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.937238932 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.937280893 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.945565939 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.945630074 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.945672989 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:06.953907967 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.953953981 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:06.953993082 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.077723026 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.077754021 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.077827930 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.080261946 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.080354929 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.080403090 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.085570097 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.087423086 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.087471008 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.087507010 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.092700958 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.092782974 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.092783928 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.097955942 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.098001957 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.098037958 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.103200912 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.103260994 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.103276968 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.108465910 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.108514071 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.108535051 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.113852978 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.113895893 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.113980055 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.119003057 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.119045973 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.119052887 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.124334097 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.124377966 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.124428034 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.129528999 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.129539967 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.129575014 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.134684086 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.134744883 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.134799957 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.140034914 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.140048981 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.140099049 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.145189047 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.145246029 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.145277977 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.150549889 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.150603056 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.150609970 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.155702114 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.155756950 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.155801058 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.161062956 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.161103010 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.161106110 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.166496038 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.166512966 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.166539907 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.171535969 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.171581984 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.171582937 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.176734924 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.176778078 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.176865101 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.182038069 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.182080030 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.182122946 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.187259912 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.187300920 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.187381983 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.192478895 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.192528009 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.288852930 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.288911104 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.288964033 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.290800095 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.290925026 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.290966034 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.294862986 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.294970989 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.295017004 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.298999071 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.299045086 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.299088955 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.302987099 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.303077936 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.303122997 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.305831909 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.305942059 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.305990934 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.309814930 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.309873104 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.309916973 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.313582897 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.313692093 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.313735962 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.317327023 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.317461014 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.317573071 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.321013927 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.321053028 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.321307898 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.324548006 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.324683905 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.324879885 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.328159094 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.328344107 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.328394890 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.331702948 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.331773043 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.331829071 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.335239887 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.335366964 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.335405111 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.338782072 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.338896036 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.338941097 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.342353106 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.342479944 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.345315933 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.345983028 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.346091986 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.346312046 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.349606991 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.349785089 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.349901915 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.353256941 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.353326082 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.353367090 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.356642962 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.356761932 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.357147932 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.360186100 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.360289097 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.360330105 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.363786936 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.363861084 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.363903999 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.367331028 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.367436886 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.367542982 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.370929003 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.371028900 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.371069908 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.374511957 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.374582052 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.374660969 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.378042936 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.378076077 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.378117085 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.381603956 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.381720066 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.381902933 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.385200024 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.385270119 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.385305882 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.388735056 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.388854027 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.388895035 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.392285109 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.392416954 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.392457008 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.395895958 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.395983934 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.396024942 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.399414062 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.399525881 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.399581909 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.403001070 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.403175116 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.403218031 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.406598091 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.406666994 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.406721115 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.410146952 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.410239935 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.410386086 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.413671017 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.413800001 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.413856983 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.417256117 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.474926949 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.499641895 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.499692917 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.499747992 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.500854969 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.500955105 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.501105070 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.503325939 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.503457069 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.503496885 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.505841970 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.505929947 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.505984068 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.508336067 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.508487940 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.508528948 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.510768890 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.510896921 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.511189938 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.513206959 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.513356924 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.513394117 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:07.515539885 CET	11111	49731	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:07.568710089 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:10.580341101 CET	49731	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:10.638962984 CET	49732	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:10.758524895 CET	11111	49732	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:10.758646965 CET	49732	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:12.696984053 CET	49732	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:12.818865061 CET	11111	49732	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:12.818880081 CET	11111	49732	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:12.818891048 CET	11111	49732	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:12.820461035 CET	11111	49732	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:13.244424105 CET	11111	49732	154.201.87.51	192.168.2.4
Dec 27, 2024 00:12:13.244602919 CET	49732	11111	192.168.2.4	154.201.87.51
Dec 27, 2024 00:12:13.366195917 CET	11111	49732	154.201.87.51	192.168.2.4

Target ID:	0
Start time:	18:11:56
Start date:	26/12/2024
Path:	C:\Users\user\Desktop\L8RabfF1Hu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\L8RabfF1Hu.exe"
Imagebase:	0xd40000
File size:	2'926'592 bytes
MD5 hash:	7DC3627F121E4AC23E7AFFCB9D4D39EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	18:11:56
Start date:	26/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	142
Total number of Limit Nodes:	4

Executed Functions

Function 2BB75430 Relevance: 91.4, APIs: 40, Strings: 12, Instructions: 440
stringnetworklibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 2BB7F707: _malloc.LIBCMT ref: 2BB7F721

_memset.LIBCMT ref: 2BB7546C
_memset.LIBCMT ref: 2BB75485
_memset.LIBCMT ref: 2BB75495
gethostname.WS2_32(?,00000032), ref: 2BB754A3
gethostbyname.WS2_32(?), ref: 2BB754AD
inet_ntoa.WS2_32 ref: 2BB754C5
_strcat_s.LIBCMT ref: 2BB754D8
_strcat_s.LIBCMT ref: 2BB754F1
inet_ntoa.WS2_32 ref: 2BB7551A
_strcat_s.LIBCMT ref: 2BB7552D
_strcat_s.LIBCMT ref: 2BB75546
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 2BB75573
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000002,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 2BB75587
GetLastInputInfo.USER32(?), ref: 2BB7559A
GetTickCount.KERNEL32 ref: 2BB755A0
wsprintfW.USER32 ref: 2BB755D5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 2BB755E8
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000296,00000000), ref: 2BB755FC
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 2BB75653
wsprintfW.USER32 ref: 2BB7566C
GetForegroundWindow.USER32 ref: 2BB75695
GetWindowTextW.USER32(00000000,000006CE,000000FA), ref: 2BB756AC
lstrlenW.KERNEL32(000008CC), ref: 2BB756D3
lstrlenW.KERNEL32(00000994), ref: 2BB75739
GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 2BB757AA
GetProcAddress.KERNEL32(00000000), ref: 2BB757B1
GetNativeSystemInfo.KERNEL32(?), ref: 2BB757C2
GetSystemInfo.KERNEL32(?), ref: 2BB757CD
wsprintfW.USER32 ref: 2BB75806
GetCurrentProcessId.KERNEL32 ref: 2BB75818
OpenProcess.KERNEL32(00000400,00000000,00000000), ref: 2BB7582E
K32GetProcessImageFileNameW.KERNEL32(00000000,?,00000104), ref: 2BB7584B
CloseHandle.KERNEL32(2BB95164), ref: 2BB7587F
GetTickCount.KERNEL32 ref: 2BB758E9
__time64.LIBCMT ref: 2BB758F8
__localtime64.LIBCMT ref: 2BB7592F
wsprintfW.USER32 ref: 2BB75968
GetLocaleInfoW.KERNEL32(00000800,00000002,00000F46,00000040), ref: 2BB7597D
GetSystemDirectoryW.KERNEL32(00001184,00000032), ref: 2BB7598C
GetCurrentHwProfileW.ADVAPI32(?), ref: 2BB75999

Part of subcall function 2BB780F0: GetLogicalDriveStringsW.KERNEL32(000003E8,?,75BF73E0,00000AD4,00000000), ref: 2BB78132
Part of subcall function 2BB780F0: lstrcmpiW.KERNEL32(?,A:\), ref: 2BB78166
Part of subcall function 2BB780F0: lstrcmpiW.KERNEL32(?,B:\), ref: 2BB78176
Part of subcall function 2BB780F0: QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 2BB781A6
Part of subcall function 2BB780F0: lstrlenW.KERNEL32(?), ref: 2BB781B7
Part of subcall function 2BB780F0: __wcsnicmp.LIBCMT ref: 2BB781CE
Part of subcall function 2BB780F0: lstrcpyW.KERNEL32(00000AD4,?), ref: 2BB78204

Strings

GROUP, xrefs: 2BB756E0
x86, xrefs: 2BB757F4, 2BB757F9
kernel32.dll, xrefs: 2BB7576F
GetNativeSystemInfo, xrefs: 2BB7576A
1.0, xrefs: 2BB75702
X86, xrefs: 2BB759B1, 2BB759D3
x64, xrefs: 2BB757ED
REMARK, xrefs: 2BB75746
X86 %s, xrefs: 2BB75800
Network, xrefs: 2BB756C2, 2BB75728
AppEvents, xrefs: 2BB756B6, 2BB7571C
%d min, xrefs: 2BB755CF

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Info$ByteCharMultiSystemWide_strcat_swsprintf$Process_memsetlstrlen$CountCurrentHandleTickWindowinet_ntoalstrcmpi$AddressCloseDeviceDirectoryDriveFileForegroundImageInputLastLocaleLogicalModuleNameNativeOpenProcProfileQueryStringsText__localtime64__time64__wcsnicmp_mallocgethostbynamegethostnamelstrcpy
String ID: %d min$1.0$AppEvents$GROUP$GetNativeSystemInfo$Network$REMARK$X86$X86 %s$kernel32.dll$x64$x86
API String ID: 1101047656-2763049356
Opcode ID: 47b3c831dcec99944697d8d977b9f2a3f2a8f6ec297c85ef0cb94d2dd4877780
Instruction ID: d6cdbffe31e2c52edcc5f16c851e72e4f5192614ae54c426a268128299ecec64
Opcode Fuzzy Hash: 47b3c831dcec99944697d8d977b9f2a3f2a8f6ec297c85ef0cb94d2dd4877780
Instruction Fuzzy Hash: 74F1E6B2940704AFDB24DB64CC85FEB73B9EF58700F0045A8E71A97181EA74AA45CF65

Function 2BB7DF10 Relevance: 61.6, APIs: 24, Strings: 11, Instructions: 354
sleepregistrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 2BB80542: __fassign.LIBCMT ref: 2BB80538

Sleep.KERNEL32(00000000), ref: 2BB7DF64
CloseHandle.KERNEL32(00000000), ref: 2BB7DF91
GetLocalTime.KERNEL32(?), ref: 2BB7DFA9
wsprintfW.USER32 ref: 2BB7DFE0
SetUnhandledExceptionFilter.KERNEL32(2BB775B0), ref: 2BB7DFEE
CloseHandle.KERNEL32(00000000), ref: 2BB7E007

Part of subcall function 2BB7F707: _malloc.LIBCMT ref: 2BB7F721

EnumWindows.USER32(2BB75CC0,?), ref: 2BB7E19D
Sleep.KERNEL32(00004E20,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 2BB7E1AA
EnumWindows.USER32(2BB75CC0,?), ref: 2BB7E1BE
Sleep.KERNEL32(00000BB8), ref: 2BB7E1F5
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 2BB7E241
Sleep.KERNEL32(00000FA0), ref: 2BB7E2C4
RegOpenKeyExW.ADVAPI32(80000001,Console,00000000,00020019,?), ref: 2BB7E2EB
RegQueryValueExW.ADVAPI32(?,IpDatespecial,00000000,?,00000000,?), ref: 2BB7E30B
CloseHandle.KERNEL32(?), ref: 2BB7E35D
Sleep.KERNEL32(000003E8,?,?), ref: 2BB7E3A4
WaitForSingleObject.KERNEL32(?,000000FF,?,?), ref: 2BB7E3D0
CloseHandle.KERNEL32(?,?,?), ref: 2BB7E3D7
Sleep.KERNEL32(000003E8,?,?), ref: 2BB7E3E2
CloseHandle.KERNEL32(?), ref: 2BB7E400
WaitForSingleObject.KERNEL32(?,000000FF,?,?), ref: 2BB7E425
CloseHandle.KERNEL32(?,?,?), ref: 2BB7E42C
Sleep.KERNEL32(00000000,?,?,?), ref: 2BB7E446
CloseHandle.KERNEL32(?), ref: 2BB7E464

Strings

Console, xrefs: 2BB7E2D5
154.201.87.51, xrefs: 2BB7E0B9
154.201.87.51, xrefs: 2BB7E117
154.201.87.51, xrefs: 2BB7E071
154.201.87.51, xrefs: 2BB7E07B, 2BB7E0C3, 2BB7E121, 2BB7E1E5, 2BB7E253
11111, xrefs: 2BB7E088
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 2BB7DFDA
11111, xrefs: 2BB7E08F, 2BB7E0D7, 2BB7E135, 2BB7E1CE, 2BB7E20C
IpDatespecial, xrefs: 2BB7E305
6666, xrefs: 2BB7E0D0
9999, xrefs: 2BB7E12E

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CloseHandleSleep$EnumObjectSingleWaitWindows$CreateEventExceptionFilterLocalOpenQueryTimeUnhandledValue__fassign_mallocwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$11111$11111$154.201.87.51$154.201.87.51$154.201.87.51$154.201.87.51$6666$9999$Console$IpDatespecial
API String ID: 1511462596-1421218999
Opcode ID: deacdf828fbf0346e476fb47c09ae2b4b7cf342c11b10e3cfb5234605d9f6f4d
Instruction ID: 2d6d2cf386799f3c9320755069aa6df3826b3556ce9b7a744a2b1ababf9c9855
Opcode Fuzzy Hash: deacdf828fbf0346e476fb47c09ae2b4b7cf342c11b10e3cfb5234605d9f6f4d
Instruction Fuzzy Hash: 58D1D0B6C08B40AFDB10EF64C985E2A77B9EF89700F004A2DF1A587291DB36D545DF62

Function 2BB7BC70 Relevance: 54.6, APIs: 27, Strings: 4, Instructions: 351
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDesktopWindow.USER32 ref: 2BB7BC8F
GetDC.USER32(00000000), ref: 2BB7BC9C
CreateCompatibleDC.GDI32(00000000), ref: 2BB7BCA2
GetDC.USER32(00000000), ref: 2BB7BCAD
GetDeviceCaps.GDI32(00000000,00000008), ref: 2BB7BCBA
GetDeviceCaps.GDI32(00000000,00000076), ref: 2BB7BCC2
ReleaseDC.USER32(00000000,00000000), ref: 2BB7BCD3
GetSystemMetrics.USER32(0000004E), ref: 2BB7BCF8
GetSystemMetrics.USER32(0000004F), ref: 2BB7BD26
GetSystemMetrics.USER32(0000004C), ref: 2BB7BD78
GetSystemMetrics.USER32(0000004D), ref: 2BB7BD8D
CreateCompatibleBitmap.GDI32(?,?,00000000), ref: 2BB7BDA6
SelectObject.GDI32(?,00000000), ref: 2BB7BDB4
SetStretchBltMode.GDI32(?,00000003), ref: 2BB7BDC0
GetSystemMetrics.USER32(0000004F), ref: 2BB7BDCD
GetSystemMetrics.USER32(0000004E), ref: 2BB7BDE0
StretchBlt.GDI32(?,00000000,00000000,?,00000000,?,?,?,00000000,?,00000000), ref: 2BB7BE07
_memset.LIBCMT ref: 2BB7BE7A
GetDIBits.GDI32(?,?,00000000,00000000,?,00000028,00000000), ref: 2BB7BE97
_memset.LIBCMT ref: 2BB7BEAF

Part of subcall function 2BB7F707: _malloc.LIBCMT ref: 2BB7F721

DeleteObject.GDI32(?), ref: 2BB7BF23
DeleteObject.GDI32(?), ref: 2BB7BF2D
ReleaseDC.USER32(00000000,?), ref: 2BB7BF39
DeleteObject.GDI32(?), ref: 2BB7BFDF
DeleteObject.GDI32(?), ref: 2BB7BFE9
ReleaseDC.USER32(00000000,?), ref: 2BB7BFF5

Strings

gfff, xrefs: 2BB7BD10
gfff, xrefs: 2BB7BD38
(, xrefs: 2BB7BE3E
6, xrefs: 2BB7BE61

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: MetricsSystem$Object$Delete$Release$CapsCompatibleCreateDeviceStretch_memset$BitmapBitsDesktopModeSelectWindow_malloc
String ID: ($6$gfff$gfff
API String ID: 3293817703-713438465
Opcode ID: 51ca5f6698cf1a5560b8239587114cbee1c27cce301536aae16d3b5b300be339
Instruction ID: 0c3730667c8073af775138dcf7615e9e53babd2867608176e281ee45472630c8
Opcode Fuzzy Hash: 51ca5f6698cf1a5560b8239587114cbee1c27cce301536aae16d3b5b300be339
Instruction Fuzzy Hash: 8FD18BB1E01318AFDB10DFE9E985AAEBBB9FF58300F104129F905AB250D774A905CF91

Function 2BB76A70 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 141
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(75BF73E0), ref: 2BB76A94
wsprintfW.USER32 ref: 2BB76AA7

Part of subcall function 2BB76910: GetCurrentProcessId.KERNEL32(6FAD02D8,00000000,00000000,75BF73E0,?,00000000,2BB910DB,000000FF,?,2BB76AB3,00000000), ref: 2BB76938
Part of subcall function 2BB76910: OpenProcess.KERNEL32(00000400,00000000,00000000,?,00000000,2BB910DB,000000FF,?,2BB76AB3,00000000), ref: 2BB76947
Part of subcall function 2BB76910: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,00000000,2BB910DB,000000FF,?,2BB76AB3,00000000), ref: 2BB76960
Part of subcall function 2BB76910: CloseHandle.KERNEL32(00000000,?,00000000,2BB910DB,000000FF,?,2BB76AB3,00000000), ref: 2BB7696B

_memset.LIBCMT ref: 2BB76AC2
GetVersionExW.KERNEL32(?), ref: 2BB76ADB
GetCurrentProcess.KERNEL32(00000008,?), ref: 2BB76B12
OpenProcessToken.ADVAPI32(00000000), ref: 2BB76B19
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 2BB76B3F
GetLastError.KERNEL32 ref: 2BB76B49
LocalAlloc.KERNEL32(00000040,?), ref: 2BB76B5D
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,?,?), ref: 2BB76B85
GetSidSubAuthorityCount.ADVAPI32 ref: 2BB76B98
GetSidSubAuthority.ADVAPI32(00000000), ref: 2BB76BA6
LocalFree.KERNEL32(?), ref: 2BB76BB5
CloseHandle.KERNEL32(?), ref: 2BB76BC2
wsprintfW.USER32 ref: 2BB76C1B

Strings

-N/, xrefs: 2BB76BEF
None/%s, xrefs: 2BB76BE7
NO/, xrefs: 2BB76BDF

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Process$Token$CurrentOpen$AuthorityCloseHandleInformationLocalwsprintf$AllocCountErrorFreeLastVersion_memset
String ID: -N/$NO/$None/%s
API String ID: 3036438616-3095023699
Opcode ID: 87b0bc239a6033babcc4a568ed4518906650f0e42f64f582293543f7a966f72d
Instruction ID: ba72e971a9800b4cfa4d59fe291e3f868937f56b881552682179605506e6198a
Opcode Fuzzy Hash: 87b0bc239a6033babcc4a568ed4518906650f0e42f64f582293543f7a966f72d
Instruction Fuzzy Hash: 75417F72D00614AFEF14EBB0CD89FEE7778EF0A300F004095E64696251DA35DA95DFA1

Function 2BB76150 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 222
stringcomregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 2BB7618B
lstrcatW.KERNEL32(2BBA1F10,2BB9510C,?,6FAD02D8,00000AD4,00000000,75BF73E0), ref: 2BB761CD
lstrcatW.KERNEL32(2BBA1F10,2BB9535C,?,6FAD02D8,00000AD4,00000000,75BF73E0), ref: 2BB761D9
CoCreateInstance.OLE32(2BB92480,00000000,00000017,2BB9578C,?,?,6FAD02D8,00000AD4,00000000,75BF73E0), ref: 2BB76220
_memset.LIBCMT ref: 2BB762CE
wsprintfW.USER32 ref: 2BB76336
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 2BB7635F
_memset.LIBCMT ref: 2BB76376

Part of subcall function 2BB76050: _memset.LIBCMT ref: 2BB7607C
Part of subcall function 2BB76050: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000000), ref: 2BB76088

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 2BB76330
Windows Defender IOfficeAntiVirus implementation , xrefs: 2BB76186, 2BB761C8, 2BB761D4, 2BB763C9, 2BB763D5, 2BB76422, 2BB76436, 2BB7645A

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: _memset$Createlstrcat$InstanceOpenSnapshotToolhelp32wsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}$Windows Defender IOfficeAntiVirus implementation
API String ID: 1221949200-1583895642
Opcode ID: f17d77e840056f120aa22cee00cde4b23e70663d009e45f664cc3a194c879236
Instruction ID: 75cf0c429e25923bb464950657c11b85cd13ac7aacb852b6d8a3b6db2c6f1f10
Opcode Fuzzy Hash: f17d77e840056f120aa22cee00cde4b23e70663d009e45f664cc3a194c879236
Instruction Fuzzy Hash: A28184B2D00528AFDF20DB64CC84FAAB778EF48704F004199F719A7155DA75AE81CFA4

Function 2D4D5CF0 Relevance: 19.6, APIs: 13, Instructions: 89sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00001770), ref: 2D4D5D00
Sleep.KERNEL32(0000012C), ref: 2D4D5D0B
GetSystemMetrics.USER32(0000004E), ref: 2D4D5D33
GetSystemMetrics.USER32(0000004F), ref: 2D4D5D40
GetSystemMetrics.USER32(0000004E), ref: 2D4D5D59
GetSystemMetrics.USER32(0000004F), ref: 2D4D5D64
SystemParametersInfoW.USER32(00000056,00000001,00000000,00000000), ref: 2D4D5D8A
PostMessageW.USER32(0000FFFF,00000112,0000F170,00000002), ref: 2D4D5D9D
SystemParametersInfoW.USER32(00000056,00000000,00000000,00000000), ref: 2D4D5DBB
PostMessageW.USER32(0000FFFF,00000112,0000F170,000000FF), ref: 2D4D5DCE
BlockInput.USER32(00000000), ref: 2D4D5DD9
Sleep.KERNEL32(000000C8), ref: 2D4D5DE4
BlockInput.USER32(00000000), ref: 2D4D5E00

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: System$Metrics$BlockInfoInputMessageParametersPostSleep$ObjectSingleWait
String ID:
API String ID: 4043121949-0
Opcode ID: 1cf719a578f5a1c613950069eabd5d6a42435fd59b868e07beeb003d08b21273
Instruction ID: 4a68c353b9bad88d86d88db5218959d87cf4e1d4caae14ca36425cfdcefad7da
Opcode Fuzzy Hash: 1cf719a578f5a1c613950069eabd5d6a42435fd59b868e07beeb003d08b21273
Instruction Fuzzy Hash: 32319531244781ABEB619B64CC5AF6677B0AF4DB52F10C219F345AA3D1CBF4A440CB68

Function 2BB780F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 114stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(000003E8,?,75BF73E0,00000AD4,00000000), ref: 2BB78132
lstrcmpiW.KERNEL32(?,A:\), ref: 2BB78166
lstrcmpiW.KERNEL32(?,B:\), ref: 2BB78176
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 2BB781A6
lstrlenW.KERNEL32(?), ref: 2BB781B7
__wcsnicmp.LIBCMT ref: 2BB781CE
lstrcpyW.KERNEL32(00000AD4,?), ref: 2BB78204
lstrcpyW.KERNEL32(?,?), ref: 2BB78228
lstrcatW.KERNEL32(?,00000000), ref: 2BB78233

Strings

B:\, xrefs: 2BB78170
A:\, xrefs: 2BB78160

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: lstrcmpilstrcpy$DeviceDriveLogicalQueryStrings__wcsnicmplstrcatlstrlen
String ID: A:\$B:\
API String ID: 950920757-1009255891
Opcode ID: c93d34e4c5aa24ab1048e2fcd0a29d0bc7cdb797cd2f4341d67385273480a483
Instruction ID: 5bb8bddf5eed1653d913741af134d274c829758c4f242041909df032ced84952
Opcode Fuzzy Hash: c93d34e4c5aa24ab1048e2fcd0a29d0bc7cdb797cd2f4341d67385273480a483
Instruction Fuzzy Hash: B8419772E016189BDF10DF65DD84AFEB378EF48610F004199DA1AA3140EB75EA05DFA4

Function 2BB76C50 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,74DEDF80,00000000,75BF73E0), ref: 2BB76C8B
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 2BB76CAA
_memset.LIBCMT ref: 2BB76CE1
GlobalMemoryStatusEx.KERNEL32(?), ref: 2BB76CF4
swprintf.LIBCMT ref: 2BB76D39
swprintf.LIBCMT ref: 2BB76D4C

Strings

@, xrefs: 2BB76CED
%sFree%d Gb , xrefs: 2BB76D41
:, xrefs: 2BB76C80
HDD:%d, xrefs: 2BB76D2E

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: swprintf$DiskDriveFreeGlobalMemorySpaceStatusType_memset
String ID: %sFree%d Gb $:$@$HDD:%d
API String ID: 3202570353-3501811827
Opcode ID: 6f4bd30bb7104fbb8b3ad9bc3501ca643982e676c715dbb1af3a5e6fb635d261
Instruction ID: ac9c9cb3eda11f3b883b3122423fe56c7e3dfa3b1ef58b410e4b8ab5bf7fef2e
Opcode Fuzzy Hash: 6f4bd30bb7104fbb8b3ad9bc3501ca643982e676c715dbb1af3a5e6fb635d261
Instruction Fuzzy Hash: C3315CB2D0021C9BDB14CFE5CC85BEEB7B9FF58300F50821DE91AA7241EA746A05CB94

Function 2BB76EE0 Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 410COMMON

Download Yara Rule

APIs

CreateDXGIFactory.DXGI(2BB9579C,?,6FAD02D8,74DEDF80,00000000,75BF73E0), ref: 2BB76F4A
swprintf.LIBCMT ref: 2BB7711E
std::_Xinvalid_argument.LIBCPMT ref: 2BB771C7

Strings

%s%s %d %d , xrefs: 2BB77113
vector<T> too long, xrefs: 2BB771C2
%s%s %d*%d , xrefs: 2BB77337

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CreateFactoryXinvalid_argumentstd::_swprintf
String ID: %s%s %d %d $%s%s %d*%d $vector<T> too long
API String ID: 3803070356-257307503
Opcode ID: c4abe58193cde28b3ea0a9517246759d8846d1cd0fe8858760c4ce3165f2a4f2
Instruction ID: cdbb2a15ac71a55158492b304ba388adec8eb1f5b0afbe949b6f6c42e173f160
Opcode Fuzzy Hash: c4abe58193cde28b3ea0a9517246759d8846d1cd0fe8858760c4ce3165f2a4f2
Instruction Fuzzy Hash: 3EE16372E002259FDF24DE65CC80BEEB375EB49700F1441E9D96AE7694D730AE819F90

Function 2D4D6E00 Relevance: 13.6, APIs: 9, Instructions: 103sleepwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 2D4D6FF0: GetCurrentThreadId.KERNEL32 ref: 2D4D700D
Part of subcall function 2D4D6FF0: GetThreadDesktop.USER32(00000000), ref: 2D4D7014
Part of subcall function 2D4D6FF0: _memset.LIBCMT ref: 2D4D702A
Part of subcall function 2D4D6FF0: GetUserObjectInformationW.USER32(00000000,00000002,?,00000200,?), ref: 2D4D704E
Part of subcall function 2D4D6FF0: OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 2D4D7059
Part of subcall function 2D4D6FF0: _memset.LIBCMT ref: 2D4D706F
Part of subcall function 2D4D6FF0: GetUserObjectInformationW.USER32(00000000,00000002,?,00000200,?), ref: 2D4D708D
Part of subcall function 2D4D6FF0: lstrcmpiW.KERNEL32(?,?), ref: 2D4D709D
Part of subcall function 2D4D6FF0: SetThreadDesktop.USER32(00000000), ref: 2D4D70A8
Part of subcall function 2D4D6FF0: CloseDesktop.USER32(00000000), ref: 2D4D70BF
Part of subcall function 2D4D6FF0: CloseDesktop.USER32(00000000), ref: 2D4D70C2

ReleaseDC.USER32(00000000,00000000), ref: 2D4D6E2B
GetDC.USER32(00000000), ref: 2D4D6E33
GetCursorPos.USER32(?), ref: 2D4D6E52
BitBlt.GDI32(?,00000000,00000000,00000000,?,00000000,?,?,?), ref: 2D4D6EC2
GetTickCount.KERNEL32 ref: 2D4D6EE8
Sleep.KERNEL32(0000000A), ref: 2D4D6EF6
GetTickCount.KERNEL32 ref: 2D4D6EFC
GetTickCount.KERNEL32 ref: 2D4D6F08
InterlockedExchange.KERNEL32(?,00000000), ref: 2D4D6F0C

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Desktop$CountThreadTick$CloseInformationObjectUser_memset$CurrentCursorExchangeInputInterlockedOpenReleaseSleeplstrcmpi
String ID:
API String ID: 3563721830-0
Opcode ID: 8cd35f3165f5f63237af706afad7ece29e0dfa5d7ebdaa6c2049371a9d88bca8
Instruction ID: 124c0e68a7a1665946074f5157043d59a47ee94e290a755568ee027f7b0d8eb0
Opcode Fuzzy Hash: 8cd35f3165f5f63237af706afad7ece29e0dfa5d7ebdaa6c2049371a9d88bca8
Instruction Fuzzy Hash: 59414532600B089FD720CF65C894B6ABBF5EF58B12F10891DEA8693B50C734B845CF60

Function 2BB76050 Relevance: 9.1, APIs: 6, Instructions: 86processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2BB7607C
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,00000000), ref: 2BB76088
Process32FirstW.KERNEL32(00000000,00000000), ref: 2BB760B9
Process32NextW.KERNEL32(00000000,0000022C), ref: 2BB7610F
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 2BB76116

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memset
String ID:
API String ID: 2526126748-0
Opcode ID: 521f172dda3fc7990183cd343a994f6a9f46451268a48187c1a24429b1e77a03
Instruction ID: a599c906907d9f387bb2a0dcae616d734b48e54b6b59563182ae1f4584323622
Opcode Fuzzy Hash: 521f172dda3fc7990183cd343a994f6a9f46451268a48187c1a24429b1e77a03
Instruction Fuzzy Hash: 7921A332E11124ABDB10EF74DD99BEAB3B5EF18310F004299DD2AD7291EB369B11DA50

Function 2D4D2FC0 Relevance: 3.1, APIs: 2, Instructions: 82networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 2D4D3033
recv.WS2_32(?,?,00040000,00000000), ref: 2D4D3054

Part of subcall function 2D4D808D: __getptd_noexit.LIBCMT ref: 2D4D808D

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: __getptd_noexitrecvselect
String ID:
API String ID: 4248608111-0
Opcode ID: e841ce8c353692ddf6d2e87decdc3cf700550f046cb2d973ae8d232977d9db99
Instruction ID: dba570c94578ead5812e95088bceabba38c1bc38ed52b5143ca52131b356f78c
Opcode Fuzzy Hash: e841ce8c353692ddf6d2e87decdc3cf700550f046cb2d973ae8d232977d9db99
Instruction Fuzzy Hash: DA2107725042089FDB51DF64CCA8BAA33B4EF15B14F1101A8E7457B394D7B0AD88CBE2

Function 2BB79E50 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 314
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GdipGetImagePixelFormat.GDIPLUS(Function_00009A30,?,?,00000000), ref: 2BB79E7B
GdipGetImageHeight.GDIPLUS(Function_00009A30,?,?,00000000), ref: 2BB79EFC
GdipGetImageWidth.GDIPLUS(Function_00009A30,?,?,00000000), ref: 2BB79F24
GdipGetImagePaletteSize.GDIPLUS(Function_00009A30,?,?,00000000), ref: 2BB79F7F
_malloc.LIBCMT ref: 2BB79FC0

Part of subcall function 2BB7F673: __FF_MSGBANNER.LIBCMT ref: 2BB7F68C
Part of subcall function 2BB7F673: __NMSG_WRITE.LIBCMT ref: 2BB7F693
Part of subcall function 2BB7F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C,2BB88E76), ref: 2BB7F6B8

_free.LIBCMT ref: 2BB7A000
GdipGetImagePalette.GDIPLUS(?,00000008,?,?,00000000), ref: 2BB7A028
SetDIBColorTable.GDI32(?,00000000,?,?,?,00000000), ref: 2BB7A0B7
GdipBitmapLockBits.GDIPLUS(Function_00009A30,?,00000001,?,?,?,00000000), ref: 2BB7A112
_free.LIBCMT ref: 2BB7A134
_memcpy_s.LIBCMT ref: 2BB7A183
GdipBitmapUnlockBits.GDIPLUS(?,?,?,00000000), ref: 2BB7A1D0
GdipCreateBitmapFromScan0.GDIPLUS(?,?,2BB95A78,00022009,?,00000000,?,00000000), ref: 2BB7A22C
GdipGetImageGraphicsContext.GDIPLUS(00000000,00022009,?,00000000), ref: 2BB7A24C
GdipDrawImageI.GDIPLUS(00000000,Function_00009A30,00000000,00000000,?,00000000), ref: 2BB7A267
GdipDeleteGraphics.GDIPLUS(?,?,00000000), ref: 2BB7A274
GdipDisposeImage.GDIPLUS(00000000,?,00000000), ref: 2BB7A27B
_free.LIBCMT ref: 2BB7A296

Strings

&, xrefs: 2BB79EE1

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Gdip$Image$Bitmap_free$BitsGraphicsPalette$AllocateColorContextCreateDeleteDisposeDrawFormatFromHeapHeightLockPixelScan0SizeTableUnlockWidth_malloc_memcpy_s
String ID: &
API String ID: 640422297-3042966939
Opcode ID: 5d0639b1821f86f63bf3b81ea7d9d1849d83294683bfbb4a1ddb11d57441a82b
Instruction ID: ab38716b2619fa6b5b0d20fe309abeab3382bf2ce3792d87f391b88ffbf8fbfb
Opcode Fuzzy Hash: 5d0639b1821f86f63bf3b81ea7d9d1849d83294683bfbb4a1ddb11d57441a82b
Instruction Fuzzy Hash: 6CD161B2A006199FDB50DF55CC80B9AB7B4EF5D304F0085A9E729A7211D734EA85CFA8

Function 00402832 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 243
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Console\0,00000000,00020019,00000065), ref: 00402877
RegQueryValueExW.ADVAPI32(00000065,d33f351a4aeea5e608853d1a56661059,00000000,00000003,00000000,00000065), ref: 0040289E
_memset.LIBCMT ref: 004028B9
RegQueryValueExW.ADVAPI32(00000A44,d33f351a4aeea5e608853d1a56661059,00000000,00000003,?,00000A44), ref: 004028D1
VirtualAlloc.KERNEL32(00000000,00003000,00000040), ref: 004028F4
RegCloseKey.ADVAPI32(00000A44), ref: 0040291B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0040296F
_memset.LIBCMT ref: 00402A14
_memset.LIBCMT ref: 00402A39
_memset.LIBCMT ref: 00402A4B
VirtualAlloc.KERNEL32(00000000,00003000,00000040), ref: 00402AAD
RegCreateKeyW.ADVAPI32(80000001,Console\0,?), ref: 00402B21
RegDeleteValueW.KERNEL32(?,d33f351a4aeea5e608853d1a56661059), ref: 00402B34
RegSetValueExW.KERNEL32(?,d33f351a4aeea5e608853d1a56661059,00000000,00000003,00000065,?), ref: 00402B47
RegCloseKey.ADVAPI32(?), ref: 00402B50

Strings

d33f351a4aeea5e608853d1a56661059, xrefs: 00402895, 0040289A, 004028CD, 00402B2B, 00402B30, 00402B43
Console\0, xrefs: 00402863, 00402B17
D, xrefs: 004028A0

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: Value_memset$Virtual$AllocCloseQuery$CreateDeleteFreeOpen
String ID: Console\0$D$d33f351a4aeea5e608853d1a56661059
API String ID: 1349358994-624226333
Opcode ID: 989c239f7bd7a6ea255373e89e76edddc455b09919b3b25dbee6dd49bd6b0f70
Instruction ID: 32db672994cb0363d3d9efa307be3839a9539a43f3dedde392f7280f8b69fd3f
Opcode Fuzzy Hash: 989c239f7bd7a6ea255373e89e76edddc455b09919b3b25dbee6dd49bd6b0f70
Instruction Fuzzy Hash: DF91A575A00209ABEB109FA0DC45BEE7B79FF49354F008476F508BB291D7B99E808B59

Function 2D4D69F0 Relevance: 31.7, APIs: 21, Instructions: 210COMMON

Download Yara Rule

APIs

Part of subcall function 2D4D52C0: LoadCursorW.USER32(00000000,00007F8A), ref: 2D4D535A

Part of subcall function 2D4D6FF0: GetCurrentThreadId.KERNEL32 ref: 2D4D700D
Part of subcall function 2D4D6FF0: GetThreadDesktop.USER32(00000000), ref: 2D4D7014
Part of subcall function 2D4D6FF0: _memset.LIBCMT ref: 2D4D702A
Part of subcall function 2D4D6FF0: GetUserObjectInformationW.USER32(00000000,00000002,?,00000200,?), ref: 2D4D704E
Part of subcall function 2D4D6FF0: OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 2D4D7059
Part of subcall function 2D4D6FF0: _memset.LIBCMT ref: 2D4D706F
Part of subcall function 2D4D6FF0: GetUserObjectInformationW.USER32(00000000,00000002,?,00000200,?), ref: 2D4D708D
Part of subcall function 2D4D6FF0: lstrcmpiW.KERNEL32(?,?), ref: 2D4D709D
Part of subcall function 2D4D6FF0: SetThreadDesktop.USER32(00000000), ref: 2D4D70A8
Part of subcall function 2D4D6FF0: CloseDesktop.USER32(00000000), ref: 2D4D70BF
Part of subcall function 2D4D6FF0: CloseDesktop.USER32(00000000), ref: 2D4D70C2

ReleaseDC.USER32(00000000,?), ref: 2D4D6A46
GetDesktopWindow.USER32 ref: 2D4D6A50
GetDC.USER32(00000000), ref: 2D4D6A60
GetTickCount.KERNEL32 ref: 2D4D6A73
GetDC.USER32(00000000), ref: 2D4D6A98
GetDeviceCaps.GDI32(00000000,00000008), ref: 2D4D6AA5
GetDeviceCaps.GDI32(00000000,0000000A), ref: 2D4D6AAD
GetDeviceCaps.GDI32(00000000,00000076), ref: 2D4D6AB2
GetDeviceCaps.GDI32(00000000,00000075), ref: 2D4D6ABA
ReleaseDC.USER32(00000000,00000000), ref: 2D4D6AC8
GetSystemMetrics.USER32(0000004E), ref: 2D4D6AD6
GetSystemMetrics.USER32(0000004F), ref: 2D4D6AEB
GetSystemMetrics.USER32(0000004C), ref: 2D4D6B2D
GetSystemMetrics.USER32(0000004D), ref: 2D4D6B42
CreateCompatibleDC.GDI32(?), ref: 2D4D6B79
CreateCompatibleDC.GDI32(?), ref: 2D4D6B82
CreateCompatibleDC.GDI32(?), ref: 2D4D6B8B
CreateDIBSection.GDI32(?,?,00000000,00000068,00000000,00000000), ref: 2D4D6BDB
CreateDIBSection.GDI32(?,?,00000000,0000006C,00000000,00000000), ref: 2D4D6BF2
SelectObject.GDI32(?,?), ref: 2D4D6C05
SelectObject.GDI32(?,?), ref: 2D4D6C0F

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Desktop$Create$CapsDeviceMetricsObjectSystem$CompatibleThread$CloseInformationReleaseSectionSelectUser_memset$CountCurrentCursorInputLoadOpenTickWindowlstrcmpi
String ID:
API String ID: 3027985456-0
Opcode ID: 70280838beb66deaafdd541e37e2898bb56653d2341edbaf28bbc65648cdc5af
Instruction ID: 47c0bcc31e6cae1e729188dc2f9e6e46ffaac7426a15919407206df08ecd13b9
Opcode Fuzzy Hash: 70280838beb66deaafdd541e37e2898bb56653d2341edbaf28bbc65648cdc5af
Instruction Fuzzy Hash: A88118B1A00A06BFD744CF65C855B96BBB4FB08700F10861AE61597A80D7B9F860CFD4

Function 2BB72DA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 203
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 2BB72DBB
InterlockedExchange.KERNEL32(?,00000000), ref: 2BB72DC7
timeGetTime.WINMM ref: 2BB72DCD
socket.WS2_32(00000002,00000001,00000006), ref: 2BB72DFA
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 2BB72E26
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 2BB72E32
lstrlenW.KERNEL32(?,00000000,000000CA,00000000,00000000), ref: 2BB72E51
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 2BB72E5D
gethostbyname.WS2_32(00000000), ref: 2BB72E6B
htons.WS2_32(?), ref: 2BB72E8D
connect.WS2_32(?,?,00000010), ref: 2BB72EAB

Strings

0u, xrefs: 2BB72F1C

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$EventExchangeInterlockedResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 640718063-3203441087
Opcode ID: 45a1a72deacbb8be1e7571720fc3d657cc454826da28b0b8f65973eaca2d034e
Instruction ID: 821c9185cd193b7e7dc0ac24a1e5bd9a919d2986e854c6819c708f2ecf7c78a8
Opcode Fuzzy Hash: 45a1a72deacbb8be1e7571720fc3d657cc454826da28b0b8f65973eaca2d034e
Instruction Fuzzy Hash: 1F6181B2E40704AFE720DFA4CD45FAAB7B8FF48700F104519F655EB2D0D675A9058B64

Function 2D4D2D90 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 203networkstringtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 2D4D2DAB
InterlockedExchange.KERNEL32(?,00000000), ref: 2D4D2DB7
timeGetTime.WINMM ref: 2D4D2DBD
socket.WS2_32(00000002,00000001,00000006), ref: 2D4D2DEA
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 2D4D2E16
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 2D4D2E22
lstrlenW.KERNEL32(?,00000000,000000CA,00000000,00000000), ref: 2D4D2E41
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 2D4D2E4D
gethostbyname.WS2_32(00000000), ref: 2D4D2E5B
htons.WS2_32(?), ref: 2D4D2E7D
connect.WS2_32(?,?,00000010), ref: 2D4D2E9B

Strings

0u, xrefs: 2D4D2F0C

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$EventExchangeInterlockedResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 640718063-3203441087
Opcode ID: 109e5c0f389cfa7d0e958e55a9c0bb6e8db96f4f752243f8ba823ed366ad162d
Instruction ID: 6cd55aa46586e70f8071bb3d5a17ad6bdf0abdb4ad7b0958fc9d2c3e4fde3f06
Opcode Fuzzy Hash: 109e5c0f389cfa7d0e958e55a9c0bb6e8db96f4f752243f8ba823ed366ad162d
Instruction Fuzzy Hash: 8D614072A40704AFDB20DFA4DC85FAAB7B8FF48B11F10851DF646A7290D7B4A905CB64

Function 00402EDD Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 173
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32(?), ref: 00402EEB
InterlockedExchange.KERNEL32(?,00000000), ref: 00402EF8
timeGetTime.WINMM ref: 00402EFE
socket.WS2_32(00000002,00000001,00000006), ref: 00402F28
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00402F4A
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 00402F52
lstrlenW.KERNEL32(?,00000000,?,00000000,00000000), ref: 00402F6F
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 00402F77
gethostbyname.WS2_32(?), ref: 00402F87
htons.WS2_32(?), ref: 00402FA8
connect.WS2_32(?,?,00000010), ref: 00402FC5
setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 00402FF4
setsockopt.WS2_32(?,0000FFFF,00001002,00040000,00000004), ref: 00403010
setsockopt.WS2_32(?,0000FFFF,00001006,?,00000004), ref: 0040302C
setsockopt.WS2_32(?,0000FFFF,00000008,?,00000004), ref: 00403045

Strings

0u, xrefs: 00403025

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: setsockopt$ByteCharMultiWidelstrlen$EventExchangeInterlockedResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 852538878-3203441087
Opcode ID: 7cbc8e167ecad88665eee4e13f40d9da3b59e931db4e546b7e591d29cb8f9eb1
Instruction ID: fc638956ebaca5a48c36650b1053da0fd2949bd59546c9d3a891564537455c76
Opcode Fuzzy Hash: 7cbc8e167ecad88665eee4e13f40d9da3b59e931db4e546b7e591d29cb8f9eb1
Instruction Fuzzy Hash: 80516EB1900709BFEB109FA4DC85EEBBBBCFF08745F004529F641E62A0D7B59A448B64

Function 2BB7AD10 Relevance: 30.1, APIs: 12, Strings: 5, Instructions: 346
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.ADVAPI32(80000001,Console,00000000,00020019,?), ref: 2BB7AD53
RegQueryValueExW.ADVAPI32(?,IpDatespecial,00000000,?,00000000,?), ref: 2BB7AD73

Strings

Console, xrefs: 2BB7AD39
+, xrefs: 2BB7AE42
%s_bin, xrefs: 2BB7AE33
IpDatespecial, xrefs: 2BB7AD6D
Console\0, xrefs: 2BB7B0DC

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: OpenQueryValue
String ID: %s_bin$Console$Console\0$IpDatespecial$+
API String ID: 4153817207-2616160532
Opcode ID: 9a750edd9e6258ef56d014b63a0922f2b106bfa414dd2c8642721d1c3dad548d
Instruction ID: 4f1ba4d1a10982f2b72fbd5b6f7ee6f772a7626203ef6b295fbe45459eab1a47
Opcode Fuzzy Hash: 9a750edd9e6258ef56d014b63a0922f2b106bfa414dd2c8642721d1c3dad548d
Instruction Fuzzy Hash: 7BC119B2A003009BEB04EF24CC46F6B73B9EFA9714F140528F9659F281E775E505DBA2

Function 00404D97 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 147
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00404D9C

Part of subcall function 00406146: __fassign.LIBCMT ref: 0040613C

Sleep.KERNEL32(00000000), ref: 00404DB9

Part of subcall function 00405AE7: _malloc.LIBCMT ref: 00405B01

Sleep.KERNEL32(00000000), ref: 00404EF2
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00404F38

Part of subcall function 00402DF7: WSAStartup.WS2_32(00000202,?), ref: 00402E48
Part of subcall function 00402DF7: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00402E53
Part of subcall function 00402DF7: InterlockedExchange.KERNEL32(00000018,00000000), ref: 00402E61

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00404F81

Part of subcall function 004027E6: CloseHandle.KERNEL32(00403357,?,11111,00404F93), ref: 004027F9
Part of subcall function 004027E6: CloseHandle.KERNEL32(00402CEC), ref: 00402804

Strings

6666, xrefs: 00404E52
154.201.87.51, xrefs: 00404E3E
154.201.87.51, xrefs: 00404E20, 00404E48, 00404E9C, 00404F02
154.201.87.51, xrefs: 00404E16
154.201.87.51, xrefs: 00404E92
,@, xrefs: 00404F1F
11111, xrefs: 00404E03, 00404E31, 00404E59, 00404EAD, 00404EFA
9999, xrefs: 00404EA6
2(@, xrefs: 00404F47
11111, xrefs: 00404E2A

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: CloseCreateEventHandleSleep$ExchangeH_prologInterlockedObjectSingleStartupWait__fassign_malloc
String ID: 11111$11111$154.201.87.51$154.201.87.51$154.201.87.51$154.201.87.51$2(@$6666$9999$,@
API String ID: 4251829366-3445381498
Opcode ID: 23b9dfc756826399665797e70971f4ec7c81b3bec9f51a9bc1602f535bf1499a
Instruction ID: c6dc29e38a7595e0ee942e07741209eb18d4aa53f1fe723396526d6935b451e9
Opcode Fuzzy Hash: 23b9dfc756826399665797e70971f4ec7c81b3bec9f51a9bc1602f535bf1499a
Instruction Fuzzy Hash: 07517170A40206ABDB10EFA5DD86AEE7AB5EF45714F10413EF111B62D2DB7C49408B9D

Function 2BB7A6F0 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 2BB7A748
_memset.LIBCMT ref: 2BB7A788
_memset.LIBCMT ref: 2BB7A80E
swprintf.LIBCMT ref: 2BB7A82D

Part of subcall function 2BB7F707: _malloc.LIBCMT ref: 2BB7F721

_memset.LIBCMT ref: 2BB7A905
swprintf.LIBCMT ref: 2BB7A924
_memset.LIBCMT ref: 2BB7A986
swprintf.LIBCMT ref: 2BB7A9A5

Strings

onlyloadinmyself, xrefs: 2BB7A71C
plugmark, xrefs: 2BB7A75B
%s %s, xrefs: 2BB7A81C, 2BB7A890, 2BB7A913, 2BB7A994

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: _memset$swprintf$_malloc
String ID: %s %s$onlyloadinmyself$plugmark
API String ID: 1873853019-591889663
Opcode ID: 231647760dcf038b9ec0cd706994cb8eacc65e6c49bff5d3ba59a6dd31e021a2
Instruction ID: 7443b5d1ead23e2e4700534f2c170743b09d9b4e205f7cd9393ab2bb8462e127
Opcode Fuzzy Hash: 231647760dcf038b9ec0cd706994cb8eacc65e6c49bff5d3ba59a6dd31e021a2
Instruction Fuzzy Hash: 9F81C1B6940200ABEB10EB24DC86F6B37A4AF69710F044174ED295F387EA71E911D6E6

Function 2BB75F40 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 88
sleepstringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32(00000000,00000000,2BB9EE04), ref: 2BB75F66
GetLastError.KERNEL32 ref: 2BB75F6E
Sleep.KERNEL32(000003E8), ref: 2BB75F85
CreateMutexW.KERNEL32(00000000,00000000,2BB9EE04), ref: 2BB75F90
GetLastError.KERNEL32 ref: 2BB75F92
_memset.LIBCMT ref: 2BB75FB9
lstrlenW.KERNEL32(?), ref: 2BB75FC6
lstrcmpW.KERNEL32(?,2BB95328), ref: 2BB75FED
Sleep.KERNEL32(000003E8), ref: 2BB75FF8
GetModuleHandleW.KERNEL32(00000000), ref: 2BB76005
GetConsoleWindow.KERNEL32 ref: 2BB7600F

Strings

key, xrefs: 2BB75FD2
open, xrefs: 2BB75FCD

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CreateErrorLastMutexSleep$ConsoleHandleModuleWindow_memsetlstrcmplstrlen
String ID: key$open
API String ID: 2922109467-2893384115
Opcode ID: 1fd603897ff9fc5229cdb5b6a26933b4f757a4cce1c3df8dbd491ac5060def4f
Instruction ID: 62412b7911e2f57f8e5d0033014e8ccf6e3bca9b1b2fde4f3153219c81eb9914
Opcode Fuzzy Hash: 1fd603897ff9fc5229cdb5b6a26933b4f757a4cce1c3df8dbd491ac5060def4f
Instruction Fuzzy Hash: 72210472D04B059FEB00EB70DD85B6A73A8DF94604F100828EA559B1D1EA75E50ACFA3

Function 2BB7DA30 Relevance: 21.3, APIs: 14, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(0000000D,?,?,?,?,?,?,2BB7A8C1,?,?), ref: 2BB7DA43
SetLastError.KERNEL32(000000C1,?,?,?,?,?,?,2BB7A8C1,?,?), ref: 2BB7DA62

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 1c2530424d9b01be0b367aa9ba5677ae2599218d79a48acc071a57029ce15a92
Instruction ID: ee6328cde56d2ed347660013bc3f6dc197c4200a0dc120883cd4189150913118
Opcode Fuzzy Hash: 1c2530424d9b01be0b367aa9ba5677ae2599218d79a48acc071a57029ce15a92
Instruction Fuzzy Hash: 9181F1B2B00A019FDB10EFB5D984B6AB7F4FF48395F104269EA59D7680E7B1E500DB90

Function 2BB762B6 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 125
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 2BB762CE
wsprintfW.USER32 ref: 2BB76336
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,?), ref: 2BB7635F
_memset.LIBCMT ref: 2BB76376
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,?,?,?), ref: 2BB763B2
lstrcatW.KERNEL32(2BBA1F10,?), ref: 2BB763CE
lstrcatW.KERNEL32(2BBA1F10,2BB9535C), ref: 2BB763DA
RegCloseKey.ADVAPI32(00000000), ref: 2BB763E3
lstrlenW.KERNEL32(2BBA1F10,?,6FAD02D8,00000AD4,00000000,75BF73E0), ref: 2BB76427
lstrcatW.KERNEL32(2BBA1F10,2BB953D4,?,6FAD02D8,00000AD4,00000000,75BF73E0), ref: 2BB7643B

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 2BB76330
Windows Defender IOfficeAntiVirus implementation , xrefs: 2BB763C9, 2BB763D5, 2BB76422, 2BB76436, 2BB7645A

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: lstrcat$_memset$CloseOpenQueryValuelstrlenwsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}$Windows Defender IOfficeAntiVirus implementation
API String ID: 1671694837-1583895642
Opcode ID: 47b8010fd5f84096c296992009f01731df0a49248d667277e08a4f413d84c6fa
Instruction ID: e56866d3efdf4a509fdb22858f1fcfc664645b93635694e7ee36c1178c646d76
Opcode Fuzzy Hash: 47b8010fd5f84096c296992009f01731df0a49248d667277e08a4f413d84c6fa
Instruction Fuzzy Hash: 3C4190F2904568ABDF24DB64CC90FAAB7B8AF48304F0041C9F349A7191DA759F81CF64

Function 2BB77490 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 99registrylibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,75BF73E0,?,?,?,2BB75611,0000035E,000002FA), ref: 2BB7749C
GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 2BB774B2
swprintf.LIBCMT ref: 2BB774EF

Part of subcall function 2BB77410: GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,2BB77523), ref: 2BB7743D
Part of subcall function 2BB77410: GetProcAddress.KERNEL32(00000000), ref: 2BB77444
Part of subcall function 2BB77410: GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,2BB77523), ref: 2BB77452

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00020019,000002FA), ref: 2BB77547
RegQueryValueExW.KERNEL32(000002FA,ProductName,00000000,00000001,00000000,?), ref: 2BB77563
RegCloseKey.ADVAPI32(000002FA), ref: 2BB77586
FreeLibrary.KERNEL32(00000000,?,?,?,2BB75611,0000035E,000002FA), ref: 2BB77598

Strings

ProductName, xrefs: 2BB7755D
RtlGetNtVersionNumbers, xrefs: 2BB774AC
ntdll.dll, xrefs: 2BB77497
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 2BB7753D
%d.%d.%d, xrefs: 2BB774E7

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: AddressLibraryProc$CloseFreeHandleInfoLoadModuleNativeOpenQuerySystemValueswprintf
String ID: %d.%d.%d$ProductName$RtlGetNtVersionNumbers$SOFTWARE\Microsoft\Windows NT\CurrentVersion$ntdll.dll
API String ID: 2158625971-3190923360
Opcode ID: 1ec53f252c17fd0e929d8fbe1bc85ceb5c898140ca6037c96b7e8092c3c10225
Instruction ID: 4a74aeb2570ea219a7b9b82aac53b87836d730ff03e745e09fc4ee32062f2cc7
Opcode Fuzzy Hash: 1ec53f252c17fd0e929d8fbe1bc85ceb5c898140ca6037c96b7e8092c3c10225
Instruction Fuzzy Hash: 84319372E40208BBEB14EBA4CD85FBF7B7CDF58200F100529BA15A6145EA74DA04DBA0

Function 2BB7C060 Relevance: 19.7, APIs: 13, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000002,?,6FAD02D8,?,00000000,?), ref: 2BB7C09E
GlobalLock.KERNEL32(00000000), ref: 2BB7C0AA
GlobalUnlock.KERNEL32(00000000), ref: 2BB7C0BF
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 2BB7C0D5
EnterCriticalSection.KERNEL32(2BB9FB64), ref: 2BB7C113
LeaveCriticalSection.KERNEL32(2BB9FB64), ref: 2BB7C124

Part of subcall function 2BB79DE0: GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 2BB79E04
Part of subcall function 2BB79DE0: GdipDisposeImage.GDIPLUS(?), ref: 2BB79E18

CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 2BB7C14C

Part of subcall function 2BB7A460: GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 2BB7A48D
Part of subcall function 2BB7A460: _free.LIBCMT ref: 2BB7A503

GetHGlobalFromStream.OLE32(?,?), ref: 2BB7C16D
GlobalLock.KERNEL32(?), ref: 2BB7C177
GlobalFree.KERNEL32(00000000), ref: 2BB7C18F

Part of subcall function 2BB79BA0: DeleteObject.GDI32(?), ref: 2BB79BD2
Part of subcall function 2BB79BA0: EnterCriticalSection.KERNEL32(2BB9FB64,?,?,?,2BB79B7B), ref: 2BB79BE3
Part of subcall function 2BB79BA0: EnterCriticalSection.KERNEL32(2BB9FB64,?,?,?,2BB79B7B), ref: 2BB79BF8
Part of subcall function 2BB79BA0: GdiplusShutdown.GDIPLUS(00000000,?,?,?,2BB79B7B), ref: 2BB79C04
Part of subcall function 2BB79BA0: LeaveCriticalSection.KERNEL32(2BB9FB64,?,?,?,2BB79B7B), ref: 2BB79C15
Part of subcall function 2BB79BA0: LeaveCriticalSection.KERNEL32(2BB9FB64,?,?,?,2BB79B7B), ref: 2BB79C1C

GlobalSize.KERNEL32(00000000), ref: 2BB7C1A5
GlobalUnlock.KERNEL32(?), ref: 2BB7C221
GlobalFree.KERNEL32(00000000), ref: 2BB7C249

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Global$CriticalSection$Stream$CreateEnterGdipLeave$FreeFromImageLockSizeUnlock$AllocBitmapDeleteDisposeEncodersGdiplusObjectShutdown_free
String ID:
API String ID: 1483550337-0
Opcode ID: 92091aa452d24619f34a6a6a057f172244bf91cfd5d76f1f893437791f4bac7b
Instruction ID: 6f13f630a4f0341076394402f52524d88d894f5b0dd5aa1b886dfdb79b149f8d
Opcode Fuzzy Hash: 92091aa452d24619f34a6a6a057f172244bf91cfd5d76f1f893437791f4bac7b
Instruction Fuzzy Hash: B46139B2D00618AFDF14EFA8D9849AEBBB8FF5D710F10412EE525A7241DB359906CF90

Function 2BB76490 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 144registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2BB764C2
RegOpenKeyExW.KERNEL32(80000001,Software\Tencent\Plugin\VAS,00000000,000F003F,?), ref: 2BB764E2
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 2BB76524
_memset.LIBCMT ref: 2BB76560
_memset.LIBCMT ref: 2BB7658E
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00000000,00000AD4,75BF73E0), ref: 2BB765BA
lstrlenW.KERNEL32(?,?,?,?,00000000,00000AD4,75BF73E0), ref: 2BB765C3
lstrlenW.KERNEL32(?,?,?,?,00000000,00000AD4,75BF73E0), ref: 2BB765D5
RegCloseKey.ADVAPI32(?,00000000,00000AD4,75BF73E0), ref: 2BB76625
lstrlenW.KERNEL32(?), ref: 2BB76635

Strings

Software\Tencent\Plugin\VAS, xrefs: 2BB764D8

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: _memsetlstrlen$CloseEnumInfoOpenQuery
String ID: Software\Tencent\Plugin\VAS
API String ID: 2921034913-3343197220
Opcode ID: 37fb3ed115459a47e3607751e1cd2dad8550655b090750118f42bf893a52dbbd
Instruction ID: 1efbd81f40d3fdb76ad9e577ff38e2aa9dd9e5b628fe8e5dfc3b78ef7f814ec0
Opcode Fuzzy Hash: 37fb3ed115459a47e3607751e1cd2dad8550655b090750118f42bf893a52dbbd
Instruction Fuzzy Hash: 0241A8F6E40218ABDB24DB60CD85FEA737CDF58700F404199E719B7041EA71EA859F64

Function 2BB76790 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 2BB75320: InterlockedDecrement.KERNEL32(00000008), ref: 2BB7536F
Part of subcall function 2BB75320: SysFreeString.OLEAUT32(00000000), ref: 2BB75384
Part of subcall function 2BB75320: SysAllocString.OLEAUT32(2BB95148), ref: 2BB753D5

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,?,2BB95148,2BB769A4,2BB95148,00000000,75BF73E0), ref: 2BB767F4
GetLastError.KERNEL32 ref: 2BB767FE
GetProcessHeap.KERNEL32(00000008,?), ref: 2BB76816
HeapAlloc.KERNEL32(00000000), ref: 2BB7681D
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,?,?), ref: 2BB7683F
LookupAccountSidW.ADVAPI32(00000000,?,?,00000100,?,00000100,?), ref: 2BB76871
GetLastError.KERNEL32 ref: 2BB7687B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 2BB768E6
HeapFree.KERNEL32(00000000), ref: 2BB768ED

Strings

NONE_MAPPED, xrefs: 2BB76888

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Heap$AllocErrorFreeInformationLastProcessStringToken$AccountDecrementInterlockedLookup
String ID: NONE_MAPPED
API String ID: 1317816589-2950899194
Opcode ID: 35923fc8ff14a337b64eef5c5e3264d1e7ce99b2a065c2104c80867f898e6d7c
Instruction ID: 6c80e6e0129f7e2aa6a411016c399e9bdb97296ea0ab99706209b81142c0b8bf
Opcode Fuzzy Hash: 35923fc8ff14a337b64eef5c5e3264d1e7ce99b2a065c2104c80867f898e6d7c
Instruction Fuzzy Hash: B94160B2D00618AFDF10EF64CD85FAA7379EF88700F0081E9E61AA7141DA759A859F64

Function 2BB7A460 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 150windowCOMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 2BB7A48D
_malloc.LIBCMT ref: 2BB7A4D1
_free.LIBCMT ref: 2BB7A503
GdipGetImageEncoders.GDIPLUS(?,?,00000008), ref: 2BB7A522
GdipSaveImageToStream.GDIPLUS(00000000,?,?,00000000), ref: 2BB7A594
GdipDisposeImage.GDIPLUS(00000000), ref: 2BB7A59F
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,00000000,?), ref: 2BB7A5C5
GdipDisposeImage.GDIPLUS(00000000), ref: 2BB7A5DD

Strings

&, xrefs: 2BB7A579

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Gdip$Image$DisposeEncoders$BitmapCreateFromSaveSizeStream_free_malloc
String ID: &
API String ID: 2794124522-3042966939
Opcode ID: 5105ffe1b1f45489fd5006d41e389c087a4155a9a9922db0e61a0ad781e69769
Instruction ID: 95567056cf7c56529820b715d6d44f1ec5a28031641158105542317bb0d9f3a1
Opcode Fuzzy Hash: 5105ffe1b1f45489fd5006d41e389c087a4155a9a9922db0e61a0ad781e69769
Instruction Fuzzy Hash: 31514EB2E002159FDF44EFA4C885EEEB7B8EF5D700F108119EA25A7250D635E905DFA0

Function 004026A6 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 102registrysleepCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE,00000000,00000102,?), ref: 00402718
RegDeleteValueW.KERNEL32(?,IpDates_info), ref: 00402727
RegSetValueExW.KERNEL32(?,IpDates_info,00000000,00000003,004182E8,000012A0), ref: 00402738
RegCloseKey.ADVAPI32(?), ref: 00402741
OpenProcess.KERNEL32(00000400,00000000,?), ref: 00402778
GetExitCodeProcess.KERNEL32(00000000,?), ref: 00402787
Sleep.KERNEL32(00000BB8), ref: 0040279F

Strings

SOFTWARE, xrefs: 0040270E
IpDates_info, xrefs: 0040271E, 00402723, 00402734

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: OpenProcessValue$CloseCodeDeleteExitSleep
String ID: IpDates_info$SOFTWARE
API String ID: 864241144-2243437601
Opcode ID: 81a0f8ce60a6003761f1b90c79ead6d15476cf87aa396c82528c29125b5c35e9
Instruction ID: 1b088efad3a1072d9db39e3e81605ba8d411973ba8a4617e0988d958dc50367d
Opcode Fuzzy Hash: 81a0f8ce60a6003761f1b90c79ead6d15476cf87aa396c82528c29125b5c35e9
Instruction Fuzzy Hash: BE31F031500144BBEB119BA8DE4DAEF7F69EB48314F20803AF601B71E1C7B88E45C7A9

Function 00404AC3 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00404AC8

Part of subcall function 00404A7E: CreateEventW.KERNEL32(00000000,?,?,00000000,?,00404AF1,00000001,00000001,?,?,00000000,?,00404DF7,00000000), ref: 00404A8B

HeapCreate.KERNEL32(00000004,00000000,00000000), ref: 00404B6D
InterlockedExchange.KERNEL32(?,00000000), ref: 00404D35
timeGetTime.WINMM ref: 00404D3B

Part of subcall function 0040124F: __CxxThrowException@8.LIBCMT ref: 0040125F
Part of subcall function 0040124F: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,?,00415DC8,?,?,00404AA1,?,00404AF1,00000001,00000001,?,?,00000000), ref: 0040126D

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00404D4F
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00404D58

Strings

mQ@, xrefs: 00404CA9
r@@, xrefs: 00404AE6

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: Create$Event$CountCriticalException@8ExchangeH_prologHeapInitializeInterlockedSectionSpinThrowTimetime
String ID: mQ@$r@@
API String ID: 1172313120-380435330
Opcode ID: b9cbefec0aa213da3ae1647b8bc4fd33f1562e8bcc51ab876a3c57a5fcf47213
Instruction ID: 4157d43860f4bc3919c5c4ed83f6f51a429712bc0ee19b8132c1151593e4686a
Opcode Fuzzy Hash: b9cbefec0aa213da3ae1647b8bc4fd33f1562e8bcc51ab876a3c57a5fcf47213
Instruction Fuzzy Hash: D091CDB0A01B46AFD354DF6AC984786FBF4FB08308F50862EE16D97A40D774A564CF94

Function 2D4D7420 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 133windowCOMMON

Download Yara Rule

APIs

CreateDIBSection.GDI32(00000000,?,00000000,?,00000000,00000000), ref: 2D4D7489
SelectObject.GDI32(?,00000000), ref: 2D4D7497
BitBlt.GDI32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,00CC0020), ref: 2D4D74B8
BitBlt.GDI32(?,00000000,00000000,00000000,00000000,?,00000000,?,00CC0020), ref: 2D4D74DB
DeleteObject.GDI32(?), ref: 2D4D7546
_free.LIBCMT ref: 2D4D7554

Strings

sM-, xrefs: 2D4D74F1, 2D4D754C, 2D4D7553
sM-, xrefs: 2D4D7427, 2D4D755F

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Object$CreateDeleteSectionSelect_free
String ID: sM-$sM-
API String ID: 3233559073-3019387597
Opcode ID: 8e06b13357726e8af75ba137fd8d409115968ebe3d106bddbfba831e5c935681
Instruction ID: 8c6fbf647896dc5043c6c1b9515bd3e032659cf98fc0b9f9eb6c7b81e82e6e84
Opcode Fuzzy Hash: 8e06b13357726e8af75ba137fd8d409115968ebe3d106bddbfba831e5c935681
Instruction Fuzzy Hash: D25103B6A00700AFC714CF69C994E2ABBF9FF88700B14895DEA869B755D670F941CB60

Function 2D4D5570 Relevance: 13.6, APIs: 9, Instructions: 83synchronizationCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 2D4D55C0
InterlockedExchange.KERNEL32(?,00000000), ref: 2D4D55C7
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,?,?,00000000,2D5019A3,000000FF), ref: 2D4D55D5
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,?,?,00000000,2D5019A3,000000FF), ref: 2D4D55DD
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,2D5019A3,000000FF), ref: 2D4D55E9
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,2D5019A3,000000FF), ref: 2D4D55EF
ReleaseDC.USER32(00000000,?), ref: 2D4D55F9
DestroyCursor.USER32(?), ref: 2D4D5629
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,2D5019A3,000000FF), ref: 2D4D563F

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: CloseHandle$ExchangeInterlockedObjectSingleWait$CursorDestroyRelease
String ID:
API String ID: 3796861758-0
Opcode ID: b8f244d72a48be4a06a4fa3469bc600b845fbe474f6b0f0c5e54a3cef36538b1
Instruction ID: 855d0a45d2a322db991e3c935cc09b1a60f1de8bd306c188afc4401c7e9d159b
Opcode Fuzzy Hash: b8f244d72a48be4a06a4fa3469bc600b845fbe474f6b0f0c5e54a3cef36538b1
Instruction Fuzzy Hash: 78313CB2504B049FD724DF99C880F6AF7F9FB88611B208A1EE55693790DBB5B804CF50

Function 2BB7CA70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 197registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Console\0,00000000,000F003F,2BB912F8,6FAD02D8,00000001,00000001,00000000), ref: 2BB7CAB1
RegQueryInfoKeyW.ADVAPI32(2BB912F8,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,00000000,00000000), ref: 2BB7CAE0
_memset.LIBCMT ref: 2BB7CB44
_memset.LIBCMT ref: 2BB7CB53
RegEnumValueW.KERNEL32(2BB912F8,?,00000000,?,00000000,?,00000000,?), ref: 2BB7CB72

Part of subcall function 2BB7F707: _malloc.LIBCMT ref: 2BB7F721

Part of subcall function 2BB7F707: std::exception::exception.LIBCMT ref: 2BB7F756
Part of subcall function 2BB7F707: std::exception::exception.LIBCMT ref: 2BB7F770
Part of subcall function 2BB7F707: __CxxThrowException@8.LIBCMT ref: 2BB7F781

RegCloseKey.ADVAPI32(2BB912F8,?,?,?,?,?,?,?,?,?,?,?,00000000,2BB912F8,000000FF), ref: 2BB7CC83

Strings

Console\0, xrefs: 2BB7CAA4

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: _memsetstd::exception::exception$CloseEnumException@8InfoOpenQueryThrowValue_malloc
String ID: Console\0
API String ID: 1348767993-1253790388
Opcode ID: 4864c57f228bbbae93d370393534525b5816d1a05cffd2ff6b97ea17242c7c3e
Instruction ID: 3f0d11222500a5ea4b30a15f94bc690e498cc2fb8b8456318c1ee94f6c6e5f70
Opcode Fuzzy Hash: 4864c57f228bbbae93d370393534525b5816d1a05cffd2ff6b97ea17242c7c3e
Instruction Fuzzy Hash: 816120B6D00219AFDB04DFA8D885EAEB7B8FF58310F14416AE915EB341D7359901CBA4

Function 2BB7BB00 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 2BB7F707: _malloc.LIBCMT ref: 2BB7F721

_memset.LIBCMT ref: 2BB7BB21
GetLastInputInfo.USER32(?), ref: 2BB7BB37
GetTickCount.KERNEL32 ref: 2BB7BB3D
wsprintfW.USER32 ref: 2BB7BB66
GetForegroundWindow.USER32 ref: 2BB7BB6F
GetWindowTextW.USER32(00000000,00000020,000000FA), ref: 2BB7BB83

Strings

%d min, xrefs: 2BB7BB60

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Window$CountForegroundInfoInputLastTextTick_malloc_memsetwsprintf
String ID: %d min
API String ID: 3754759880-1947832151
Opcode ID: 79363ac07947a5e89389792ac52a680eaa69d3e90dfd5946d3206b8b901f7f59
Instruction ID: e2af93bc24985708559f06f6f11f68af85642ecded21d7a0bc26b9f194d43455
Opcode Fuzzy Hash: 79363ac07947a5e89389792ac52a680eaa69d3e90dfd5946d3206b8b901f7f59
Instruction Fuzzy Hash: 9D41A2B6D00214AFDB14EFA4C989EAF7BB8EF58700F148164E9199B351D674DA04CFE1

Function 2D4D7E97 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 2D4D7EB1

Part of subcall function 2D4D7E03: __FF_MSGBANNER.LIBCMT ref: 2D4D7E1C
Part of subcall function 2D4D7E03: __NMSG_WRITE.LIBCMT ref: 2D4D7E23
Part of subcall function 2D4D7E03: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,2D4DADD0,00000000,00000001,00000000,?,2D4DC162,00000018,2D52AFE0,0000000C,2D4DC1F2), ref: 2D4D7E48

std::exception::exception.LIBCMT ref: 2D4D7EE6
std::exception::exception.LIBCMT ref: 2D4D7F00
__CxxThrowException@8.LIBCMT ref: 2D4D7F11

Strings

l#P-, xrefs: 2D4D7EDF
d#P-, xrefs: 2D4D7EC9
R-, xrefs: 2D4D7EC4

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: d#P-$l#P-$R-
API String ID: 615853336-3173330459
Opcode ID: efc9274e9f30f01f66c3f0f3f6455da00c5b2ccd09aa1fa0ddbbe9d060065ccc
Instruction ID: bde602d851d7ad8ac8e86077e95351d9d766b7c205947a54c47df8d127505982
Opcode Fuzzy Hash: efc9274e9f30f01f66c3f0f3f6455da00c5b2ccd09aa1fa0ddbbe9d060065ccc
Instruction Fuzzy Hash: 44F0F432400519AEDB88DB94DC68EBE3BB9FB10E44F21405DE622F62D0CBB09E04C745

Function 2BB76910 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(6FAD02D8,00000000,00000000,75BF73E0,?,00000000,2BB910DB,000000FF,?,2BB76AB3,00000000), ref: 2BB76938
OpenProcess.KERNEL32(00000400,00000000,00000000,?,00000000,2BB910DB,000000FF,?,2BB76AB3,00000000), ref: 2BB76947
OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,00000000,2BB910DB,000000FF,?,2BB76AB3,00000000), ref: 2BB76960
CloseHandle.KERNEL32(00000000,?,00000000,2BB910DB,000000FF,?,2BB76AB3,00000000), ref: 2BB7696B
SysStringLen.OLEAUT32(00000000), ref: 2BB769BE
SysStringLen.OLEAUT32(00000000), ref: 2BB769CC
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,2BB910DB,000000FF), ref: 2BB76A2E
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,2BB910DB,000000FF), ref: 2BB76A34

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CloseHandleProcess$OpenString$CurrentToken
String ID:
API String ID: 429299433-0
Opcode ID: 54570115d9ed4a52ac8bd715fed1b386d93a02b48e112cb97d0f06fc6e6ee4d4
Instruction ID: 910b9c9405d00ad4444d68143582f80d4c05807bda03d98f4b13d271fb37b302
Opcode Fuzzy Hash: 54570115d9ed4a52ac8bd715fed1b386d93a02b48e112cb97d0f06fc6e6ee4d4
Instruction Fuzzy Hash: 7141D2B3D006189FDB00DFA8CC81AAEB7B8FF58700F10466AE965F7241E7759901DBA0

Function 2D4D7280 Relevance: 10.7, APIs: 7, Instructions: 153COMMON

Download Yara Rule

APIs

CreateRectRgnIndirect.GDI32(?), ref: 2D4D7334
GetRegionData.GDI32(00000000,00000000,00000000), ref: 2D4D73B8
GetRegionData.GDI32(?,00000000,00000000), ref: 2D4D73D1
DeleteObject.GDI32(?), ref: 2D4D73D8

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: DataRegion$CreateDeleteIndirectObjectRect
String ID:
API String ID: 2186813130-0
Opcode ID: 122e8af45a03f852d1dd6f3da3d96996871104d693411603cd720906380aee6c
Instruction ID: 2299ab017f63e12e302cd89b510a3dbdbd3dc1dc7c7964161f392b363c2d970e
Opcode Fuzzy Hash: 122e8af45a03f852d1dd6f3da3d96996871104d693411603cd720906380aee6c
Instruction Fuzzy Hash: BF518EB2A003058FDB14CFA5C8E5AAEB7F5FB48611F24852EE507E3301E778A945CB64

Function 2BB76D70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 89registrystringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2BB76DD9
RegOpenKeyExW.KERNEL32(80000001,2BB95164,00000000,00020019,75BF73E0), ref: 2BB76DFC
RegQueryValueExW.KERNEL32(75BF73E0,GROUP,00000000,00000001,?,00000208), ref: 2BB76E4A
lstrcmpW.KERNEL32(?,2BB95148), ref: 2BB76E60
lstrcpyW.KERNEL32(2BB756EA,?), ref: 2BB76E72

Strings

GROUP, xrefs: 2BB76E42

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: OpenQueryValue_memsetlstrcmplstrcpy
String ID: GROUP
API String ID: 2102619503-2593425013
Opcode ID: 987686e2247974dec0231ed73396fc5c0cf13e5754e1d6c482cbd474e588e35b
Instruction ID: 5efd0a5a5d6f9b3ed19bd491df8ed7dd612670fd1f8981b90c3f1a5b78117b7f
Opcode Fuzzy Hash: 987686e2247974dec0231ed73396fc5c0cf13e5754e1d6c482cbd474e588e35b
Instruction Fuzzy Hash: 9E317671900219AFDF20DFA0DD89FDAB7B8EB08710F104299E519A7190DB79EA85CF64

Function 00405E5B Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 00405E80
__calloc_crt.LIBCMT ref: 00405E8C
__getptd.LIBCMT ref: 00405E99
CreateThread.KERNEL32(?,?,00405DF6,00000000,?,?), ref: 00405ED0
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 00405EDA
_free.LIBCMT ref: 00405EE3
__dosmaperr.LIBCMT ref: 00405EEE

Part of subcall function 00405FAB: __getptd_noexit.LIBCMT ref: 00405FAB

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: 8ef3443a0b134dae4d588a088bce12e4b4682313ba3fc70934c9e8beb3ea1dde
Instruction ID: ad13e1b821ed2851042e6c24a589c87f04214b9cc242500fa9853e645b4607a8
Opcode Fuzzy Hash: 8ef3443a0b134dae4d588a088bce12e4b4682313ba3fc70934c9e8beb3ea1dde
Instruction Fuzzy Hash: 71110232110B06AFDB10AFA6EC4199B3B99EF44368710013FF990B62D1DF38C9018FA9

Function 2BB7FA29 Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 2BB7FA4E
__calloc_crt.LIBCMT ref: 2BB7FA5A
__getptd.LIBCMT ref: 2BB7FA67
CreateThread.KERNEL32(?,?,2BB7F9C4,00000000,?,?), ref: 2BB7FA9E
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 2BB7FAA8
_free.LIBCMT ref: 2BB7FAB1
__dosmaperr.LIBCMT ref: 2BB7FABC

Part of subcall function 2BB7F91B: __getptd_noexit.LIBCMT ref: 2BB7F91B

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: 1eed4d084a79d2b70017a13e95176905f844b5a3ff028a782e26ca248425cf37
Instruction ID: 43b0dd0812d3f6a737e3ca7c983a31f45b9b5f8811ec6b4931c0ee08dccb02e2
Opcode Fuzzy Hash: 1eed4d084a79d2b70017a13e95176905f844b5a3ff028a782e26ca248425cf37
Instruction Fuzzy Hash: 2311CE33604786BFDF01EFA5DC89D9B37B9DF29260B10402AF924860A0DB71D801DA68

Function 2D4D819B Relevance: 10.6, APIs: 7, Instructions: 63threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 2D4D81C0
__calloc_crt.LIBCMT ref: 2D4D81CC
__getptd.LIBCMT ref: 2D4D81D9
CreateThread.KERNEL32(?,?,2D4D8136,00000000,?,?), ref: 2D4D8210
GetLastError.KERNEL32(?,?,?,?,?,00000000), ref: 2D4D821A
_free.LIBCMT ref: 2D4D8223
__dosmaperr.LIBCMT ref: 2D4D822E

Part of subcall function 2D4D808D: __getptd_noexit.LIBCMT ref: 2D4D808D

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__dosmaperr__getptd__getptd_noexit_free
String ID:
API String ID: 155776804-0
Opcode ID: ddb4b066b96a16d94131c3c26c38580832ccbd9fcae586aec9b1c9939b2806b7
Instruction ID: 5076d64efb5ca38a509261bd03e7b2fbc014098ed6023ca6780cae58fe43f28d
Opcode Fuzzy Hash: ddb4b066b96a16d94131c3c26c38580832ccbd9fcae586aec9b1c9939b2806b7
Instruction Fuzzy Hash: D61106331087066FDB91DFA49C60ABB37E8DF24EA0F12401DFA14B6240DB31D801C6A1

Function 2D4D6C80 Relevance: 10.6, APIs: 7, Instructions: 59COMMON

Download Yara Rule

APIs

ReleaseDC.USER32(00000000,?), ref: 2D4D6C91
DeleteDC.GDI32(?), ref: 2D4D6CA1
DeleteDC.GDI32(?), ref: 2D4D6CA7
DeleteDC.GDI32(?), ref: 2D4D6CAD
DeleteObject.GDI32(?), ref: 2D4D6CB9
DeleteObject.GDI32(?), ref: 2D4D6CBF
DestroyCursor.USER32(?), ref: 2D4D6D13

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Delete$Object$CursorDestroyRelease
String ID:
API String ID: 1665608007-0
Opcode ID: e3a2ed0eb7451bc09e14f556609c501ca2a972846e9b38846a3819172fcef59d
Instruction ID: b975c060712970e3cb05fd73ffb9c8ed554063e77f5068df6cc2c76372b981d7
Opcode Fuzzy Hash: e3a2ed0eb7451bc09e14f556609c501ca2a972846e9b38846a3819172fcef59d
Instruction Fuzzy Hash: B81133B66007445BDA20EB65CC90B67B3FCEF98A01F15481DEA4693750DAB9F800DF61

Function 2BB77410 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,?,?,?,?,?,?,?,?,2BB77523), ref: 2BB7743D
GetProcAddress.KERNEL32(00000000), ref: 2BB77444
GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,2BB77523), ref: 2BB77452
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,2BB77523), ref: 2BB7745A

Strings

kernel32.dll, xrefs: 2BB7741D
GetNativeSystemInfo, xrefs: 2BB77418

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 3433367815-192647395
Opcode ID: 2fd711c5eb4f0b5c5919072be7ff1469c1cc7ce7163291124954da0aa2c04f19
Instruction ID: 80f74b68624a789d8767acf2402ac281516a5490f222ec89c7dbeca7ccbfb2a3
Opcode Fuzzy Hash: 2fd711c5eb4f0b5c5919072be7ff1469c1cc7ce7163291124954da0aa2c04f19
Instruction Fuzzy Hash: 99014BB1D002099FCF40EFB5D9446AEBBF5EB08300F5045AAD959E3240EA3A8A10CFA1

Function 00405DF6 Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 00405DFC

Part of subcall function 00408D18: TlsGetValue.KERNEL32(?,00405E01), ref: 00408D21
Part of subcall function 00408D18: DecodePointer.KERNEL32(?,00405E01), ref: 00408D33
Part of subcall function 00408D18: TlsSetValue.KERNEL32(00000000,?,00405E01), ref: 00408D42

___fls_getvalue@4.LIBCMT ref: 00405E07

Part of subcall function 00408CF8: TlsGetValue.KERNEL32(?,?,00405E0C,00000000), ref: 00408D06

___fls_setvalue@8.LIBCMT ref: 00405E1A

Part of subcall function 00408D4C: DecodePointer.KERNEL32(?,?,?,00405E1F,00000000,?,00000000), ref: 00408D5D

GetLastError.KERNEL32(00000000,?,00000000), ref: 00405E23
ExitThread.KERNEL32 ref: 00405E2A
GetCurrentThreadId.KERNEL32 ref: 00405E30
__freefls@4.LIBCMT ref: 00405E50

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2383549826-0
Opcode ID: 2fc00eb8b2fe200871dbf507be9609cb573f5d9c14796885594e8b418c55bbcd
Instruction ID: 5caf4c4d3fdade9bbe853045276b708fa976273acafaa08517931b46730abf76
Opcode Fuzzy Hash: 2fc00eb8b2fe200871dbf507be9609cb573f5d9c14796885594e8b418c55bbcd
Instruction Fuzzy Hash: 76F06274000600ABD704FF72CA0984B7BA9EF88308320C53EF884A7297DE39D9429B9C

Function 2BB7F9C4 Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 2BB7F9CA

Part of subcall function 2BB83CA0: TlsGetValue.KERNEL32(00000000,2BB83DF9,?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C,2BB88E76,00000000,00000000), ref: 2BB83CA9
Part of subcall function 2BB83CA0: DecodePointer.KERNEL32(?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C,2BB88E76,00000000,00000000,?,2BB83F06,0000000D), ref: 2BB83CBB
Part of subcall function 2BB83CA0: TlsSetValue.KERNEL32(00000000,?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C,2BB88E76,00000000,00000000,?,2BB83F06), ref: 2BB83CCA

___fls_getvalue@4.LIBCMT ref: 2BB7F9D5

Part of subcall function 2BB83C80: TlsGetValue.KERNEL32(?,?,2BB7F9DA,00000000), ref: 2BB83C8E

___fls_setvalue@8.LIBCMT ref: 2BB7F9E8

Part of subcall function 2BB83CD4: DecodePointer.KERNEL32(?,?,?,2BB7F9ED,00000000,?,00000000), ref: 2BB83CE5

GetLastError.KERNEL32(00000000,?,00000000), ref: 2BB7F9F1
ExitThread.KERNEL32 ref: 2BB7F9F8
GetCurrentThreadId.KERNEL32 ref: 2BB7F9FE
__freefls@4.LIBCMT ref: 2BB7FA1E

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2383549826-0
Opcode ID: 331930c8609443439f737694b646c533cf7fefa0882b5f8dfeab32c744545955
Instruction ID: 165de7697ec367f8e1bea18d51a87c87f33dbd799082a48181cf81c488d97248
Opcode Fuzzy Hash: 331930c8609443439f737694b646c533cf7fefa0882b5f8dfeab32c744545955
Instruction Fuzzy Hash: 15F06D75900780BBCB08EF70CA0980E7BB8AFAC240721C418F94887211DA35D542DFA5

Function 2D4D8136 Relevance: 10.5, APIs: 7, Instructions: 34threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 2D4D813C

Part of subcall function 2D4DA56D: TlsGetValue.KERNEL32(?,2D4DA6C6,?,?,2D4D8092,2D4D8002,?,?,?,2D4D66C6,154.201.87.51,000000FF,?), ref: 2D4DA576
Part of subcall function 2D4DA56D: DecodePointer.KERNEL32(?,?,2D4D8092,2D4D8002,?,?,?,2D4D66C6,154.201.87.51,000000FF,?), ref: 2D4DA588
Part of subcall function 2D4DA56D: TlsSetValue.KERNEL32(00000000,?,?,2D4D8092,2D4D8002,?,?,?,2D4D66C6,154.201.87.51,000000FF,?), ref: 2D4DA597

___fls_getvalue@4.LIBCMT ref: 2D4D8147

Part of subcall function 2D4DA54D: TlsGetValue.KERNEL32(?,?,2D4D814C,00000000), ref: 2D4DA55B

___fls_setvalue@8.LIBCMT ref: 2D4D815A

Part of subcall function 2D4DA5A1: DecodePointer.KERNEL32(?,?,?,2D4D815F,00000000,?,00000000), ref: 2D4DA5B2

GetLastError.KERNEL32(00000000,?,00000000), ref: 2D4D8163
ExitThread.KERNEL32 ref: 2D4D816A
GetCurrentThreadId.KERNEL32 ref: 2D4D8170
__freefls@4.LIBCMT ref: 2D4D8190

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 2383549826-0
Opcode ID: f6bdf44898dff4ba8c130f9339d8049dd7f7337a1dd5f3bebdf2bde81ff21d2d
Instruction ID: 7efa07bd2c85fed6224370cdc5f0228ff5f14e20f2d3ce4b0c2468ac13d70ea5
Opcode Fuzzy Hash: f6bdf44898dff4ba8c130f9339d8049dd7f7337a1dd5f3bebdf2bde81ff21d2d
Instruction Fuzzy Hash: E8F09673408201EBC744EF70C83592E7BA9EF68A45B16C45DEA05A7311DB38D946C794

Function 2D4D32F0 Relevance: 9.0, APIs: 6, Instructions: 32synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 2D4D3301
Sleep.KERNEL32(00000258), ref: 2D4D330E
InterlockedExchange.KERNEL32(?,00000000), ref: 2D4D3316
WaitForSingleObject.KERNEL32(?,000000FF), ref: 2D4D3322
WaitForSingleObject.KERNEL32(?,000000FF), ref: 2D4D332A
Sleep.KERNEL32(0000012C), ref: 2D4D333B

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: ObjectSingleWait$Sleep$ExchangeInterlocked
String ID:
API String ID: 3137405945-0
Opcode ID: cb68673b4023e7363c14fa2f77fa04cbea1f9769d2233d1eb2328fd2f0df336a
Instruction ID: 9122ad73f9f032c3115955490e6b0c2610f1599759f78f0566666cbac063671a
Opcode Fuzzy Hash: cb68673b4023e7363c14fa2f77fa04cbea1f9769d2233d1eb2328fd2f0df336a
Instruction Fuzzy Hash: 69F019711047146BD620DBA9CC84F56F3BCAF99775B108709F265973D0CAB4E801CB64

Function 00403309 Relevance: 9.0, APIs: 6, Instructions: 29synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00403319
Sleep.KERNEL32(00000258), ref: 00403326
InterlockedExchange.KERNEL32(?,00000000), ref: 0040332E
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00403339
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00403340
Sleep.KERNEL32(0000012C), ref: 00403351

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: ObjectSingleWait$Sleep$ExchangeInterlocked
String ID:
API String ID: 3137405945-0
Opcode ID: 5f230104ba8933e9ad720eb2b106fd75057886ca0ca9e8170ce1e52d4fc87cd9
Instruction ID: 3b6399797d51742ab285c3a9098de88e9b5c0e5fd51ae38b364b1f0446525be5
Opcode Fuzzy Hash: 5f230104ba8933e9ad720eb2b106fd75057886ca0ca9e8170ce1e52d4fc87cd9
Instruction Fuzzy Hash: 71F065311047146FDB20AF59DC44E8AFBE8EF85731F214729F261922F4CAB0AD04CB54

Function 2BB76690 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 2BB7669B
CoCreateInstance.OLE32(2BB946FC,00000000,00000001,2BB9471C,?,?,?,?,?,?,?,?,?,?,2BB7588A), ref: 2BB766B2
SysFreeString.OLEAUT32(?), ref: 2BB7674C
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,2BB7588A), ref: 2BB7677D

Strings

FriendlyName, xrefs: 2BB7673B

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CreateFreeInitializeInstanceStringUninitialize
String ID: FriendlyName
API String ID: 841178590-3623505368
Opcode ID: 7aef10ddc248765ef6a20e17f2c4bd5e40eb4311a65ed302ae1935e7e13505a2
Instruction ID: a5cbe6eb0fae3383ffd988fa5bf81284eeec0e27bc706003c62f97ad282b3318
Opcode Fuzzy Hash: 7aef10ddc248765ef6a20e17f2c4bd5e40eb4311a65ed302ae1935e7e13505a2
Instruction Fuzzy Hash: 4A313275A00609AFDB00DBA9DC80EAEB7B9EFC9304F148194F515E7354DA71ED01DB60

Function 00405AE7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405B01

Part of subcall function 00405A53: __FF_MSGBANNER.LIBCMT ref: 00405A6C
Part of subcall function 00405A53: __NMSG_WRITE.LIBCMT ref: 00405A73
Part of subcall function 00405A53: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00409550,?,00000001,?,?,0040A9D1,00000018,00415BC0,0000000C,0040AA61), ref: 00405A98

std::exception::exception.LIBCMT ref: 00405B36
std::exception::exception.LIBCMT ref: 00405B50
__CxxThrowException@8.LIBCMT ref: 00405B61

Strings

bad allocation, xrefs: 00405B2F

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID: bad allocation
API String ID: 615853336-2104205924
Opcode ID: b3d4a146f113417b4e34c74719e206fead6ea15c05466c0ad4886eee53fd17dd
Instruction ID: a35f023433661d8035625688eb4b1a42f344342af4ec897a278b1ecbf9a70a23
Opcode Fuzzy Hash: b3d4a146f113417b4e34c74719e206fead6ea15c05466c0ad4886eee53fd17dd
Instruction Fuzzy Hash: 31F0D631900609AACF04FB51EC52ADF77A8DB40718F24403FE815B61D1CBB89E518F9D

Function 2D4D5410 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,00000000,?,2D501A3E,000000FF,?,2D4D6612,?), ref: 2D4D5451

Part of subcall function 2D4D52C0: LoadCursorW.USER32(00000000,00007F8A), ref: 2D4D535A

Part of subcall function 2D4D7E97: _malloc.LIBCMT ref: 2D4D7EB1

GetDesktopWindow.USER32 ref: 2D4D54BA
GetDC.USER32(00000000), ref: 2D4D54C1
GetSystemMetrics.USER32(0000004E), ref: 2D4D54D5
GetSystemMetrics.USER32(0000004F), ref: 2D4D54DC

Part of subcall function 2D4D69F0: ReleaseDC.USER32(00000000,?), ref: 2D4D6A46
Part of subcall function 2D4D69F0: GetDC.USER32(00000000), ref: 2D4D6A60
Part of subcall function 2D4D69F0: GetTickCount.KERNEL32 ref: 2D4D6A73
Part of subcall function 2D4D69F0: GetDC.USER32(00000000), ref: 2D4D6A98
Part of subcall function 2D4D69F0: GetDeviceCaps.GDI32(00000000,00000008), ref: 2D4D6AA5
Part of subcall function 2D4D69F0: GetDeviceCaps.GDI32(00000000,0000000A), ref: 2D4D6AAD
Part of subcall function 2D4D69F0: GetDeviceCaps.GDI32(00000000,00000076), ref: 2D4D6AB2
Part of subcall function 2D4D69F0: GetDeviceCaps.GDI32(00000000,00000075), ref: 2D4D6ABA
Part of subcall function 2D4D69F0: ReleaseDC.USER32(00000000,00000000), ref: 2D4D6AC8
Part of subcall function 2D4D69F0: GetSystemMetrics.USER32(0000004E), ref: 2D4D6AD6
Part of subcall function 2D4D69F0: GetSystemMetrics.USER32(0000004F), ref: 2D4D6AEB

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release$CountCreateCursorDesktopEventLoadTickWindow_malloc
String ID:
API String ID: 2825136315-0
Opcode ID: 65de345bc42ace058c560340ade00d581d6a6ace8af3d430a5b14ba11b6720ed
Instruction ID: f76009ed749918ae91d369c950d5bee5beb820cecca349e080f9c6ef41407819
Opcode Fuzzy Hash: 65de345bc42ace058c560340ade00d581d6a6ace8af3d430a5b14ba11b6720ed
Instruction Fuzzy Hash: 0B31AEB1404B44AFE760CF65CC84B6BBBE8FB09B14F00892EE54AA7740D7B4A8048B65

Function 2D4D2D20 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 2D4D2D4C
CancelIo.KERNEL32(?), ref: 2D4D2D56
InterlockedExchange.KERNEL32(00000000,00000000), ref: 2D4D2D5F
closesocket.WS2_32(?), ref: 2D4D2D69
SetEvent.KERNEL32(00000001), ref: 2D4D2D73

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: 1cd6dba3b57825e730fae3a8ba00bf8bd1854727b9b742bf857cdc469c9f0689
Instruction ID: ea4033fd180805602b4e2c9acbef21941646157283477d6e058ae0ac635ec394
Opcode Fuzzy Hash: 1cd6dba3b57825e730fae3a8ba00bf8bd1854727b9b742bf857cdc469c9f0689
Instruction Fuzzy Hash: 4AF04F76100700ABD720DF95CC49F6677B8FB49F22F10C658F68297780C6B4B444CBA4

Function 00402E7B Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 00402EAB
CancelIo.KERNEL32(?), ref: 00402EB4
InterlockedExchange.KERNEL32(?,00000000), ref: 00402EBD
closesocket.WS2_32(?), ref: 00402EC6
SetEvent.KERNEL32(?), ref: 00402ECF

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: 5df6acb9f08b649d388b724e07487c8fb41e8d5ec63bb505284f48fab2f6fb6d
Instruction ID: da3ddb7d32b6403ed4a306121332d52789c32b487c34561e10a70f0c7b978b2a
Opcode Fuzzy Hash: 5df6acb9f08b649d388b724e07487c8fb41e8d5ec63bb505284f48fab2f6fb6d
Instruction Fuzzy Hash: 9AF04F72500300BBD7215F64DD0ABAA7BB8FF04B12F004539F282A15F0D7B16A14DB48

Function 2D4D66B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,2D4D6570,00000000,00000000,00000000), ref: 2D4D66F2
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 2D4D6700
Sleep.KERNEL32(0000012C), ref: 2D4D670B

Strings

154.201.87.51, xrefs: 2D4D66BC

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: CreateObjectSingleSleepThreadWait
String ID: 154.201.87.51
API String ID: 4198075804-455070577
Opcode ID: ec7b1780f3219c2096aa2708f4499735c398483bf5fda9aa4b32486400fd2207
Instruction ID: 33b70471cfce07b9918a84377184b19dda747659d4a638a099adb9361de15d13
Opcode Fuzzy Hash: ec7b1780f3219c2096aa2708f4499735c398483bf5fda9aa4b32486400fd2207
Instruction Fuzzy Hash: F7F05E70680304ABEF14DFA4DC19F6A37B4AB08F11F108215F624AA3C1C6F46404CB58

Function 2D4D6D20 Relevance: 6.1, APIs: 4, Instructions: 89windowCOMMON

Download Yara Rule

APIs

Part of subcall function 2D4D6FF0: GetCurrentThreadId.KERNEL32 ref: 2D4D700D
Part of subcall function 2D4D6FF0: GetThreadDesktop.USER32(00000000), ref: 2D4D7014
Part of subcall function 2D4D6FF0: _memset.LIBCMT ref: 2D4D702A
Part of subcall function 2D4D6FF0: GetUserObjectInformationW.USER32(00000000,00000002,?,00000200,?), ref: 2D4D704E
Part of subcall function 2D4D6FF0: OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 2D4D7059
Part of subcall function 2D4D6FF0: _memset.LIBCMT ref: 2D4D706F
Part of subcall function 2D4D6FF0: GetUserObjectInformationW.USER32(00000000,00000002,?,00000200,?), ref: 2D4D708D
Part of subcall function 2D4D6FF0: lstrcmpiW.KERNEL32(?,?), ref: 2D4D709D
Part of subcall function 2D4D6FF0: SetThreadDesktop.USER32(00000000), ref: 2D4D70A8
Part of subcall function 2D4D6FF0: CloseDesktop.USER32(00000000), ref: 2D4D70BF
Part of subcall function 2D4D6FF0: CloseDesktop.USER32(00000000), ref: 2D4D70C2

ReleaseDC.USER32(00000000,?), ref: 2D4D6D48
GetDC.USER32(00000000), ref: 2D4D6D4F
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?), ref: 2D4D6D84
_free.LIBCMT ref: 2D4D6DD2

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Desktop$Thread$CloseInformationObjectUser_memset$CurrentInputOpenRelease_freelstrcmpi
String ID:
API String ID: 3594995762-0
Opcode ID: 3277d6eeeb5d22b3f2c534b19a822f1fa171239353c1cdffb3ef88cecce715e3
Instruction ID: f1dc9409da205181d1c6b1218da3c49a4f3dfb4a39806a316875a09460e45c3a
Opcode Fuzzy Hash: 3277d6eeeb5d22b3f2c534b19a822f1fa171239353c1cdffb3ef88cecce715e3
Instruction Fuzzy Hash: 1C313CB6600B44AFC360CF5AD890D67F7F9FF99610B20891DEA8693B10D631F945CB60

Function 2BB7DE70 Relevance: 6.1, APIs: 4, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 2BB7DE93
_free.LIBCMT ref: 2BB7DED5
GetProcessHeap.KERNEL32(00000000,00000000,2BB7DC95), ref: 2BB7DEFC
HeapFree.KERNEL32(00000000), ref: 2BB7DF03

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Heap_free$FreeProcess
String ID:
API String ID: 1072109031-0
Opcode ID: 45990e48f7ea967744f5eae9cac7e25ffa5e8a10e43e968bf1dea0cf329abaf4
Instruction ID: 80619f963455123267cfe5e86d5f0e1b912acf4f38ba064549d33feb04faa23d
Opcode Fuzzy Hash: 45990e48f7ea967744f5eae9cac7e25ffa5e8a10e43e968bf1dea0cf329abaf4
Instruction Fuzzy Hash: 3E114CB2A00B009BDB20EA64CD45F2773F6FF98650F10891CE6AA47A90D774F442DF91

Function 2BB7F707 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 2BB7F721

Part of subcall function 2BB7F673: __FF_MSGBANNER.LIBCMT ref: 2BB7F68C
Part of subcall function 2BB7F673: __NMSG_WRITE.LIBCMT ref: 2BB7F693
Part of subcall function 2BB7F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C,2BB88E76), ref: 2BB7F6B8

std::exception::exception.LIBCMT ref: 2BB7F756
std::exception::exception.LIBCMT ref: 2BB7F770
__CxxThrowException@8.LIBCMT ref: 2BB7F781

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: 77e1b5c7bc884261f102fec83ccf4328b5c056fb2c7fe371e49456abcf116233
Instruction ID: 9006df053ca6f1deea2593cf225e0cfd7b7da7dbf97c634818dc613d917847f2
Opcode Fuzzy Hash: 77e1b5c7bc884261f102fec83ccf4328b5c056fb2c7fe371e49456abcf116233
Instruction Fuzzy Hash: D8F02872800589ABCF04EF54ED6DA9E37F8AF74364F200029E820D61A4DF71DA41EF98

Function 2BB75320 Relevance: 4.6, APIs: 3, Instructions: 88memoryCOMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(00000008), ref: 2BB7536F
SysFreeString.OLEAUT32(00000000), ref: 2BB75384
SysAllocString.OLEAUT32(2BB95148), ref: 2BB753D5

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: String$AllocDecrementFreeInterlocked
String ID:
API String ID: 3605875487-0
Opcode ID: a6754bb174b9a3bd072d94e5142ee1406073db5f4140e880d1c899e859990b13
Instruction ID: 2994707cbbc72afbd96b8a6c6eff4faa17d80ad6775114f50713c5b23078cc27
Opcode Fuzzy Hash: a6754bb174b9a3bd072d94e5142ee1406073db5f4140e880d1c899e859990b13
Instruction Fuzzy Hash: 9331A072A016549BDB10DF64C880B5A77F8EF18B10F118569ED66DB360D7B5E900DB90

Function 2BB73160 Relevance: 4.6, APIs: 3, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 2BB7316B
InterlockedExchange.KERNEL32(?,00000001), ref: 2BB73183
GetCurrentThreadId.KERNEL32 ref: 2BB7322F

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CurrentThread$ExchangeInterlocked
String ID:
API String ID: 4033114805-0
Opcode ID: ca9bcbfebfa9f2689964f58b690adde6c7995f598049f092c12481ead5f3a6b9
Instruction ID: 44e46b05f1cb2a4eb85117e17cde8c70f190af38cf17a97aa07943f574fabf74
Opcode Fuzzy Hash: ca9bcbfebfa9f2689964f58b690adde6c7995f598049f092c12481ead5f3a6b9
Instruction Fuzzy Hash: 3C31C372650A02DFCB14EF69C981A56B3F4FF48714B10C52DE96ACBA25D731F882DB90

Function 2D4D3150 Relevance: 4.6, APIs: 3, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 2D4D315B
InterlockedExchange.KERNEL32(?,00000001), ref: 2D4D3173
GetCurrentThreadId.KERNEL32 ref: 2D4D321F

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: CurrentThread$ExchangeInterlocked
String ID:
API String ID: 4033114805-0
Opcode ID: b0707b70d7ed0f009190b2fb5e724fb3913048cb1cbce318cd5fd4f065f88783
Instruction ID: 1b9de5510ea75fb9f1dd6b115b593d35d875a3e119fd64bbd6f09d309121d4f3
Opcode Fuzzy Hash: b0707b70d7ed0f009190b2fb5e724fb3913048cb1cbce318cd5fd4f065f88783
Instruction Fuzzy Hash: 70319F72200602DFC754CF69C8A8A6AB7E4FF49749B10C51DE95AEB715D731F842CB90

Function 2BB711B0 Relevance: 4.6, APIs: 3, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 2BB711E9
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 2BB71226
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 2BB71255

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 5e340035f0d55c1bc5c943cd65d5f50178b280a867681a1d2b172efb2097bf43
Instruction ID: 0e13e08194a4ce174377e197d18477e18ac3c19ca9573d613ed0bf1eb30610cf
Opcode Fuzzy Hash: 5e340035f0d55c1bc5c943cd65d5f50178b280a867681a1d2b172efb2097bf43
Instruction Fuzzy Hash: 3F21CF71E00B09AFDB10DFAAD945B6EFBF4EF44B05F00856DE859E3640E631A9508B10

Function 2D4D11B0 Relevance: 4.6, APIs: 3, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 2D4D11E9
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 2D4D1226
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 2D4D1255

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 86333e69ed251f9fc17d6fb6263a30b5fcc699f9a766b32b38496c6ea362f303
Instruction ID: 5c27adb35a5ca78e96c17c4c25d65182571e081cdb17d2631a61addcde80046f
Opcode Fuzzy Hash: 86333e69ed251f9fc17d6fb6263a30b5fcc699f9a766b32b38496c6ea362f303
Instruction Fuzzy Hash: 5E210132B04708AFDB508FAAD886B6EFBF4EF48B01F00846DED49E2640E670A9508700

Function 2BB71100 Relevance: 4.6, APIs: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 2BB7112F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 2BB7115F
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 2BB71192

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: a93df3bb54eb65ce636e9bd2a954af60d2aac87ed769b48f66663e41697bdaa2
Instruction ID: 3cc72dbdebfb2cd4b25648be8b0b94ddd346782881a1f1ea878ce2d9d7b97d17
Opcode Fuzzy Hash: a93df3bb54eb65ce636e9bd2a954af60d2aac87ed769b48f66663e41697bdaa2
Instruction Fuzzy Hash: CE11D371E00708AFDF00DFA9C986B6EFBF8EF04705F008469E969E7640E63599508B20

Function 2D4D1100 Relevance: 4.6, APIs: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 2D4D112F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 2D4D115F
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 2D4D1192

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 89d944ce854f6908682cc54d0f8a4791a7ff4bd1130bb88d26565af14b43a4ae
Instruction ID: b2f32887db215be75623eb8647844246f2fea6f9b62dee49b8c81009cf93d4e4
Opcode Fuzzy Hash: 89d944ce854f6908682cc54d0f8a4791a7ff4bd1130bb88d26565af14b43a4ae
Instruction Fuzzy Hash: 1511D371A04704AFDB408FA9C986B6EFBF8EF0CB05F008469ED59E2240E6749954CB54

Function 0040114D Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0040117F

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 6b9525e9adad3298079807e544f9608e927dd76a2d380ac2b438a834b9e708a1
Instruction ID: e9f89bebeab611efa17717417c944779504c8d8fe372e8839d2683ca2999228b
Opcode Fuzzy Hash: 6b9525e9adad3298079807e544f9608e927dd76a2d380ac2b438a834b9e708a1
Instruction Fuzzy Hash: 2A11C871300705AFD7145F25DC82F5A7BE8EB48794F10C43FF64AEA6A1E634E9408A5D

Function 004010C0 Relevance: 4.6, APIs: 3, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 004010EA
VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004,?,?,?,?,00401052), ref: 00401105
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00401133

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: Virtual$AllocFree__floor_pentium4
String ID:
API String ID: 2605973128-0
Opcode ID: 660ff344e6f03bdf81dbf9ed672beec0b296522fab3323740666c81ad1cfebe8
Instruction ID: 0e8bea10f06e6325294a07fe01878d71805fa7165c557f5eeede67526d8802bc
Opcode Fuzzy Hash: 660ff344e6f03bdf81dbf9ed672beec0b296522fab3323740666c81ad1cfebe8
Instruction Fuzzy Hash: 2B019271600704EBD7109F6ADD46F5BB7E8EB44754F10C43EF546E26A1EA74E9008B5C

Function 2BB79DE0 Relevance: 4.5, APIs: 3, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 2BB79E04
GdipDisposeImage.GDIPLUS(?), ref: 2BB79E18
GdipDisposeImage.GDIPLUS(?), ref: 2BB79E3B

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Gdip$DisposeImage$BitmapCreateFromStream
String ID:
API String ID: 800915452-0
Opcode ID: 27e1618356125ec4ee9c08be3b136ea82c6f6bae7e8921f90f4ab53e031c3070
Instruction ID: cd47f136e7c85230c41a56ea490b851367922289231e904c1411259ecfeddcb1
Opcode Fuzzy Hash: 27e1618356125ec4ee9c08be3b136ea82c6f6bae7e8921f90f4ab53e031c3070
Instruction Fuzzy Hash: DBF0AF72D04629AB8F04EFA4D9448AEFB78EF5C711B00825AFD55A7350D6358B05DFE0

Function 2BB79AC0 Relevance: 4.5, APIs: 3, Instructions: 36COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(2BB9FB64), ref: 2BB79ADC
GdiplusStartup.GDIPLUS(2BB9FB60,?,?), ref: 2BB79B15
LeaveCriticalSection.KERNEL32(2BB9FB64), ref: 2BB79B26

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$EnterGdiplusLeaveStartup
String ID:
API String ID: 389129658-0
Opcode ID: 722c24da32db6a8de6d8de3998f3c50a75c226afffe19dcf3d068382ba85e19b
Instruction ID: 5616865f6fb280e32f959bf69eec094e5ade92956d438c81954c0e99672e598b
Opcode Fuzzy Hash: 722c24da32db6a8de6d8de3998f3c50a75c226afffe19dcf3d068382ba85e19b
Instruction Fuzzy Hash: 52F04F71C41609EBDF00DFD1D9697BEB7B8EB08325F500199D64453240D7765149DEA1

Function 00405D96 Relevance: 4.5, APIs: 3, Instructions: 11threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00405D9B

Part of subcall function 00408E5A: GetLastError.KERNEL32(00000001,00000000,00405FB0,00405ADC,00000000,?,00409550,?,00000001,?,?,0040A9D1,00000018,00415BC0,0000000C,0040AA61), ref: 00408E5E
Part of subcall function 00408E5A: ___set_flsgetvalue.LIBCMT ref: 00408E6C
Part of subcall function 00408E5A: __calloc_crt.LIBCMT ref: 00408E80
Part of subcall function 00408E5A: DecodePointer.KERNEL32(00000000,?,00409550,?,00000001,?,?,0040A9D1,00000018,00415BC0,0000000C,0040AA61,?,?,?,00408F7E), ref: 00408E9A
Part of subcall function 00408E5A: GetCurrentThreadId.KERNEL32 ref: 00408EB0
Part of subcall function 00408E5A: SetLastError.KERNEL32(00000000,?,00409550,?,00000001,?,?,0040A9D1,00000018,00415BC0,0000000C,0040AA61,?,?,?,00408F7E), ref: 00408EC8

__freeptd.LIBCMT ref: 00405DA5

Part of subcall function 0040901C: TlsGetValue.KERNEL32(?,?,00405DAA,00000000,?,00405DD6,00000000), ref: 0040903D
Part of subcall function 0040901C: TlsGetValue.KERNEL32(?,?,00405DAA,00000000,?,00405DD6,00000000), ref: 0040904F
Part of subcall function 0040901C: DecodePointer.KERNEL32(00000000,?,00405DAA,00000000,?,00405DD6,00000000), ref: 00409065
Part of subcall function 0040901C: __freefls@4.LIBCMT ref: 00409070
Part of subcall function 0040901C: TlsSetValue.KERNEL32(00000005,00000000,?,00405DAA,00000000,?,00405DD6,00000000), ref: 00409082

ExitThread.KERNEL32 ref: 00405DAE

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: Value$DecodeErrorLastPointerThread$CurrentExit___set_flsgetvalue__calloc_crt__freefls@4__freeptd__getptd_noexit
String ID:
API String ID: 4224061863-0
Opcode ID: 43c90c582516c578090ccbd7ae2cfa3e2be8eb14b21ebb76a914147b3c0c58ff
Instruction ID: ee64aa4151f865db0acf69fd0ace98d1237e69e6fc59a3c4fe9fdf6a4b72aa57
Opcode Fuzzy Hash: 43c90c582516c578090ccbd7ae2cfa3e2be8eb14b21ebb76a914147b3c0c58ff
Instruction Fuzzy Hash: 80C08C20000218AEEA503B62CC0E91B3A2C9D80300704443B7804E20A2DE7CDC018498

Function 2BB7F964 Relevance: 4.5, APIs: 3, Instructions: 11threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 2BB7F969

Part of subcall function 2BB83DE2: GetLastError.KERNEL32(00000001,00000000,2BB7F920,2BB7F6FC,00000000,?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C,2BB88E76), ref: 2BB83DE6
Part of subcall function 2BB83DE2: ___set_flsgetvalue.LIBCMT ref: 2BB83DF4
Part of subcall function 2BB83DE2: __calloc_crt.LIBCMT ref: 2BB83E08
Part of subcall function 2BB83DE2: DecodePointer.KERNEL32(00000000,?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C,2BB88E76,00000000,00000000,?,2BB83F06), ref: 2BB83E22
Part of subcall function 2BB83DE2: GetCurrentThreadId.KERNEL32 ref: 2BB83E38
Part of subcall function 2BB83DE2: SetLastError.KERNEL32(00000000,?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C,2BB88E76,00000000,00000000,?,2BB83F06), ref: 2BB83E50

__freeptd.LIBCMT ref: 2BB7F973

Part of subcall function 2BB83FA6: TlsGetValue.KERNEL32(?,?,2BB810F0,00000000,2BB96278,00000008,2BB81155,?,?,?,2BB96298,0000000C,2BB81210,?), ref: 2BB83FC7
Part of subcall function 2BB83FA6: TlsGetValue.KERNEL32(?,?,2BB810F0,00000000,2BB96278,00000008,2BB81155,?,?,?,2BB96298,0000000C,2BB81210,?), ref: 2BB83FD9
Part of subcall function 2BB83FA6: DecodePointer.KERNEL32(00000000,?,2BB810F0,00000000,2BB96278,00000008,2BB81155,?,?,?,2BB96298,0000000C,2BB81210,?), ref: 2BB83FEF
Part of subcall function 2BB83FA6: __freefls@4.LIBCMT ref: 2BB83FFA
Part of subcall function 2BB83FA6: TlsSetValue.KERNEL32(00000013,00000000,?,2BB810F0,00000000,2BB96278,00000008,2BB81155,?,?,?,2BB96298,0000000C,2BB81210,?), ref: 2BB8400C

ExitThread.KERNEL32 ref: 2BB7F97C

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Value$DecodeErrorLastPointerThread$CurrentExit___set_flsgetvalue__calloc_crt__freefls@4__freeptd__getptd_noexit
String ID:
API String ID: 4224061863-0
Opcode ID: dc5e5c3f1322a89f51d397f17e30c3fbb25b0dbd3487764026fd9f5fa381b023
Instruction ID: eac97e7be8097a86a4d5fea197941762498eb1778fa43f47b4c67d5c90ffa93d
Opcode Fuzzy Hash: dc5e5c3f1322a89f51d397f17e30c3fbb25b0dbd3487764026fd9f5fa381b023
Instruction Fuzzy Hash: B3C04C214046457B9F147771891E91A3A6DDFA42507514010B91586150DE69DC5195A4

Function 2D4D80D6 Relevance: 4.5, APIs: 3, Instructions: 11threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 2D4D80DB

Part of subcall function 2D4DA6AF: GetLastError.KERNEL32(?,?,2D4D8092,2D4D8002,?,?,?,2D4D66C6,154.201.87.51,000000FF,?), ref: 2D4DA6B3
Part of subcall function 2D4DA6AF: ___set_flsgetvalue.LIBCMT ref: 2D4DA6C1
Part of subcall function 2D4DA6AF: __calloc_crt.LIBCMT ref: 2D4DA6D5
Part of subcall function 2D4DA6AF: DecodePointer.KERNEL32(00000000,?,?,2D4D8092,2D4D8002,?,?,?,2D4D66C6,154.201.87.51,000000FF,?), ref: 2D4DA6EF
Part of subcall function 2D4DA6AF: GetCurrentThreadId.KERNEL32 ref: 2D4DA705
Part of subcall function 2D4DA6AF: SetLastError.KERNEL32(00000000,?,?,2D4D8092,2D4D8002,?,?,?,2D4D66C6,154.201.87.51,000000FF,?), ref: 2D4DA71D

__freeptd.LIBCMT ref: 2D4D80E5

Part of subcall function 2D4DA871: TlsGetValue.KERNEL32(?,?,2D4D84D8,00000000,2D52AED0,00000008,2D4D853D,?,?,?,2D52AEF0,0000000C,2D4D85F8,?), ref: 2D4DA892
Part of subcall function 2D4DA871: TlsGetValue.KERNEL32(?,?,2D4D84D8,00000000,2D52AED0,00000008,2D4D853D,?,?,?,2D52AEF0,0000000C,2D4D85F8,?), ref: 2D4DA8A4
Part of subcall function 2D4DA871: DecodePointer.KERNEL32(00000000,?,2D4D84D8,00000000,2D52AED0,00000008,2D4D853D,?,?,?,2D52AEF0,0000000C,2D4D85F8,?), ref: 2D4DA8BA
Part of subcall function 2D4DA871: __freefls@4.LIBCMT ref: 2D4DA8C5
Part of subcall function 2D4DA871: TlsSetValue.KERNEL32(FFFFFFFF,00000000,?,2D4D84D8,00000000,2D52AED0,00000008,2D4D853D,?,?,?,2D52AEF0,0000000C,2D4D85F8,?), ref: 2D4DA8D7

ExitThread.KERNEL32 ref: 2D4D80EE

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Value$DecodeErrorLastPointerThread$CurrentExit___set_flsgetvalue__calloc_crt__freefls@4__freeptd__getptd_noexit
String ID:
API String ID: 4224061863-0
Opcode ID: 9668f9d763a13959a8eb63192215b2831dab0f13ce7537c20514f078bc733b43
Instruction ID: ce725aec1bfe153dda3707057b347e0eb4da9cef347374a1d2c5e1635ce52b11
Opcode Fuzzy Hash: 9668f9d763a13959a8eb63192215b2831dab0f13ce7537c20514f078bc733b43
Instruction Fuzzy Hash: B6C08C220082086BCA812B32882AA3B3B1CEF60901B6340257A08A1160EE64D8428154

Function 2D4D6570 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 2D4D6648

Part of subcall function 2D4D7E97: _malloc.LIBCMT ref: 2D4D7EB1

Part of subcall function 2D4D2C70: WSAStartup.WS2_32(00000202,?), ref: 2D4D2CCF
Part of subcall function 2D4D2C70: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 2D4D2CDA
Part of subcall function 2D4D2C70: InterlockedExchange.KERNEL32(00000018,00000000), ref: 2D4D2CE8

Strings

154.201.87.51, xrefs: 2D4D65F7

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: CreateEventExchangeExitInterlockedProcessStartup_malloc
String ID: 154.201.87.51
API String ID: 3123767384-455070577
Opcode ID: ed06aa15924dae70c35772ef99e8ff0b1dc320be9784d450d13fd8ddbae10405
Instruction ID: 7d7b763a77d1ddaf2b7b312923b7cce0bd1efca175cb4209e65575a8018a8d6b
Opcode Fuzzy Hash: ed06aa15924dae70c35772ef99e8ff0b1dc320be9784d450d13fd8ddbae10405
Instruction Fuzzy Hash: B021F572904248DBDB80DFA8D824F5A73F4EB19B10F10476AE911B73C5EB75EA08C796

Function 2B9F01CB Relevance: 3.3, APIs: 2, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 2B9F022B

Memory Dump Source

Source File: 00000000.00000002.4113322478.000000002B9F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 2B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b9f0000_L8RabfF1Hu.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 173a0753eb1870a11fb702d1a013be029f39be02b255bbe32865f3a9974466fd
Instruction ID: e2c278f5b9bf1e1d69cdc022fa54b2e67b79b22c08a9e5000d8104de751360df
Opcode Fuzzy Hash: 173a0753eb1870a11fb702d1a013be029f39be02b255bbe32865f3a9974466fd
Instruction Fuzzy Hash: 76A15870E00606EFDF04CFA9C880AAEB7B9FF58724F1481A9E555DB251E770EA51CB90

Function 2BB73360 Relevance: 3.2, APIs: 2, Instructions: 151timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,00000000), ref: 2BB73413
_memmove.LIBCMT ref: 2BB734A5

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Time_memmovetime
String ID:
API String ID: 1463837790-0
Opcode ID: 46653a5d2af6ba78cd1ca2f2e3335321e65ac0aace76ffc712e45b77a455f345
Instruction ID: 7ff92cca30349e3495f1a1952d1db393a2048365162a4b39cb256ed192b47141
Opcode Fuzzy Hash: 46653a5d2af6ba78cd1ca2f2e3335321e65ac0aace76ffc712e45b77a455f345
Instruction Fuzzy Hash: BA51AE73B006019FDB15EF69C8C0A5AB7B5FF58314715C62CE929CBB05DB31E9429B90

Function 2D4D3360 Relevance: 3.2, APIs: 2, Instructions: 151timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,00000000), ref: 2D4D3413
_memmove.LIBCMT ref: 2D4D34A5

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Time_memmovetime
String ID:
API String ID: 1463837790-0
Opcode ID: 1b070ed3374cd3b909c6868e37382471c73a87b52b63785f740d09580138409a
Instruction ID: d0da2457d0f86e4f4c3946919c55c41822293668959d563f9ec323bfaf41e9ed
Opcode Fuzzy Hash: 1b070ed3374cd3b909c6868e37382471c73a87b52b63785f740d09580138409a
Instruction Fuzzy Hash: DB51D0737002029FD341CF69C9E8E6AB7A5FF48218B15866CEA59AB701DB35F941CB90

Function 2BB7D470 Relevance: 3.1, APIs: 2, Instructions: 95COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2BB7D4DB
SetLastError.KERNEL32(0000000D,00000000,00000000), ref: 2BB7D544

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: ErrorLast_memset
String ID:
API String ID: 533350023-0
Opcode ID: 941e8514fd9573d98ed83e2e865b0a459e63b1ef79077ce01ded4b4ee8b8ea81
Instruction ID: 42a9550204e8c9ea4207554834ab7ac60efd78b46361685d41a80c7c7cd07393
Opcode Fuzzy Hash: 941e8514fd9573d98ed83e2e865b0a459e63b1ef79077ce01ded4b4ee8b8ea81
Instruction Fuzzy Hash: 1C318DB2A00204AFEB14DF58DD81F6AB3B8FF88748F108458E959C7385D670EA51DBA0

Function 2BB72FD0 Relevance: 3.1, APIs: 2, Instructions: 82networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 2BB73043
recv.WS2_32(?,?,00040000,00000000), ref: 2BB73064

Part of subcall function 2BB7F91B: __getptd_noexit.LIBCMT ref: 2BB7F91B

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: __getptd_noexitrecvselect
String ID:
API String ID: 4248608111-0
Opcode ID: 52c38fdfe8d70c9ae50db7f0a0c32ac61939243966e5eb75c0da6099fd559910
Instruction ID: 1af9b12f10e640f8469ac3426a7b8194ca0daf885f86d3ec62b9c287de3a57e9
Opcode Fuzzy Hash: 52c38fdfe8d70c9ae50db7f0a0c32ac61939243966e5eb75c0da6099fd559910
Instruction Fuzzy Hash: 7621E772940208DFDF20EF65CC95B9A77B4EF24310F1085A5E624AB1E0D771D986DBA1

Function 2D4D5C00 Relevance: 3.1, APIs: 2, Instructions: 77sleepsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00001770,?,9B5F627A), ref: 2D4D5C43
Sleep.KERNEL32(0000012C), ref: 2D4D5C4E

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: ObjectSingleSleepWait
String ID:
API String ID: 309074506-0
Opcode ID: 5b4ad217b1093591b61987e4dc295d0056dd853c891af9a74f0db85b790b5fdd
Instruction ID: 7ad6cb2fdf76bd732d1d5073b49813844d53814c1fcaeac8abf419bea920e33d
Opcode Fuzzy Hash: 5b4ad217b1093591b61987e4dc295d0056dd853c891af9a74f0db85b790b5fdd
Instruction Fuzzy Hash: 96318DB6A04604AFD700CF64C880FAAFBF4FB49B10F10856EEA15A7781D774A940CBE1

Function 004030C1 Relevance: 3.1, APIs: 2, Instructions: 73networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000000), ref: 00403116
recv.WS2_32(?,?,00040000,00000000), ref: 00403131

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: recvselect
String ID:
API String ID: 741273618-0
Opcode ID: baccfa17fff96ff61cafdee79c4d05841eb7c61170ac9edbed44183d057de907
Instruction ID: 59cf7d25fe62353fc71bc41ef06c839be5cd5144994407053238e5bb223a0a1d
Opcode Fuzzy Hash: baccfa17fff96ff61cafdee79c4d05841eb7c61170ac9edbed44183d057de907
Instruction Fuzzy Hash: 33216271504214FBCB21AF659C45A9F7F78EF09366F100177FA04BA1D1C6788F81DAA9

Function 2BB73260 Relevance: 3.1, APIs: 2, Instructions: 60networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00040000,00000000), ref: 2BB73291
send.WS2_32(?,?,?,00000000), ref: 2BB732CE

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 1aa32594f03cc1923d777c13c909971e6920c337bbe9809125b17f229f6a09c3
Instruction ID: f1e511adca9bed35ea0c22735fb435d76ad9adfd2ac1296df616e2fa7f250b8e
Opcode Fuzzy Hash: 1aa32594f03cc1923d777c13c909971e6920c337bbe9809125b17f229f6a09c3
Instruction Fuzzy Hash: 2011E573B85B04BBCB10DA6ACD85B4AB7F8FB95264F108025EA28E7290D271D943A654

Function 2D4D3250 Relevance: 3.1, APIs: 2, Instructions: 60networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00040000,00000000), ref: 2D4D3281
send.WS2_32(?,?,?,00000000), ref: 2D4D32BE

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: f0e4a81a66a7c16599a4a4ef50f3c21640ca208ade6a1ee6929ff74ffdf4889d
Instruction ID: cd14b3416aa36e352fff57f4c744e9034c6d3615fc0f72c84041af0a3e960ee1
Opcode Fuzzy Hash: f0e4a81a66a7c16599a4a4ef50f3c21640ca208ade6a1ee6929ff74ffdf4889d
Instruction Fuzzy Hash: 46112573F05204A7DB80CB6ADC88B5A77A8FB81668F204125EB48F7284D270AD419250

Function 00403279 Relevance: 3.1, APIs: 2, Instructions: 58networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00040000,00000000), ref: 004032AE
send.WS2_32(?,?,?,00000000), ref: 004032E3

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 8fe0056f69112d6763cff7c99f82050ea26d5f5561161c4478f3a40bea0c543b
Instruction ID: 46e87287bb9aeea6df6d68c576d48259ab54ec438239425b018441933011b972
Opcode Fuzzy Hash: 8fe0056f69112d6763cff7c99f82050ea26d5f5561161c4478f3a40bea0c543b
Instruction Fuzzy Hash: 69113332D00218FBCB119E59C985BCDBFB8FF05756F2080BAE814B6191D3749B959B94

Function 2BB730E0 Relevance: 3.0, APIs: 2, Instructions: 46sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 2BB7310A
timeGetTime.WINMM ref: 2BB73124

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: f39ef9790aeaa5819882296c1dfee594a12a9d8b4763af61203aaa1023cf36a1
Instruction ID: a46627b825890b93c98af94227d982c410851a02f525932a76e63208b8a42213
Opcode Fuzzy Hash: f39ef9790aeaa5819882296c1dfee594a12a9d8b4763af61203aaa1023cf36a1
Instruction Fuzzy Hash: 6A01F232A5060AAFD701EF24C8C4B69B7B5FF99301F108264D21487AA0C735AAC7DBD1

Function 2D4D30D0 Relevance: 3.0, APIs: 2, Instructions: 46sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 2D4D30FA
timeGetTime.WINMM ref: 2D4D3114

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: af33ba5856058a3764aa90f0a6c32db886805f061b6c677d91986e92674cfb0c
Instruction ID: 83696afc5a89cae1e882ddd72c2ce691810f677fbd324f5fe71cedde310b6754
Opcode Fuzzy Hash: af33ba5856058a3764aa90f0a6c32db886805f061b6c677d91986e92674cfb0c
Instruction Fuzzy Hash: 6C01F732200206AFD700CF59C8D8B7DB3B9FB5A345F608229D680A7380C774AAC6C7D1

Function 0040318D Relevance: 3.0, APIs: 2, Instructions: 38sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 004031A6
timeGetTime.WINMM ref: 004031C2

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: a5e5f1f40ff20a6668eedf27bcfb8eadf13c28ba7b7abf0fe73b994918ffd9be
Instruction ID: 1790d7517a47d71c4a9077240f247aed72c85d9443b1fc054f30e5777d36981d
Opcode Fuzzy Hash: a5e5f1f40ff20a6668eedf27bcfb8eadf13c28ba7b7abf0fe73b994918ffd9be
Instruction Fuzzy Hash: 7FF086312002049FD7258F59C84875EBBB8AB5A706F00052AD0429A1E0CB79AB85C795

Function 2BB7CD00 Relevance: 3.0, APIs: 2, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000004,00000000,00000000,2BB7E04E,00000000,2BB79800,?,?,?,00000000,2BB9125B,000000FF,?,2BB7E04E), ref: 2BB7CD1B
_free.LIBCMT ref: 2BB7CD56

Part of subcall function 2BB71280: __CxxThrowException@8.LIBCMT ref: 2BB71290
Part of subcall function 2BB71280: DeleteCriticalSection.KERNEL32(00000000,2BB7D3E6,2BB96624,?,?,2BB7D3E6,?,?,?,?,2BB95A40,00000000), ref: 2BB712A1

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CreateCriticalDeleteException@8HeapSectionThrow_free
String ID:
API String ID: 1116298128-0
Opcode ID: 4227979ed11e48322c7c083dda644410738567a1897c8fc300691ac3492816d2
Instruction ID: 298922c21a9db6f469596691c6a2a7a615defb9954088137781452c4294bc826
Opcode Fuzzy Hash: 4227979ed11e48322c7c083dda644410738567a1897c8fc300691ac3492816d2
Instruction Fuzzy Hash: EE017EB1A01B408FD720DF6A8844A07FAF8FFA8700B104A1ED2DAC7A20D375E106DF55

Function 2BB7E480 Relevance: 3.0, APIs: 2, Instructions: 21synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,2BB7DF10,00000000,00000000,00000000), ref: 2BB7E49B
WaitForSingleObject.KERNEL32(00000000,000000FF,?,2BB81168,?,?,?,?,?,?,2BB96298,0000000C,2BB81210,?), ref: 2BB7E4A9

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: 9974d3e4ec5fa33213c019e5e74c34d2bd0d8d432d37a367a50fe38c12ac99f7
Instruction ID: 407a2230147058099bfa30f62ac02ec35a640ec3de8c4a6540d444c599903654
Opcode Fuzzy Hash: 9974d3e4ec5fa33213c019e5e74c34d2bd0d8d432d37a367a50fe38c12ac99f7
Instruction Fuzzy Hash: B7E012B5C08615BFDF00EB548C84E3673ECDF04370B204217B920D7295D53AD9909AA0

Function 00405DB5 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00405DC1

Part of subcall function 00408ED3: __getptd_noexit.LIBCMT ref: 00408ED6
Part of subcall function 00408ED3: __amsg_exit.LIBCMT ref: 00408EE3

Part of subcall function 00405D96: __getptd_noexit.LIBCMT ref: 00405D9B
Part of subcall function 00405D96: __freeptd.LIBCMT ref: 00405DA5
Part of subcall function 00405D96: ExitThread.KERNEL32 ref: 00405DAE

__XcptFilter.LIBCMT ref: 00405DE2

Part of subcall function 00409205: __getptd_noexit.LIBCMT ref: 0040920B

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: __getptd_noexit$ExitFilterThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 418257734-0
Opcode ID: 067cf44c50f9a28e69ca44513cbfe98f7ebced60e5b978a6ca2f4703c9f9793c
Instruction ID: 69a2c3714a42aeb4acb38a01fd482d4a29005f38a1e6aac3dfb8f689815de5c2
Opcode Fuzzy Hash: 067cf44c50f9a28e69ca44513cbfe98f7ebced60e5b978a6ca2f4703c9f9793c
Instruction Fuzzy Hash: 71E0ECB5940600EFDB18BBA1C946F6E7775EF48315F20049EF1026B2E2DA799D40DF29

Function 2BB7F983 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 2BB7F98F

Part of subcall function 2BB83E5B: __getptd_noexit.LIBCMT ref: 2BB83E5E
Part of subcall function 2BB83E5B: __amsg_exit.LIBCMT ref: 2BB83E6B

Part of subcall function 2BB7F964: __getptd_noexit.LIBCMT ref: 2BB7F969
Part of subcall function 2BB7F964: __freeptd.LIBCMT ref: 2BB7F973
Part of subcall function 2BB7F964: ExitThread.KERNEL32 ref: 2BB7F97C

__XcptFilter.LIBCMT ref: 2BB7F9B0

Part of subcall function 2BB8418F: __getptd_noexit.LIBCMT ref: 2BB84195

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: __getptd_noexit$ExitFilterThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 418257734-0
Opcode ID: de580856f0fa62288ffe6cfa65785e222abdae58cdbd5d270bd40a082b669d2d
Instruction ID: 83135654c33aaca8e923f049185363da1d15c0742b49f517d33e148179802882
Opcode Fuzzy Hash: de580856f0fa62288ffe6cfa65785e222abdae58cdbd5d270bd40a082b669d2d
Instruction Fuzzy Hash: 0CE012B1904640EFDF18EBE0D846E7D7775EF78602F204158E1026B2A0CF359940DF20

Function 2D4D80F5 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 2D4D8101

Part of subcall function 2D4DA728: __getptd_noexit.LIBCMT ref: 2D4DA72B
Part of subcall function 2D4DA728: __amsg_exit.LIBCMT ref: 2D4DA738

Part of subcall function 2D4D80D6: __getptd_noexit.LIBCMT ref: 2D4D80DB
Part of subcall function 2D4D80D6: __freeptd.LIBCMT ref: 2D4D80E5
Part of subcall function 2D4D80D6: ExitThread.KERNEL32 ref: 2D4D80EE

__XcptFilter.LIBCMT ref: 2D4D8122

Part of subcall function 2D4DAA5A: __getptd_noexit.LIBCMT ref: 2D4DAA60

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: __getptd_noexit$ExitFilterThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 418257734-0
Opcode ID: 6401ab207929d3b1cf3ba44a441e6b68baf78998a3bf2b319a4627fb05ab7073
Instruction ID: 092ac3dc3629c3483ec01f5e71e80a1b83ef22555c504254ee23c711efaa40fc
Opcode Fuzzy Hash: 6401ab207929d3b1cf3ba44a441e6b68baf78998a3bf2b319a4627fb05ab7073
Instruction Fuzzy Hash: BBE012B690C604DFEB58DBA0C969E7E7775EF24B15F22004DE2027B2B1CB759941DB20

Function 2BB86403 Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 2BB8641B

Part of subcall function 2BB88E5B: __mtinitlocknum.LIBCMT ref: 2BB88E71
Part of subcall function 2BB88E5B: __amsg_exit.LIBCMT ref: 2BB88E7D
Part of subcall function 2BB88E5B: EnterCriticalSection.KERNEL32(00000000,00000000,?,2BB83F06,0000000D,2BB96340,00000008,2BB83FFF,00000000,?,2BB810F0,00000000,2BB96278,00000008,2BB81155,?), ref: 2BB88E85

__tzset_nolock.LIBCMT ref: 2BB8642C

Part of subcall function 2BB85D22: __lock.LIBCMT ref: 2BB85D44
Part of subcall function 2BB85D22: ____lc_codepage_func.LIBCMT ref: 2BB85D8B
Part of subcall function 2BB85D22: __getenv_helper_nolock.LIBCMT ref: 2BB85DAD
Part of subcall function 2BB85D22: _free.LIBCMT ref: 2BB85DE4
Part of subcall function 2BB85D22: _strlen.LIBCMT ref: 2BB85DEB
Part of subcall function 2BB85D22: __malloc_crt.LIBCMT ref: 2BB85DF2
Part of subcall function 2BB85D22: _strlen.LIBCMT ref: 2BB85E08
Part of subcall function 2BB85D22: _strcpy_s.LIBCMT ref: 2BB85E16
Part of subcall function 2BB85D22: __invoke_watson.LIBCMT ref: 2BB85E2B
Part of subcall function 2BB85D22: _free.LIBCMT ref: 2BB85E3A

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: __lock_free_strlen$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__invoke_watson__malloc_crt__mtinitlocknum__tzset_nolock_strcpy_s
String ID:
API String ID: 1828324828-0
Opcode ID: f6231b328f8a5de138efef29977099e027b2f718b92188bbadfaf09f607b823d
Instruction ID: 2843e26fde8f7a50d92f117d403f7751e7d1a10714916ef468c4681b9483e4dd
Opcode Fuzzy Hash: f6231b328f8a5de138efef29977099e027b2f718b92188bbadfaf09f607b823d
Instruction Fuzzy Hash: 63E01231C42714D7CF16DFF8A643A1CB261AFBDF25F944229E55552091DA358241C662

Function 2BB7D560 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f894746965166d5d2e89480a9af08f2c6ebe6bd03f75375ff31dfb97a62ab7e
Instruction ID: 78bc7616355ab2b25f8954bd55712cf7078fa84d3bcf97acf85c9560a0c12f39
Opcode Fuzzy Hash: 6f894746965166d5d2e89480a9af08f2c6ebe6bd03f75375ff31dfb97a62ab7e
Instruction Fuzzy Hash: A9110A73A011065BE700DB1DD880EA673BEFFC4364F54435AE908C7695DB72E922C6D0

Function 0040335B Relevance: 1.6, APIs: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,00000000,?,?,00403186,?,?,00000000), ref: 004033B7

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: Timetime
String ID:
API String ID: 17336451-0
Opcode ID: c86024cdd912bfd08de45b50fb3a686ab0fed40fa5c6b1a13786f23b41b41c64
Instruction ID: c20e9dc67a88f4dff2cb00905eaa3f19bd47f9ddd93c2b6aa80072353f27cf43
Opcode Fuzzy Hash: c86024cdd912bfd08de45b50fb3a686ab0fed40fa5c6b1a13786f23b41b41c64
Instruction Fuzzy Hash: D0213035200104ABCB45DF55CCC1E9A3B6DFF48745B108077FE04AF2A6D635EA828B95

Function 004031EC Relevance: 1.6, APIs: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00402DD2: GetCurrentThreadId.KERNEL32 ref: 00402DD3
Part of subcall function 00402DD2: InterlockedExchange.KERNEL32(?,00000001), ref: 00402DE3

Part of subcall function 00403279: send.WS2_32(?,?,00040000,00000000), ref: 004032AE
Part of subcall function 00403279: send.WS2_32(?,?,?,00000000), ref: 004032E3

GetCurrentThreadId.KERNEL32 ref: 00403258

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: CurrentThreadsend$ExchangeInterlocked
String ID:
API String ID: 2143143107-0
Opcode ID: 621fe6bcc9a94f6ae9dcd85bca723a205cfcec00711216a61eff4dfd670cbaec
Instruction ID: 951079acdf484fdc8253ce70972fe3f8d16851deb56906d0985fbb33e1cad4f1
Opcode Fuzzy Hash: 621fe6bcc9a94f6ae9dcd85bca723a205cfcec00711216a61eff4dfd670cbaec
Instruction Fuzzy Hash: DB115A72110609BBD710EB62DC82F9AB7ACFF14719F10802AF240A6891E775FA548B94

Function 2D4FDFB0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 2D4FDFBB

Part of subcall function 2D4D7E03: __FF_MSGBANNER.LIBCMT ref: 2D4D7E1C
Part of subcall function 2D4D7E03: __NMSG_WRITE.LIBCMT ref: 2D4D7E23
Part of subcall function 2D4D7E03: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,2D4DADD0,00000000,00000001,00000000,?,2D4DC162,00000018,2D52AFE0,0000000C,2D4DC1F2), ref: 2D4D7E48

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 0c534456263fbf1349e05ce540b62b90d1fab89115a8abc414ed6cb2043ea2ed
Instruction ID: 685b9e2b56a40d54c7bbf545daa3f2d856cea1de97e0c98e0c4bb301901f68d9
Opcode Fuzzy Hash: 0c534456263fbf1349e05ce540b62b90d1fab89115a8abc414ed6cb2043ea2ed
Instruction Fuzzy Hash: 7AB092B390430D5B8B01DE98A982C5A739CAA64920F0A442ABA1D8B601E531FA208692

Function 2D4E6450 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 2D4E6457

Part of subcall function 2D4D7DC9: RtlFreeHeap.NTDLL(00000000,00000000,?,2D4DA719,00000000,?,?,2D4D8092,2D4D8002,?,?,?,2D4D66C6,154.201.87.51,000000FF,?), ref: 2D4D7DDF
Part of subcall function 2D4D7DC9: GetLastError.KERNEL32(00000000,?,2D4DA719,00000000,?,?,2D4D8092,2D4D8002,?,?,?,2D4D66C6,154.201.87.51,000000FF,?), ref: 2D4D7DF1

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: 0d454a7db004dcf821282e2d649164326a21d8d945a1a7490fde49ab830bda7d
Instruction ID: cbccc1a5030a1eabc144d7f5b6a1858763e5e12e5ce33857bb4bd017e8f5b78b
Opcode Fuzzy Hash: 0d454a7db004dcf821282e2d649164326a21d8d945a1a7490fde49ab830bda7d
Instruction Fuzzy Hash: BBB012B781430C13890099D86801C16338C4718820F044020BA0D47204E472F5148192

Function 2D4E6430 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 2D4E6437

Part of subcall function 2D4D7E03: __FF_MSGBANNER.LIBCMT ref: 2D4D7E1C
Part of subcall function 2D4D7E03: __NMSG_WRITE.LIBCMT ref: 2D4D7E23
Part of subcall function 2D4D7E03: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,2D4DADD0,00000000,00000001,00000000,?,2D4DC162,00000018,2D52AFE0,0000000C,2D4DC1F2), ref: 2D4D7E48

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 5e41ccea490c44be54849ae542bf6f10394f15854abfb3b38ec27c110797cc5f
Instruction ID: 9fc71e7669bfc8a0f1f496c236b819a6b8dffd093878cba80bb8f6987b504d6e
Opcode Fuzzy Hash: 5e41ccea490c44be54849ae542bf6f10394f15854abfb3b38ec27c110797cc5f
Instruction Fuzzy Hash: A7B012F390430C178A0195D86801C06338C4614820F054025BA0D47601E431F91081D2

Function 2D4D90EC Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 2D4D90F2

Part of subcall function 2D4D8F80: __lock.LIBCMT ref: 2D4D8F8E
Part of subcall function 2D4D8F80: DecodePointer.KERNEL32(2D52AF30,00000020,2D4D90E7,00000000,00000001,00000000,?,2D4D9118,000000FF,?,2D4DC1FE,00000011,?,?,2D4DA645,0000000D), ref: 2D4D8FCA
Part of subcall function 2D4D8F80: DecodePointer.KERNEL32(?,2D4D9118,000000FF,?,2D4DC1FE,00000011,?,?,2D4DA645,0000000D), ref: 2D4D8FDB
Part of subcall function 2D4D8F80: DecodePointer.KERNEL32(-00000004,?,2D4D9118,000000FF,?,2D4DC1FE,00000011,?,?,2D4DA645,0000000D), ref: 2D4D9001
Part of subcall function 2D4D8F80: DecodePointer.KERNEL32(?,2D4D9118,000000FF,?,2D4DC1FE,00000011,?,?,2D4DA645,0000000D), ref: 2D4D9014
Part of subcall function 2D4D8F80: DecodePointer.KERNEL32(?,2D4D9118,000000FF,?,2D4DC1FE,00000011,?,?,2D4DA645,0000000D), ref: 2D4D901E

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: DecodePointer$__lock_doexit
String ID:
API String ID: 3343572566-0
Opcode ID: 61cc1048c9adf6bbef98f44e7947428adfb5ecee68712f559f8c60e7f46661f4
Instruction ID: b23d5fa2c3defcb50f1a9eb4fc6be0e91fd73b14fe526cd19ed22bba4696cb89
Opcode Fuzzy Hash: 61cc1048c9adf6bbef98f44e7947428adfb5ecee68712f559f8c60e7f46661f4
Instruction Fuzzy Hash: 40A002AABD830421F9A091503C53FA421129BA0F09FD90058FB083C1C5A4D626588057

Function 2D4D8E29 Relevance: 1.5, APIs: 1, Instructions: 4memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNELBASE(2D4D8446,2D52AED0,00000008,2D4D853D,?,?,?,2D52AEF0,0000000C,2D4D85F8,?), ref: 2D4D8E2F

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: d4c0e6a1550882bacb9baca0d662a5a97912fd15f9e95e4330ac7b852db033ac
Instruction ID: 4c5944080112eedb9d865465c80d48b3d1bf2ba1f09f1416005bddc98fdab763
Opcode Fuzzy Hash: d4c0e6a1550882bacb9baca0d662a5a97912fd15f9e95e4330ac7b852db033ac
Instruction Fuzzy Hash: 4AB001B50202008BDF125B90C88E7643A71B758F17F884954D10245A60C7FD0428EA0E

Function 00402809 Relevance: 1.3, APIs: 1, Instructions: 15sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000BB8,?,?,?,?,?,00402B67), ref: 00402825

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 86eccc9c7d7456072ce158959297a4fe3040b6a6689b1294430854539381f1a5
Instruction ID: aa586a451095a2377f0bb31ddc17fb411c2485f3522472dadaf578047b43c66e
Opcode Fuzzy Hash: 86eccc9c7d7456072ce158959297a4fe3040b6a6689b1294430854539381f1a5
Instruction Fuzzy Hash: DED0C9B0A40700BFE720AF21CC49E777BACEB15B0575008A9FC46E7292D7799E00CAE4

Function 2BB7D9B0 Relevance: 1.3, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 2BB7D9C3

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8961362ab20b5da5060abfe17784348e4beade99e0271661ab0370530c501ead
Instruction ID: 32e4a6a6d30ed48f0e7727e220b7732373b62b0f05b6b23f26d3b4518db87195
Opcode Fuzzy Hash: 8961362ab20b5da5060abfe17784348e4beade99e0271661ab0370530c501ead
Instruction Fuzzy Hash: 7ED0EAB9610649AF9B04DE99D989CAB37ADEB88610B008508B91987200D675FD118BB1

Function 2BB7D9D0 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 2BB7D9DF

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 40e3803b18c20064ffd370e8ed65aa77b145c6cbc11d9de2d88f99b032a319ed
Instruction ID: b05813f1202ec754a6db8ed8205b1f8b11bd43242555c4ea639c0432054f1595
Opcode Fuzzy Hash: 40e3803b18c20064ffd370e8ed65aa77b145c6cbc11d9de2d88f99b032a319ed
Instruction Fuzzy Hash: 62C04CB955070CAF9B04DF54D885CBB776DEB88610B00C505FD1947301D675FD118AA0

Non-executed Functions

Function 2BB7E850 Relevance: 72.1, APIs: 36, Strings: 5, Instructions: 311stringfilesynchronizationCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2BB7E8A9
Sleep.KERNEL32(00000001,?,?,?,2BB7604D), ref: 2BB7E8B3
GetTickCount.KERNEL32 ref: 2BB7E8BF
GetTickCount.KERNEL32 ref: 2BB7E8D2
InterlockedExchange.KERNEL32(2BBA1F08,00000000), ref: 2BB7E8DA
OpenClipboard.USER32(00000000), ref: 2BB7E8E2
GetClipboardData.USER32(0000000D), ref: 2BB7E8EA
GlobalSize.KERNEL32(00000000), ref: 2BB7E8FB
GlobalLock.KERNEL32(00000000), ref: 2BB7E90C
wsprintfW.USER32 ref: 2BB7E985
_memset.LIBCMT ref: 2BB7E9A3
GlobalUnlock.KERNEL32(00000000), ref: 2BB7E9AC
CloseClipboard.USER32 ref: 2BB7E9B2
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 2BB7E9CA
CreateFileW.KERNEL32(2BBA0D80,40000000,00000002,00000000,00000004,00000002,00000000), ref: 2BB7E9E4
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 2BB7EA02
lstrlenW.KERNEL32(2BB95B48,?,00000000), ref: 2BB7EA16
WriteFile.KERNEL32(00000000,2BB95B48,00000000), ref: 2BB7EA25
CloseHandle.KERNEL32(00000000), ref: 2BB7EA2C
ReleaseMutex.KERNEL32(00000000), ref: 2BB7EA38
GetKeyState.USER32(00000014), ref: 2BB7EABC
lstrlenW.KERNEL32(2BB9B4A8), ref: 2BB7EB0B
wsprintfW.USER32 ref: 2BB7EB1D
lstrlenW.KERNEL32(2BB9B4D0), ref: 2BB7EB3E
lstrlenW.KERNEL32(2BB9B4D0), ref: 2BB7EB61
wsprintfW.USER32 ref: 2BB7EB7F
wsprintfW.USER32 ref: 2BB7EB95
wsprintfW.USER32 ref: 2BB7EBBF
lstrlenW.KERNEL32(00000000), ref: 2BB7EC0B
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 2BB7EC21
CreateFileW.KERNEL32(2BBA0D80,40000000,00000002,00000000,00000004,00000002,00000000), ref: 2BB7EC3B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 2BB7EC59
lstrlenW.KERNEL32(00000000,?,00000000), ref: 2BB7EC69
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 2BB7EC74
CloseHandle.KERNEL32(00000000), ref: 2BB7EC7B
ReleaseMutex.KERNEL32(00000000), ref: 2BB7EC88

Strings

%s%s, xrefs: 2BB7EB8F
%s%s, xrefs: 2BB7EBB9
[, xrefs: 2BB7E97F
%s%s, xrefs: 2BB7EB17, 2BB7EB79
[esc], xrefs: 2BB7EB4E, 2BB7EB77, 2BB7EB8D, 2BB7EBB7

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Filelstrlen$wsprintf$ClipboardCloseGlobal$CountCreateHandleMutexObjectPointerReleaseSingleTickWaitWrite_memset$DataExchangeInterlockedLockOpenSizeSleepStateUnlock
String ID: [$%s%s$%s%s$%s%s$[esc]
API String ID: 1637302245-2373594894
Opcode ID: cb99209bd77528b1391a50dd99846069d9ca41cd509bc7aa8ecbd19b510fedb6
Instruction ID: ac5f6cc20e1163deaa840c88068d76e1e53e3a7558431640624c255257c361fa
Opcode Fuzzy Hash: cb99209bd77528b1391a50dd99846069d9ca41cd509bc7aa8ecbd19b510fedb6
Instruction Fuzzy Hash: 80C1AE7AD00A10AFDB24EF24CD89BAA7BB8FF09700F004158E296DB291D779D585DF61

Function 2BB777E0 Relevance: 68.5, APIs: 30, Strings: 9, Instructions: 240libraryloaderinjectionCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2BB77804
_memset.LIBCMT ref: 2BB77850
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 2BB77864

Part of subcall function 2BB78720: _vswprintf_s.LIBCMT ref: 2BB78731

GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 2BB77893
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000214,00000000,00000000,00000044,?), ref: 2BB778DA

Part of subcall function 2BB77740: GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,?,2BB778FC), ref: 2BB77756
Part of subcall function 2BB77740: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,2BB778FC,?,?,?,?,?,?,74DF0630), ref: 2BB7775D

OpenProcess.KERNEL32(001FFFFF,00000000,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 2BB7790A
_memset.LIBCMT ref: 2BB77923
LoadLibraryA.KERNEL32(Kernel32.dll,OpenProcess,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 2BB7793B
GetProcAddress.KERNEL32(00000000), ref: 2BB77944
LoadLibraryA.KERNEL32(Kernel32.dll,ExitProcess,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 2BB77956
GetProcAddress.KERNEL32(00000000), ref: 2BB77959
LoadLibraryA.KERNEL32(Kernel32.dll,WinExec,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 2BB7796B
GetProcAddress.KERNEL32(00000000), ref: 2BB7796E
LoadLibraryA.KERNEL32(Kernel32.dll,WaitForSingleObject,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 2BB77980
GetProcAddress.KERNEL32(00000000), ref: 2BB77983
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 2BB7798B
GetProcessId.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,74DF0630,?,74DF0F00), ref: 2BB77992
_memset.LIBCMT ref: 2BB779B4
GetModuleFileNameA.KERNEL32(00000000,?,000000FA,?,?,?,?,?,?,?,?,?,?,?,?,74DF0630), ref: 2BB779CA
VirtualAllocEx.KERNEL32(00000000,00000000,00000118,00003000,00000040), ref: 2BB779FF
WriteProcessMemory.KERNEL32(00000000,00000000,?,00000118,00000000), ref: 2BB77A1B
VirtualProtectEx.KERNEL32(00000000,00000000,00000118,00000001,?), ref: 2BB77A43
VirtualAllocEx.KERNEL32(00000000,00000000,00001000,00003000,00000040), ref: 2BB77A58
WriteProcessMemory.KERNEL32(00000000,00000000,2BB776F0,00001000,00000000), ref: 2BB77A72
VirtualProtectEx.KERNEL32(00000000,00000000,00001000,00000001,00000000), ref: 2BB77A90
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000), ref: 2BB77AA1
Sleep.KERNEL32(0000EA60,?,?,?,?,?,?,?,?,?,?,?,?,?,?,74DF0630), ref: 2BB77ABA
VirtualProtectEx.KERNEL32(00000000,00000000,00000118,00000040,00000000), ref: 2BB77AD6
VirtualProtectEx.KERNEL32(00000000,00000000,00001000,00000040,00000000), ref: 2BB77AE8
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,74DF0630), ref: 2BB77AF1

Strings

Windows\System32\svchost.exe, xrefs: 2BB778A4
%s%s, xrefs: 2BB77876, 2BB778AA
OpenProcess, xrefs: 2BB77931
Windows\SysWOW64\svchost.exe, xrefs: 2BB77870
Kernel32.dll, xrefs: 2BB77936, 2BB7794B, 2BB77960, 2BB77975
WinExec, xrefs: 2BB7795B
WaitForSingleObject, xrefs: 2BB77970
D, xrefs: 2BB77840
ExitProcess, xrefs: 2BB77946

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Process$Virtual$AddressLibraryLoadProcProtect_memset$AllocCreateCurrentFileMemoryOpenThreadWrite$AttributesDirectoryModuleNameRemoteResumeSleepSystemToken_vswprintf_s
String ID: %s%s$D$ExitProcess$Kernel32.dll$OpenProcess$WaitForSingleObject$WinExec$Windows\SysWOW64\svchost.exe$Windows\System32\svchost.exe
API String ID: 4176418925-3213446972
Opcode ID: d5128904904408dfdf5600e796203eccefecd81de3422f57da3609058c9337a2
Instruction ID: 99715392a1001aa8662146497dd4e9dc4b34dc25a41d897d3b374f6869f00260
Opcode Fuzzy Hash: d5128904904408dfdf5600e796203eccefecd81de3422f57da3609058c9337a2
Instruction Fuzzy Hash: DD81A271D407187BEB21DB62CC49FEB777CEF99700F004099F648A6181DAB59B85CE64

Function 2BB77E50 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 131threadinjectionprocessCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2BB77E73
_memset.LIBCMT ref: 2BB77E9F
_memset.LIBCMT ref: 2BB77ED4
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 2BB77EE8

Part of subcall function 2BB78720: _vswprintf_s.LIBCMT ref: 2BB78731

GetFileAttributesA.KERNEL32(?), ref: 2BB77F15
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 2BB77F65
VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 2BB77F92
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,00003000,00000040), ref: 2BB77FAA
GetThreadContext.KERNEL32(?,?,?,00000000,?,00003000,00000040), ref: 2BB77FCC
SetThreadContext.KERNEL32(?,00010007,?,00000000,?,00003000,00000040), ref: 2BB77FEA
ResumeThread.KERNEL32(?,?,00000000,?,00003000,00000040), ref: 2BB77FFF

Strings

Windows\System32\svchost.exe, xrefs: 2BB77F26
%s%s, xrefs: 2BB77EFA, 2BB77F2C
Windows\SysWOW64\svchost.exe, xrefs: 2BB77EEE
D, xrefs: 2BB77EB3

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Thread_memset$ContextProcess$AllocAttributesCreateDirectoryFileMemoryResumeSystemVirtualWrite_vswprintf_s
String ID: %s%s$D$Windows\SysWOW64\svchost.exe$Windows\System32\svchost.exe
API String ID: 2170139861-2473635271
Opcode ID: 990cddc37ab77edd5f62a88a7d56e30dd3124b7492ff43beb8d3c670d9e0b1cc
Instruction ID: cb6d85c54db1ebdd5f21effd75df30d7e05af7b425fd3705936e7dca68c62471
Opcode Fuzzy Hash: 990cddc37ab77edd5f62a88a7d56e30dd3124b7492ff43beb8d3c670d9e0b1cc
Instruction Fuzzy Hash: 2D4181B1E00258ABDB20DB61DD85FEE77BCAF58700F0041D9E60DA6181DAB5AB85CF64

Function 00402B6E Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 117threadinjectionprocessCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00402B8A
_memset.LIBCMT ref: 00402BA4
_memset.LIBCMT ref: 00402BD0
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 00402BE4

Part of subcall function 00402CD0: _vswprintf_s.LIBCMT ref: 00402CE2

GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00402C12
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 00402C4D
VirtualAllocEx.KERNEL32(?,00000000,?,00003000,00000040), ref: 00402C68
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 00402C7E
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00402C9C
SetThreadContext.KERNEL32(?,00010007,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00402CB6
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00402CC3

Strings

Windows\SysWOW64\tracerpt.exe, xrefs: 00402BEA
Windows\System32\tracerpt.exe, xrefs: 00402C1D
%s%s, xrefs: 00402BF6, 00402BFB, 00402C29
D, xrefs: 00402BBC

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: Thread_memset$ContextProcess$AllocAttributesCreateDirectoryFileMemoryResumeSystemVirtualWrite_vswprintf_s
String ID: %s%s$D$Windows\SysWOW64\tracerpt.exe$Windows\System32\tracerpt.exe
API String ID: 2170139861-1986163084
Opcode ID: a0e9074150215b2363295ef3dcc7d57c9bc398c836b759c2a3415b6ad2e14ab1
Instruction ID: f41ac5f19dc63ada243b515e8b263872f7d94abbf8bebc3c841f4af59ac79dfa
Opcode Fuzzy Hash: a0e9074150215b2363295ef3dcc7d57c9bc398c836b759c2a3415b6ad2e14ab1
Instruction Fuzzy Hash: AD4153B1900108BFEB209FA5CD49FEF7BFDEB48744F004475B608E21A1D6789E858B28

Function 2BB7E4F0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 143synchronizationfilekeyboardCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,2BBA0D80,74DEE010,74DF2FA0,74DF0F00,?,2BB76028,?,?), ref: 2BB7E519
lstrcatW.KERNEL32(2BBA0D80,\DisplaySessionContainers.log,?,2BB76028,?,?), ref: 2BB7E529
CreateMutexW.KERNEL32(00000000,00000000,2BBA0D80,?,2BB76028,?,?), ref: 2BB7E538
WaitForSingleObject.KERNEL32(00000000,000000FF,?,2BB76028,?,?), ref: 2BB7E546
CreateFileW.KERNEL32(2BBA0D80,40000000,00000002,00000000,00000004,00000080,00000000,?,2BB76028,?,?), ref: 2BB7E563
GetFileSize.KERNEL32(00000000,00000000,?,2BB76028,?,?), ref: 2BB7E56E
CloseHandle.KERNEL32(00000000,?,2BB76028,?,?), ref: 2BB7E577
DeleteFileW.KERNEL32(2BBA0D80,?,2BB76028,?,?), ref: 2BB7E58A
ReleaseMutex.KERNEL32(00000000,?,2BB76028,?,?), ref: 2BB7E597
DirectInput8Create.DINPUT8(?,00000800,2BB94934,2BBA1220,00000000,?,2BB76028,?,?), ref: 2BB7E5B2
GetTickCount.KERNEL32 ref: 2BB7E665
GetKeyState.USER32(00000014), ref: 2BB7E672

Strings

\DisplaySessionContainers.log, xrefs: 2BB7E51F
<, xrefs: 2BB7E637

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CreateFile$Mutex$CloseCountDeleteDirectFolderHandleInput8ObjectPathReleaseSingleSizeStateTickWaitlstrcat
String ID: <$\DisplaySessionContainers.log
API String ID: 1095970075-1170057892
Opcode ID: 83e23a3c6f5a1f29c07df6c95ca137182b8317de6c87cd3c5acf4580011be1d7
Instruction ID: 2c55ec96b3ec402d2bafc4c3b396ef1488466b1534db6c0cd28482c470590e05
Opcode Fuzzy Hash: 83e23a3c6f5a1f29c07df6c95ca137182b8317de6c87cd3c5acf4580011be1d7
Instruction Fuzzy Hash: B4419E75E00605AFDB50DFA8CD99FAA3BB9AF4D304F104019F615DB284DA3AE446CFA4

Function 2D4D5E10 Relevance: 24.2, APIs: 16, Instructions: 235keyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 2D4D6FF0: GetCurrentThreadId.KERNEL32 ref: 2D4D700D
Part of subcall function 2D4D6FF0: GetThreadDesktop.USER32(00000000), ref: 2D4D7014
Part of subcall function 2D4D6FF0: _memset.LIBCMT ref: 2D4D702A
Part of subcall function 2D4D6FF0: GetUserObjectInformationW.USER32(00000000,00000002,?,00000200,?), ref: 2D4D704E
Part of subcall function 2D4D6FF0: OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 2D4D7059
Part of subcall function 2D4D6FF0: _memset.LIBCMT ref: 2D4D706F
Part of subcall function 2D4D6FF0: GetUserObjectInformationW.USER32(00000000,00000002,?,00000200,?), ref: 2D4D708D
Part of subcall function 2D4D6FF0: lstrcmpiW.KERNEL32(?,?), ref: 2D4D709D
Part of subcall function 2D4D6FF0: SetThreadDesktop.USER32(00000000), ref: 2D4D70A8
Part of subcall function 2D4D6FF0: CloseDesktop.USER32(00000000), ref: 2D4D70BF
Part of subcall function 2D4D6FF0: CloseDesktop.USER32(00000000), ref: 2D4D70C2

BlockInput.USER32(00000000,75C11040,?,?), ref: 2D4D5E52
GetDeviceCaps.GDI32(?,00000076), ref: 2D4D5E74
GetDeviceCaps.GDI32(?,00000075), ref: 2D4D5EB9
MapVirtualKeyW.USER32(?,00000000), ref: 2D4D5F34
keybd_event.USER32(?,00000000), ref: 2D4D5F46
MapVirtualKeyW.USER32(?,00000000), ref: 2D4D5F58
keybd_event.USER32(?,00000000), ref: 2D4D5F6A
MapVirtualKeyW.USER32(?,00000000), ref: 2D4D5F93
keybd_event.USER32(?,00000000), ref: 2D4D5FA5
MapVirtualKeyW.USER32(?,00000000), ref: 2D4D5FB7
keybd_event.USER32(?,00000000), ref: 2D4D5FC9
mouse_event.USER32(00008008,?,?,00000000,00000000), ref: 2D4D6024
mouse_event.USER32(00008006,?,?,00000000,00000000), ref: 2D4D6045
mouse_event.USER32(00008018,?,?,00000000,00000000), ref: 2D4D6063
mouse_event.USER32(00008060,?,?,00000000,00000000), ref: 2D4D609B
mouse_event.USER32(00008002,?,?,00000000,00000000), ref: 2D4D60BC

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Desktopmouse_event$Virtualkeybd_event$Thread$CapsCloseDeviceInformationInputObjectUser_memset$BlockCurrentOpenlstrcmpi
String ID:
API String ID: 3088714538-0
Opcode ID: ff1470983a17620fbf75701f59470d692d15d079970160e984405bcdc05783fc
Instruction ID: 965eb274f38d6f2263d80ed5c676329736014e3cbfc9c25c3bc92d6809a6128b
Opcode Fuzzy Hash: ff1470983a17620fbf75701f59470d692d15d079970160e984405bcdc05783fc
Instruction Fuzzy Hash: 0081A531644244FAEB619F55CC59FAB7A78FB46F41F20C056FB08BE2C0C6B5A941C768

Function 2BB77620 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,?,?,?,?,?,?,?,2BB7DFA4), ref: 2BB77637
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,2BB7DFA4), ref: 2BB7763E
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 2BB7765A
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 2BB77677
CloseHandle.KERNEL32(?), ref: 2BB77681
GetModuleHandleA.KERNEL32(NtDll.dll,NtSetInformationProcess,?,?,?,?,?,?,?,2BB7DFA4), ref: 2BB77691
GetProcAddress.KERNEL32(00000000), ref: 2BB77698
GetCurrentProcessId.KERNEL32 ref: 2BB776BA
OpenProcess.KERNEL32(001FFFFF,00000000,00000000), ref: 2BB776C7

Strings

SeDebugPrivilege, xrefs: 2BB7764C
NtSetInformationProcess, xrefs: 2BB77687
NtDll.dll, xrefs: 2BB7768C

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Process$CurrentHandleOpenToken$AddressAdjustCloseLookupModulePrivilegePrivilegesProcValue
String ID: NtDll.dll$NtSetInformationProcess$SeDebugPrivilege
API String ID: 1802016953-1577477132
Opcode ID: f3b44aeacb75d9f40555a7bda7afa842948621ff3807c781237e9aec0f44a7c7
Instruction ID: c776945cc44213f2bf72725a782fa506449b6ecad499120144727b957b8bcde1
Opcode Fuzzy Hash: f3b44aeacb75d9f40555a7bda7afa842948621ff3807c781237e9aec0f44a7c7
Instruction Fuzzy Hash: 0C214F72E40608AFEB10EFA4CD4AFBE7778EF08700F004019F615A7181DAB595458FA5

Function 004050C1 Relevance: 15.0, APIs: 10, Instructions: 33threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00004F98), ref: 004050C7
GetConsoleWindow.KERNEL32(00000000), ref: 004050D0
ShowWindow.USER32(00000000), ref: 004050D7
GetCurrentThreadId.KERNEL32 ref: 004050E0
PostThreadMessageA.USER32(00000000), ref: 004050E7
GetInputState.USER32 ref: 004050ED
CreateThread.KERNEL32(00000000,00000000,Function_00004D97,00000000,00000000,00000000), ref: 004050FD
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0040510B
CloseHandle.KERNEL32 ref: 00405117
Sleep.KERNEL32(0000012C), ref: 00405122

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: Thread$Window$CloseConsoleCreateCurrentExceptionFilterHandleInputMessageObjectPostShowSingleSleepStateUnhandledWait
String ID:
API String ID: 2277684705-0
Opcode ID: 2ee1d104e9a331fb45893852bf4777ec20886f6a18b2bb74717aa72ea3e5b47a
Instruction ID: b4a7d6824b616608f05758ebdb6e7d928e6c1e6e72145a6b26d2ad21388fe8c4
Opcode Fuzzy Hash: 2ee1d104e9a331fb45893852bf4777ec20886f6a18b2bb74717aa72ea3e5b47a
Instruction Fuzzy Hash: A4F07471502121BBC6206FF5BC0CDCB7EA8EF0E6A33118170F20AE10A8CB344645CBAD

Function 2BB8054D Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 92memorylibraryloaderCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 2BB80576
GetSystemInfo.KERNEL32(?), ref: 2BB8058E
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 2BB8059E
GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 2BB805AE
VirtualAlloc.KERNEL32(?,-00000001,00001000,00000004), ref: 2BB80600
VirtualProtect.KERNEL32(?,-00000001,00000104,?), ref: 2BB80615

Strings

kernel32.dll, xrefs: 2BB80597
SetThreadStackGuarantee, xrefs: 2BB805A8

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Virtual$AddressAllocHandleInfoModuleProcProtectQuerySystem
String ID: SetThreadStackGuarantee$kernel32.dll
API String ID: 3290314748-423161677
Opcode ID: d1718417526028a00c1f5a7b44da0cc39fc9e80271f643af4c1ce716ad868972
Instruction ID: ad141c3a69553dccfb22204ec1076b590272b89f09a44fd5deecb648fe3589f5
Opcode Fuzzy Hash: d1718417526028a00c1f5a7b44da0cc39fc9e80271f643af4c1ce716ad868972
Instruction Fuzzy Hash: 04318272E4161AABDF10DBA0CD84AFEB7B9EF48785F500225E641E7140DB74EA45CBA0

Function 2BB77B70 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 2BB77B89
OpenProcessToken.ADVAPI32(00000000), ref: 2BB77B90
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 2BB77BB6
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 2BB77BCC
GetLastError.KERNEL32 ref: 2BB77BD2
CloseHandle.KERNEL32(?), ref: 2BB77BE0
CloseHandle.KERNEL32(?), ref: 2BB77BFB

Strings

SeShutdownPrivilege, xrefs: 2BB77BA2

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3435690185-3733053543
Opcode ID: 42523ab700907af4070c864bfd75ea3d1e78d2b36f2f3ab0f92facc6f193f316
Instruction ID: ca1f936fa93d2218f3716514fafccad3c4202b92af4fc0fbf2e6c7e21317cd72
Opcode Fuzzy Hash: 42523ab700907af4070c864bfd75ea3d1e78d2b36f2f3ab0f92facc6f193f316
Instruction Fuzzy Hash: 7C115471E40608AFDB10DFA4CD5AFBE7778EF08700F504559FA05A7280DA76D906CBA4

Function 2D4D57A0 Relevance: 12.2, APIs: 8, Instructions: 168keyboardclipboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000000), ref: 2D4D57E7
BlockInput.USER32(?), ref: 2D4D5804
InterlockedExchange.KERNEL32(?), ref: 2D4D5821
SetEvent.KERNEL32(?), ref: 2D4D5832
InterlockedExchange.KERNEL32(?,?), ref: 2D4D587B
BlockInput.USER32(?,?,?), ref: 2D4D5885
InterlockedExchange.KERNEL32(?,?), ref: 2D4D589B
OpenClipboard.USER32(00000000), ref: 2D4D58D4

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: BlockExchangeInputInterlocked$ClipboardEventOpen
String ID:
API String ID: 3048215192-0
Opcode ID: 67ff044e9e3d0d9fc112e39806338e072d444edb42f54215cedd0a5587d6744a
Instruction ID: e2d836a8d078e87b0d505a410720e7585ae011e5b93663a2ed577f8999ec80db
Opcode Fuzzy Hash: 67ff044e9e3d0d9fc112e39806338e072d444edb42f54215cedd0a5587d6744a
Instruction Fuzzy Hash: B5410E733492149AD340AB59B850BAAFBA9FBE6233F04C16FF6C8DA201C5268015D774

Function 2D4D6170 Relevance: 10.6, APIs: 7, Instructions: 59clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 2D4D6176
GetClipboardData.USER32(00000001), ref: 2D4D6183
CloseClipboard.USER32 ref: 2D4D618F
GlobalSize.KERNEL32(00000000), ref: 2D4D619F
GlobalLock.KERNEL32(00000000), ref: 2D4D61A9
GlobalUnlock.KERNEL32(00000000), ref: 2D4D61D2
CloseClipboard.USER32 ref: 2D4D61D8

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Clipboard$Global$Close$DataLockOpenSizeUnlock
String ID:
API String ID: 2237123812-0
Opcode ID: bd084e859d21919ef3b7580eb78ec4f1832c51192d65d6928488326b911e9c37
Instruction ID: ebcd60118d6bb5605a4fb497ec635a0f26d2411403988cb28b420fd47e3c2f63
Opcode Fuzzy Hash: bd084e859d21919ef3b7580eb78ec4f1832c51192d65d6928488326b911e9c37
Instruction Fuzzy Hash: 9011C277504204AFDB00DF64CC58FBAB7BCEF89A12F01806AFA0997312DBB59900C7A1

Function 2D4D6120 Relevance: 10.5, APIs: 7, Instructions: 29clipboardmemoryCOMMON

Download Yara Rule

APIs

EmptyClipboard.USER32 ref: 2D4D6124
GlobalAlloc.KERNEL32(00000002,?,?,?,2D4D58E9), ref: 2D4D612D
GlobalLock.KERNEL32(00000000), ref: 2D4D613A
GlobalUnlock.KERNEL32(00000000), ref: 2D4D614F
SetClipboardData.USER32(00000001,00000000), ref: 2D4D6158
GlobalFree.KERNEL32(00000000), ref: 2D4D615F
CloseClipboard.USER32 ref: 2D4D6165

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Global$Clipboard$AllocCloseDataEmptyFreeLockUnlock
String ID:
API String ID: 65910523-0
Opcode ID: ebbfb2d4e602346e303586cc4573e7f642ae218d0dc552d4ad1307a4b58330e7
Instruction ID: ad0030a03dd6118e807623c01df18c53c6e897cc624498f8401433c86bed4bcf
Opcode Fuzzy Hash: ebbfb2d4e602346e303586cc4573e7f642ae218d0dc552d4ad1307a4b58330e7
Instruction Fuzzy Hash: 5DE0C936401625ABCB112BA19C1DFAF3E3CEF4DF53B01C014F705D1741DAA94640C6B9

Function 2BB7B3C0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 26COMMON

Download Yara Rule

APIs

OpenEventLogW.ADVAPI32(00000000,2BB958BC), ref: 2BB7B3E7
ClearEventLogW.ADVAPI32(00000000,00000000), ref: 2BB7B3F2
CloseEventLog.ADVAPI32(00000000), ref: 2BB7B3F9

Strings

Security, xrefs: 2BB7B3CE
System, xrefs: 2BB7B3D6
Application, xrefs: 2BB7B3C6

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: Application$Security$System
API String ID: 1391105993-2169399579
Opcode ID: d7b9eca4a2044118b1f25e8eca5a840f3089d3773ce7b1cd9606b948511d9348
Instruction ID: 49dc6438d8a01e531738d4f72e7e6f4231b6c47a25a5c49861433921c39b222c
Opcode Fuzzy Hash: d7b9eca4a2044118b1f25e8eca5a840f3089d3773ce7b1cd9606b948511d9348
Instruction Fuzzy Hash: 98E0ED32E46B104FE321EF15B8C072EB7A0FFCC341F000229EA8897200C630C8429FAA

Function 2B9F660F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2B9F66A0
swprintf.LIBCMT ref: 2B9F66F8
swprintf.LIBCMT ref: 2B9F670B

Strings

@, xrefs: 2B9F66AC
:, xrefs: 2B9F663F

Memory Dump Source

Source File: 00000000.00000002.4113322478.000000002B9F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 2B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b9f0000_L8RabfF1Hu.jbxd

Similarity

API ID: swprintf$_memset
String ID: :$@
API String ID: 1292703666-1367939426
Opcode ID: 3ce09b44c703f379a6cffab786f078c12705430181853880a2577985a84515e9
Instruction ID: cf1129d3126cf1d7120a700489041c6d135dd31fdb23fce87108707002f02bad
Opcode Fuzzy Hash: 3ce09b44c703f379a6cffab786f078c12705430181853880a2577985a84515e9
Instruction Fuzzy Hash: 703150B2D0021CABDB14CFE5CC85FEEB7B9FB98304F50421DE90AA7241E6746945CB54

Function 2BB77740 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,?,2BB778FC), ref: 2BB77756
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,2BB778FC,?,?,?,?,?,?,74DF0630), ref: 2BB7775D
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 2BB77785
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 2BB777B9

Strings

SeDebugPrivilege, xrefs: 2BB7777E

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 2349140579-2896544425
Opcode ID: 4006fb3ef4e6780e1683c783660d522fb307d974e8c9bf61affb4a6d63d49a6c
Instruction ID: b8098995a39704b3f3f9da4f938b9fedb6728a0bd96cf35dcb13472c2894f7bb
Opcode Fuzzy Hash: 4006fb3ef4e6780e1683c783660d522fb307d974e8c9bf61affb4a6d63d49a6c
Instruction Fuzzy Hash: 67112171E40208AFEF04DFE5C95ABBEB7B4EF48704F108159E515EB280EA79A505CFA4

Function 0040B0F4 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0040DEDB
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040DEF0
UnhandledExceptionFilter.KERNEL32(00414C00), ref: 0040DEFB
GetCurrentProcess.KERNEL32(C0000409), ref: 0040DF17
TerminateProcess.KERNEL32(00000000), ref: 0040DF1E

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: d0e1f950edf4ed278f5f8edace879d18db5c6e46267b331238cc6a75c8ede6b7
Instruction ID: 06bb30416bcc9847ef42a2021308f0f4a450963795408ccd5fab91c3b6be5211
Opcode Fuzzy Hash: d0e1f950edf4ed278f5f8edace879d18db5c6e46267b331238cc6a75c8ede6b7
Instruction Fuzzy Hash: 9921CDF49232009FC701DF69FC496D43BB4BB48315F12C83AE5099B2A2E7B459E58B4E

Function 2BB7F00A Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 2BB8131C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 2BB81331
UnhandledExceptionFilter.KERNEL32(2BB925B8), ref: 2BB8133C
GetCurrentProcess.KERNEL32(C0000409), ref: 2BB81358
TerminateProcess.KERNEL32(00000000), ref: 2BB8135F

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 5030673df63b51400435a474c2c3ee07c6769c89cf32b13af2ca2c50e2eb1a06
Instruction ID: 1849be765d2b90f9ff7c3a449a3ece467d1af9ac040882f5993c0012cff21afb
Opcode Fuzzy Hash: 5030673df63b51400435a474c2c3ee07c6769c89cf32b13af2ca2c50e2eb1a06
Instruction Fuzzy Hash: CF21C0B9805A04DFC740DF28D6486683BB4BF18321F10841AE92897390EBBAE992CF55

Function 2D4D779B Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 2D4D8704
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 2D4D8719
UnhandledExceptionFilter.KERNEL32(2D5023A0), ref: 2D4D8724
GetCurrentProcess.KERNEL32(C0000409), ref: 2D4D8740
TerminateProcess.KERNEL32(00000000), ref: 2D4D8747

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: c884b3f69300345673882532e0de218d28fe5ba8718b9bc50bb44461b906ef2f
Instruction ID: 5d9f42d7809382bdd3c38e988c353a8dfe677b68ef64095d5ecd5af5d2fc5a0d
Opcode Fuzzy Hash: c884b3f69300345673882532e0de218d28fe5ba8718b9bc50bb44461b906ef2f
Instruction Fuzzy Hash: 8821BCB58003449BDB41DFA4D98DB543BF0FB08B05F14842AE5689A340EBF95A89CF8E

Function 2B9F689F Relevance: 4.9, APIs: 3, Instructions: 410COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 2B9F6ADD
std::_Xinvalid_argument.LIBCPMT ref: 2B9F6B86

Memory Dump Source

Source File: 00000000.00000002.4113322478.000000002B9F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 2B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b9f0000_L8RabfF1Hu.jbxd

Similarity

API ID: Xinvalid_argumentstd::_swprintf
String ID:
API String ID: 2109912724-0
Opcode ID: fb3159d5d0cc833ea859812a30b47ed7f5190ad94b9111cceee841ddcb571069
Instruction ID: d70c288d4fd18a886489d1c802a130b5b722064805f012218019090e7cc04fe3
Opcode Fuzzy Hash: fb3159d5d0cc833ea859812a30b47ed7f5190ad94b9111cceee841ddcb571069
Instruction Fuzzy Hash: C8E16371E012259FDF24CF64CC81BEEB3B9EB85714F1446E9D94AE7285D630AE81CB90

Function 00D75AD0 Relevance: 4.1, Strings: 3, Instructions: 310COMMON

Download Yara Rule

Strings

suspendG from non-preemptible goroutinetraceback: unexpected SPWRITE function transport endpoint is already connected13877787807814456755295395851135253906256938893903907228377647697925567626953125MapIter.Key called on exhausted iteratoraddress family not supp, xrefs: 00D75F63
', xrefs: 00D75F6C
invalid g statusmSpanList.insertmSpanList.removemessage too longmissing stackmapno colon on lineno route to hostnon-Go functionnon-IPv4 addressnon-IPv6 addressobject is remotereflect mismatchremote I/O errorruntime: addr = runtime: base = runtime: head = runt, xrefs: 00D75F4D

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: '$invalid g statusmSpanList.insertmSpanList.removemessage too longmissing stackmapno colon on lineno route to hostnon-Go functionnon-IPv4 addressnon-IPv6 addressobject is remotereflect mismatchremote I/O errorruntime: addr = runtime: base = runtime: head = runt$suspendG from non-preemptible goroutinetraceback: unexpected SPWRITE function transport endpoint is already connected13877787807814456755295395851135253906256938893903907228377647697925567626953125MapIter.Key called on exhausted iteratoraddress family not supp
API String ID: 0-690613325
Opcode ID: 7913c1658ffa2786c1bf2a45dde0eded83068ea47e4119f8d579e8060114f910
Instruction ID: 0d417662a1a1612b5da398f2941af0a86d35c956264ca8f6b188541ddecb4e86
Opcode Fuzzy Hash: 7913c1658ffa2786c1bf2a45dde0eded83068ea47e4119f8d579e8060114f910
Instruction Fuzzy Hash: ACD110741087818FC314DF25D090A2ABBE1BF89304F58886DF8D98B396E7B5E945DB63

Function 2B9F00CD Relevance: 2.6, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

ntdl, xrefs: 2B9F0185
l, xrefs: 2B9F018C

Memory Dump Source

Source File: 00000000.00000002.4113322478.000000002B9F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 2B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b9f0000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: l$ntdl
API String ID: 0-924918826
Opcode ID: c362b51c53e3eeabca090c6237b61e6bcf708d1a3817c6eecd03a2daff8ddda5
Instruction ID: 5b614a9d999daa405990150b5306af711c55500ff39fc229f692c61b82e1ff12
Opcode Fuzzy Hash: c362b51c53e3eeabca090c6237b61e6bcf708d1a3817c6eecd03a2daff8ddda5
Instruction Fuzzy Hash: A921D271B005209FCF198F1484A562F7BEAEF667207158199E5099F354EB34CD12C7D1

Function 2BB724B0 Relevance: 1.7, Strings: 1, Instructions: 479COMMON

Download Yara Rule

Strings

[RO] %ld bytes, xrefs: 2BB72537, 2BB7264A, 2BB726D0, 2BB7292C, 2BB729EF

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: [RO] %ld bytes
API String ID: 0-772938740
Opcode ID: 3a5f2d2a8747718b589b3b590bf194bd0f4ae2a0a5a29300363545aadaf1d4c7
Instruction ID: 506e189678c39aec4eeb8aa67cd8759243d5f8032183147f15008c9011119648
Opcode Fuzzy Hash: 3a5f2d2a8747718b589b3b590bf194bd0f4ae2a0a5a29300363545aadaf1d4c7
Instruction Fuzzy Hash: 1C2225B5E00B058FCB24DF69C580A9ABBF1FF49300F208A6DD9AA97755D730E981DB50

Function 2D4D24B0 Relevance: 1.7, Strings: 1, Instructions: 479COMMON

Download Yara Rule

Strings

[RO] %ld bytes, xrefs: 2D4D2537, 2D4D264A, 2D4D26D0, 2D4D292C, 2D4D29EF

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: [RO] %ld bytes
API String ID: 0-772938740
Opcode ID: f0453b12f574379557ac381a239bccc4debb73425ab3aa29adde4f7cdf5fdd19
Instruction ID: ffc4b2236d6dd793be1872e4c5b6949edf128239312271857c73b75ba65948d2
Opcode Fuzzy Hash: f0453b12f574379557ac381a239bccc4debb73425ab3aa29adde4f7cdf5fdd19
Instruction Fuzzy Hash: 25222771A00B059FCB64CF69C5D0AAABBF1FF48300F248A6DD99AA7755D330E941CB50

Function 00D51410 Relevance: 1.6, Strings: 1, Instructions: 396COMMON

Download Yara Rule

Strings

, xrefs: 00D51825

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 15e82c27a7ecce3b989fbbba3bab31a70aa5c5411114e3ecace9a10068ae6cb4
Instruction ID: caf918c592ae5c33d53a40cb05b477d5f7de9f884b9bf872faa75943d3d17e37
Opcode Fuzzy Hash: 15e82c27a7ecce3b989fbbba3bab31a70aa5c5411114e3ecace9a10068ae6cb4
Instruction Fuzzy Hash: A10277B8A087458FC714DF19C18061AFBE1BFC8750F14892EE9E997321D770E9498FA2

Function 2BB7B43F Relevance: 1.5, APIs: 1, Instructions: 13shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 2BB77B70: GetCurrentProcess.KERNEL32(00000028,?), ref: 2BB77B89
Part of subcall function 2BB77B70: OpenProcessToken.ADVAPI32(00000000), ref: 2BB77B90
Part of subcall function 2BB77B70: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 2BB77BB6
Part of subcall function 2BB77B70: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 2BB77BCC
Part of subcall function 2BB77B70: GetLastError.KERNEL32 ref: 2BB77BD2
Part of subcall function 2BB77B70: CloseHandle.KERNEL32(?), ref: 2BB77BE0

ExitWindowsEx.USER32(00000006,00000000), ref: 2BB7B44D

Part of subcall function 2BB77B70: CloseHandle.KERNEL32(?), ref: 2BB77BFB

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 68c9042b59ce2c6c323761c4d73375a0541b166825f5a76afbd62578136c322f
Instruction ID: 5ac8c9bf391bd6585b127ef4186ddc7e6ebe1139d825ce70a557c3f31100f5c8
Opcode Fuzzy Hash: 68c9042b59ce2c6c323761c4d73375a0541b166825f5a76afbd62578136c322f
Instruction Fuzzy Hash: F3C08C3374010006D614B2B66C33B6EF350DBB8322F00402BA60A885C00C5784A151E6

Function 2BB7B41B Relevance: 1.5, APIs: 1, Instructions: 13shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 2BB77B70: GetCurrentProcess.KERNEL32(00000028,?), ref: 2BB77B89
Part of subcall function 2BB77B70: OpenProcessToken.ADVAPI32(00000000), ref: 2BB77B90
Part of subcall function 2BB77B70: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 2BB77BB6
Part of subcall function 2BB77B70: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 2BB77BCC
Part of subcall function 2BB77B70: GetLastError.KERNEL32 ref: 2BB77BD2
Part of subcall function 2BB77B70: CloseHandle.KERNEL32(?), ref: 2BB77BE0

ExitWindowsEx.USER32(00000004,00000000), ref: 2BB7B429

Part of subcall function 2BB77B70: CloseHandle.KERNEL32(?), ref: 2BB77BFB

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 9046495f396de100a5890cf4dc337fb1b203396d3e040396abf6e83d878194bb
Instruction ID: 01a6d9d3131e6a738dbd54d8145d3cfbb6c1212e3f18944c2d981e962fedf58b
Opcode Fuzzy Hash: 9046495f396de100a5890cf4dc337fb1b203396d3e040396abf6e83d878194bb
Instruction Fuzzy Hash: 12C08C337401000AD614B3B66C33B6DF350DBB8322F00402BA70A885C00C67849111EA

Function 2BB7B463 Relevance: 1.5, APIs: 1, Instructions: 13shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 2BB77B70: GetCurrentProcess.KERNEL32(00000028,?), ref: 2BB77B89
Part of subcall function 2BB77B70: OpenProcessToken.ADVAPI32(00000000), ref: 2BB77B90
Part of subcall function 2BB77B70: LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 2BB77BB6
Part of subcall function 2BB77B70: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 2BB77BCC
Part of subcall function 2BB77B70: GetLastError.KERNEL32 ref: 2BB77BD2
Part of subcall function 2BB77B70: CloseHandle.KERNEL32(?), ref: 2BB77BE0

ExitWindowsEx.USER32(00000005,00000000), ref: 2BB7B471

Part of subcall function 2BB77B70: CloseHandle.KERNEL32(?), ref: 2BB77BFB

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 04be5329901ba126172daf72eac40f8c5797078e096241a15aa0efefc000d0d2
Instruction ID: ab0a73a0e554f3ad29d3c75d3c5b9e564f548714d5d66a05f954a25ffb7475ac
Opcode Fuzzy Hash: 04be5329901ba126172daf72eac40f8c5797078e096241a15aa0efefc000d0d2
Instruction Fuzzy Hash: FBC08C3374010006D614B2B66C33B6EF350DBB8322F00402BA71A885C00C57849115E6

Function 0040987E Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000983C), ref: 00409883

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 07425c5153b102eb0bc711422236a92fdef65f66ac02a027fff0b8e477737e9d
Instruction ID: 91fe642d37f71acd704457940fe6a1473e9393596c2fe3059928da1c88275b78
Opcode Fuzzy Hash: 07425c5153b102eb0bc711422236a92fdef65f66ac02a027fff0b8e477737e9d
Instruction Fuzzy Hash: 229002A12611006ACA002B706C095453ED05A4D713F51D471A489E4199DA6446449519

Function 00D4F530 Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

concurrent map writesdefer on system stackfindrunnable: wrong pkey is not comparablelink has been severedlocalhost.localdomainnegative shift amountpackage not installedpanic on system stackpreempt at unknown pcread-only file systemreflect.Value.Complexreflect., xrefs: 00D4F568, 00D4F63C

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: concurrent map writesdefer on system stackfindrunnable: wrong pkey is not comparablelink has been severedlocalhost.localdomainnegative shift amountpackage not installedpanic on system stackpreempt at unknown pcread-only file systemreflect.Value.Complexreflect.
API String ID: 0-1363300655
Opcode ID: 3355a7cf26026fd03e9a8b0be5bac948633c9606d0cff7bcc839108be9d3b3b8
Instruction ID: 0a312b0306664ea2b4414beb31b4a875b15a7c3dc9637ee8f75b3880ff5dce40
Opcode Fuzzy Hash: 3355a7cf26026fd03e9a8b0be5bac948633c9606d0cff7bcc839108be9d3b3b8
Instruction Fuzzy Hash: 07A19B746083458FC754DF28C18062ABBE2BF89704F69897DE9C94B362E735EC45CB62

Function 2D501C87 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 2D501C87

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 635b3d5e99276f20d92e16cc7e29cbf2fb0a43c058143c1f49ee4f19385415a1
Instruction ID: cd18b57fccc38c48660fec6216683e4333470d7dd2be57241e5dce5f605e24fa
Opcode Fuzzy Hash: 635b3d5e99276f20d92e16cc7e29cbf2fb0a43c058143c1f49ee4f19385415a1
Instruction Fuzzy Hash: BDC04C710055419EDF88CFE8A59DB263AB0B32CE43F284549F51995781CBF81058875A

Function 2B9F82BF Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113322478.000000002B9F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 2B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b9f0000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfce4a1a5e8fd92abbba4c6a44f6adf7b218211a2e35efd4732c1bdd9f67e9cb
Instruction ID: 7216a7dbe7bc3fd900cfbb77d5aa37b3db2313213fbc527f9e5a90e8c15b897a
Opcode Fuzzy Hash: dfce4a1a5e8fd92abbba4c6a44f6adf7b218211a2e35efd4732c1bdd9f67e9cb
Instruction Fuzzy Hash: B2226277E5151A8BDB08CA99CC515D9B3E3BBD8314B1F9129C819E3305EE78BA478BC0

Function 2BB78900 Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937e1f3a1d14cd005c09e73a9772b0bf7c6123677b8ea21a104c91ac6da37d46
Instruction ID: 67dc2fbf1eba58201ee0d21c84e1982a6b0f19633875cce7eddcadf8bc8da091
Opcode Fuzzy Hash: 937e1f3a1d14cd005c09e73a9772b0bf7c6123677b8ea21a104c91ac6da37d46
Instruction Fuzzy Hash: 28226177E5151A8BDB08CA95CC515D9B3E3BBC8314B1F9129C819E3305EE78BA478BC0

Function 2B9F1E6F Relevance: .5, Instructions: 479COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4113322478.000000002B9F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 2B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b9f0000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0310cf5ebc2e2a90283327764d4546fd3d9aec9e33a65a2a1938e8938fd551d8
Instruction ID: dd1d479fa398eb16fa7658f5b8bd10e1c87c0cae433ce0598ed0505dd7fa3e94
Opcode Fuzzy Hash: 0310cf5ebc2e2a90283327764d4546fd3d9aec9e33a65a2a1938e8938fd551d8
Instruction Fuzzy Hash: 892218B0A00B058FDB24CF69C580B9ABBF5FF48314F20866DE99A97755D770E981CB90

Function 00D57F40 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be14eff64e826573153a950e7c9927df9da857d38ec5b669289a6e1c0c13462
Instruction ID: fbc30243834388ebccdf4b25b30ac681fe805ff0c0a2d2798e0975366027fbff
Opcode Fuzzy Hash: 7be14eff64e826573153a950e7c9927df9da857d38ec5b669289a6e1c0c13462
Instruction Fuzzy Hash: 68D19372A083258FC714DE5DC88070EFBE2ABC4344F49863DE9549B3A5EB75AC098BD5

Function 2D4EE344 Relevance: .4, Instructions: 360COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad150f52dfff435c631f7698172e33577d1788e5e1d774a4e58ff19d60af518
Instruction ID: 4f7028b4c5e8642772d21dbc7bba755c09ec939b8d314bb6df2ce7458b7ab1f6
Opcode Fuzzy Hash: dad150f52dfff435c631f7698172e33577d1788e5e1d774a4e58ff19d60af518
Instruction Fuzzy Hash: F0E1F271A442188BDB1CCF18C8E47BDB7A2AF94311F2483EDC55A6B693DA355E86CF10

Function 2D4EE5E7 Relevance: .4, Instructions: 354COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5433ccbb50938275326fa824b254592c69e7aadd79705a1b43388e379dd3ca
Instruction ID: 9acd61dcc080185e701eec9749fc80ca9f71faf03d3123d67060429db1ad3cf4
Opcode Fuzzy Hash: 6e5433ccbb50938275326fa824b254592c69e7aadd79705a1b43388e379dd3ca
Instruction Fuzzy Hash: ADE1F271A403188BDB1CCF18C8E87BDB7A2AF95310F2483EDC55A6B693DA355E85CB10

Function 2D4EE887 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b335276c2c97ad50e2502abbb24c3fc49d3b67aa3f3467f1de1254d1da84d0b
Instruction ID: 050fe0f8c51506a15fa456af3e9d97f9ab361b382d8859cdac0aa1aa3d5183ea
Opcode Fuzzy Hash: 7b335276c2c97ad50e2502abbb24c3fc49d3b67aa3f3467f1de1254d1da84d0b
Instruction Fuzzy Hash: 99D1F271A443188BDB1CCF18C8E87BDB7A2AF95310F2483EDC55A6B693CA355E85CB10

Function 2D4EEB27 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c08006b3ef8b1f3cfd11d5826e371c076e630d4ea3f0d1fb0a5d9e3e698fbe0
Instruction ID: 8a2920a3961c5fa30f2bc4569998b2e43b3ee7ba839dc46194d406ada50f2b25
Opcode Fuzzy Hash: 3c08006b3ef8b1f3cfd11d5826e371c076e630d4ea3f0d1fb0a5d9e3e698fbe0
Instruction Fuzzy Hash: 75D1E271A442188BDB1DCF18C8E87BDB7A2AF95310F2483EDC55A6B693CA355E85CF10

Function 2D4EEDC7 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53a881f569a9bf5092afa20699a9cb77b32332f2209e0a91d550f248025ad5f3
Instruction ID: d111ff81dd849ac93dc7377e749f891e97203a2644e70f39ebf58ab5d3a465ee
Opcode Fuzzy Hash: 53a881f569a9bf5092afa20699a9cb77b32332f2209e0a91d550f248025ad5f3
Instruction Fuzzy Hash: 8ED1F371A443188BDB1CCF18C8E87BDB7A2AF95310F2483EDC55A6B693CA355E85CB10

Function 2D4EF067 Relevance: .3, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f5c91af71f35be8fc9b546707dacdb5b8244c1090e13a56d87e7be6714bd70f
Instruction ID: c74e6e36918268db8a8cd13978e2c7cb113f7d07a12790c74dc5fd416b267c93
Opcode Fuzzy Hash: 6f5c91af71f35be8fc9b546707dacdb5b8244c1090e13a56d87e7be6714bd70f
Instruction Fuzzy Hash: 0DD1E471A443148BDB1DCF18C8E87BDB7A2AF95310F2483EDC55A6B693CA355E85CB10

Function 2D4EF307 Relevance: .3, Instructions: 324COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59e35e333437525381bb46715f1b9e270685dbbc4b384d96d2c92412b216ab62
Instruction ID: 29768853f687f32dbde646b5f4e5fd0a4f0ee11d36b2c8fb638ea0d6c09bacb2
Opcode Fuzzy Hash: 59e35e333437525381bb46715f1b9e270685dbbc4b384d96d2c92412b216ab62
Instruction Fuzzy Hash: F5D1F471A443148BDB1DCF18C8E87BDB7A2AF95310F2483EDC55A6B6A3CA355E85CB10

Function 2D4EF5A7 Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19642c8e1a6fc36b02490547e501a7d4419c58037f699ba0f95d94edfbb9db19
Instruction ID: 34d04781f1f360c317b5e4a23578a3c5d56a7a744012dc06ebc2ebd1e24f2f0f
Opcode Fuzzy Hash: 19642c8e1a6fc36b02490547e501a7d4419c58037f699ba0f95d94edfbb9db19
Instruction Fuzzy Hash: A5C1F431A443148BCB1DCF28C8E87ADB7A2AF95310F2483EDC55A677A3CA355E85CB10

Function 2D4F3200 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48d86adb91c4c434518ee51852f6445a91e3ee15b204d830e22b1a8c08173404
Instruction ID: 02e5170f0d2586f966664acfc2df5078dd6b0ec555bc7e1e7c8067649726e2db
Opcode Fuzzy Hash: 48d86adb91c4c434518ee51852f6445a91e3ee15b204d830e22b1a8c08173404
Instruction Fuzzy Hash: 30D16A70A056248FDB25CF18C894BAAB7B6FF84304F1085EDD54AAB351DB34AA85CF91

Function 2D4EF847 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae83c06ddc9c511b14df4beb39c7435168581cbf04634d784f50b4e8f1fefc0a
Instruction ID: 64d8238ebb5634a0a6400fa9352984edbff065afde16f61d2f5bb07164cfceb6
Opcode Fuzzy Hash: ae83c06ddc9c511b14df4beb39c7435168581cbf04634d784f50b4e8f1fefc0a
Instruction Fuzzy Hash: 86C1F531A447158FDB1DCF18C8E47ADB7A2AF95310F2483EDC55AAB7A2CA345E85CB10

Function 2D4EFAE7 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d1ea1deb8e79db0a60a79f8689c00567526d288d93d54b9dab65f3662037e1
Instruction ID: 697f1d171c644c4aa1eb2e70dd64a53a519c89cb19ddfe13cb6c362d8c6cea16
Opcode Fuzzy Hash: 45d1ea1deb8e79db0a60a79f8689c00567526d288d93d54b9dab65f3662037e1
Instruction Fuzzy Hash: 62C1D531A447158FCB1DCF28C8E47A9B7A2AF95310F2483EDC55AA77A3CA355E85CB10

Function 2D4EFD87 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f94c3f9ff2bdf462f6a5e41ebbffcf2a4b3b7432899dcf31fc044f1dd384bf98
Instruction ID: 7b39b5f0d1f8668bb76c4ec2650d3a747f00c9e92787de7626776e1add69edcc
Opcode Fuzzy Hash: f94c3f9ff2bdf462f6a5e41ebbffcf2a4b3b7432899dcf31fc044f1dd384bf98
Instruction Fuzzy Hash: BBC1C531A447158FC71DCF2CC8E87A9B7A2AF95210F2583EDC15AA77A2CA355D85CB10

Function 2D4FDCC0 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e9e1d52e6e21ffe421f188024286398b1298f6f6921db61a57995abc5cb32e5
Instruction ID: 3e898e1905063db4ac7efff2656630898d01943cb69ddfec5745c6cbb69e6512
Opcode Fuzzy Hash: 3e9e1d52e6e21ffe421f188024286398b1298f6f6921db61a57995abc5cb32e5
Instruction Fuzzy Hash: 7061B1766915D34BE710CEECDCC87263772E7C9701F198930CB008B746C6BDE6669A88

Function 00D4B520 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b843b8d531be860a5065eb410d1795d7ad2b3ba6c76ea8bcc7a3357eea888e
Instruction ID: ff794d558f22fefd191c93b62050f891f344cf2bdd263cff2053e5f921bf3e0f
Opcode Fuzzy Hash: d4b843b8d531be860a5065eb410d1795d7ad2b3ba6c76ea8bcc7a3357eea888e
Instruction Fuzzy Hash: 3741D571918B444BC306DF78C49131AB7E1FFD6394F148B2EE84AAB692EB35C8828751

Function 00D50ED0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eefa371c63b9f828661bf1ea3bfb3734247a9cb566d72026a423d47f4e5169fa
Instruction ID: 9f9f5e52599e26b1ee8cbf6da91d7539878e07a62c00a778ffd032eea6986758
Opcode Fuzzy Hash: eefa371c63b9f828661bf1ea3bfb3734247a9cb566d72026a423d47f4e5169fa
Instruction Fuzzy Hash: BC316073D197199BD300AE49C840209F7E2ABD0770F5EC65DDD9817312EA70AE55CBC6

Function 00D47EC0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90dbb5bb8bfb48ffe23f2d86b7e9e895357b62b386dbb44fa7dcda7827820158
Instruction ID: 704e017a606b2134132215eac22c7e6c715b72c0a67548b154455660e3fef898
Opcode Fuzzy Hash: 90dbb5bb8bfb48ffe23f2d86b7e9e895357b62b386dbb44fa7dcda7827820158
Instruction Fuzzy Hash: 5D2192717082068BC708CF3DC8E112AF7E2AFC8310F69857DD456C76A1EB35E80AC665

Function 00D8DB90 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14be1f166bd83356cbe90e56ac357f68549d5b2ef92423b7a658de37d57859fe
Instruction ID: 412d1e75451e1611f66100097138a5f959fc1d3c56c3f4e4f4ec9c285e9db626
Opcode Fuzzy Hash: 14be1f166bd83356cbe90e56ac357f68549d5b2ef92423b7a658de37d57859fe
Instruction Fuzzy Hash: C80128746043048FD31CEF99C5D5B6573E2FB88300F8585BDDA0E8BBA7EA706816DA90

Function 00DA1960 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af53735252ec1253206960035aaf19d61b52af53b65fbddad5c1b045fd608c51
Instruction ID: b832fd61b0744b05700de0dda102bda92647e90e2e693cb41364d4fa74e0b250
Opcode Fuzzy Hash: af53735252ec1253206960035aaf19d61b52af53b65fbddad5c1b045fd608c51
Instruction Fuzzy Hash: 44E0B6B04183459BC310EF0CC88114ABBE1BB88230F418B5DA8B8473A1E33095088B93

Function 2D4E9559 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5bb76dc5603594ebadbb9d06c1009663e0f1c927494714133e67cafadce578
Instruction ID: 1ded41cf2cbf84ccf3bf197a8fe86faa2fc8ed660aa0432fe637abb90d826113
Opcode Fuzzy Hash: 4a5bb76dc5603594ebadbb9d06c1009663e0f1c927494714133e67cafadce578
Instruction Fuzzy Hash: DFA012310891605BCB224734C2D00107A20AF4220030A04E984050FC1781100010D712

Function 2BB7B556 Relevance: 43.9, APIs: 8, Strings: 17, Instructions: 161registrysleepCOMMON

Download Yara Rule

APIs

Part of subcall function 2BB7F707: _malloc.LIBCMT ref: 2BB7F721

RegOpenKeyExW.ADVAPI32(80000001,Console,00000000,00000002,?), ref: 2BB7B586
RegDeleteValueW.ADVAPI32(?,IpDate), ref: 2BB7B596
RegSetValueExW.ADVAPI32(?,IpDate,00000000,00000003,00000002,?), ref: 2BB7B5B3
_memset.LIBCMT ref: 2BB7B5D4
RegCloseKey.ADVAPI32(?), ref: 2BB7B61B
_memset.LIBCMT ref: 2BB7B63C
RegCloseKey.ADVAPI32(?), ref: 2BB7B72C
Sleep.KERNEL32(000007D0), ref: 2BB7B737

Part of subcall function 2BB7F707: std::exception::exception.LIBCMT ref: 2BB7F756
Part of subcall function 2BB7F707: std::exception::exception.LIBCMT ref: 2BB7F770
Part of subcall function 2BB7F707: __CxxThrowException@8.LIBCMT ref: 2BB7F781

Strings

o1:, xrefs: 2BB7B695
154.201.87.51, xrefs: 2BB7B6B4
154.201.87.51, xrefs: 2BB7B6ED
154.201.87.51, xrefs: 2BB7B67E
11111, xrefs: 2BB7B690
p2:, xrefs: 2BB7B6B9
t1:, xrefs: 2BB7B6A7
Console, xrefs: 2BB7B57C
p1:, xrefs: 2BB7B683
p3:, xrefs: 2BB7B6F2
IpDate, xrefs: 2BB7B590, 2BB7B5AD
o2:, xrefs: 2BB7B6CE
t3:, xrefs: 2BB7B719
t2:, xrefs: 2BB7B6E0
o3:, xrefs: 2BB7B704
6666, xrefs: 2BB7B6C9
9999, xrefs: 2BB7B6FF

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CloseValue_memsetstd::exception::exception$DeleteException@8OpenSleepThrow_malloc
String ID: 11111$154.201.87.51$154.201.87.51$154.201.87.51$6666$9999$Console$IpDate$o1:$o2:$o3:$p1:$p2:$p3:$t1:$t2:$t3:
API String ID: 1186799303-1572082970
Opcode ID: 4cc22092681921551fb54f4aec98a44c5996bff79c691b60e818511c52eb7bef
Instruction ID: 6e1a5c2097045d3e08299a00a82076297cfd24b79e529246a6f046cb6fe6a878
Opcode Fuzzy Hash: 4cc22092681921551fb54f4aec98a44c5996bff79c691b60e818511c52eb7bef
Instruction Fuzzy Hash: 4941CA76A80700BBFF11EB50ACC6F6A73649F69710F104034FA147E286DE65F5158AFA

Function 0040908A Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,004061FA,00415AD0,00000014), ref: 00409092
__mtterm.LIBCMT ref: 0040909E

Part of subcall function 00408D69: DecodePointer.KERNEL32(00000005,00409200,?,004061FA,00415AD0,00000014), ref: 00408D7A
Part of subcall function 00408D69: TlsFree.KERNEL32(00000005,00409200,?,004061FA,00415AD0,00000014), ref: 00408D94
Part of subcall function 00408D69: DeleteCriticalSection.KERNEL32(00000000,00000000,76EF5810,?,00409200,?,004061FA,00415AD0,00000014), ref: 0040A933
Part of subcall function 00408D69: _free.LIBCMT ref: 0040A936
Part of subcall function 00408D69: DeleteCriticalSection.KERNEL32(00000005,76EF5810,?,00409200,?,004061FA,00415AD0,00000014), ref: 0040A95D

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004090B4
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004090C1
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 004090CE
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004090DB
TlsAlloc.KERNEL32(?,004061FA,00415AD0,00000014), ref: 0040912B
TlsSetValue.KERNEL32(00000000,?,004061FA,00415AD0,00000014), ref: 00409146
__init_pointers.LIBCMT ref: 00409150
EncodePointer.KERNEL32(?,004061FA,00415AD0,00000014), ref: 00409161
EncodePointer.KERNEL32(?,004061FA,00415AD0,00000014), ref: 0040916E
EncodePointer.KERNEL32(?,004061FA,00415AD0,00000014), ref: 0040917B
EncodePointer.KERNEL32(?,004061FA,00415AD0,00000014), ref: 00409188
DecodePointer.KERNEL32(Function_00008EED,?,004061FA,00415AD0,00000014), ref: 004091A9
__calloc_crt.LIBCMT ref: 004091BE
DecodePointer.KERNEL32(00000000,?,004061FA,00415AD0,00000014), ref: 004091D8
GetCurrentThreadId.KERNEL32 ref: 004091EA

Strings

KERNEL32.DLL, xrefs: 0040908D
FlsFree, xrefs: 004090D0
FlsAlloc, xrefs: 004090AE
FlsSetValue, xrefs: 004090C3
FlsGetValue, xrefs: 004090B6

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 67b52c673a3a92e3a096272174beb86fe92c2ec430036a8f912fcdcd133de471
Instruction ID: c29653147e58baa9bdebf92250cc1a6c90466a972f30246631034e9b544f59de
Opcode Fuzzy Hash: 67b52c673a3a92e3a096272174beb86fe92c2ec430036a8f912fcdcd133de471
Instruction Fuzzy Hash: 1431FD30A45311BADB21AF75ED0C6963FA5EB94320710853BE414A32F2DBBD8861DF5E

Function 2BB84014 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,2BB80FC1,2BB96278,00000008,2BB81155,?,?,?,2BB96298,0000000C,2BB81210,?), ref: 2BB8401C
__mtterm.LIBCMT ref: 2BB84028

Part of subcall function 2BB83CF1: DecodePointer.KERNEL32(00000006,2BB81084,2BB8106A,2BB96278,00000008,2BB81155,?,?,?,2BB96298,0000000C,2BB81210,?), ref: 2BB83D02
Part of subcall function 2BB83CF1: TlsFree.KERNEL32(00000013,2BB81084,2BB8106A,2BB96278,00000008,2BB81155,?,?,?,2BB96298,0000000C,2BB81210,?), ref: 2BB83D1C
Part of subcall function 2BB83CF1: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,2BB81084,2BB8106A,2BB96278,00000008,2BB81155,?,?,?,2BB96298,0000000C,2BB81210,?), ref: 2BB88D48
Part of subcall function 2BB83CF1: _free.LIBCMT ref: 2BB88D4B
Part of subcall function 2BB83CF1: DeleteCriticalSection.KERNEL32(00000013,?,?,2BB81084,2BB8106A,2BB96278,00000008,2BB81155,?,?,?,2BB96298,0000000C,2BB81210,?), ref: 2BB88D72

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 2BB8403E
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 2BB8404B
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 2BB84058
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 2BB84065
TlsAlloc.KERNEL32(?,?,2BB80FC1,2BB96278,00000008,2BB81155,?,?,?,2BB96298,0000000C,2BB81210,?), ref: 2BB840B5
TlsSetValue.KERNEL32(00000000,?,?,2BB80FC1,2BB96278,00000008,2BB81155,?,?,?,2BB96298,0000000C,2BB81210,?), ref: 2BB840D0
__init_pointers.LIBCMT ref: 2BB840DA
EncodePointer.KERNEL32(?,?,2BB80FC1,2BB96278,00000008,2BB81155,?,?,?,2BB96298,0000000C,2BB81210,?), ref: 2BB840EB
EncodePointer.KERNEL32(?,?,2BB80FC1,2BB96278,00000008,2BB81155,?,?,?,2BB96298,0000000C,2BB81210,?), ref: 2BB840F8
EncodePointer.KERNEL32(?,?,2BB80FC1,2BB96278,00000008,2BB81155,?,?,?,2BB96298,0000000C,2BB81210,?), ref: 2BB84105
EncodePointer.KERNEL32(?,?,2BB80FC1,2BB96278,00000008,2BB81155,?,?,?,2BB96298,0000000C,2BB81210,?), ref: 2BB84112
DecodePointer.KERNEL32(Function_00013E75,?,?,2BB80FC1,2BB96278,00000008,2BB81155,?,?,?,2BB96298,0000000C,2BB81210,?), ref: 2BB84133
__calloc_crt.LIBCMT ref: 2BB84148
DecodePointer.KERNEL32(00000000,?,?,2BB80FC1,2BB96278,00000008,2BB81155,?,?,?,2BB96298,0000000C,2BB81210,?), ref: 2BB84162
GetCurrentThreadId.KERNEL32 ref: 2BB84174

Strings

KERNEL32.DLL, xrefs: 2BB84017
FlsSetValue, xrefs: 2BB8404D
FlsGetValue, xrefs: 2BB84040
FlsAlloc, xrefs: 2BB84038
FlsFree, xrefs: 2BB8405A

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 3dff002c5e1cbfb0263b939789e3bc7829bdd7e1e8eee92827592b49309a0e3b
Instruction ID: e58668193496f90c624a043ee3e0b30c586e764e2fc1e8e9e4dcdf85fa0c103a
Opcode Fuzzy Hash: 3dff002c5e1cbfb0263b939789e3bc7829bdd7e1e8eee92827592b49309a0e3b
Instruction Fuzzy Hash: 24316131C05A10AEDF41EF75D98A53A3FA6EF5D3A0F40462AE950C32A0EB3AC045EF50

Function 2D4DA8DF Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,2D4D83A9,2D52AED0,00000008,2D4D853D,?,?,?,2D52AEF0,0000000C,2D4D85F8,?), ref: 2D4DA8E7
__mtterm.LIBCMT ref: 2D4DA8F3

Part of subcall function 2D4DA5BE: DecodePointer.KERNEL32(FFFFFFFF,2D4D846C,2D4D8452,2D52AED0,00000008,2D4D853D,?,?,?,2D52AEF0,0000000C,2D4D85F8,?), ref: 2D4DA5CF
Part of subcall function 2D4DA5BE: TlsFree.KERNEL32(FFFFFFFF,2D4D846C,2D4D8452,2D52AED0,00000008,2D4D853D,?,?,?,2D52AEF0,0000000C,2D4D85F8,?), ref: 2D4DA5E9
Part of subcall function 2D4DA5BE: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,2D4D846C,2D4D8452,2D52AED0,00000008,2D4D853D,?,?,?,2D52AEF0,0000000C,2D4D85F8,?), ref: 2D4DC0C4
Part of subcall function 2D4DA5BE: _free.LIBCMT ref: 2D4DC0C7
Part of subcall function 2D4DA5BE: DeleteCriticalSection.KERNEL32(FFFFFFFF,?,?,2D4D846C,2D4D8452,2D52AED0,00000008,2D4D853D,?,?,?,2D52AEF0,0000000C,2D4D85F8,?), ref: 2D4DC0EE

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 2D4DA909
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 2D4DA916
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 2D4DA923
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 2D4DA930
TlsAlloc.KERNEL32(?,?,2D4D83A9,2D52AED0,00000008,2D4D853D,?,?,?,2D52AEF0,0000000C,2D4D85F8,?), ref: 2D4DA980
TlsSetValue.KERNEL32(00000000,?,?,2D4D83A9,2D52AED0,00000008,2D4D853D,?,?,?,2D52AEF0,0000000C,2D4D85F8,?), ref: 2D4DA99B
__init_pointers.LIBCMT ref: 2D4DA9A5
EncodePointer.KERNEL32(?,?,2D4D83A9,2D52AED0,00000008,2D4D853D,?,?,?,2D52AEF0,0000000C,2D4D85F8,?), ref: 2D4DA9B6
EncodePointer.KERNEL32(?,?,2D4D83A9,2D52AED0,00000008,2D4D853D,?,?,?,2D52AEF0,0000000C,2D4D85F8,?), ref: 2D4DA9C3
EncodePointer.KERNEL32(?,?,2D4D83A9,2D52AED0,00000008,2D4D853D,?,?,?,2D52AEF0,0000000C,2D4D85F8,?), ref: 2D4DA9D0
EncodePointer.KERNEL32(?,?,2D4D83A9,2D52AED0,00000008,2D4D853D,?,?,?,2D52AEF0,0000000C,2D4D85F8,?), ref: 2D4DA9DD
DecodePointer.KERNEL32(Function_0000A742,?,?,2D4D83A9,2D52AED0,00000008,2D4D853D,?,?,?,2D52AEF0,0000000C,2D4D85F8,?), ref: 2D4DA9FE
__calloc_crt.LIBCMT ref: 2D4DAA13
DecodePointer.KERNEL32(00000000,?,?,2D4D83A9,2D52AED0,00000008,2D4D853D,?,?,?,2D52AEF0,0000000C,2D4D85F8,?), ref: 2D4DAA2D
GetCurrentThreadId.KERNEL32 ref: 2D4DAA3F

Strings

FlsAlloc, xrefs: 2D4DA903
FlsSetValue, xrefs: 2D4DA918
KERNEL32.DLL, xrefs: 2D4DA8E2
FlsGetValue, xrefs: 2D4DA90B
FlsFree, xrefs: 2D4DA925

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: 0ca7542555fdde9862414133a6226c2d5a55f46c3f86f7665e03620508ee5a62
Instruction ID: 93dc42bd69f5c2d968474d361766d3dd1cd26489b7a7b64fa1866347e32c927d
Opcode Fuzzy Hash: 0ca7542555fdde9862414133a6226c2d5a55f46c3f86f7665e03620508ee5a62
Instruction Fuzzy Hash: EF316C338082119BCF419BB69D5DB253AF4FB18E66B11451BE606E33E0DBB88449CE5C

Function 2BB7C3A0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 170stringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2BB7C3C2
_wcsrchr.LIBCMT ref: 2BB7C3CA
_memset.LIBCMT ref: 2BB7C401
_wcsrchr.LIBCMT ref: 2BB7C409
lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 2BB7C416
_memset.LIBCMT ref: 2BB7C484
wsprintfW.USER32 ref: 2BB7C49C
_memset.LIBCMT ref: 2BB7C4B0
_memset.LIBCMT ref: 2BB7C4CB
ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,00000002), ref: 2BB7C501
lstrcatW.KERNEL32(?,2BB9535C), ref: 2BB7C549
lstrcatW.KERNEL32(?,?), ref: 2BB7C553
_memset.LIBCMT ref: 2BB7C56A

Strings

"%1, xrefs: 2BB7C50D
D, xrefs: 2BB7C576
%s\shell\open\command, xrefs: 2BB7C496
WinSta0\Default, xrefs: 2BB7C582

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: _memset$_wcsrchrlstrcat$EnvironmentExpandStringslstrlenwsprintf
String ID: "%1$%s\shell\open\command$D$WinSta0\Default
API String ID: 3970221696-33419044
Opcode ID: 96088cdf040ff6ec6d6a618122d264739b588695148e037d0b55a22ef7cc0c15
Instruction ID: 6236914227b2ffdb7f8203f6608c0fd627339c8c624fb83dbbe46080981b5724
Opcode Fuzzy Hash: 96088cdf040ff6ec6d6a618122d264739b588695148e037d0b55a22ef7cc0c15
Instruction Fuzzy Hash: 9051FDB2D4031C6AEF24EB60CD46FEE7378DF28701F004199AB19A6080EB759B44DFA5

Function 2BB77C80 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 141libraryloaderfileCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wininet.dll), ref: 2BB77CC3
GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 2BB77CD7
FreeLibrary.KERNEL32(00000000), ref: 2BB77CF7
GetProcAddress.KERNEL32(00000000,InternetOpenUrlW), ref: 2BB77D16
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 2BB77D53
_memset.LIBCMT ref: 2BB77D7E
GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 2BB77D8C
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 2BB77DDB
CloseHandle.KERNEL32(?), ref: 2BB77DF9
Sleep.KERNEL32(00000001), ref: 2BB77E01
GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 2BB77E0D
FreeLibrary.KERNEL32(00000000), ref: 2BB77E28

Strings

wininet.dll, xrefs: 2BB77CA6
InternetReadFile, xrefs: 2BB77D86
InternetCloseHandle, xrefs: 2BB77E07
InternetOpenUrlW, xrefs: 2BB77D10
InternetOpenW, xrefs: 2BB77CD1
MSIE 6.0, xrefs: 2BB77CE1

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: AddressProc$Library$FileFree$CloseCreateHandleLoadSleepWrite_memset
String ID: InternetCloseHandle$InternetOpenUrlW$InternetOpenW$InternetReadFile$MSIE 6.0$wininet.dll
API String ID: 1463273941-1099148085
Opcode ID: 8d4a9d0cb4c036432bba2d7d2de8e91546c7e31eae97e07a0e834c9bcdbb0779
Instruction ID: b09de3e5b978847fc06d13b699849f158c572892a2484b5db30603d7e880ce71
Opcode Fuzzy Hash: 8d4a9d0cb4c036432bba2d7d2de8e91546c7e31eae97e07a0e834c9bcdbb0779
Instruction Fuzzy Hash: 87418272D41618ABDB20EF648D45FEA73F8FF48700F10C1A9E658A7180DE749A468FE4

Function 00404F98 Relevance: 31.6, APIs: 14, Strings: 4, Instructions: 103libraryCOMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00404FA1
LoadLibraryW.KERNEL32(DbgHelp.dll), ref: 00404FB9

Strings

%s-%04d%02d%02d-%02d%02d%02d.dmp, xrefs: 0040503D
MiniDumpWriteDump, xrefs: 00404FCF
!analyze -v, xrefs: 00405032
DbgHelp.dll, xrefs: 00404FB4

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: DebuggerLibraryLoadPresent
String ID: !analyze -v$%s-%04d%02d%02d-%02d%02d%02d.dmp$DbgHelp.dll$MiniDumpWriteDump
API String ID: 923341983-3774911088
Opcode ID: 6a97a3d66ee6b2bbab1f2fa5a6c2911387b1bc7ba010874e993df68107176572
Instruction ID: 599cbd91554087b52c969747f4e7e6c04cdf254549e98945fdcde29a701e75f7
Opcode Fuzzy Hash: 6a97a3d66ee6b2bbab1f2fa5a6c2911387b1bc7ba010874e993df68107176572
Instruction Fuzzy Hash: 8F315E75901214BBDB109FA5AC4DEFFBAFCEF4C712F104562FA05E2194D6388A408BA9

Function 2BB74530 Relevance: 27.2, APIs: 18, Instructions: 247threadnetworksleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 2BB7455A
timeGetTime.WINMM ref: 2BB7457B
GetCurrentThreadId.KERNEL32 ref: 2BB7459B
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 2BB745BD
SwitchToThread.KERNEL32 ref: 2BB745D7
SetEvent.KERNEL32(?), ref: 2BB74620
CloseHandle.KERNEL32(?), ref: 2BB74644
send.WS2_32(?,2BB949C0,00000010,00000000), ref: 2BB74668
SetEvent.KERNEL32(?), ref: 2BB74686
InterlockedExchange.KERNEL32(?,00000000), ref: 2BB74691
WSACloseEvent.WS2_32(?), ref: 2BB7469F
shutdown.WS2_32(?,00000001), ref: 2BB746B3
closesocket.WS2_32(?), ref: 2BB746BD
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000139F), ref: 2BB746F6
SetLastError.KERNEL32(000005B4), ref: 2BB7470A
GetCurrentThreadId.KERNEL32 ref: 2BB7472B
InterlockedExchange.KERNEL32(?,00000001), ref: 2BB74743

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: EventExchangeInterlockedThread$CloseCurrentErrorLast$CompareHandleSleepSwitchTimeclosesocketsendshutdowntime
String ID:
API String ID: 1692523546-0
Opcode ID: cb99db845c7a39821cbc7e60c5c40736be1c108465735bb6162588f4b8032563
Instruction ID: 6d3e671a0573e8cf89688f54c6c6610ac53ed297d9c73bf19de2157a4c727194
Opcode Fuzzy Hash: cb99db845c7a39821cbc7e60c5c40736be1c108465735bb6162588f4b8032563
Instruction Fuzzy Hash: A291BC72E00A12EFCB14EF24C984A6AB7B5FF48702F148519E526CB6A4C735F991DBD0

Function 2D4D4540 Relevance: 27.2, APIs: 18, Instructions: 247threadnetworksleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 2D4D456A
timeGetTime.WINMM ref: 2D4D458B
GetCurrentThreadId.KERNEL32 ref: 2D4D45AB
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 2D4D45CD
SwitchToThread.KERNEL32 ref: 2D4D45E7
SetEvent.KERNEL32(?), ref: 2D4D4630
CloseHandle.KERNEL32(?), ref: 2D4D4654
send.WS2_32(?,2D52A8F8,00000010,00000000), ref: 2D4D4678
SetEvent.KERNEL32(?), ref: 2D4D4696
InterlockedExchange.KERNEL32(?,00000000), ref: 2D4D46A1
WSACloseEvent.WS2_32(?), ref: 2D4D46AF
shutdown.WS2_32(?,00000001), ref: 2D4D46C3
closesocket.WS2_32(?), ref: 2D4D46CD
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000139F), ref: 2D4D4706
SetLastError.KERNEL32(000005B4), ref: 2D4D471A
GetCurrentThreadId.KERNEL32 ref: 2D4D473B
InterlockedExchange.KERNEL32(?,00000001), ref: 2D4D4753

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: EventExchangeInterlockedThread$CloseCurrentErrorLast$CompareHandleSleepSwitchTimeclosesocketsendshutdowntime
String ID:
API String ID: 1692523546-0
Opcode ID: d739fe5d60de8b7e3d1120a8b26a9f435faa9018e85da22ad382939d7ea1de2e
Instruction ID: 7169fbb6e026c399ace5f2da14ce143ae38da885d0c21784632158f389b968bc
Opcode Fuzzy Hash: d739fe5d60de8b7e3d1120a8b26a9f435faa9018e85da22ad382939d7ea1de2e
Instruction Fuzzy Hash: 9B91A172200712AFCB58CF64C8A4B6AB7B5FF48742F60C119E60AA7750D774E991CBD0

Function 2BB75CC0 Relevance: 24.7, APIs: 2, Strings: 12, Instructions: 164windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 2BB75CD3

Strings

Capsa, xrefs: 2BB75E37, 2BB75E5B
Wireshark, xrefs: 2BB75DB7
Fiddler, xrefs: 2BB75E0F
CurrPorts, xrefs: 2BB75D75
TCPEye, xrefs: 2BB75D49
Metascan, xrefs: 2BB75DA1
Process, xrefs: 2BB75E6D
Malwarebytes, xrefs: 2BB75D33
Port, xrefs: 2BB75D8B
TaskExplorer, xrefs: 2BB75D5F
ApateDNS, xrefs: 2BB75D1D
Sniff, xrefs: 2BB75E49

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: VisibleWindow
String ID: ApateDNS$Capsa$CurrPorts$Fiddler$Malwarebytes$Metascan$Port$Process$Sniff$TCPEye$TaskExplorer$Wireshark
API String ID: 1208467747-3439171801
Opcode ID: 2326006c37eab4ba4bbc6cad736e258e019e1b99bb23a103ed89fe9673fe004a
Instruction ID: ecd7250c6d45584010dc3d66d027e9293476608122377dbf944b80660e5a7a05
Opcode Fuzzy Hash: 2326006c37eab4ba4bbc6cad736e258e019e1b99bb23a103ed89fe9673fe004a
Instruction Fuzzy Hash: 68418B63D45E15AA9E51F531AD42F9F3168DF360CAF440134EC18E411BFA09E319E8FA

Function 2BB7C5E0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 164registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2BB7C63D
_memset.LIBCMT ref: 2BB7C64C
RegOpenKeyExW.ADVAPI32(80000000,?,00000000,00020019,00000000), ref: 2BB7C66F

Part of subcall function 2BB7C81E: RegCloseKey.ADVAPI32(80000000,2BB7C7FA), ref: 2BB7C82B
Part of subcall function 2BB7C81E: RegCloseKey.ADVAPI32(00000000), ref: 2BB7C834

Strings

%08X, xrefs: 2BB7C7D5

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Close_memset$Open
String ID: %08X
API String ID: 4292648718-3773563069
Opcode ID: da6efa15dea2c92ae88ca2364d3f2e85ada000039719affb06110dedbd0d609e
Instruction ID: fa4cfc2d1f441f699d92a3e34ed30522e870ce71b805aa0345bb693f174739f8
Opcode Fuzzy Hash: da6efa15dea2c92ae88ca2364d3f2e85ada000039719affb06110dedbd0d609e
Instruction Fuzzy Hash: 26514EB2900218AFEB24DF50CD85FEA7778EB48704F404599F719A7180EB75AB44DFA4

Function 2BB736F0 Relevance: 21.1, APIs: 14, Instructions: 141networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 2BB73710
WSAIoctl.WS2_32(00000000,9800000C,?,00000004,00000000,00000000,?,00000000,00000000), ref: 2BB73749
setsockopt.WS2_32(?,0000FFFF,000000FB,?,00000004), ref: 2BB73766
setsockopt.WS2_32(?,0000FFFF,00000004,?,00000004), ref: 2BB73779
WSACreateEvent.WS2_32 ref: 2BB7377B
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,2BBA1F0C), ref: 2BB7378D
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,2BBA1F0C), ref: 2BB73799
lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,?,?,?,?,?,2BBA1F0C), ref: 2BB737B8
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,?,2BBA1F0C), ref: 2BB737C4
gethostbyname.WS2_32(00000000), ref: 2BB737D2
htons.WS2_32(?), ref: 2BB737F8
WSAEventSelect.WS2_32(?,?,00000030), ref: 2BB73816
connect.WS2_32(?,?,00000010), ref: 2BB7382B
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,2BBA1F0C), ref: 2BB7383A

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: ByteCharEventMultiWidelstrlensetsockopt$CreateErrorIoctlLastSelectconnectgethostbynamehtonssocket
String ID:
API String ID: 1455939504-0
Opcode ID: e1076e1631c788e433afb5b9b04b47d53a26b562c01c2a9fb2636240ea9c10af
Instruction ID: c80901a17f98c90aff385bcae0d273c1bc58bb4a8a55279d5a09f95d45bab44a
Opcode Fuzzy Hash: e1076e1631c788e433afb5b9b04b47d53a26b562c01c2a9fb2636240ea9c10af
Instruction Fuzzy Hash: 72417E71E40205AFEB10DFA4CD8AF7AB7B8EF48710F104519F7259B2C0D675A906DB60

Function 2D4D3700 Relevance: 21.1, APIs: 14, Instructions: 141networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 2D4D3720
WSAIoctl.WS2_32(00000000,9800000C,?,00000004,00000000,00000000,?,00000000,00000000), ref: 2D4D3759
setsockopt.WS2_32(?,0000FFFF,000000FB,?,00000004), ref: 2D4D3776
setsockopt.WS2_32(?,0000FFFF,00000004,?,00000004), ref: 2D4D3789
WSACreateEvent.WS2_32 ref: 2D4D378B
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,2D52F3E0), ref: 2D4D379D
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,2D52F3E0), ref: 2D4D37A9
lstrlenW.KERNEL32(?,00000000,?,00000000,00000000,?,?,?,?,?,?,2D52F3E0), ref: 2D4D37C8
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,?,?,2D52F3E0), ref: 2D4D37D4
gethostbyname.WS2_32(00000000), ref: 2D4D37E2
htons.WS2_32(?), ref: 2D4D3808
WSAEventSelect.WS2_32(?,?,00000030), ref: 2D4D3826
connect.WS2_32(?,?,00000010), ref: 2D4D383B
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,2D52F3E0), ref: 2D4D384A

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: ByteCharEventMultiWidelstrlensetsockopt$CreateErrorIoctlLastSelectconnectgethostbynamehtonssocket
String ID:
API String ID: 1455939504-0
Opcode ID: f7d01260154531aba1eeb2e1f6b9e83202f20897e42cba84a6d63b545d62b7ef
Instruction ID: 7dd7384513d47351c5536c7b2ddfe3c4957b6aa2bf99fb0d8cfb54cff5e90ca3
Opcode Fuzzy Hash: f7d01260154531aba1eeb2e1f6b9e83202f20897e42cba84a6d63b545d62b7ef
Instruction Fuzzy Hash: 4D416071A00305ABEB10DFA4CC89F7FB7B8EB89B11F208519F651A62C0D7B4A905CB65

Function 004035AC Relevance: 21.1, APIs: 14, Instructions: 125networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 004035BE
WSAIoctl.WS2_32(00000000,9800000C,00040000,00000004,00000000,00000000,?,00000000,00000000), ref: 004035EB
setsockopt.WS2_32(?,0000FFFF,000000FB,00040000,00000004), ref: 00403607
setsockopt.WS2_32(?,0000FFFF,00000004,00040000,00000004), ref: 00403619
WSACreateEvent.WS2_32 ref: 0040361B
lstrlenW.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00403631
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 00403639
lstrlenW.KERNEL32(?,00000000,?,00000000,00000000), ref: 00403656
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000000), ref: 0040365E
gethostbyname.WS2_32(?), ref: 0040366E

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: ByteCharMultiWidelstrlensetsockopt$CreateEventIoctlgethostbynamesocket
String ID:
API String ID: 2536029566-0
Opcode ID: 5e2fd73e8962afb1d7c55afea424c3a37e6d219915bc1c189cebf08d257c7f34
Instruction ID: 6b1e060b20cecab37b02e692e00d4e8f86faef2f64161c4fbdfd2042df739e3c
Opcode Fuzzy Hash: 5e2fd73e8962afb1d7c55afea424c3a37e6d219915bc1c189cebf08d257c7f34
Instruction Fuzzy Hash: B44130B5500209BFDB109FA4DC85DAEBFBCEF08355F108526FA11A62E0D7769E44DB24

Function 2BB7AA10 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 190sleeptimeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,6FAD02D8), ref: 2BB7AA58
wsprintfW.USER32 ref: 2BB7AA8F
_memset.LIBCMT ref: 2BB7AAA7
_memset.LIBCMT ref: 2BB7AABA

Part of subcall function 2BB78020: lstrlenW.KERNEL32(?), ref: 2BB78038
Part of subcall function 2BB78020: _memset.LIBCMT ref: 2BB78042
Part of subcall function 2BB78020: lstrlenW.KERNEL32(?), ref: 2BB7804B
Part of subcall function 2BB78020: lstrlenW.KERNEL32(?), ref: 2BB78056

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 2BB7ABBE
Sleep.KERNEL32(000003E8,?,?,?,?,?,?), ref: 2BB7AC6E
CloseHandle.KERNEL32(?), ref: 2BB7ACAA

Part of subcall function 2BB7F707: _malloc.LIBCMT ref: 2BB7F721

Part of subcall function 2BB79730: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,6FAD02D8,00000000,?,?,?,00000000,2BB9125B,000000FF,?,2BB7E04E,00000000), ref: 2BB79773
Part of subcall function 2BB79730: InitializeCriticalSectionAndSpinCount.KERNEL32(2BB7E1AE,00000000,?,?,?,00000000,2BB9125B,000000FF,?,2BB7E04E), ref: 2BB79812
Part of subcall function 2BB79730: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,2BB9125B,000000FF,?,2BB7E04E), ref: 2BB79850

Strings

o1:, xrefs: 2BB7AAE2
p1:, xrefs: 2BB7AACE
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 2BB7AA89
t1:, xrefs: 2BB7AAF3

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CreateEvent_memsetlstrlen$CloseCountCriticalHandleInitializeLocalSectionSleepSpinTime_mallocwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$o1:$p1:$t1:
API String ID: 1254190970-1225219777
Opcode ID: 137698c0c4489a4173f77f944885099e5b1118a7e0f31d0b2aaf1ff4a1c5c798
Instruction ID: a0e709c546edf85120f3f01c426ab2f872d2e1c5f02966ee6ca939b4d4082036
Opcode Fuzzy Hash: 137698c0c4489a4173f77f944885099e5b1118a7e0f31d0b2aaf1ff4a1c5c798
Instruction Fuzzy Hash: 5161B2B2508740ABDB60DF64CCC1EABB3F9FF99610F004A1DF5A997241EB359544CBA2

Function 00D54000 Relevance: 18.0, Strings: 14, Instructions: 473COMMON

Download Yara Rule

Strings

runtime.SetFinalizer: second argument is runtime: blocked read on closing polldescruntime: typeBitsBulkBarrier without typestopTheWorld: not stopped (stopwait != 0)strconv: illegal AppendInt/FormatInt basetime: Reset called on uninitialized Timer17347234759768, xrefs: 00D54567
to finalizer untyped args -thread limit.WithDeadline(1907348632812595367431640625<not Stringer>CertCloseStoreComputerNameExCreateProcessWCryptGenRandomDefWindowProcWFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserN, xrefs: 00D543FB, 00D54483, 00D5450B
runtime.SetFinalizer: pointer not in allocated blockruntime: GetQueuedCompletionStatusEx failed (errno= runtime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetcompileCallback: argument size is larger than uintpt, xrefs: 00D545FC
runtime.SetFinalizer: first argument is runtime.preemptM: duplicatehandle failedruntime: SyscallN has too many argumentsruntime: out of memory: cannot allocate runtime: typeBitsBulkBarrier with type ryuFtoaFixed32 called with negative prectime: Stop called on, xrefs: 00D54655
because dotdotdot in async preempt to non-Go memory , locked to thread/etc/nsswitch.conf298023223876953125Arab Standard TimeCaucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGC worker (active)GetComputerNameExWGetExitC, xrefs: 00D54525
runtime.SetFinalizer: pointer not at beginning of allocated blockuser arena chunk size is not a mutliple of the physical page sizego package net: built with netgo build tag; using Go's DNS resolverbytes.Buffer: UnreadByte: previous operation was not a success, xrefs: 00D545AC
+, xrefs: 00D546A3
, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGetClientRectGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWOld_HungarianRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExW, xrefs: 00D5466F
nil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriod, xrefs: 00D54628
, not a function.WithValue(type /etc/resolv.conf0123456789ABCDEF0123456789abcdef2384185791015625AddDllDirectory, xrefs: 00D54581
runtime.SetFinalizer: first argument is nilruntime: casfrom_Gscanstatus bad oldval gp=runtime: releaseSudog with non-nil gp.paramruntime:stoplockedm: lockedg (atomicstatus=unfinished open-coded defers in deferreturnunknown runnable goroutine during bootstrapac, xrefs: 00D5469A
(, xrefs: 00D5465F
runtime.SetFinalizer: cannot pass runtime: g is running but p is notschedule: spinning with local workslice bounds out of range [%x:%y:]slice bounds out of range [:%x:%y]too many references: cannot spliceunexpected runtime.netpoll error: 1776356839400250464677, xrefs: 00D543D9, 00D54461, 00D544E9
runtime.SetFinalizer: first argument was allocated into an arenaruntime.SetFinalizer: pointer not at beginning of allocated blockuser arena chunk size is not a mutliple of the physical page sizego package net: built with netgo build tag; using Go's DNS resolve, xrefs: 00D54612

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: because dotdotdot in async preempt to non-Go memory , locked to thread/etc/nsswitch.conf298023223876953125Arab Standard TimeCaucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGC worker (active)GetComputerNameExWGetExitC$ to finalizer untyped args -thread limit.WithDeadline(1907348632812595367431640625<not Stringer>CertCloseStoreComputerNameExCreateProcessWCryptGenRandomDefWindowProcWFindFirstFileWFormatMessageWGC assist waitGC worker initGetConsoleModeGetProcAddressGetUserN$($+$, not a function.WithValue(type /etc/resolv.conf0123456789ABCDEF0123456789abcdef2384185791015625AddDllDirectory$, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGetClientRectGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWOld_HungarianRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExW$nil elem type!no module datano such deviceprotocol errorreflect.Value.runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriod$runtime.SetFinalizer: cannot pass runtime: g is running but p is notschedule: spinning with local workslice bounds out of range [%x:%y:]slice bounds out of range [:%x:%y]too many references: cannot spliceunexpected runtime.netpoll error: 1776356839400250464677$runtime.SetFinalizer: first argument is nilruntime: casfrom_Gscanstatus bad oldval gp=runtime: releaseSudog with non-nil gp.paramruntime:stoplockedm: lockedg (atomicstatus=unfinished open-coded defers in deferreturnunknown runnable goroutine during bootstrapac$runtime.SetFinalizer: first argument is runtime.preemptM: duplicatehandle failedruntime: SyscallN has too many argumentsruntime: out of memory: cannot allocate runtime: typeBitsBulkBarrier with type ryuFtoaFixed32 called with negative prectime: Stop called on$runtime.SetFinalizer: first argument was allocated into an arenaruntime.SetFinalizer: pointer not at beginning of allocated blockuser arena chunk size is not a mutliple of the physical page sizego package net: built with netgo build tag; using Go's DNS resolve$runtime.SetFinalizer: pointer not at beginning of allocated blockuser arena chunk size is not a mutliple of the physical page sizego package net: built with netgo build tag; using Go's DNS resolverbytes.Buffer: UnreadByte: previous operation was not a success$runtime.SetFinalizer: pointer not in allocated blockruntime: GetQueuedCompletionStatusEx failed (errno= runtime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetcompileCallback: argument size is larger than uintpt$runtime.SetFinalizer: second argument is runtime: blocked read on closing polldescruntime: typeBitsBulkBarrier without typestopTheWorld: not stopped (stopwait != 0)strconv: illegal AppendInt/FormatInt basetime: Reset called on uninitialized Timer17347234759768
API String ID: 0-1678866747
Opcode ID: 2548d30bbafcb1a79af5891c54b1589ad73a30d7101d132c76b052194b95db6b
Instruction ID: dd56bb2f34bb7dc588936890613fde6866fe78466128f5d01afad703bfb1065d
Opcode Fuzzy Hash: 2548d30bbafcb1a79af5891c54b1589ad73a30d7101d132c76b052194b95db6b
Instruction Fuzzy Hash: D5126AB45087158FCB14EF19C48066ABBE0FF84305F54892DECD98B392E774D989DBA2

Function 00403426 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 0040356C: CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 00403574

InterlockedIncrement.KERNEL32(0041BAA8), ref: 00403485
InterlockedIncrement.KERNEL32(0041BAA8), ref: 0040348F
setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 004034B5
setsockopt.WS2_32(?,0000FFFF,00001002,00040000,00000004), ref: 004034CD
ResetEvent.KERNEL32(?), ref: 0040350E
SetLastError.KERNEL32 ref: 00403522
GetLastError.KERNEL32(?,CUdpSocket::Start,00000000,?,?,?,?,?,?,?,?,0041BAA8), ref: 00403551

Part of subcall function 00403C7D: GetCurrentThreadId.KERNEL32 ref: 00403C86
Part of subcall function 00403C7D: send.WS2_32(?,00415448,00000010,00000000), ref: 00403CE8
Part of subcall function 00403C7D: SetEvent.KERNEL32(00040000,?,?,?,?,00000000,74DEDFA0,?,?,00403560,?,CUdpSocket::Start,00000000), ref: 00403D02
Part of subcall function 00403C7D: InterlockedExchange.KERNEL32(?,00000000), ref: 00403D0D
Part of subcall function 00403C7D: WSACloseEvent.WS2_32(?), ref: 00403D1B
Part of subcall function 00403C7D: shutdown.WS2_32(?,00000001), ref: 00403D2F
Part of subcall function 00403C7D: closesocket.WS2_32(?), ref: 00403D38

SetLastError.KERNEL32(00000000,?,CUdpSocket::Start,00000000,?,?,?,?,?,?,?,?,0041BAA8), ref: 00403561

Strings

CUdpSocket::Start, xrefs: 0040352D

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: ErrorEventInterlockedLast$Incrementsetsockopt$CloseCreateCurrentExchangeResetThreadTimerWaitableclosesocketsendshutdown
String ID: CUdpSocket::Start
API String ID: 3322730357-1445979842
Opcode ID: 88f59f946f8fa9787bbd9d109dd7493e7b1cb83bd0f512d30c2e5350177cf418
Instruction ID: 4dc85cd65296e32c064f818d196ff09bf4ebd9cbe7beeab3ca112e30d8308202
Opcode Fuzzy Hash: 88f59f946f8fa9787bbd9d109dd7493e7b1cb83bd0f512d30c2e5350177cf418
Instruction Fuzzy Hash: 93316DB1A00625BFD751DF65CC84ADABEACFB08706F104026E504E7690D7B9EA60CFD9

Function 2BB7C860 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 66registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,AppEvents,00000000,00000002,?), ref: 2BB7C889
RegDeleteValueW.ADVAPI32(?), ref: 2BB7C894
RegCloseKey.ADVAPI32(?), ref: 2BB7C8A4
RegCreateKeyW.ADVAPI32(80000001,AppEvents,?), ref: 2BB7C8C3
lstrlenW.KERNEL32(?), ref: 2BB7C8D1
RegSetValueExW.ADVAPI32(?,?,00000000,00000003,?,00000000), ref: 2BB7C8E4
RegCloseKey.ADVAPI32(?,?,00000000,00000003,?,00000000), ref: 2BB7C8F2
RegCloseKey.ADVAPI32(?), ref: 2BB7C900

Strings

Network, xrefs: 2BB7C876, 2BB7C8B4
AppEvents, xrefs: 2BB7C86F, 2BB7C883, 2BB7C8AD, 2BB7C8BD

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Close$Value$CreateDeleteOpenlstrlen
String ID: AppEvents$Network
API String ID: 3935456190-3733486940
Opcode ID: 4770154ce9d16878c4b3da4e08d8b327934cef2b6b384a787b0552cd8c079e1d
Instruction ID: 80e40b484d7245a046c0baa24b9cd63d70f1d021a47396e376a23d8459b6671e
Opcode Fuzzy Hash: 4770154ce9d16878c4b3da4e08d8b327934cef2b6b384a787b0552cd8c079e1d
Instruction Fuzzy Hash: CE118B76E00614BFEB10DAA4DD88FBBB37CEB08251F104059BA0097241D676EE00DBA8

Function 2B9FA0AF Relevance: 16.8, APIs: 11, Instructions: 254COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2B9FA107
_memset.LIBCMT ref: 2B9FA147
_memset.LIBCMT ref: 2B9FA1CD
swprintf.LIBCMT ref: 2B9FA1EC

Part of subcall function 2B9FF0C6: _malloc.LIBCMT ref: 2B9FF0E0

_memset.LIBCMT ref: 2B9FA2C4
swprintf.LIBCMT ref: 2B9FA2E3
_memset.LIBCMT ref: 2B9FA345
swprintf.LIBCMT ref: 2B9FA364

Memory Dump Source

Source File: 00000000.00000002.4113322478.000000002B9F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 2B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b9f0000_L8RabfF1Hu.jbxd

Similarity

API ID: _memset$swprintf$_malloc
String ID:
API String ID: 1873853019-0
Opcode ID: 062e854903829bf1e59bc273fd803ecd21369289b7c01ee10e87d698f024efb4
Instruction ID: 2b855f64907289d23a88d5cba7e605da84b6545079f929eeacb182ba52cb771f
Opcode Fuzzy Hash: 062e854903829bf1e59bc273fd803ecd21369289b7c01ee10e87d698f024efb4
Instruction Fuzzy Hash: E081F4B1A40200ABEB10DF54EC86F6B77A4AF65724F1441A4FE195F383EB71E910C7A6

Function 2D4D6230 Relevance: 16.7, APIs: 11, Instructions: 227timeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,9B5F627A,?,?,?,2D4D65DE,00000000), ref: 2D4D6275
InitializeCriticalSectionAndSpinCount.KERNEL32(2D4D673E,00000000,?,?,?,2D4D65DE), ref: 2D4D6314
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,2D4D65DE), ref: 2D4D6352
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,2D4D65DE), ref: 2D4D6377
InitializeCriticalSectionAndSpinCount.KERNEL32(2D4D67DE,00000000), ref: 2D4D646F
InitializeCriticalSectionAndSpinCount.KERNEL32(2D4D67F6,00000000), ref: 2D4D6490
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,2D4D65DE), ref: 2D4D639C

Part of subcall function 2D4D1280: __CxxThrowException@8.LIBCMT ref: 2D4D1290
Part of subcall function 2D4D1280: DeleteCriticalSection.KERNEL32(00000000,?,2D52B248,?,?,2D4D67A1,?,?,?,2D4D65DE), ref: 2D4D12A1

InterlockedExchange.KERNEL32(2D4D65F6,00000000), ref: 2D4D6501
timeGetTime.WINMM ref: 2D4D6507
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 2D4D651B
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 2D4D6524

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: CreateEvent$CriticalSection$CountInitializeSpin$DeleteException@8ExchangeInterlockedThrowTimetime
String ID:
API String ID: 1400036169-0
Opcode ID: d37e71ed2c18380b6fe6f5e30a6cb8946a0d3473f49978fa3e5c89a1cef4e478
Instruction ID: 23177a3b28232ef476465dd58192e8f6cd99f187013aebd5853519e2acb128d2
Opcode Fuzzy Hash: d37e71ed2c18380b6fe6f5e30a6cb8946a0d3473f49978fa3e5c89a1cef4e478
Instruction Fuzzy Hash: 34A106B1A05A46AFD744CF7AC88479AFBE8FB08704F50862EE11DD7640D774A964CF90

Function 2BB74CB0 Relevance: 16.7, APIs: 11, Instructions: 156COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,6FAD02D8,?,?,?,?,00000000,000000FF,00000000), ref: 2BB74CE6
EnterCriticalSection.KERNEL32(?,6FAD02D8,?,?,?,?,00000000,000000FF,00000000), ref: 2BB74D0D
SetLastError.KERNEL32(0000139F,?,?,00000000,000000FF), ref: 2BB74D21
LeaveCriticalSection.KERNEL32(?,?,?,00000000,000000FF), ref: 2BB74D28

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: 0d273e8ce180739a97bc2ececc02a81fb35f6605540c3c71d11d0aea9c1b0ab5
Instruction ID: 31816ca2d8325038f50385807ef64ab56c2757774a6c4ea43b3034ccb9ce77ae
Opcode Fuzzy Hash: 0d273e8ce180739a97bc2ececc02a81fb35f6605540c3c71d11d0aea9c1b0ab5
Instruction Fuzzy Hash: A351AD76E04A009FD714EFA8D985A6AF7F4FF48711F04492AE96AC3780D736E900CB51

Function 2D4D4CA0 Relevance: 16.7, APIs: 11, Instructions: 156COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,9B5F627A,?,?,?,?,00000000,000000FF,00000000), ref: 2D4D4CD6
EnterCriticalSection.KERNEL32(?,9B5F627A,?,?,?,?,00000000,000000FF,00000000), ref: 2D4D4CFD
SetLastError.KERNEL32(0000139F,?,?,00000000,000000FF), ref: 2D4D4D11
LeaveCriticalSection.KERNEL32(?,?,?,00000000,000000FF), ref: 2D4D4D18

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: 35df7545dc9601b47613d312fcabf4525e1aaf66068f913fd41033614933c6f3
Instruction ID: ce94ea44e161cd046ef11507c993adca2ac298f8d441ef6a5bbafebcc0f011dc
Opcode Fuzzy Hash: 35df7545dc9601b47613d312fcabf4525e1aaf66068f913fd41033614933c6f3
Instruction Fuzzy Hash: 8A51C176A087058FC714CFA8D895B6AF7F4FB48B11F10892EE91AD3740D775A500CB51

Function 0040457A Relevance: 16.6, APIs: 11, Instructions: 113COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040457F
SetLastError.KERNEL32(0000139F,?), ref: 00404597
EnterCriticalSection.KERNEL32(?,?,?), ref: 004045B2
SetLastError.KERNEL32(0000139F), ref: 004045C6
LeaveCriticalSection.KERNEL32(?), ref: 004045CD

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterH_prologLeave
String ID:
API String ID: 3594992196-0
Opcode ID: ec427024782bbdab1133dcca9ada77260546e140a4aeb0793b17b826fe485793
Instruction ID: 0ef4c1af5bb08cb4c3b40fa091e0e5b378706fe37953981a2661ee1bc52395ad
Opcode Fuzzy Hash: ec427024782bbdab1133dcca9ada77260546e140a4aeb0793b17b826fe485793
Instruction Fuzzy Hash: 6941C371900701DFC720DFA9C9816AAFBF4FF88700F10493EE256A7691D779AA01CB69

Function 0040475D Relevance: 16.6, APIs: 11, Instructions: 105networktimeCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(0000000D,?,?,00000004), ref: 00404791
EnterCriticalSection.KERNEL32(00000204,?,?,00000004), ref: 004047A6
WSASetLastError.WS2_32(00002746), ref: 004047B8
LeaveCriticalSection.KERNEL32(?), ref: 004047C1
timeGetTime.WINMM ref: 004047E3
timeGetTime.WINMM ref: 0040480B
SetEvent.KERNEL32(?), ref: 00404839
InterlockedExchange.KERNEL32(?,00000001), ref: 00404845
WSASetLastError.WS2_32(00002746), ref: 0040485B
LeaveCriticalSection.KERNEL32(?), ref: 00404864
LeaveCriticalSection.KERNEL32(?), ref: 00404875

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$ErrorLastLeave$Timetime$EnterEventExchangeInterlocked
String ID:
API String ID: 1405026782-0
Opcode ID: 6c9ae48391dd33ce5818419004d661bf5786b040f6b4e6a4e3f9252c3b299b5f
Instruction ID: 5f61534c0652ade8df489f45b58c9bf7c57317b303597f10a90b06348893fddf
Opcode Fuzzy Hash: 6c9ae48391dd33ce5818419004d661bf5786b040f6b4e6a4e3f9252c3b299b5f
Instruction Fuzzy Hash: D641D6B5500340AFC730AF64C849AAABFF4BB89711F01C97AD646A72E1C774DD44CB59

Function 2D4D6FF0 Relevance: 16.6, APIs: 11, Instructions: 75threadstringCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 2D4D700D
GetThreadDesktop.USER32(00000000), ref: 2D4D7014
_memset.LIBCMT ref: 2D4D702A
GetUserObjectInformationW.USER32(00000000,00000002,?,00000200,?), ref: 2D4D704E
OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 2D4D7059
_memset.LIBCMT ref: 2D4D706F
GetUserObjectInformationW.USER32(00000000,00000002,?,00000200,?), ref: 2D4D708D
lstrcmpiW.KERNEL32(?,?), ref: 2D4D709D
SetThreadDesktop.USER32(00000000), ref: 2D4D70A8
CloseDesktop.USER32(00000000), ref: 2D4D70BF
CloseDesktop.USER32(00000000), ref: 2D4D70C2

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Desktop$Thread$CloseInformationObjectUser_memset$CurrentInputOpenlstrcmpi
String ID:
API String ID: 3313130609-0
Opcode ID: d6434df7b95416470bb0a577622b5e947eaf7b5f10ce5f02f7985a479813d4ce
Instruction ID: d8f19427bdb10acc5a97238538fc24f063f091e6de0422163265f09891eb1991
Opcode Fuzzy Hash: d6434df7b95416470bb0a577622b5e947eaf7b5f10ce5f02f7985a479813d4ce
Instruction Fuzzy Hash: 8B219CB6544318ABEB10DB60CC89FEA737CDB49B01F018195F715B62C1DAB45E05CBA9

Function 2B9FBD5F Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2B9FBD81
_wcsrchr.LIBCMT ref: 2B9FBD89
_memset.LIBCMT ref: 2B9FBDC0
_wcsrchr.LIBCMT ref: 2B9FBDC8
_memset.LIBCMT ref: 2B9FBE43
_memset.LIBCMT ref: 2B9FBE6F
_memset.LIBCMT ref: 2B9FBE8A
_memset.LIBCMT ref: 2B9FBF29

Strings

D, xrefs: 2B9FBF35

Memory Dump Source

Source File: 00000000.00000002.4113322478.000000002B9F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 2B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b9f0000_L8RabfF1Hu.jbxd

Similarity

API ID: _memset$_wcsrchr
String ID: D
API String ID: 170005318-2746444292
Opcode ID: dbe0af0cfe405bfaa2f7670afa9565592a0c6507b5e6e8f9ef5526909d63a184
Instruction ID: c8b48c641080f0fd47825f4ed0df9ff2d9aa48d092dea84cde979fa1c7f3b60c
Opcode Fuzzy Hash: dbe0af0cfe405bfaa2f7670afa9565592a0c6507b5e6e8f9ef5526909d63a184
Instruction Fuzzy Hash: 8751D3B2A4032D7ADF20EB60CD86FEA777C9F24710F4045D5E60DA6080EB709794CBA6

Function 2BB7E730 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 74stringtimeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2BB7E751
GetForegroundWindow.USER32(?,74DF23A0,00000000), ref: 2BB7E759
GetWindowTextW.USER32(00000000,2BBA16F0,00000800), ref: 2BB7E76F
_memset.LIBCMT ref: 2BB7E78D
lstrlenW.KERNEL32(2BBA16F0,?,?,?,?,74DF23A0,00000000), ref: 2BB7E7AC
GetLocalTime.KERNEL32(?,?,?,?,?,74DF23A0,00000000), ref: 2BB7E7BD
wsprintfW.USER32 ref: 2BB7E804

Part of subcall function 2BB7E6B0: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,?,?,2BB7E815,?,?,?,?,74DF23A0,00000000), ref: 2BB7E6BD
Part of subcall function 2BB7E6B0: CreateFileW.KERNEL32(2BBA0D80,40000000,00000002,00000000,00000004,00000002,00000000,?,?,2BB7E815,?,?,?,?,74DF23A0,00000000), ref: 2BB7E6D7
Part of subcall function 2BB7E6B0: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 2BB7E6F2
Part of subcall function 2BB7E6B0: lstrlenW.KERNEL32(?,00000000,00000000), ref: 2BB7E6FF
Part of subcall function 2BB7E6B0: WriteFile.KERNEL32(00000000,?,00000000), ref: 2BB7E70A
Part of subcall function 2BB7E6B0: CloseHandle.KERNEL32(00000000), ref: 2BB7E711
Part of subcall function 2BB7E6B0: ReleaseMutex.KERNEL32(00000000), ref: 2BB7E71E

_memset.LIBCMT ref: 2BB7E820

Strings

[, xrefs: 2BB7E7FE

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: File_memset$Windowlstrlen$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleTextTimeWaitWritewsprintf
String ID: [
API String ID: 2192163267-4056885943
Opcode ID: e76710514803e027cbf3b1ecda5ddd507d6c1bb171625d600bfbebd585d03c05
Instruction ID: d817dabf7bd584ae01a66571bae0b0a084e5076c4939a96f84a4391e753da49d
Opcode Fuzzy Hash: e76710514803e027cbf3b1ecda5ddd507d6c1bb171625d600bfbebd585d03c05
Instruction Fuzzy Hash: 43219175D00128AACBA4DF688C46ABAB3BDFF15B00F048195F98592180DE39D9D9CFE4

Function 2BB73DE0 Relevance: 15.1, APIs: 10, Instructions: 117memorynetworkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,2BB7398D,?,00000000,000000FF,00000000), ref: 2BB73E05
LeaveCriticalSection.KERNEL32(?,?,?,2BB7398D,?,00000000,000000FF,00000000), ref: 2BB73E50
send.WS2_32(?,000000FF,00000000,00000000), ref: 2BB73E6E
EnterCriticalSection.KERNEL32(?), ref: 2BB73E81
LeaveCriticalSection.KERNEL32(?), ref: 2BB73E94
HeapFree.KERNEL32(00000000,00000000,?,?,?,2BB7398D,?,00000000,000000FF,00000000), ref: 2BB73EBC
WSAGetLastError.WS2_32(?,?,2BB7398D,?,00000000,000000FF,00000000), ref: 2BB73EC7
EnterCriticalSection.KERNEL32(?,?,?,2BB7398D,?,00000000,000000FF,00000000), ref: 2BB73EDB
LeaveCriticalSection.KERNEL32(?), ref: 2BB73F14
HeapFree.KERNEL32(00000000,00000000,?), ref: 2BB73F51

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$EnterLeave$FreeHeap$ErrorLastsend
String ID:
API String ID: 1701177279-0
Opcode ID: d13a51aa05c43676fc857377799761456276851468aab743a90432535e45df27
Instruction ID: c11043b7d6de607e35a95f6ab2d83ae3eba09ba825b8ae7915739be9f42e77a8
Opcode Fuzzy Hash: d13a51aa05c43676fc857377799761456276851468aab743a90432535e45df27
Instruction Fuzzy Hash: AC410872944A019FCB54DF74C988AA7B7F8EF48300F00896DE9AECB250D735E5469F60

Function 2D4D3DF0 Relevance: 15.1, APIs: 10, Instructions: 117memorynetworkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,2D4D399D,?,00000000,000000FF,00000000), ref: 2D4D3E15
LeaveCriticalSection.KERNEL32(?,?,?,2D4D399D,?,00000000,000000FF,00000000), ref: 2D4D3E60
send.WS2_32(?,000000FF,00000000,00000000), ref: 2D4D3E7E
EnterCriticalSection.KERNEL32(?), ref: 2D4D3E91
LeaveCriticalSection.KERNEL32(?), ref: 2D4D3EA4
HeapFree.KERNEL32(00000000,00000000,?,?,?,2D4D399D,?,00000000,000000FF,00000000), ref: 2D4D3ECC
WSAGetLastError.WS2_32(?,?,2D4D399D,?,00000000,000000FF,00000000), ref: 2D4D3ED7
EnterCriticalSection.KERNEL32(?,?,?,2D4D399D,?,00000000,000000FF,00000000), ref: 2D4D3EEB
LeaveCriticalSection.KERNEL32(?), ref: 2D4D3F24
HeapFree.KERNEL32(00000000,00000000,?), ref: 2D4D3F61

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$EnterLeave$FreeHeap$ErrorLastsend
String ID:
API String ID: 1701177279-0
Opcode ID: 0275ce5bd403644b096ac7691356ed502b8396e66888e4ad9951142fb9519dd0
Instruction ID: 41e8533cdd348844fb77330a55118f22457346a451e4086e5c63583b831b61ce
Opcode Fuzzy Hash: 0275ce5bd403644b096ac7691356ed502b8396e66888e4ad9951142fb9519dd0
Instruction Fuzzy Hash: D14136726047049FD791CF74C898BA7B7F8BB48705F50892EE99ADB640E774E8018B60

Function 2BB74F30 Relevance: 15.1, APIs: 10, Instructions: 114timenetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(0000000D,00000000,000000FF,00000000,000000FF,00000000), ref: 2BB74F63
EnterCriticalSection.KERNEL32(000002FF,00000000,000000FF,00000000,000000FF,00000000), ref: 2BB74F78
WSASetLastError.WS2_32(00002746), ref: 2BB74F8A
LeaveCriticalSection.KERNEL32(000002FF), ref: 2BB74F91
timeGetTime.WINMM ref: 2BB74FBF
timeGetTime.WINMM ref: 2BB74FE7
SetEvent.KERNEL32(?), ref: 2BB75025
InterlockedExchange.KERNEL32(?,00000001), ref: 2BB75031
LeaveCriticalSection.KERNEL32(000002FF), ref: 2BB75038
LeaveCriticalSection.KERNEL32(000002FF), ref: 2BB7504B

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$Leave$ErrorLastTimetime$EnterEventExchangeInterlocked
String ID:
API String ID: 1979691958-0
Opcode ID: 63c45d797ab83d8d67b87ed56c6aa09d58a0b3b030a5dacedac31905b4964181
Instruction ID: f0d0191451d43d461724caff5584ab3b507e66f7178448a375648fe1af6af461
Opcode Fuzzy Hash: 63c45d797ab83d8d67b87ed56c6aa09d58a0b3b030a5dacedac31905b4964181
Instruction Fuzzy Hash: F041D532E00A008FDB10EF68C648A5AF7F9FF48715F044559E49ACB652E376E545DF81

Function 2D4D4F20 Relevance: 15.1, APIs: 10, Instructions: 114timenetworkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(0000000D,00000000,000000FF,00000000,000000FF,00000000), ref: 2D4D4F53
EnterCriticalSection.KERNEL32(000002FF,00000000,000000FF,00000000,000000FF,00000000), ref: 2D4D4F68
WSASetLastError.WS2_32(00002746), ref: 2D4D4F7A
LeaveCriticalSection.KERNEL32(000002FF), ref: 2D4D4F81
timeGetTime.WINMM ref: 2D4D4FAF
timeGetTime.WINMM ref: 2D4D4FD7
SetEvent.KERNEL32(?), ref: 2D4D5015
InterlockedExchange.KERNEL32(?,00000001), ref: 2D4D5021
LeaveCriticalSection.KERNEL32(000002FF), ref: 2D4D5028
LeaveCriticalSection.KERNEL32(000002FF), ref: 2D4D503B

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$Leave$ErrorLastTimetime$EnterEventExchangeInterlocked
String ID:
API String ID: 1979691958-0
Opcode ID: 375a4110c926e7d8a82ffd03fc9aaaf6bf1a0e915b0cb681782b859ea850bf6b
Instruction ID: ea042f99edb72ac9ab17070c313ed4f4c5b8f672041b770ad2f21f39fe1389b6
Opcode Fuzzy Hash: 375a4110c926e7d8a82ffd03fc9aaaf6bf1a0e915b0cb681782b859ea850bf6b
Instruction Fuzzy Hash: 5D411F326043008FD760DF69C8A8B6AB7F9FB48716F60C659E84E97762E375E940CB40

Function 2BB7C270 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98filestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2BB7C2AE
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 2BB7C2CC
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 2BB7C309
CloseHandle.KERNEL32(00000000), ref: 2BB7C314
lstrlenW.KERNEL32(?), ref: 2BB7C321
wsprintfW.USER32 ref: 2BB7C345

Strings

%s %s, xrefs: 2BB7C33F

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: File$CloseCreateHandleWrite_memsetlstrlenwsprintf
String ID: %s %s
API String ID: 1326869720-2939940506
Opcode ID: b2f2be081cc03f3abf98428db815abc24cb22c765c4109e21c68ce0c9257ecae
Instruction ID: ec6844ff57d6956ead8398698358ff17f57528cfbccc8984bb5ae750dade4fe9
Opcode Fuzzy Hash: b2f2be081cc03f3abf98428db815abc24cb22c765c4109e21c68ce0c9257ecae
Instruction Fuzzy Hash: 7631C432A406186FEB24EB64CC85FEF7378EB09311F40029AF655E7180DA359A44DFA4

Function 2BB7C980 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 88processstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 2BB7C98D
_wcsrchr.LIBCMT ref: 2BB7C9C7

Part of subcall function 2BB77C80: LoadLibraryW.KERNEL32(wininet.dll), ref: 2BB77CC3
Part of subcall function 2BB77C80: GetProcAddress.KERNEL32(00000000,InternetOpenW), ref: 2BB77CD7
Part of subcall function 2BB77C80: FreeLibrary.KERNEL32(00000000), ref: 2BB77CF7

GetFileAttributesW.KERNEL32(-00000002), ref: 2BB7C9E6
GetLastError.KERNEL32 ref: 2BB7C9F1
_memset.LIBCMT ref: 2BB7CA04
CreateProcessW.KERNEL32(00000000,-00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 2BB7CA31

Strings

D, xrefs: 2BB7CA23
WinSta0\Default, xrefs: 2BB7CA2A

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Library$AddressAttributesCreateErrorFileFreeLastLoadProcProcess_memset_wcsrchrlstrlen
String ID: D$WinSta0\Default
API String ID: 174883095-1101385590
Opcode ID: d5b03eb8535b4075855dbf8a8b3f09d8123f1083b325916fce2fc3f58805c3a4
Instruction ID: d86dbec3874f0affbe858442a397c3c57f598897ab094b01ec61a852cd3a8706
Opcode Fuzzy Hash: d5b03eb8535b4075855dbf8a8b3f09d8123f1083b325916fce2fc3f58805c3a4
Instruction Fuzzy Hash: B41127B3D0010827EB14E6B89C46FBFB77CDF69611F400129FA16EA1C4E636DA05D6E6

Function 2BB78159 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 58stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(?,A:\), ref: 2BB78166
lstrcmpiW.KERNEL32(?,B:\), ref: 2BB78176
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 2BB781A6
lstrlenW.KERNEL32(?), ref: 2BB781B7
__wcsnicmp.LIBCMT ref: 2BB781CE
lstrcpyW.KERNEL32(00000AD4,?), ref: 2BB78204
lstrcpyW.KERNEL32(?,?), ref: 2BB78228
lstrcatW.KERNEL32(?,00000000), ref: 2BB78233

Strings

B:\, xrefs: 2BB78170
A:\, xrefs: 2BB78160

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: lstrcmpilstrcpy$DeviceQuery__wcsnicmplstrcatlstrlen
String ID: A:\$B:\
API String ID: 4249875308-1009255891
Opcode ID: f6dd315f62c1cb0d47c9bbd1f18c03cb01cd4632a44a89ed39af24e3cdeb74c5
Instruction ID: 60c414e4589be6efad5111d846c4d7e597eeeef8404b29736549cb2ba694a805
Opcode Fuzzy Hash: f6dd315f62c1cb0d47c9bbd1f18c03cb01cd4632a44a89ed39af24e3cdeb74c5
Instruction Fuzzy Hash: E3114F72E116189BDF14EF51DD447FE7379EF58210F004098DA19A3240E735EA06DFA5

Function 00D575D0 Relevance: 14.0, Strings: 11, Instructions: 296COMMON

Download Yara Rule

Strings

jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not , val .local.onion390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticFormatFridayGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLycianLydianMondayRejangSCHED St, xrefs: 00D579B9
next= p->m= prev= span=% util(...), i = , not , val .local.onion390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticFormatFridayGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLycianLydianMondayRejangSCHED StringSundaySyriacTai_LeTangutTe, xrefs: 00D5798F
in gcMark expecting to see gcphase as _GCmarkterminationnon-empty pointer map passed for non-pointer-size valuesprofilealloc called without a P or outside bootstrappinggentraceback cannot trace user goroutine on its own stackruntime: checkmarks found unexpecte, xrefs: 00D57AB1
nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = .WithCancel/dev/stderr/dev/stdout30517578125: frame.sp=ClassHESIODCloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACE, xrefs: 00D57A0E
runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriod, xrefs: 00D57965
work.full != 0 with GC prog,M3.2.0,M11.1.0476837158203125: no frame (sp=<invalid Value>ASCII_Hex_DigitCreateHardLinkWCreateWindowExWDeviceIoControlDuplicateHandleFailed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetSta, xrefs: 00D5790E
8, xrefs: 00D57ABA
flushedWork idlethreads= is nil, not nStackRoots= pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep wait, xrefs: 00D577E2
P has cached GC work at end of mark terminationattempting to link in too many shared librariesfailed to acquire lock to start a GC transitionfinishGCTransition called without starting one?function symbol table not sorted by PC offset: racy sudog adjustment due, xrefs: 00D578B1
wbuf1.n= wbuf2.n=%!(EXTRA (MISSING)(unknown), newval=, oldval=, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticFindCloseHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanPalmyren, xrefs: 00D57828
runtime: P runtime: g runtime: p scheddetailsecur32.dllshell32.dllshort writetracealloc(unreachableuserenv.dll B (goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte pre, xrefs: 00D577B7

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: flushedWork idlethreads= is nil, not nStackRoots= pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep wait$ jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not , val .local.onion390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticFormatFridayGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLycianLydianMondayRejangSCHED St$ nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = .WithCancel/dev/stderr/dev/stdout30517578125: frame.sp=ClassHESIODCloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACE$ next= p->m= prev= span=% util(...), i = , not , val .local.onion390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticFormatFridayGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLycianLydianMondayRejangSCHED StringSundaySyriacTai_LeTangutTe$ wbuf1.n= wbuf2.n=%!(EXTRA (MISSING)(unknown), newval=, oldval=, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticFindCloseHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanPalmyren$8$P has cached GC work at end of mark terminationattempting to link in too many shared librariesfailed to acquire lock to start a GC transitionfinishGCTransition called without starting one?function symbol table not sorted by PC offset: racy sudog adjustment due$in gcMark expecting to see gcphase as _GCmarkterminationnon-empty pointer map passed for non-pointer-size valuesprofilealloc called without a P or outside bootstrappinggentraceback cannot trace user goroutine on its own stackruntime: checkmarks found unexpecte$runtime: P runtime: g runtime: p scheddetailsecur32.dllshell32.dllshort writetracealloc(unreachableuserenv.dll B (goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte pre$runtime: full=runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriod$work.full != 0 with GC prog,M3.2.0,M11.1.0476837158203125: no frame (sp=<invalid Value>ASCII_Hex_DigitCreateHardLinkWCreateWindowExWDeviceIoControlDuplicateHandleFailed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetSta
API String ID: 0-2106679929
Opcode ID: 829b7b9848d6482dc7025273a654248f32b7f8d2dab1608d1f6ed7b20171ca48
Instruction ID: b318b3617a53153078e87c0cba1455276de8e7a3e8a3d1f80d7a0fef5682d1c3
Opcode Fuzzy Hash: 829b7b9848d6482dc7025273a654248f32b7f8d2dab1608d1f6ed7b20171ca48
Instruction Fuzzy Hash: 62D11374609705DFC704EF25E5A4A6ABBE1FF88304F15882DE88987352EB30D848DB72

Function 00D56E70 Relevance: 14.0, Strings: 11, Instructions: 288COMMON

Download Yara Rule

Strings

work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGetClientRectGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWOld_HungarianRegDeleteKeyW, xrefs: 00D5721E, 00D5729F
work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGetClientRectGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWOld_HungarianRegDeleteKeyWRegEnumKeyExW, xrefs: 00D571F4
work.nwait > work.nproc1164153218269348144531254grtu7rtshy6uxjsdf5ghjk9582076609134674072265625Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime, xrefs: 00D57252
work.nwait was > work.nproc args stack map entries for 18189894035458564758300781259094947017729282379150390625Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreateCertificateContextEnglish n, xrefs: 00D572D3
gcBgMarkWorker: blackening not enabledindex out of range [%x] with length %yinsufficient data for base length typeinternal error: exit hook invoked exitm changed unexpectedly in cgocallbackgmakechan: invalid channel element typeruntime: blocked read on free po, xrefs: 00D57343
runtime: p.gcMarkWorkerMode= runtime: split stack overflowruntime: sudog with non-nil cruntime: summary max pages = runtime: traceback stuck. pc=scanobject of a noscan objectsemacquire not on the G stackstring concatenation too longsyntax error scanning boolea, xrefs: 00D571C9
gcBgMarkWorker: mode not setgcstopm: negative nmspinninginvalid runtime symbol tablemheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockednewproc1: new g is not Gdeadnewproc1: newg missing stackos: process already finishedprotocol, xrefs: 00D572E9
worker mode != sweepgen MB globals, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc C, xrefs: 00D5730E
&, xrefs: 00D5734C
GC worker initGetConsoleModeGetProcAddressGetUserNameExWMB; allocated Module32FirstWNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRCodeNameErrorRegSetValueExWReleaseCaptureResourceHeaderSetFilePointerTranslateNameWVirtualProtectallocfre, xrefs: 00D56EAE, 00D56EBC
runtime: work.nwait= stale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverabletimer data corruptionunexpected value stepunknown empty Context%SystemRoot%\system32\.localhost.localdomain4656612873077392578125Aleutian Standard TimeAtla, xrefs: 00D57275

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGetClientRectGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWOld_HungarianRegDeleteKeyW$ work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGetClientRectGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextWOld_HungarianRegDeleteKeyWRegEnumKeyExW$&$GC worker initGetConsoleModeGetProcAddressGetUserNameExWMB; allocated Module32FirstWNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRCodeNameErrorRegSetValueExWReleaseCaptureResourceHeaderSetFilePointerTranslateNameWVirtualProtectallocfre$gcBgMarkWorker: blackening not enabledindex out of range [%x] with length %yinsufficient data for base length typeinternal error: exit hook invoked exitm changed unexpectedly in cgocallbackgmakechan: invalid channel element typeruntime: blocked read on free po$gcBgMarkWorker: mode not setgcstopm: negative nmspinninginvalid runtime symbol tablemheap.freeSpanLocked - span missing stack in shrinkstackmspan.sweep: m is not lockednewproc1: new g is not Gdeadnewproc1: newg missing stackos: process already finishedprotocol$runtime: p.gcMarkWorkerMode= runtime: split stack overflowruntime: sudog with non-nil cruntime: summary max pages = runtime: traceback stuck. pc=scanobject of a noscan objectsemacquire not on the G stackstring concatenation too longsyntax error scanning boolea$runtime: work.nwait= stale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverabletimer data corruptionunexpected value stepunknown empty Context%SystemRoot%\system32\.localhost.localdomain4656612873077392578125Aleutian Standard TimeAtla$work.nwait > work.nproc1164153218269348144531254grtu7rtshy6uxjsdf5ghjk9582076609134674072265625Azerbaijan Standard TimeBangladesh Standard TimeCape Verde Standard TimeCertFreeCertificateChainCreateToolhelp32SnapshotGetSystemTimeAsFileTime$work.nwait was > work.nproc args stack map entries for 18189894035458564758300781259094947017729282379150390625Aus Central W. Standard TimeCanada Central Standard TimeCen. Australia Standard TimeCentral Europe Standard TimeCertCreateCertificateContextEnglish n$worker mode != sweepgen MB globals, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc C
API String ID: 0-2868843973
Opcode ID: c182ed2daf8568d5b1ee06a0916280903294ff036e99b6ad3738146d41ed036e
Instruction ID: f0ea0662e081a09682911f4a23b3e08a029ed045cd38e351bbe8eafce9c48009
Opcode Fuzzy Hash: c182ed2daf8568d5b1ee06a0916280903294ff036e99b6ad3738146d41ed036e
Instruction Fuzzy Hash: 48E1EFB4509744DFC704EF28D194A5ABBF0FF88704F11896DE8898B362EB35D849DB62

Function 2BB79730 Relevance: 13.7, APIs: 9, Instructions: 195timeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,6FAD02D8,00000000,?,?,?,00000000,2BB9125B,000000FF,?,2BB7E04E,00000000), ref: 2BB79773
InitializeCriticalSectionAndSpinCount.KERNEL32(2BB7E1AE,00000000,?,?,?,00000000,2BB9125B,000000FF,?,2BB7E04E), ref: 2BB79812
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,2BB9125B,000000FF,?,2BB7E04E), ref: 2BB79850
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,2BB9125B,000000FF,?,2BB7E04E), ref: 2BB79875
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,2BB9125B,000000FF,?,2BB7E04E), ref: 2BB7989A

Part of subcall function 2BB71280: __CxxThrowException@8.LIBCMT ref: 2BB71290
Part of subcall function 2BB71280: DeleteCriticalSection.KERNEL32(00000000,2BB7D3E6,2BB96624,?,?,2BB7D3E6,?,?,?,?,2BB95A40,00000000), ref: 2BB712A1

Part of subcall function 2BB7CE10: InitializeCriticalSectionAndSpinCount.KERNEL32(2BB7E076,00000000,6FAD02D8,2BB7E04E,74DF2F60,00000000,?,2BB7E226,2BB9110B,000000FF,?,2BB7994A,2BB7E226), ref: 2BB7CE67
Part of subcall function 2BB7CE10: InitializeCriticalSectionAndSpinCount.KERNEL32(2BB7E08E,00000000,?,2BB7E226,2BB9110B,000000FF,?,2BB7994A,2BB7E226,?,?,?,00000000,2BB9125B,000000FF), ref: 2BB7CE83

InterlockedExchange.KERNEL32(2BB7E066,00000000), ref: 2BB799A0
timeGetTime.WINMM(?,?,?,00000000,2BB9125B,000000FF,?,2BB7E04E), ref: 2BB799A6
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,00000000,2BB9125B,000000FF,?,2BB7E04E), ref: 2BB799B4
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,2BB9125B,000000FF,?,2BB7E04E), ref: 2BB799BD

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CreateEvent$CriticalSection$CountInitializeSpin$DeleteException@8ExchangeInterlockedThrowTimetime
String ID:
API String ID: 1400036169-0
Opcode ID: ec077e7386c1db71c39c2b85c87f515007afb5746a6c56ad1a26d5f0c92dca06
Instruction ID: 8d67a967ddc021f636d2ca30dfd46466f37260de4f8dada55ccdd9dccd2a0c39
Opcode Fuzzy Hash: ec077e7386c1db71c39c2b85c87f515007afb5746a6c56ad1a26d5f0c92dca06
Instruction Fuzzy Hash: EA81E4B1A01A46BFE744DF7AC98479AFBA8FB08344F50422EE12CD7640D775A960DF90

Function 2BB73500 Relevance: 13.6, APIs: 9, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 2BB73660: CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 2BB73667
Part of subcall function 2BB73660: _free.LIBCMT ref: 2BB7369C
Part of subcall function 2BB73660: _malloc.LIBCMT ref: 2BB736D7
Part of subcall function 2BB73660: _memset.LIBCMT ref: 2BB736E5

InterlockedIncrement.KERNEL32(2BBA1F0C), ref: 2BB73565
InterlockedIncrement.KERNEL32(2BBA1F0C), ref: 2BB73573
setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 2BB7359A
setsockopt.WS2_32(?,0000FFFF,00001002,?,00000004), ref: 2BB735B3
ResetEvent.KERNEL32(?,?,?,2BBA1F0C), ref: 2BB735EE
SetLastError.KERNEL32(00000000), ref: 2BB73621
GetLastError.KERNEL32 ref: 2BB73639

Part of subcall function 2BB73F60: GetCurrentThreadId.KERNEL32 ref: 2BB73F65
Part of subcall function 2BB73F60: send.WS2_32(?,2BB949C0,00000010,00000000), ref: 2BB73FC6
Part of subcall function 2BB73F60: SetEvent.KERNEL32(?), ref: 2BB73FE9
Part of subcall function 2BB73F60: InterlockedExchange.KERNEL32(?,00000000), ref: 2BB73FF5
Part of subcall function 2BB73F60: WSACloseEvent.WS2_32(?), ref: 2BB74003
Part of subcall function 2BB73F60: shutdown.WS2_32(?,00000001), ref: 2BB7401B
Part of subcall function 2BB73F60: closesocket.WS2_32(?), ref: 2BB74025

SetLastError.KERNEL32(00000000), ref: 2BB73649

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: ErrorEventInterlockedLast$Incrementsetsockopt$CloseCreateCurrentExchangeResetThreadTimerWaitable_free_malloc_memsetclosesocketsendshutdown
String ID:
API String ID: 127459856-0
Opcode ID: f4f34b0be415f86af620085c12887049da23c48ea8d85faa1c2e03d62afdb312
Instruction ID: 89968628fade9b091f2458cd175ce11bc612f6464c7f8af84cad9da25cd7fc13
Opcode Fuzzy Hash: f4f34b0be415f86af620085c12887049da23c48ea8d85faa1c2e03d62afdb312
Instruction Fuzzy Hash: 8041BDB2A40B04AFD760EF69CD80B6AB7F8FF48300F10442EE686D3640D7B5E8458B50

Function 2D4D3510 Relevance: 13.6, APIs: 9, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 2D4D3670: CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 2D4D3677
Part of subcall function 2D4D3670: _free.LIBCMT ref: 2D4D36AC
Part of subcall function 2D4D3670: _malloc.LIBCMT ref: 2D4D36E7
Part of subcall function 2D4D3670: _memset.LIBCMT ref: 2D4D36F5

InterlockedIncrement.KERNEL32(2D52F3E0), ref: 2D4D3575
InterlockedIncrement.KERNEL32(2D52F3E0), ref: 2D4D3583
setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 2D4D35AA
setsockopt.WS2_32(?,0000FFFF,00001002,?,00000004), ref: 2D4D35C3
ResetEvent.KERNEL32(?,?,?,2D52F3E0), ref: 2D4D35FE
SetLastError.KERNEL32(00000000), ref: 2D4D3631
GetLastError.KERNEL32 ref: 2D4D3649

Part of subcall function 2D4D3F70: GetCurrentThreadId.KERNEL32 ref: 2D4D3F75
Part of subcall function 2D4D3F70: send.WS2_32(?,2D52A8F8,00000010,00000000), ref: 2D4D3FD6
Part of subcall function 2D4D3F70: SetEvent.KERNEL32(?), ref: 2D4D3FF9
Part of subcall function 2D4D3F70: InterlockedExchange.KERNEL32(?,00000000), ref: 2D4D4005
Part of subcall function 2D4D3F70: WSACloseEvent.WS2_32(?), ref: 2D4D4013
Part of subcall function 2D4D3F70: shutdown.WS2_32(?,00000001), ref: 2D4D402B
Part of subcall function 2D4D3F70: closesocket.WS2_32(?), ref: 2D4D4035

SetLastError.KERNEL32(00000000), ref: 2D4D3659

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: ErrorEventInterlockedLast$Incrementsetsockopt$CloseCreateCurrentExchangeResetThreadTimerWaitable_free_malloc_memsetclosesocketsendshutdown
String ID:
API String ID: 127459856-0
Opcode ID: a90790e049c612083cf6d5a950421a2e98ad9e64099436819979e970e5ee5064
Instruction ID: fb72f29deda15a7e649075f1873e51e019032d7fcfe4acbc15b320d62ac62a20
Opcode Fuzzy Hash: a90790e049c612083cf6d5a950421a2e98ad9e64099436819979e970e5ee5064
Instruction Fuzzy Hash: EE417CB2600704AFD3A0DF69CC94B6AB7E4FF48B15F50842EE686E7780D7B5E9448B50

Function 2BB74430 Relevance: 13.6, APIs: 9, Instructions: 93synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 2BB74443
ResetEvent.KERNEL32(?), ref: 2BB7444C
timeGetTime.WINMM ref: 2BB7444E
InterlockedExchange.KERNEL32(?,00000000), ref: 2BB7445D
WaitForSingleObject.KERNEL32(?,00001770), ref: 2BB744AB
ResetEvent.KERNEL32(?), ref: 2BB744C8

Part of subcall function 2BB73F60: GetCurrentThreadId.KERNEL32 ref: 2BB73F65
Part of subcall function 2BB73F60: send.WS2_32(?,2BB949C0,00000010,00000000), ref: 2BB73FC6
Part of subcall function 2BB73F60: SetEvent.KERNEL32(?), ref: 2BB73FE9
Part of subcall function 2BB73F60: InterlockedExchange.KERNEL32(?,00000000), ref: 2BB73FF5
Part of subcall function 2BB73F60: WSACloseEvent.WS2_32(?), ref: 2BB74003
Part of subcall function 2BB73F60: shutdown.WS2_32(?,00000001), ref: 2BB7401B
Part of subcall function 2BB73F60: closesocket.WS2_32(?), ref: 2BB74025

ResetEvent.KERNEL32(?), ref: 2BB744DC

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Event$Reset$ExchangeInterlocked$CloseCurrentObjectSingleThreadTimeWaitclosesocketsendshutdowntime
String ID:
API String ID: 542259498-0
Opcode ID: 960b711147ff7b749e28a9cb712e9a4ab8f1ca8d48f2613b5d51aa0c55f509ad
Instruction ID: 97c7057095599cc80ae93f3efecaf9401e19b4ce89b180a50ee11d99c559fe22
Opcode Fuzzy Hash: 960b711147ff7b749e28a9cb712e9a4ab8f1ca8d48f2613b5d51aa0c55f509ad
Instruction Fuzzy Hash: A3219572A00B049BC720EF79DD85B97B3F8EF9D711F104A1EE69AC3650DA71E4019BA1

Function 2D4D4440 Relevance: 13.6, APIs: 9, Instructions: 93synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 2D4D4453
ResetEvent.KERNEL32(?), ref: 2D4D445C
timeGetTime.WINMM ref: 2D4D445E
InterlockedExchange.KERNEL32(?,00000000), ref: 2D4D446D
WaitForSingleObject.KERNEL32(?,00001770), ref: 2D4D44BB
ResetEvent.KERNEL32(?), ref: 2D4D44D8

Part of subcall function 2D4D3F70: GetCurrentThreadId.KERNEL32 ref: 2D4D3F75
Part of subcall function 2D4D3F70: send.WS2_32(?,2D52A8F8,00000010,00000000), ref: 2D4D3FD6
Part of subcall function 2D4D3F70: SetEvent.KERNEL32(?), ref: 2D4D3FF9
Part of subcall function 2D4D3F70: InterlockedExchange.KERNEL32(?,00000000), ref: 2D4D4005
Part of subcall function 2D4D3F70: WSACloseEvent.WS2_32(?), ref: 2D4D4013
Part of subcall function 2D4D3F70: shutdown.WS2_32(?,00000001), ref: 2D4D402B
Part of subcall function 2D4D3F70: closesocket.WS2_32(?), ref: 2D4D4035

ResetEvent.KERNEL32(?), ref: 2D4D44EC

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Event$Reset$ExchangeInterlocked$CloseCurrentObjectSingleThreadTimeWaitclosesocketsendshutdowntime
String ID:
API String ID: 542259498-0
Opcode ID: 349e2f4e57a31c739de259e8244fd24a1b79fc6722f6f2c1f1319787616aeade
Instruction ID: e6c40fe5f65f675b10c9885bb9c3abaf1c44d6060a2e3d5dcca08cab88b3743f
Opcode Fuzzy Hash: 349e2f4e57a31c739de259e8244fd24a1b79fc6722f6f2c1f1319787616aeade
Instruction Fuzzy Hash: 36218F762007046BC720EF69DC94BA7B3F8FF99B11F104A1EE68AD7240D671A440CBA4

Function 2BB74E80 Relevance: 13.6, APIs: 9, Instructions: 70COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,?), ref: 2BB74E99
TryEnterCriticalSection.KERNEL32(?,?), ref: 2BB74EB8
TryEnterCriticalSection.KERNEL32(?), ref: 2BB74EC2
SetLastError.KERNEL32(0000139F), ref: 2BB74ED9
LeaveCriticalSection.KERNEL32(?), ref: 2BB74EE2
LeaveCriticalSection.KERNEL32(?), ref: 2BB74EE9

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 3efab6a297e9549f6e52833bf0cd5019c136acf8156bd5e2926f9731f2266983
Instruction ID: 72896277119376a01419c3789dbaa27463a36854c1a4d70e214a67533934f1a6
Opcode Fuzzy Hash: 3efab6a297e9549f6e52833bf0cd5019c136acf8156bd5e2926f9731f2266983
Instruction Fuzzy Hash: 23119033B047048BD720EB79DD8496BB3E8EF89622B00092AE655C3550DA75E905DAA1

Function 2D4D4E70 Relevance: 13.6, APIs: 9, Instructions: 70COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,?), ref: 2D4D4E89
TryEnterCriticalSection.KERNEL32(?,?), ref: 2D4D4EA8
TryEnterCriticalSection.KERNEL32(?), ref: 2D4D4EB2
SetLastError.KERNEL32(0000139F), ref: 2D4D4EC9
LeaveCriticalSection.KERNEL32(?), ref: 2D4D4ED2
LeaveCriticalSection.KERNEL32(?), ref: 2D4D4ED9

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: ed87b5ab3d1e05e545e83ddb3a856e553c24cf120d40b73134e8b8719b0229b9
Instruction ID: 3a2877ad4cd1d2a3ec2f70cd315363d6a542a6fdbbcdf326c5f25ad3b5f2d62e
Opcode Fuzzy Hash: ed87b5ab3d1e05e545e83ddb3a856e553c24cf120d40b73134e8b8719b0229b9
Instruction Fuzzy Hash: 971182337043149BC760DBB9DC95A7BB3ECFB88622B404A2EEA09D2640D675D845C7A5

Function 004046CC Relevance: 13.6, APIs: 9, Instructions: 57COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F,?,?,?,?,004044F8,00000000), ref: 004046DF
TryEnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,004044F8,00000000), ref: 004046F8
TryEnterCriticalSection.KERNEL32(?,?,?,?,?,?,004044F8,00000000), ref: 00404702
SetLastError.KERNEL32(0000139F,?,?,?,?,?,004044F8,00000000), ref: 00404719
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,004044F8,00000000), ref: 00404722
LeaveCriticalSection.KERNEL32(00000004,?,?,?,?,?,004044F8,00000000), ref: 00404727

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: cd00265e087aae57643f29b67c9b93b5c885d9748c17056c6d0268b10e2155b5
Instruction ID: 464b34e30b8714bcfc4780518cca75fe178f9d0022d49c872ba062527f95968c
Opcode Fuzzy Hash: cd00265e087aae57643f29b67c9b93b5c885d9748c17056c6d0268b10e2155b5
Instruction Fuzzy Hash: 7E01A5B1500204ABC720AB76CC4986BBBECEF89355B01443AE216E31A0D7B4E945CA69

Function 00D5C950 Relevance: 12.7, Strings: 10, Instructions: 238COMMON

Download Yara Rule

Strings

s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type ::ffff:AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitJanuaryKannadaMUI_DltMUI_StdMakasarMandaicMarchenMultaniMyanmarOctoberOsmanyaRadicalSharadaShavianS, xrefs: 00D5CBCB
s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGetClientRectGunjala_GondiMapViewOfFileMasaram_GondiMende_Kikakui, xrefs: 00D5CA64
<== at fp= is lr: of on pc= sp: sp=) = ) m=+Inf-Inf3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomCESTChamDashEESTGOGCJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaSASTStatThaiTypem=] = ] n=allgallpavx2basebindbitsbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandead, xrefs: 00D5CCE4
... MB, and got= max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-09301562578125<nil>AdlamAprilBamumBatakBuhidClassDograErrorGreekKhmerLatinLimbuLocalMarchNushuOghamOriyaOsageRunicSTermTakriTamilTypeA] = (arrayclosedeferfalsefault, xrefs: 00D5CC1F, 00D5CD2A
s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit127.0.0.1:53152587890625762939453125Bidi_ControlCreateThreadGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempP, xrefs: 00D5CA8E
unknown(wsaioctl (forced) B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA (MISSING)(unknown), newval=, oldval=, size = , tail = -07:00:002, xrefs: 00D5CB3B
*( - < > m= n=%: +00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...125625::1???ADTASTBSTCATCDTCETCSTDltEATEDTEETEOFESTGMTHDTHSTHanIDTISTJSTKSTLaoMDTMSKMSTMayMroNDTNSTNaNNkoPC=PDTPKTPSTStdTTLUTCVaiWAT\\?]:adxaesavxcgodnsendfinfmaft, xrefs: 00D5CC50
s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA (MISSING)(unknown), newval=, oldval=, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticFindCloseHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayala, xrefs: 00D5CA3A
s.base()= spinning= stopwait= sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday((BADINDEX), bound = , limit = .localhost/dev/stdin/etc/hosts122070312561035156258.8.8.8:53AdditionalBad varintCancelIoExChorasmianClassCHAOSClassCSNETCreateFile, xrefs: 00D5CA10
) = ) m=+Inf-Inf3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomCESTChamDashEESTGOGCJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaSASTStatThaiTypem=] = ] n=allgallpavx2basebindbitsbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeaddialermsfileftpsfunchttpicmpidleigmpint8itab, xrefs: 00D5CCA4

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: *( - < > m= n=%: +00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...125625::1???ADTASTBSTCATCDTCETCSTDltEATEDTEETEOFESTGMTHDTHSTHanIDTISTJSTKSTLaoMDTMSKMSTMayMroNDTNSTNaNNkoPC=PDTPKTPSTStdTTLUTCVaiWAT\\?]:adxaesavxcgodnsendfinfmaft$ ... MB, and got= max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-09301562578125<nil>AdlamAprilBamumBatakBuhidClassDograErrorGreekKhmerLatinLimbuLocalMarchNushuOghamOriyaOsageRunicSTermTakriTamilTypeA] = (arrayclosedeferfalsefault$ <== at fp= is lr: of on pc= sp: sp=) = ) m=+Inf-Inf3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomCESTChamDashEESTGOGCJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaSASTStatThaiTypem=] = ] n=allgallpavx2basebindbitsbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandead$ s.base()= spinning= stopwait= sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday((BADINDEX), bound = , limit = .localhost/dev/stdin/etc/hosts122070312561035156258.8.8.8:53AdditionalBad varintCancelIoExChorasmianClassCHAOSClassCSNETCreateFile$ s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit127.0.0.1:53152587890625762939453125Bidi_ControlCreateThreadGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempP$ s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA (MISSING)(unknown), newval=, oldval=, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticFindCloseHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayala$ s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGetClientRectGunjala_GondiMapViewOfFileMasaram_GondiMende_Kikakui$ s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type ::ffff:AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitJanuaryKannadaMUI_DltMUI_StdMakasarMandaicMarchenMultaniMyanmarOctoberOsmanyaRadicalSharadaShavianS$) = ) m=+Inf-Inf3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomCESTChamDashEESTGOGCJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaSASTStatThaiTypem=] = ] n=allgallpavx2basebindbitsbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeaddialermsfileftpsfunchttpicmpidleigmpint8itab$unknown(wsaioctl (forced) B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA (MISSING)(unknown), newval=, oldval=, size = , tail = -07:00:002
API String ID: 0-675457366
Opcode ID: 36fbb187ed2ece8a0b7934eabd99e395bab4181251be35001b49ed19c7a03699
Instruction ID: 9e2bf0f6a878a87a9dacbeb1db688eeb0168816b15995120751a281abef86e09
Opcode Fuzzy Hash: 36fbb187ed2ece8a0b7934eabd99e395bab4181251be35001b49ed19c7a03699
Instruction Fuzzy Hash: 03B1CCB4509B448FC704EF64D195A6EBBE0EF88708F41886DF88887352EB34D9489B72

Function 00D49CB0 Relevance: 12.7, Strings: 10, Instructions: 233COMMON

Download Yara Rule

Strings

bad system huge page sizechansend: spurious wakeupcheckdead: no m for timercheckdead: no p for timercontext deadline exceededinconsistent poll.fdMutexinvalid cross-device linkinvalid network interfacemissing stack in newstackmissing traceGCSweepStartno answer , xrefs: 00D49F46
bad system page sizebad use of bucket.bpbad use of bucket.mpchan send (nil chan)close of nil channelconnection timed outdodeltimer0: wrong Pfloating point errorforcegc: phase errorgetadaptersaddressesgo of nil func valuegopark: bad g statusinvalid DNS response, xrefs: 00D49FA8, 00D4A034, 00D4A0C0
failed to get system page sizefreedefer with d._panic != nilinappropriate ioctl for deviceinvalid network interface nameinvalid pointer found on stacknotetsleep - waitm out of syncprotocol wrong type for socketreflect: Elem of invalid type reflect: Len of non-, xrefs: 00D4A0D6
) must be a power of 223283064365386962890625<invalid reflect.Value>Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainCreateAcceleratorTableWDestroyEnvironmentBlockE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvi, xrefs: 00D49F2B, 00D49F8D
bad TinySizeClassentersyscallblockexec format errorg already scannedgp.waiting != nillocked m0 woke upmark - bad statusmarkBits overflownil resource bodyno data availablenotetsleepg on g0permission deniedreflect.Value.Intreflect.Value.Lenreflect: call of runti, xrefs: 00D4A0EC
) is larger than maximum page size () is not Grunnable or Gscanrunnable0123456789abcdefghijklmnopqrstuvwxyz444089209850062616169452667236328125Error setting file hidden attribute:Go pointer stored into non-Go memoryUnable to determine system directoryaccessed, xrefs: 00D4A07B
system huge page size (too many pointers (>10)unexpected address typeunpacking Question.Nameunpacking Question.Typework.nwait > work.nproc1164153218269348144531254grtu7rtshy6uxjsdf5ghjk9582076609134674072265625Azerbaijan Standard TimeBangladesh Standard TimeCa, xrefs: 00D49EFF
) is smaller than minimum page size (2220446049250313080847263336181640625_cgo_notify_runtime_init_done missingall goroutines are asleep - deadlock!cannot create context from nil parentcannot exec a shared library directlycipher: message authentication failedf, xrefs: 00D49FEF
system page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard Ti, xrefs: 00D49F61, 00D49FC3, 00D4A04F
$, xrefs: 00D4A084

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: $$) is larger than maximum page size () is not Grunnable or Gscanrunnable0123456789abcdefghijklmnopqrstuvwxyz444089209850062616169452667236328125Error setting file hidden attribute:Go pointer stored into non-Go memoryUnable to determine system directoryaccessed$) is smaller than minimum page size (2220446049250313080847263336181640625_cgo_notify_runtime_init_done missingall goroutines are asleep - deadlock!cannot create context from nil parentcannot exec a shared library directlycipher: message authentication failedf$) must be a power of 223283064365386962890625<invalid reflect.Value>Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainCreateAcceleratorTableWDestroyEnvironmentBlockE. Africa Standard TimeE. Europe Standard TimeFreeEnvironmentStringsWGetEnvi$bad TinySizeClassentersyscallblockexec format errorg already scannedgp.waiting != nillocked m0 woke upmark - bad statusmarkBits overflownil resource bodyno data availablenotetsleepg on g0permission deniedreflect.Value.Intreflect.Value.Lenreflect: call of runti$bad system huge page sizechansend: spurious wakeupcheckdead: no m for timercheckdead: no p for timercontext deadline exceededinconsistent poll.fdMutexinvalid cross-device linkinvalid network interfacemissing stack in newstackmissing traceGCSweepStartno answer $bad system page sizebad use of bucket.bpbad use of bucket.mpchan send (nil chan)close of nil channelconnection timed outdodeltimer0: wrong Pfloating point errorforcegc: phase errorgetadaptersaddressesgo of nil func valuegopark: bad g statusinvalid DNS response$failed to get system page sizefreedefer with d._panic != nilinappropriate ioctl for deviceinvalid network interface nameinvalid pointer found on stacknotetsleep - waitm out of syncprotocol wrong type for socketreflect: Elem of invalid type reflect: Len of non-$system huge page size (too many pointers (>10)unexpected address typeunpacking Question.Nameunpacking Question.Typework.nwait > work.nproc1164153218269348144531254grtu7rtshy6uxjsdf5ghjk9582076609134674072265625Azerbaijan Standard TimeBangladesh Standard TimeCa$system page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard Ti
API String ID: 0-2473082533
Opcode ID: b9c47694c930224c8f767675c5d71f8d5ba88e5eaf717e8b48eb8d9aa1846f0b
Instruction ID: a279980ed71f5f8c28ebcb24918ca68c72aa2f62b5db5bc57471f3e1d2e243ec
Opcode Fuzzy Hash: b9c47694c930224c8f767675c5d71f8d5ba88e5eaf717e8b48eb8d9aa1846f0b
Instruction Fuzzy Hash: 0FB112B05096098FD704EF25E59479ABBE5FF48304F01C82DE48D87365EB789888EB72

Function 00D45DC0 Relevance: 12.7, Strings: 10, Instructions: 198COMMON

Download Yara Rule

Strings

is nil, not nStackRoots= pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGetClientRectGunjala_Gondi, xrefs: 00D46109
(types from different packages)28421709430404007434844970703125CertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before NextWSAGetOverlappedResult not found" not supported for cpu option "crypto/aes: input not full blockgo p, xrefs: 00D45FBE
, not , val .local.onion390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticFormatFridayGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLycianLydianMondayRejangSCHED StringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UT, xrefs: 00D45EB9
interfaceinvalid nipv6-icmplocalhostmSpanDeadntdll.dllpanicwaitpclmulqdqpreemptedprofBlockpsapi.dllquestionsrecover: reflect: rwxrwxrwxscavtracestackpooltracebackwbufSpans} stack=[ netGo = MB goal, flushGen gfreecnt= heapGoal= pages at ptrSize= runqsize=, xrefs: 00D45DF2
is lr: of on pc= sp: sp=) = ) m=+Inf-Inf3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomCESTChamDashEESTGOGCJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaSASTStatThaiTypem=] = ] n=allgallpavx2basebindbitsbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeaddialermsfileftps, xrefs: 00D45E9F
interface conversion: invalid address familykernel32.dll not foundminpc or maxpc invalidmissing ']' in addressnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledprotocol not availableprotocol not supportedremote address cha, xrefs: 00D45E7D, 00D46039, 00D460E7
is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYCyrillicDecemberDuployanEthiopicExtenderFebruaryFullPathGeorgianGoStringGujaratiGurm, xrefs: 00D46053
(types from different scopes) in prepareForSweep; sweepgen locals stack map entries for 227373675443232059478759765625Central European Standard TimeCentral Standard Time (Mexico)E. South America Standard TimeEastern Standard Time (Mexico)Error getting execut, xrefs: 00D45FF6
, xrefs: 00D45FC8
: missing method DnsRecordListFreeFLE Standard TimeGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWLookupAccountSidWOld_North_ArabianOld_South_ArabianOther_ID_ContinueRegLoadMUIStringWRtlGetCurrentPeb, xrefs: 00D46075

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: $ (types from different packages)28421709430404007434844970703125CertAddCertificateContextToStoreCertVerifyCertificateChainPolicyMapIter.Value called before NextWSAGetOverlappedResult not found" not supported for cpu option "crypto/aes: input not full blockgo p$ (types from different scopes) in prepareForSweep; sweepgen locals stack map entries for 227373675443232059478759765625Central European Standard TimeCentral Standard Time (Mexico)E. South America Standard TimeEastern Standard Time (Mexico)Error getting execut$ is lr: of on pc= sp: sp=) = ) m=+Inf-Inf3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomCESTChamDashEESTGOGCJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaSASTStatThaiTypem=] = ] n=allgallpavx2basebindbitsbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeaddialermsfileftps$ is nil, not nStackRoots= pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGetClientRectGunjala_Gondi$ is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYCyrillicDecemberDuployanEthiopicExtenderFebruaryFullPathGeorgianGoStringGujaratiGurm$, not , val .local.onion390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticFormatFridayGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLycianLydianMondayRejangSCHED StringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UT$: missing method DnsRecordListFreeFLE Standard TimeGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWLookupAccountSidWOld_North_ArabianOld_South_ArabianOther_ID_ContinueRegLoadMUIStringWRtlGetCurrentPeb$interface conversion: invalid address familykernel32.dll not foundminpc or maxpc invalidmissing ']' in addressnetwork is unreachablenon-Go function at pc=oldoverflow is not niloperation was canceledprotocol not availableprotocol not supportedremote address cha$interfaceinvalid nipv6-icmplocalhostmSpanDeadntdll.dllpanicwaitpclmulqdqpreemptedprofBlockpsapi.dllquestionsrecover: reflect: rwxrwxrwxscavtracestackpooltracebackwbufSpans} stack=[ netGo = MB goal, flushGen gfreecnt= heapGoal= pages at ptrSize= runqsize=
API String ID: 0-2120854484
Opcode ID: 94dc3df471a2a5e182185da10bc20afbf50e2878177717b4c94a19d3e1d4ae6f
Instruction ID: 38ced76113b0e3dbd601875723d2129d7cfce4a52fd2ee4bd50785d7fbbd8dbc
Opcode Fuzzy Hash: 94dc3df471a2a5e182185da10bc20afbf50e2878177717b4c94a19d3e1d4ae6f
Instruction Fuzzy Hash: 0FA179B4A083449FD318DF19D190A6ABBE1BF88700F50892EF9D987351DB75E848CF62

Function 2BB7DD10 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000007F), ref: 2BB7DD32
SetLastError.KERNEL32(0000007F), ref: 2BB7DE35

Strings

Main, xrefs: 2BB7DD1F, 2BB7DD5C

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: ErrorLast
String ID: Main
API String ID: 1452528299-521822810
Opcode ID: 6ae8f91ee35b0903907c74cabbd32cc4adbdc1c379eab146ee208750a9ac667b
Instruction ID: e0bd2a5a7b3c7afc3d7f8b48648bbec6f98cea564520f9f9ad5736e1d93ed2db
Opcode Fuzzy Hash: 6ae8f91ee35b0903907c74cabbd32cc4adbdc1c379eab146ee208750a9ac667b
Instruction Fuzzy Hash: 424120B2A406049FEB10EF68DC80BAAB3F4FF94354F0446A9E855CB391E775E941DB90

Function 2D4DA5FB Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,2D52AF70,00000008,2D4DA703,00000000,00000000,?,?,2D4D8092,2D4D8002,?,?,?,2D4D66C6,154.201.87.51,000000FF), ref: 2D4DA60C
__lock.LIBCMT ref: 2D4DA640

Part of subcall function 2D4DC1D7: __mtinitlocknum.LIBCMT ref: 2D4DC1ED
Part of subcall function 2D4DC1D7: __amsg_exit.LIBCMT ref: 2D4DC1F9
Part of subcall function 2D4DC1D7: EnterCriticalSection.KERNEL32(?,?,?,2D4DA645,0000000D), ref: 2D4DC201

InterlockedIncrement.KERNEL32(2D52D720), ref: 2D4DA64D
__lock.LIBCMT ref: 2D4DA661
___addlocaleref.LIBCMT ref: 2D4DA67F

Strings

P/P-, xrefs: 2D4DA615
KERNEL32.DLL, xrefs: 2D4DA607

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL$P/P-
API String ID: 637971194-3197123866
Opcode ID: 16f8dbddcf96c6d363f07501157e5a4d2fd890333cfe5b47c37ec9976f27c871
Instruction ID: ddd6dcf3d01fcf5871f5303527cd07703bc95d7ef588e381e0b3f31a9e60834b
Opcode Fuzzy Hash: 16f8dbddcf96c6d363f07501157e5a4d2fd890333cfe5b47c37ec9976f27c871
Instruction Fuzzy Hash: 6F016172408B00DFD754CF65C859719BBE0EF28721F10890ED6D6A77A0CBB4A645CF55

Function 00403B5B Relevance: 12.1, APIs: 8, Instructions: 86networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?), ref: 00403B88
LeaveCriticalSection.KERNEL32(?), ref: 00403B9E
send.WS2_32(?,?,?,00000000), ref: 00403BBB
EnterCriticalSection.KERNEL32(?), ref: 00403BD0
LeaveCriticalSection.KERNEL32(?), ref: 00403BE3
WSAGetLastError.WS2_32 ref: 00403BFE
EnterCriticalSection.KERNEL32(?), ref: 00403C16
LeaveCriticalSection.KERNEL32 ref: 00403C4E

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ErrorLastsend
String ID:
API String ID: 3480985631-0
Opcode ID: eaa39dd10c1493d520b6b73d0c1e6ba60e7282baad73f42f61dc2c3675b04745
Instruction ID: f7e8c8874b42229415283f37ac488c4608cb3fd5fa2c8d75ade2914539fd37cc
Opcode Fuzzy Hash: eaa39dd10c1493d520b6b73d0c1e6ba60e7282baad73f42f61dc2c3675b04745
Instruction Fuzzy Hash: 75313A71508B059FD320DF79C888AA7BBF8BB08312F404A2EE5AAD3690D734F6058B55

Function 00403C7D Relevance: 12.1, APIs: 8, Instructions: 80networkthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00403C86
SetLastError.KERNEL32(0000139F,?,00000000,74DEDFA0,?,?,00403560,?,CUdpSocket::Start,00000000), ref: 00403D64

Part of subcall function 00402D0D: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 00402D23
Part of subcall function 00402D0D: SwitchToThread.KERNEL32(?,00000001,00000000), ref: 00402D35

send.WS2_32(?,00415448,00000010,00000000), ref: 00403CE8
SetEvent.KERNEL32(00040000,?,?,?,?,00000000,74DEDFA0,?,?,00403560,?,CUdpSocket::Start,00000000), ref: 00403D02
InterlockedExchange.KERNEL32(?,00000000), ref: 00403D0D
WSACloseEvent.WS2_32(?), ref: 00403D1B
shutdown.WS2_32(?,00000001), ref: 00403D2F
closesocket.WS2_32(?), ref: 00403D38

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: EventExchangeInterlockedThread$CloseCompareCurrentErrorLastSwitchclosesocketsendshutdown
String ID:
API String ID: 3254528666-0
Opcode ID: fff06a7402dc2eb01f7863ae7919d73a6a787d2c97de84e19feabbb64d75d229
Instruction ID: 01a6ed736676356f65b124bae59a914274ca92839b4d8fa3424f973e9d85bbeb
Opcode Fuzzy Hash: fff06a7402dc2eb01f7863ae7919d73a6a787d2c97de84e19feabbb64d75d229
Instruction Fuzzy Hash: 0F213971600700AFD7209F6ADD49A8BBBF9FF44706B10492AF192E66A0D775EE409B18

Function 2BB73F60 Relevance: 12.1, APIs: 8, Instructions: 79networkthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 2BB73F65
SetLastError.KERNEL32(0000139F,?,74DEDFA0,2BB73648), ref: 2BB74054

Part of subcall function 2BB72BC0: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 2BB72BD6
Part of subcall function 2BB72BC0: SwitchToThread.KERNEL32 ref: 2BB72BEA

send.WS2_32(?,2BB949C0,00000010,00000000), ref: 2BB73FC6
SetEvent.KERNEL32(?), ref: 2BB73FE9
InterlockedExchange.KERNEL32(?,00000000), ref: 2BB73FF5
WSACloseEvent.WS2_32(?), ref: 2BB74003
shutdown.WS2_32(?,00000001), ref: 2BB7401B
closesocket.WS2_32(?), ref: 2BB74025

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: EventExchangeInterlockedThread$CloseCompareCurrentErrorLastSwitchclosesocketsendshutdown
String ID:
API String ID: 3254528666-0
Opcode ID: e94b947686db47a0ca1802ea437c60ff445283d99a12e8b36fcf991a437b1988
Instruction ID: 4d4599b9b678f73fdb018b370152653b55dce08f0ef8405bb0c988e3e29e0bf6
Opcode Fuzzy Hash: e94b947686db47a0ca1802ea437c60ff445283d99a12e8b36fcf991a437b1988
Instruction Fuzzy Hash: 45210872A00B009FD720EF64C988B6BB7F9FF45751F14491CE2A287690C7BAE4469B90

Function 2D4D3F70 Relevance: 12.1, APIs: 8, Instructions: 79networkthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 2D4D3F75
SetLastError.KERNEL32(0000139F,?,74DEDFA0,2D4D3658), ref: 2D4D4064

Part of subcall function 2D4D2BA0: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 2D4D2BB6
Part of subcall function 2D4D2BA0: SwitchToThread.KERNEL32 ref: 2D4D2BCA

send.WS2_32(?,2D52A8F8,00000010,00000000), ref: 2D4D3FD6
SetEvent.KERNEL32(?), ref: 2D4D3FF9
InterlockedExchange.KERNEL32(?,00000000), ref: 2D4D4005
WSACloseEvent.WS2_32(?), ref: 2D4D4013
shutdown.WS2_32(?,00000001), ref: 2D4D402B
closesocket.WS2_32(?), ref: 2D4D4035

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: EventExchangeInterlockedThread$CloseCompareCurrentErrorLastSwitchclosesocketsendshutdown
String ID:
API String ID: 3254528666-0
Opcode ID: ebc6674f2c531e3b38db2ce9ee65cb9f8e952e3420a0aa4c512745c9d7c43446
Instruction ID: 8f1a403c1c8bac0e5caee80524bb88e000dee488d633b025ca180264cfef68dd
Opcode Fuzzy Hash: ebc6674f2c531e3b38db2ce9ee65cb9f8e952e3420a0aa4c512745c9d7c43446
Instruction Fuzzy Hash: 77216972200B009BD7209F64C898B6BB7F5FF48B16F60891CE286A7790C7BAE445CB54

Function 2BB74060 Relevance: 12.1, APIs: 8, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,2BB74039,?,74DEDFA0,2BB73648), ref: 2BB74074
ResetEvent.KERNEL32(?,?,00000000,2BB74039,?,74DEDFA0,2BB73648), ref: 2BB74087
ResetEvent.KERNEL32(?,?,00000000,2BB74039,?,74DEDFA0,2BB73648), ref: 2BB74090
ResetEvent.KERNEL32(?,?,00000000,2BB74039,?,74DEDFA0,2BB73648), ref: 2BB74099

Part of subcall function 2BB71350: HeapFree.KERNEL32(?,00000000,?,?,?,2BB740A6,?,00000000,2BB74039,?,74DEDFA0,2BB73648), ref: 2BB71390

Part of subcall function 2BB71420: HeapFree.KERNEL32(?,00000000,?,?,?,2BB740B1,?,00000000,2BB74039,?,74DEDFA0,2BB73648), ref: 2BB7143D
Part of subcall function 2BB71420: _free.LIBCMT ref: 2BB71459

HeapDestroy.KERNEL32(?,?,00000000,2BB74039,?,74DEDFA0,2BB73648), ref: 2BB740B9
HeapCreate.KERNEL32(?,?,?,?,00000000,2BB74039,?,74DEDFA0,2BB73648), ref: 2BB740D4
SetEvent.KERNEL32(?,?,00000000,2BB74039,?,74DEDFA0,2BB73648), ref: 2BB74150
LeaveCriticalSection.KERNEL32(?,?,00000000,2BB74039,?,74DEDFA0,2BB73648), ref: 2BB74157

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: EventHeap$Reset$CriticalFreeSection$CreateDestroyEnterLeave_free
String ID:
API String ID: 1219087420-0
Opcode ID: 696e637b194281c8949172d2dde7df9e06ca5f986d8454d608b73e3777040670
Instruction ID: 2c1682ad3bb12029a0b5dc3ddd36347b111ea4fd4e0ab6f6d7fab9c130131121
Opcode Fuzzy Hash: 696e637b194281c8949172d2dde7df9e06ca5f986d8454d608b73e3777040670
Instruction Fuzzy Hash: 69314871A00A02AFDB09EB34C859BA6F7B8FF58311F148259E429C7250DB35E951DFE0

Function 2D4D4070 Relevance: 12.1, APIs: 8, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,2D4D4049,?,74DEDFA0,2D4D3658), ref: 2D4D4084
ResetEvent.KERNEL32(?,?,00000000,2D4D4049,?,74DEDFA0,2D4D3658), ref: 2D4D4097
ResetEvent.KERNEL32(?,?,00000000,2D4D4049,?,74DEDFA0,2D4D3658), ref: 2D4D40A0
ResetEvent.KERNEL32(?,?,00000000,2D4D4049,?,74DEDFA0,2D4D3658), ref: 2D4D40A9

Part of subcall function 2D4D1350: HeapFree.KERNEL32(?,00000000,?,?,?,2D4D40B6,?,00000000,2D4D4049,?,74DEDFA0,2D4D3658), ref: 2D4D1390

Part of subcall function 2D4D1420: HeapFree.KERNEL32(?,00000000,?,?,?,2D4D40C1,?,00000000,2D4D4049,?,74DEDFA0,2D4D3658), ref: 2D4D143D
Part of subcall function 2D4D1420: _free.LIBCMT ref: 2D4D1459

HeapDestroy.KERNEL32(?,?,00000000,2D4D4049,?,74DEDFA0,2D4D3658), ref: 2D4D40C9
HeapCreate.KERNEL32(?,?,?,?,00000000,2D4D4049,?,74DEDFA0,2D4D3658), ref: 2D4D40E4
SetEvent.KERNEL32(?,?,00000000,2D4D4049,?,74DEDFA0,2D4D3658), ref: 2D4D4160
LeaveCriticalSection.KERNEL32(?,?,00000000,2D4D4049,?,74DEDFA0,2D4D3658), ref: 2D4D4167

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: EventHeap$Reset$CriticalFreeSection$CreateDestroyEnterLeave_free
String ID:
API String ID: 1219087420-0
Opcode ID: 8b97565efd29d2a46670eb1e32ee85bc543d29cf79d3fd1fa39d6cd3f0a81a22
Instruction ID: 3f9baf44d345f68009edab9c99e42e290f144ada8f665247bd5e260f615c1232
Opcode Fuzzy Hash: 8b97565efd29d2a46670eb1e32ee85bc543d29cf79d3fd1fa39d6cd3f0a81a22
Instruction Fuzzy Hash: 6D313471600A06AFD789CB74C8A8BAAF7A8FF48711F10C249E52997250CB79A855CF90

Function 0040407F Relevance: 12.1, APIs: 8, Instructions: 73synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?), ref: 00404091
ResetEvent.KERNEL32(?), ref: 00404099
timeGetTime.WINMM ref: 0040409B
InterlockedExchange.KERNEL32(?,00000000), ref: 004040AA
WaitForSingleObject.KERNEL32(?,00001770), ref: 004040F2
ResetEvent.KERNEL32(?), ref: 00404110

Part of subcall function 00403C7D: GetCurrentThreadId.KERNEL32 ref: 00403C86
Part of subcall function 00403C7D: send.WS2_32(?,00415448,00000010,00000000), ref: 00403CE8
Part of subcall function 00403C7D: SetEvent.KERNEL32(00040000,?,?,?,?,00000000,74DEDFA0,?,?,00403560,?,CUdpSocket::Start,00000000), ref: 00403D02
Part of subcall function 00403C7D: InterlockedExchange.KERNEL32(?,00000000), ref: 00403D0D
Part of subcall function 00403C7D: WSACloseEvent.WS2_32(?), ref: 00403D1B
Part of subcall function 00403C7D: shutdown.WS2_32(?,00000001), ref: 00403D2F
Part of subcall function 00403C7D: closesocket.WS2_32(?), ref: 00403D38

InterlockedExchange.KERNEL32(?,00000001), ref: 0040411C
ResetEvent.KERNEL32(?), ref: 00404128

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: Event$Reset$ExchangeInterlocked$CloseCurrentObjectSingleThreadTimeWaitclosesocketsendshutdowntime
String ID:
API String ID: 542259498-0
Opcode ID: 7b5be0166bbc2d200e559abb1d5b70d5c49700fe5dd706b044f74d0ec6793a8b
Instruction ID: ae2b1b349564280eb0239e4b83ac9781016d3b4752a40a5aab77e3eabc6e76ab
Opcode Fuzzy Hash: 7b5be0166bbc2d200e559abb1d5b70d5c49700fe5dd706b044f74d0ec6793a8b
Instruction Fuzzy Hash: A0219F71100B00ABC7319F75CC8999BBBF9EF89710B00093AF28AE62A0D675E9459B58

Function 00D98D70 Relevance: 11.4, Strings: 9, Instructions: 175COMMON

Download Yara Rule

Strings

not in ranges: untyped locals , not a function.WithValue(type /etc/resolv.conf0123456789ABCDEF0123456789abcdef2384185791015625AddDllDirectory, xrefs: 00D98EDE
- < > m= n=%: +00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...125625::1???ADTASTBSTCATCDTCETCSTDltEATEDTEETEOFESTGMTHDTHSTHanIDTISTJSTKSTLaoMDTMSKMSTMayMroNDTNSTNaNNkoPC=PDTPKTPSTStdTTLUTCVaiWAT\\?]:adxaesavxcgodnsendfinfmaftpgc, xrefs: 00D99011
base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not , val .local.onion390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticFormatFridayGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLe, xrefs: 00D98EB4
runtime: type offset out of rangeskip everything and stop the walkslice bounds out of range [%x:%y]stackalloc not on scheduler stackstoplockedm: inconsistent lockingsync: RUnlock of unlocked RWMutextimer period must be non-negativetoo many Answers to pack (>65, xrefs: 00D99045
out of range procedure in to finalizer untyped args -thread limit.WithDeadline(1907348632812595367431640625<not Stringer>CertCloseStoreComputerNameExCreateProcessWCryptGenRandomDefWindowProcWFindFirstFileWFormatMessageWGC assist waitGC worker initGetConso, xrefs: 00D98FE7
!, xrefs: 00D9904E
runtime: type offset base pointer out of rangesignal arrived during external code executionslice bounds out of range [:%x] with length %ystopTheWorld: not stopped (status != _Pgcstop)sysGrow bounds not aligned to pallocChunkBytestried to park scavenger from a, xrefs: 00D98F99
runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spansync.RWMutex.Lockthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version, xrefs: 00D98E89, 00D98FBC
types value=answersconnectconsolecpuproffloat32float64forcegcgctracehead = invalidlookup minpc= nil keypacer: panic: runningsyscalluintptrunknownwaitingwindowswsarecvwsasend bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= poin, xrefs: 00D98F29

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: types value=answersconnectconsolecpuproffloat32float64forcegcgctracehead = invalidlookup minpc= nil keypacer: panic: runningsyscalluintptrunknownwaitingwindowswsarecvwsasend bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= poin$ - < > m= n=%: +00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...125625::1???ADTASTBSTCATCDTCETCSTDltEATEDTEETEOFESTGMTHDTHSTHanIDTISTJSTKSTLaoMDTMSKMSTMayMroNDTNSTNaNNkoPC=PDTPKTPSTStdTTLUTCVaiWAT\\?]:adxaesavxcgodnsendfinfmaftpgc$ base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not , val .local.onion390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticFormatFridayGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLe$ not in ranges: untyped locals , not a function.WithValue(type /etc/resolv.conf0123456789ABCDEF0123456789abcdef2384185791015625AddDllDirectory$ out of range procedure in to finalizer untyped args -thread limit.WithDeadline(1907348632812595367431640625<not Stringer>CertCloseStoreComputerNameExCreateProcessWCryptGenRandomDefWindowProcWFindFirstFileWFormatMessageWGC assist waitGC worker initGetConso$!$runtime: type offset base pointer out of rangesignal arrived during external code executionslice bounds out of range [:%x] with length %ystopTheWorld: not stopped (status != _Pgcstop)sysGrow bounds not aligned to pallocChunkBytestried to park scavenger from a$runtime: type offset out of rangeskip everything and stop the walkslice bounds out of range [%x:%y]stackalloc not on scheduler stackstoplockedm: inconsistent lockingsync: RUnlock of unlocked RWMutextimer period must be non-negativetoo many Answers to pack (>65$runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spansync.RWMutex.Lockthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version
API String ID: 0-1906747915
Opcode ID: a450348a0b3c1236800b1ec3664a659773e9b0dbcdf7b6ac9d908d1e15d425dd
Instruction ID: c69d7b2106e40901b7298c2c07d7e7c085bdb6f820fd809b1b599e6a3741cea9
Opcode Fuzzy Hash: a450348a0b3c1236800b1ec3664a659773e9b0dbcdf7b6ac9d908d1e15d425dd
Instruction Fuzzy Hash: 478101B4509B059FC744EF28D585A9ABBE1FF88704F44882DF48887352EB74D948DB72

Function 00D71EB0 Relevance: 11.4, Strings: 9, Instructions: 172COMMON

Download Yara Rule

Strings

runtime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not foundzero length segment markroot jobs done to unalloca, xrefs: 00D7204B
runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=transitioning GC to the same state as before?tried to run scavenger from another goroutineunsafe.String: ptr is nil and len is not zero (bad use of unsafe.Pointer? try -d, xrefs: 00D7213C
CreateWaitableTimerEx when creating timer failedcould not find GetSystemTimeAsFileTime() syscallnot enough significant bits after mult64bitPow10parsing/packing of this type isn't available yetruntime.preemptM: duplicatehandle failed; errno=runtime: waitforsing, xrefs: 00D72170
runtime.minit: duplicatehandle failedruntime: allocation size out of rangeruntime: unexpected SPWRITE function setprofilebucket: profile already setstartTheWorld: inconsistent mp->nextptoo many Additionals to pack (>65535)too many Authorities to pack (>65535)v, xrefs: 00D721CB
VirtualQuery for stack base failedcrypto/aes: invalid buffer overlapdoaddtimer: P already set in timerforEachP: sched.safePointWait != 0mspan.ensureSwept: m is not lockedout of memory allocating allArenasreflect: Field index out of boundsreflect: Field of non-, xrefs: 00D72115
runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime:, xrefs: 00D720E1
%, xrefs: 00D721D4
runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=transitioning GC to the same state as before?tried to run scavenger from another goroutineunsafe.String: ptr is nil and len i, xrefs: 00D72197
bad g0 stackbad recoverycan't happencas64 failedchan receivecontext.TODOdumping heapend tracegcentersyscallgcBitsArenasgcpacertracegetaddrinfowharddecommithost is downillegal seekinvalid pathinvalid portinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpe, xrefs: 00D720BA

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: %$CreateWaitableTimerEx when creating timer failedcould not find GetSystemTimeAsFileTime() syscallnot enough significant bits after mult64bitPow10parsing/packing of this type isn't available yetruntime.preemptM: duplicatehandle failed; errno=runtime: waitforsing$VirtualQuery for stack base failedcrypto/aes: invalid buffer overlapdoaddtimer: P already set in timerforEachP: sched.safePointWait != 0mspan.ensureSwept: m is not lockedout of memory allocating allArenasreflect: Field index out of boundsreflect: Field of non-$bad g0 stackbad recoverycan't happencas64 failedchan receivecontext.TODOdumping heapend tracegcentersyscallgcBitsArenasgcpacertracegetaddrinfowharddecommithost is downillegal seekinvalid pathinvalid portinvalid slotiphlpapi.dllkernel32.dllmadvdontneedmheapSpe$runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=transitioning GC to the same state as before?tried to run scavenger from another goroutineunsafe.String: ptr is nil and len i$runtime.minit: duplicatehandle failedruntime: allocation size out of rangeruntime: unexpected SPWRITE function setprofilebucket: profile already setstartTheWorld: inconsistent mp->nextptoo many Additionals to pack (>65535)too many Authorities to pack (>65535)v$runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=transitioning GC to the same state as before?tried to run scavenger from another goroutineunsafe.String: ptr is nil and len is not zero (bad use of unsafe.Pointer? try -d$runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime:$runtime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtoo many open filesunexpected g statusunknown wait reasonwinmm.dll not foundzero length segment markroot jobs done to unalloca
API String ID: 0-2610977477
Opcode ID: 3b03e6f5362044f864be2e8d82330400628c21eedc00bdea92628a936170615a
Instruction ID: a394459300617ba0bd9a471db9b6ec9eb4779549ed59803fefe3fa9f262608df
Opcode Fuzzy Hash: 3b03e6f5362044f864be2e8d82330400628c21eedc00bdea92628a936170615a
Instruction Fuzzy Hash: 8781ADB45097459FD300EF68D59975ABBE0EF48708F00896DF48887392EB74D9498B72

Function 00D98AB0 Relevance: 11.4, Strings: 9, Instructions: 156COMMON

Download Yara Rule

Strings

not in ranges: untyped locals , not a function.WithValue(type /etc/resolv.conf0123456789ABCDEF0123456789abcdef2384185791015625AddDllDirectory, xrefs: 00D98BD9
- < > m= n=%: +00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...125625::1???ADTASTBSTCATCDTCETCSTDltEATEDTEETEOFESTGMTHDTHSTHanIDTISTJSTKSTLaoMDTMSKMSTMayMroNDTNSTNaNNkoPC=PDTPKTPSTStdTTLUTCVaiWAT\\?]:adxaesavxcgodnsendfinfmaftpgc, xrefs: 00D98D10
runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spansync.RWMutex.Lockthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version, xrefs: 00D98B84, 00D98CBB
base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not , val .local.onion390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticFormatFridayGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLe, xrefs: 00D98BAF
runtime: name offset out of rangeruntime: text offset out of rangeruntime: type offset out of rangeskip everything and stop the walkslice bounds out of range [%x:%y]stackalloc not on scheduler stackstoplockedm: inconsistent lockingsync: RUnlock of unlocked RWM, xrefs: 00D98D44
out of range procedure in to finalizer untyped args -thread limit.WithDeadline(1907348632812595367431640625<not Stringer>CertCloseStoreComputerNameExCreateProcessWCryptGenRandomDefWindowProcWFindFirstFileWFormatMessageWGC assist waitGC worker initGetConso, xrefs: 00D98CE6
runtime: name offset base pointer out of rangeruntime: panic before malloc heap initializedruntime: text offset base pointer out of rangeruntime: type offset base pointer out of rangesignal arrived during external code executionslice bounds out of range [:%x, xrefs: 00D98C98
!, xrefs: 00D98D4D
types value=answersconnectconsolecpuproffloat32float64forcegcgctracehead = invalidlookup minpc= nil keypacer: panic: runningsyscalluintptrunknownwaitingwindowswsarecvwsasend bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= poin, xrefs: 00D98C28

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: types value=answersconnectconsolecpuproffloat32float64forcegcgctracehead = invalidlookup minpc= nil keypacer: panic: runningsyscalluintptrunknownwaitingwindowswsarecvwsasend bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= poin$ - < > m= n=%: +00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...125625::1???ADTASTBSTCATCDTCETCSTDltEATEDTEETEOFESTGMTHDTHSTHanIDTISTJSTKSTLaoMDTMSKMSTMayMroNDTNSTNaNNkoPC=PDTPKTPSTStdTTLUTCVaiWAT\\?]:adxaesavxcgodnsendfinfmaftpgc$ base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not , val .local.onion390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticFormatFridayGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLe$ not in ranges: untyped locals , not a function.WithValue(type /etc/resolv.conf0123456789ABCDEF0123456789abcdef2384185791015625AddDllDirectory$ out of range procedure in to finalizer untyped args -thread limit.WithDeadline(1907348632812595367431640625<not Stringer>CertCloseStoreComputerNameExCreateProcessWCryptGenRandomDefWindowProcWFindFirstFileWFormatMessageWGC assist waitGC worker initGetConso$!$runtime: name offset base pointer out of rangeruntime: panic before malloc heap initializedruntime: text offset base pointer out of rangeruntime: type offset base pointer out of rangesignal arrived during external code executionslice bounds out of range [:%x$runtime: name offset out of rangeruntime: text offset out of rangeruntime: type offset out of rangeskip everything and stop the walkslice bounds out of range [%x:%y]stackalloc not on scheduler stackstoplockedm: inconsistent lockingsync: RUnlock of unlocked RWM$runtime: nameOff runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spansync.RWMutex.Lockthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version
API String ID: 0-1878492405
Opcode ID: 427e92be742dbf00e6fd812967cbc353503145c29412cf6fc364717fe4eb1a55
Instruction ID: 57e2729ede21714630aa44d3a8769a228aefb14ae35cff7ede21992e16073f9b
Opcode Fuzzy Hash: 427e92be742dbf00e6fd812967cbc353503145c29412cf6fc364717fe4eb1a55
Instruction Fuzzy Hash: A661ECB4509B049FC704EF64D1856AABBE1FF88704F40882DF88887352EB74D988DB72

Function 00D500F0 Relevance: 11.4, Strings: 9, Instructions: 121COMMON

Download Yara Rule

Strings

to unused region of span2006-01-02T15:04:05Z07:002910383045673370361328125AUS Central Standard TimeAUS Eastern Standard TimeAfghanistan Standard TimeExpandEnvironmentStringsWGODEBUG: can not enable "GetFinalPathNameByHandleWGetQueuedCompletionStatusKaliningra, xrefs: 00D50318
objectpopcntrdtscpreturnselectsocketstringstructsweep sysmontelnettimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type ::ffff:AvestanBengaliBrailleCh, xrefs: 00D50206
found bad pointer in Go heap (incorrect use of unsafe or cgo?)limiterEvent.stop: found wrong event in p's limiter event slotreflect: reflect.Value.Pointer on an invalid notinheap pointerruntime: internal error: misuse of lockOSThread/unlockOSThreadmalformed GO, xrefs: 00D5017C
runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spansync.RWMutex.Lockthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version, xrefs: 00D50113
>, xrefs: 00D50185
runtime: found in object at *(runtime: impossible type kind socket operation on non-socketsync: inconsistent mutex statesync: unlock of unlocked mutexunsafe.Slice: len out of range) not in usable address space: ...additional frames elided....lib section in a., xrefs: 00D50197
to unallocated span37252902984619140625Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryInfo, xrefs: 00D50255
span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit127.0.0.1:53152587890625762939453125Bidi_ControlCreateThreadGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLoadLibr, xrefs: 00D502B1
span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGetClientRectGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextW, xrefs: 00D50287

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: unknown pc CertOpenStoreFindFirstFileFindNextFileWFreeAddrInfoWGC sweep waitGetClientRectGunjala_GondiMapViewOfFileMasaram_GondiMende_KikakuiModule32NextW$ span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit127.0.0.1:53152587890625762939453125Bidi_ControlCreateThreadGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLoadLibr$ to unallocated span37252902984619140625Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGetAdaptersAddressesGetCurrentDirectoryWGetFileAttributesExWGetProcessMemoryInfo$ to unused region of span2006-01-02T15:04:05Z07:002910383045673370361328125AUS Central Standard TimeAUS Eastern Standard TimeAfghanistan Standard TimeExpandEnvironmentStringsWGODEBUG: can not enable "GetFinalPathNameByHandleWGetQueuedCompletionStatusKaliningra$>$found bad pointer in Go heap (incorrect use of unsafe or cgo?)limiterEvent.stop: found wrong event in p's limiter event slotreflect: reflect.Value.Pointer on an invalid notinheap pointerruntime: internal error: misuse of lockOSThread/unlockOSThreadmalformed GO$objectpopcntrdtscpreturnselectsocketstringstructsweep sysmontelnettimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type ::ffff:AvestanBengaliBrailleCh$runtime: found in object at *(runtime: impossible type kind socket operation on non-socketsync: inconsistent mutex statesync: unlock of unlocked mutexunsafe.Slice: len out of range) not in usable address space: ...additional frames elided....lib section in a.$runtime: pointer runtime: summary[runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spansync.RWMutex.Lockthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version
API String ID: 0-2313556339
Opcode ID: 035823285ad1b34dc02fc1a17d861827df149a4a05ef5dcbad1692c6a743215c
Instruction ID: 75b411a36f668c8ab49aede62ad386623e6529fad142dc9b292204b62cf6283b
Opcode Fuzzy Hash: 035823285ad1b34dc02fc1a17d861827df149a4a05ef5dcbad1692c6a743215c
Instruction Fuzzy Hash: C9519EB4409B049ED700EF64C599BAEBBE4EF48708F41886DF8C887252F774D9489B72

Function 2B9FB62F Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 351COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2B9FB839
_memset.LIBCMT ref: 2B9FB86E

Part of subcall function 2B9FF0C6: _malloc.LIBCMT ref: 2B9FF0E0

Strings

gfff, xrefs: 2B9FB6CF
gfff, xrefs: 2B9FB6F7
(, xrefs: 2B9FB7FD
6, xrefs: 2B9FB820

Memory Dump Source

Source File: 00000000.00000002.4113322478.000000002B9F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 2B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b9f0000_L8RabfF1Hu.jbxd

Similarity

API ID: _memset$_malloc
String ID: ($6$gfff$gfff
API String ID: 3506388080-713438465
Opcode ID: adc29c7617633d4b8d790a07087d8aa0c6b7af03618b52efd29b7f2ce1e6f169
Instruction ID: 274101dc437c21229a36040983a8baf1fbb9c2dd976f7d10708dfcb41e04233c
Opcode Fuzzy Hash: adc29c7617633d4b8d790a07087d8aa0c6b7af03618b52efd29b7f2ce1e6f169
Instruction Fuzzy Hash: E9D17AB1E01318AFDF10DFE9E885BAEBBB9FF58300F104529E505AB251D770A945CBA1

Function 2BB72140 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 303COMMON

Download Yara Rule

APIs

Part of subcall function 2BB71610: __vswprintf.LIBCMT ref: 2BB71646

_malloc.LIBCMT ref: 2BB72330

Part of subcall function 2BB7F673: __FF_MSGBANNER.LIBCMT ref: 2BB7F68C
Part of subcall function 2BB7F673: __NMSG_WRITE.LIBCMT ref: 2BB7F693
Part of subcall function 2BB7F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C,2BB88E76), ref: 2BB7F6B8

Strings

[RI] %d bytes, xrefs: 2BB7216F
input wins: %lu, xrefs: 2BB723CF
input probe, xrefs: 2BB723A1
input psh: sn=%lu ts=%lu, xrefs: 2BB722DF
input ack: sn=%lu rtt=%ld rto=%ld, xrefs: 2BB722AC

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: AllocateHeap__vswprintf_malloc
String ID: [RI] %d bytes$input ack: sn=%lu rtt=%ld rto=%ld$input probe$input psh: sn=%lu ts=%lu$input wins: %lu
API String ID: 3723585974-868042568
Opcode ID: b71beb5b82ca08cc1164dbda49cb969c48fc1ec9fbba7e5b1daf39cb6d4d8820
Instruction ID: 2381f55e192c8deb2e4fada6403b9543d1cf072cad2b35caf112923d43c1f562
Opcode Fuzzy Hash: b71beb5b82ca08cc1164dbda49cb969c48fc1ec9fbba7e5b1daf39cb6d4d8820
Instruction Fuzzy Hash: C0B1B372E002058FCF18EF68D881AAA77B1FF49310F1445AEDDA99B35AD731D941DBA0

Function 2D4D2140 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 303COMMON

Download Yara Rule

APIs

Part of subcall function 2D4D1610: __vswprintf.LIBCMT ref: 2D4D1646

_malloc.LIBCMT ref: 2D4D2330

Part of subcall function 2D4D7E03: __FF_MSGBANNER.LIBCMT ref: 2D4D7E1C
Part of subcall function 2D4D7E03: __NMSG_WRITE.LIBCMT ref: 2D4D7E23
Part of subcall function 2D4D7E03: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,2D4DADD0,00000000,00000001,00000000,?,2D4DC162,00000018,2D52AFE0,0000000C,2D4DC1F2), ref: 2D4D7E48

Strings

input ack: sn=%lu rtt=%ld rto=%ld, xrefs: 2D4D22AC
input psh: sn=%lu ts=%lu, xrefs: 2D4D22DF
input wins: %lu, xrefs: 2D4D23CF
[RI] %d bytes, xrefs: 2D4D216F
input probe, xrefs: 2D4D23A1

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: AllocateHeap__vswprintf_malloc
String ID: [RI] %d bytes$input ack: sn=%lu rtt=%ld rto=%ld$input probe$input psh: sn=%lu ts=%lu$input wins: %lu
API String ID: 3723585974-868042568
Opcode ID: bc178d5a6fc7adc0fe4d24957338c5f508ba04bc1d0c1e013ec895b77bdbfa26
Instruction ID: 01d18f96c9e4d57eddeaaf96d56c5cda1742560e0c18068ecdc37d803e5d6b9f
Opcode Fuzzy Hash: bc178d5a6fc7adc0fe4d24957338c5f508ba04bc1d0c1e013ec895b77bdbfa26
Instruction Fuzzy Hash: A1B1A472A042058FCB48CF68C8E06AA77A5FF48710F15C5AEEE19BB34AD731D941CB90

Function 2BB71830 Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 2BB71878
_free.LIBCMT ref: 2BB718B6
_free.LIBCMT ref: 2BB718F5
_free.LIBCMT ref: 2BB71935
_free.LIBCMT ref: 2BB7195D
_free.LIBCMT ref: 2BB71981
_free.LIBCMT ref: 2BB719B9

Part of subcall function 2BB7F639: RtlFreeHeap.NTDLL(00000000,00000000,?,2BB83E4C,00000000,?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C,2BB88E76), ref: 2BB7F64F
Part of subcall function 2BB7F639: GetLastError.KERNEL32(00000000,?,2BB83E4C,00000000,?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C,2BB88E76,00000000), ref: 2BB7F661

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5de8f00b77dcbaaf7a3b6fe80d9b1dadc022544f04257418c53dffd350f8575
Instruction ID: 2384b04e3104a322abff81418f4f85af9b86c1c70902a5c30620eb937370e429
Opcode Fuzzy Hash: d5de8f00b77dcbaaf7a3b6fe80d9b1dadc022544f04257418c53dffd350f8575
Instruction Fuzzy Hash: 5A513D73A00211CFCB04EF58C584969BBB6FF9921472580ADC6299B325D732ED83DFA1

Function 2D4D1830 Relevance: 10.7, APIs: 7, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 2D4D1878
_free.LIBCMT ref: 2D4D18B6
_free.LIBCMT ref: 2D4D18F5
_free.LIBCMT ref: 2D4D1935
_free.LIBCMT ref: 2D4D195D
_free.LIBCMT ref: 2D4D1981
_free.LIBCMT ref: 2D4D19B9

Part of subcall function 2D4D7DC9: RtlFreeHeap.NTDLL(00000000,00000000,?,2D4DA719,00000000,?,?,2D4D8092,2D4D8002,?,?,?,2D4D66C6,154.201.87.51,000000FF,?), ref: 2D4D7DDF
Part of subcall function 2D4D7DC9: GetLastError.KERNEL32(00000000,?,2D4DA719,00000000,?,?,2D4D8092,2D4D8002,?,?,?,2D4D66C6,154.201.87.51,000000FF,?), ref: 2D4D7DF1

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 87cab4d4d935510312a36b6a1d122c09e38300d761de046880129a538a598611
Instruction ID: d6848dfc3bcabab1509972b4337bd6d79755605661c8bcb9d606dc2134531aaf
Opcode Fuzzy Hash: 87cab4d4d935510312a36b6a1d122c09e38300d761de046880129a538a598611
Instruction Fuzzy Hash: A4516DB7A00111CFC744DF49C094965BBB6FF9C254B2580ADEA4A6B311C772ED46CB91

Function 2BB73870 Relevance: 10.6, APIs: 7, Instructions: 149threadnetworktimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 2BB73883
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,00000000,FFFFD8F0,000000FF), ref: 2BB738C4
WSAWaitForMultipleEvents.WS2_32(00000004,?,00000000,000000FF,00000000), ref: 2BB73931
GetCurrentThreadId.KERNEL32 ref: 2BB7395C
GetLastError.KERNEL32(?,00000000,000000FF,00000000), ref: 2BB739F4
SetLastError.KERNEL32(0000139F,?,00000000,000000FF,00000000), ref: 2BB73A22
WSAGetLastError.WS2_32(?,00000000,000000FF,00000000), ref: 2BB73A39

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: ErrorLast$CurrentThread$EventsMultipleTimerWaitWaitable
String ID:
API String ID: 3058130114-0
Opcode ID: 49ea28853b727bbb6402ef79f9bb2cbe93f00fb9eba7fd8e1efb5009de6a54b6
Instruction ID: cc601b269ed20a8a8f301d9792e14d42f9c12a48914bd67c8be18b226dd0485f
Opcode Fuzzy Hash: 49ea28853b727bbb6402ef79f9bb2cbe93f00fb9eba7fd8e1efb5009de6a54b6
Instruction Fuzzy Hash: D151CC72A80B009BDB20EF24C985B9AB7F4FF14710F108529D9ABD7290EB31E942DB51

Function 2D4D3880 Relevance: 10.6, APIs: 7, Instructions: 149threadnetworktimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 2D4D3893
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,00000000,FFFFD8F0,000000FF), ref: 2D4D38D4
WSAWaitForMultipleEvents.WS2_32(00000004,?,00000000,000000FF,00000000), ref: 2D4D3941
GetCurrentThreadId.KERNEL32 ref: 2D4D396C
GetLastError.KERNEL32(?,00000000,000000FF,00000000), ref: 2D4D3A04
SetLastError.KERNEL32(0000139F,?,00000000,000000FF,00000000), ref: 2D4D3A32
WSAGetLastError.WS2_32(?,00000000,000000FF,00000000), ref: 2D4D3A49

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: ErrorLast$CurrentThread$EventsMultipleTimerWaitWaitable
String ID:
API String ID: 3058130114-0
Opcode ID: c8c37c35e9584e3ce20d7ae2aea8f8435d2818e5c2cf577a14bc7c5a371a4dba
Instruction ID: 8323d1a1a2e49b239224174cd5caf947a3432d43bbe11ac9cba6e274a39918b6
Opcode Fuzzy Hash: c8c37c35e9584e3ce20d7ae2aea8f8435d2818e5c2cf577a14bc7c5a371a4dba
Instruction Fuzzy Hash: C351C4726047019BD7A0DF64C9A8B6AB7E4FF04B18F60845DEA9AB7380D774F941CB44

Function 00403D6E Relevance: 10.6, APIs: 7, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,00000000,?,?,00403D47,?,?,?,?,00000000,74DEDFA0,?,?,00403560), ref: 00403D89
ResetEvent.KERNEL32(?,?,?,00403D47,?,?,?,?,00000000,74DEDFA0,?,?,00403560,?,CUdpSocket::Start,00000000), ref: 00403D9B
ResetEvent.KERNEL32(?,?,?,00403D47,?,?,?,?,00000000,74DEDFA0,?,?,00403560,?,CUdpSocket::Start,00000000), ref: 00403DA3
ResetEvent.KERNEL32(?,?,?,00403D47,?,?,?,?,00000000,74DEDFA0,?,?,00403560,?,CUdpSocket::Start,00000000), ref: 00403DAB
HeapFree.KERNEL32(?,00000000,00000000,?,?,00403D47,?,?,?,?,00000000,74DEDFA0,?,?,00403560), ref: 00403DBF
SetEvent.KERNEL32(?,?,?,00403D47,?,?,?,?,00000000,74DEDFA0,?,?,00403560,?,CUdpSocket::Start,00000000), ref: 00403E41
LeaveCriticalSection.KERNEL32(00040000,?,?,00403D47,?,?,?,?,00000000,74DEDFA0,?,?,00403560,?,CUdpSocket::Start,00000000), ref: 00403E4A

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: Event$Reset$CriticalSection$EnterFreeHeapLeave
String ID:
API String ID: 1940115254-0
Opcode ID: b0ebef6e85874d2ca91ce5a4f934140c7660f4af46ab5262681a8454505c747f
Instruction ID: 70f7c0f7bb405fbde3ab9f6e7a83a19aeaf4651cb06ac7ed6e1aeb30c88943f7
Opcode Fuzzy Hash: b0ebef6e85874d2ca91ce5a4f934140c7660f4af46ab5262681a8454505c747f
Instruction Fuzzy Hash: 6D318B70100A01DFC721EF75C88899ABBF9FF48316B10857EE21AA72A0DB35AA01CB44

Function 2BB7E6B0 Relevance: 10.5, APIs: 7, Instructions: 44filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,?,?,2BB7E815,?,?,?,?,74DF23A0,00000000), ref: 2BB7E6BD
CreateFileW.KERNEL32(2BBA0D80,40000000,00000002,00000000,00000004,00000002,00000000,?,?,2BB7E815,?,?,?,?,74DF23A0,00000000), ref: 2BB7E6D7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 2BB7E6F2
lstrlenW.KERNEL32(?,00000000,00000000), ref: 2BB7E6FF
WriteFile.KERNEL32(00000000,?,00000000), ref: 2BB7E70A
CloseHandle.KERNEL32(00000000), ref: 2BB7E711
ReleaseMutex.KERNEL32(00000000), ref: 2BB7E71E

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID:
API String ID: 4202892810-0
Opcode ID: 9c060a605b413d4b0e5128c12b439119e810ab4b8fc40a80f97869090c32218f
Instruction ID: 286ef04260e0ae6fb42940243f931aef8fcc354fd29a3c3555a5a82c49fc9877
Opcode Fuzzy Hash: 9c060a605b413d4b0e5128c12b439119e810ab4b8fc40a80f97869090c32218f
Instruction Fuzzy Hash: 8B01F471E41A10BBE3109BA4DE0FFBA366CEF09721F100200F754E71C0C6B9E8118BA4

Function 00408DA6 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00415B50,00000008,00408EAE,00000000,00000000,?,00409550,?,00000001,?,?,0040A9D1,00000018,00415BC0,0000000C), ref: 00408DB7
__lock.LIBCMT ref: 00408DEB

Part of subcall function 0040AA46: __mtinitlocknum.LIBCMT ref: 0040AA5C
Part of subcall function 0040AA46: __amsg_exit.LIBCMT ref: 0040AA68
Part of subcall function 0040AA46: EnterCriticalSection.KERNEL32(?,?,?,00408F7E,0000000D,00415B78,00000008,00405E55,?,00000000), ref: 0040AA70

InterlockedIncrement.KERNEL32(00417730), ref: 00408DF8
__lock.LIBCMT ref: 00408E0C
___addlocaleref.LIBCMT ref: 00408E2A

Strings

KERNEL32.DLL, xrefs: 00408DB2

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 5d5e36c25058e90352d5dcd955f2d92a86728bcb8bc9949d51d59cb53f218962
Instruction ID: b3cdf994ab4a9c5334460ec25d99e31aef2ca20d3ae7d973c375cb18b0f2bac2
Opcode Fuzzy Hash: 5d5e36c25058e90352d5dcd955f2d92a86728bcb8bc9949d51d59cb53f218962
Instruction Fuzzy Hash: 4301A171540700DAD720AF66C945789FBF0AF44319F10852FE499A77E1CBB8AA40CF59

Function 2BB83D2E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,2BB96318,00000008,2BB83E36,00000000,00000000,?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C), ref: 2BB83D3F
__lock.LIBCMT ref: 2BB83D73

Part of subcall function 2BB88E5B: __mtinitlocknum.LIBCMT ref: 2BB88E71
Part of subcall function 2BB88E5B: __amsg_exit.LIBCMT ref: 2BB88E7D
Part of subcall function 2BB88E5B: EnterCriticalSection.KERNEL32(00000000,00000000,?,2BB83F06,0000000D,2BB96340,00000008,2BB83FFF,00000000,?,2BB810F0,00000000,2BB96278,00000008,2BB81155,?), ref: 2BB88E85

InterlockedIncrement.KERNEL32(?), ref: 2BB83D80
__lock.LIBCMT ref: 2BB83D94
___addlocaleref.LIBCMT ref: 2BB83DB2

Strings

KERNEL32.DLL, xrefs: 2BB83D3A

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: e3d42e1c151830276ece920fda7bf6da61c91bf9f7062a1b9ae6eeef01916346
Instruction ID: 582bc7c837c30959685b0543ecc0d544039ff496b9bc5d91ce2797d5dc5c749d
Opcode Fuzzy Hash: e3d42e1c151830276ece920fda7bf6da61c91bf9f7062a1b9ae6eeef01916346
Instruction Fuzzy Hash: A0016D71800B00EBEF20CF69D945749FBE0AF64310F10891EE4DA972A0CB74A641CF15

Function 2BB7B78C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Console,00000000,00000002), ref: 2BB7B7A7
RegDeleteValueW.ADVAPI32(?,IpDatespecial), ref: 2BB7B7B7
RegSetValueExW.ADVAPI32(?,IpDatespecial,00000000,00000003,?,00000004), ref: 2BB7B7CE
RegCloseKey.ADVAPI32(?,?,00000004), ref: 2BB7B7D9

Strings

Console, xrefs: 2BB7B79D
IpDatespecial, xrefs: 2BB7B7B1, 2BB7B7C8

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Value$CloseDeleteOpen
String ID: Console$IpDatespecial
API String ID: 3183427449-1840232981
Opcode ID: f3c0a665d5fd3a85d2161daa1dc4c2370d5f7fd9d49863f8219e1d7a529da9e0
Instruction ID: 705a1f5f22228df1563552ec1bdcb9c94bd0d9894754cf6ed307f20c37c8bcec
Opcode Fuzzy Hash: f3c0a665d5fd3a85d2161daa1dc4c2370d5f7fd9d49863f8219e1d7a529da9e0
Instruction Fuzzy Hash: A4F0A071A94740FFE3248B60AD8EF66B764FB88701F50461DFBC4661818A6AE101CF66

Function 00411E60 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00411E81

Part of subcall function 00408ED3: __getptd_noexit.LIBCMT ref: 00408ED6
Part of subcall function 00408ED3: __amsg_exit.LIBCMT ref: 00408EE3

__getptd.LIBCMT ref: 00411E92
__getptd.LIBCMT ref: 00411EA0

Strings

RCC, xrefs: 00411E6C
csm, xrefs: 00411E7A
MOC, xrefs: 00411E73

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 1bf31e07cf1033e39a48527a9ad6bca6032a43e3d210e0e77a634f4b1097a4b6
Instruction ID: 2af61cdeb895b4406404626905aef18f7087ec9127a7fcf37c87c93ba49c44e2
Opcode Fuzzy Hash: 1bf31e07cf1033e39a48527a9ad6bca6032a43e3d210e0e77a634f4b1097a4b6
Instruction Fuzzy Hash: 75E012345003088ECB209BA5D14A7AB33A4EB48318F1A45BBE94CD7373DB3CE894559B

Function 2BB902FC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 2BB9031D

Part of subcall function 2BB83E5B: __getptd_noexit.LIBCMT ref: 2BB83E5E
Part of subcall function 2BB83E5B: __amsg_exit.LIBCMT ref: 2BB83E6B

__getptd.LIBCMT ref: 2BB9032E
__getptd.LIBCMT ref: 2BB9033C

Strings

RCC, xrefs: 2BB90308
csm, xrefs: 2BB90316
MOC, xrefs: 2BB9030F

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: a1f0d33c8d38bd48e94782b4de51ff7935ea793739f44933f6f473294c896614
Instruction ID: 5b0ddb970979f341b2c021f4dbec2b5bde00ebb8cf798ce3ce6158f6438edfff
Opcode Fuzzy Hash: a1f0d33c8d38bd48e94782b4de51ff7935ea793739f44933f6f473294c896614
Instruction Fuzzy Hash: B5E09A35518504CFCF10DB68D186B6836D9EB6C615F9544B1E50CCB232D738E5908996

Function 2D500C73 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 2D500C94

Part of subcall function 2D4DA728: __getptd_noexit.LIBCMT ref: 2D4DA72B
Part of subcall function 2D4DA728: __amsg_exit.LIBCMT ref: 2D4DA738

__getptd.LIBCMT ref: 2D500CA5
__getptd.LIBCMT ref: 2D500CB3

Strings

csm, xrefs: 2D500C8D
RCC, xrefs: 2D500C7F
MOC, xrefs: 2D500C86

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 8149de7511cd4e6ff05cba69110b733c41889b0d36a929712ecf72fb4e9677b7
Instruction ID: 0c2bcbe3bc1d13776a9c0d40d138a9907d9a26155fa95dc048fc3b897dd47471
Opcode Fuzzy Hash: 8149de7511cd4e6ff05cba69110b733c41889b0d36a929712ecf72fb4e9677b7
Instruction Fuzzy Hash: 18E092321182048EC700D768C045BA832E4FF5C74DF2645A6D50CEB262C765D5808542

Function 00D5AD50 Relevance: 10.5, Strings: 8, Instructions: 457COMMON

Download Yara Rule

Strings

runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringsunknown portwirep: p->m=worker mode != sweepgen MB globals, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= pluginpath= s.spanclass= span.base, xrefs: 00D5AFDB, 00D5B3F2
, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentProcessIdGetSystemDire, xrefs: 00D5B02A, 00D5B441, 00D5B50C
mark - bad statusmarkBits overflownil resource bodyno data availablenotetsleepg on g0permission deniedreflect.Value.Intreflect.Value.Lenreflect: call of runtime.newosprocruntime/internal/runtime: level = runtime: nameOff runtime: pointer runtime: summary[runti, xrefs: 00D5B05E
, goid=, j0 = 19531259765625: type ::ffff:AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitJanuaryKannadaMUI_DltMUI_StdMakasarMandaicMarchenMultaniMyanmarOctoberOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboT, xrefs: 00D5B000, 00D5B417, 00D5B4E2
can't scan our own stackconnection reset by peerdouble traceGCSweepStartfunction not implementedgcDrainN phase incorrecthash of unhashable type hy6uhgt5wb9hyxy8fgetgf5ylevel 2 not synchronizedlink number out of rangenot supported by windowsout of streams resou, xrefs: 00D5B3A1
scanstack: goroutine not stoppedscavenger state is already wiredslice bounds out of range [%x::]slice bounds out of range [:%x:]slice bounds out of range [::%x]software caused connection abortsweep increased allocation countsync: Unlock of unlocked RWMutexsync, xrefs: 00D5B475
runtime:scanstack: gp=s.freeindex > s.nelemsscanstack - bad statussend on closed channelskipping Question Nameskipping Question Typespan has no free spacestack not a power of 2trace reader (blocked)trace: alloc too largeunexpected method stepwirep: invalid p s, xrefs: 00D5B4BD
, xrefs: 00D5B47E

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: $, goid=, j0 = 19531259765625: type ::ffff:AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitJanuaryKannadaMUI_DltMUI_StdMakasarMandaicMarchenMultaniMyanmarOctoberOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboT$, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentProcessIdGetSystemDire$can't scan our own stackconnection reset by peerdouble traceGCSweepStartfunction not implementedgcDrainN phase incorrecthash of unhashable type hy6uhgt5wb9hyxy8fgetgf5ylevel 2 not synchronizedlink number out of rangenot supported by windowsout of streams resou$mark - bad statusmarkBits overflownil resource bodyno data availablenotetsleepg on g0permission deniedreflect.Value.Intreflect.Value.Lenreflect: call of runtime.newosprocruntime/internal/runtime: level = runtime: nameOff runtime: pointer runtime: summary[runti$runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringsunknown portwirep: p->m=worker mode != sweepgen MB globals, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= pluginpath= s.spanclass= span.base$runtime:scanstack: gp=s.freeindex > s.nelemsscanstack - bad statussend on closed channelskipping Question Nameskipping Question Typespan has no free spacestack not a power of 2trace reader (blocked)trace: alloc too largeunexpected method stepwirep: invalid p s$scanstack: goroutine not stoppedscavenger state is already wiredslice bounds out of range [%x::]slice bounds out of range [:%x:]slice bounds out of range [::%x]software caused connection abortsweep increased allocation countsync: Unlock of unlocked RWMutexsync
API String ID: 0-1749166126
Opcode ID: 0c51f8cbe1b956b3dc5e721f895cfa3ddb9e8dd45635fc7178020c878c112ec3
Instruction ID: eb7cad671fe74ea3b006ac8682203ad77174c97f90e2ca1a0dd49584bea1eb1e
Opcode Fuzzy Hash: 0c51f8cbe1b956b3dc5e721f895cfa3ddb9e8dd45635fc7178020c878c112ec3
Instruction Fuzzy Hash: 3C22C2B4508744CFC764EF28C594B9ABBE0FF88715F14892DE8888B351E775D948CB62

Function 00D41120 Relevance: 10.3, Strings: 8, Instructions: 348COMMON

Download Yara Rule

Strings

", missing CPU supportbytes.Buffer: too largechan receive (nil chan)close of closed channeldevice or resource busyfatal: morestack on g0garbage collection scangcDrain phase incorrectindex out of range [%x]interrupted system callinvalid m->lockedInt = left ov, xrefs: 00D413E3
cpu., xrefs: 00D41193
!, xrefs: 00D41316
GODEBUG: can not enable "GetFinalPathNameByHandleWGetQueuedCompletionStatusKaliningrad Standard TimeMiddle East Standard TimeNew Zealand Standard TimeNorth Korea Standard TimeSouth Sudan Standard TimeTransbaikal Standard TimeUS Mountain Standard TimeUlaanbaata, xrefs: 00D413B9
GODEBUG: value "GetComputerNameWGetConsoleWindowGetCurrentThreadGetFullPathNameWGetLongPathNameWGetModuleHandleWImperial_AramaicMeroitic_CursiveNetApiBufferFreeOpenProcessTokenOther_AlphabeticRCodeFormatErrorRegQueryInfoKeyWRegQueryValueExWRegisterClassExWRemo, xrefs: 00D41284
" not supported for cpu option "crypto/aes: input not full blockgo package net: hostLookupOrder(invalid limiter event type foundnumerical argument out of domainpanic while printing panic valuereflect.nameFrom: tag too long: removespecial on invalid pointerreso, xrefs: 00D412AE
GODEBUG: unknown cpu feature "MapIter.Key called before NextPacific Standard Time (Mexico)Turks And Caicos Standard Timeabi mismatch detected between assignment to entry in nil mapcheckdead: inconsistent countsfailed to get system page sizefreedefer with d._pa, xrefs: 00D41512
GODEBUG: no value specified for "InitializeProcThreadAttributeListconcurrent map read and map writecrypto/aes: output not full blockfindrunnable: negative nmspinningfreeing stack not in a stack spango package net: confVal.netCgo = min must be a non-zero power , xrefs: 00D4130D

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: !$" not supported for cpu option "crypto/aes: input not full blockgo package net: hostLookupOrder(invalid limiter event type foundnumerical argument out of domainpanic while printing panic valuereflect.nameFrom: tag too long: removespecial on invalid pointerreso$", missing CPU supportbytes.Buffer: too largechan receive (nil chan)close of closed channeldevice or resource busyfatal: morestack on g0garbage collection scangcDrain phase incorrectindex out of range [%x]interrupted system callinvalid m->lockedInt = left ov$GODEBUG: can not enable "GetFinalPathNameByHandleWGetQueuedCompletionStatusKaliningrad Standard TimeMiddle East Standard TimeNew Zealand Standard TimeNorth Korea Standard TimeSouth Sudan Standard TimeTransbaikal Standard TimeUS Mountain Standard TimeUlaanbaata$GODEBUG: no value specified for "InitializeProcThreadAttributeListconcurrent map read and map writecrypto/aes: output not full blockfindrunnable: negative nmspinningfreeing stack not in a stack spango package net: confVal.netCgo = min must be a non-zero power $GODEBUG: unknown cpu feature "MapIter.Key called before NextPacific Standard Time (Mexico)Turks And Caicos Standard Timeabi mismatch detected between assignment to entry in nil mapcheckdead: inconsistent countsfailed to get system page sizefreedefer with d._pa$GODEBUG: value "GetComputerNameWGetConsoleWindowGetCurrentThreadGetFullPathNameWGetLongPathNameWGetModuleHandleWImperial_AramaicMeroitic_CursiveNetApiBufferFreeOpenProcessTokenOther_AlphabeticRCodeFormatErrorRegQueryInfoKeyWRegQueryValueExWRegisterClassExWRemo$cpu.
API String ID: 0-334836260
Opcode ID: e7fb4ea516c8d94b3ddc27418b671d1b6995d00e57da36c28d14969f18e94894
Instruction ID: a3ecdf078e8c418da03f86d4954a525799532ec149eaf54e2abfc16ddf5bb3c1
Opcode Fuzzy Hash: e7fb4ea516c8d94b3ddc27418b671d1b6995d00e57da36c28d14969f18e94894
Instruction Fuzzy Hash: EED1A0786093558FCB14EF24C48056EBBE2EF88714F54892DE89997342E730ED85DBB2

Function 00D81B90 Relevance: 10.2, Strings: 8, Instructions: 222COMMON

Download Yara Rule

Strings

mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYCyrillicDecemberDuployanEthiopicExtenderFebruaryFullPathGeorgianGoStringGujaratiGurmukhiHiraganaJava, xrefs: 00D81E86
nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type ::ffff:AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitJanuaryKannadaMUI_DltMUI_StdMakasarMandaicMarchenMultaniMyanmarOctoberOsmanyaR, xrefs: 00D81EB1
checkdead: no m for timercheckdead: no p for timercontext deadline exceededinconsistent poll.fdMutexinvalid cross-device linkinvalid network interfacemissing stack in newstackmissing traceGCSweepStartno answer from DNS serverno buffer space availableno such de, xrefs: 00D81DAE
no goroutines (main called runtime.Goexit) - deadlock!runtime: signal received on thread not created by Go. is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonescasfrom_Gscanstatus:top gp->status is not , xrefs: 00D81CB7
checkdead: inconsistent countsfailed to get system page sizefreedefer with d._panic != nilinappropriate ioctl for deviceinvalid network interface nameinvalid pointer found on stacknotetsleep - waitm out of syncprotocol wrong type for socketreflect: Elem of inv, xrefs: 00D81EE6
all goroutines are asleep - deadlock!cannot create context from nil parentcannot exec a shared library directlycipher: message authentication failedfailed to reserve page summary memoryinternal error: unknown network type method ABI and value ABI do not alignr, xrefs: 00D81E01
nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit.WithDeadline(1907348632812595367431640625<not Stringer>CertCloseStoreComputerNameExCreateProcessWCryptGenRandomDefWindowProcWFindFirstFileWFormatMessageWGC assis, xrefs: 00D81E5B
%, xrefs: 00D81E0A

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: mcount= minLC= minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYCyrillicDecemberDuployanEthiopicExtenderFebruaryFullPathGeorgianGoStringGujaratiGurmukhiHiraganaJava$ nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit.WithDeadline(1907348632812595367431640625<not Stringer>CertCloseStoreComputerNameExCreateProcessWCryptGenRandomDefWindowProcWFindFirstFileWFormatMessageWGC assis$ nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type ::ffff:AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitJanuaryKannadaMUI_DltMUI_StdMakasarMandaicMarchenMultaniMyanmarOctoberOsmanyaR$%$all goroutines are asleep - deadlock!cannot create context from nil parentcannot exec a shared library directlycipher: message authentication failedfailed to reserve page summary memoryinternal error: unknown network type method ABI and value ABI do not alignr$checkdead: inconsistent countsfailed to get system page sizefreedefer with d._panic != nilinappropriate ioctl for deviceinvalid network interface nameinvalid pointer found on stacknotetsleep - waitm out of syncprotocol wrong type for socketreflect: Elem of inv$checkdead: no m for timercheckdead: no p for timercontext deadline exceededinconsistent poll.fdMutexinvalid cross-device linkinvalid network interfacemissing stack in newstackmissing traceGCSweepStartno answer from DNS serverno buffer space availableno such de$no goroutines (main called runtime.Goexit) - deadlock!runtime: signal received on thread not created by Go. is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonescasfrom_Gscanstatus:top gp->status is not
API String ID: 0-1350322387
Opcode ID: 7da89490e057cbd6d6ab271088adc90f7727ca3f1f6bb5bc067876ed03ada193
Instruction ID: eb8fc6829594effe0636dcd1cff8f49bead722c00321e87c5b469045655334b5
Opcode Fuzzy Hash: 7da89490e057cbd6d6ab271088adc90f7727ca3f1f6bb5bc067876ed03ada193
Instruction Fuzzy Hash: 949157746097048FC704EF25D4907AEBBE5EB84704F49882DE889C7361EB34D949EB62

Function 00D47970 Relevance: 10.2, Strings: 8, Instructions: 192COMMON

Download Yara Rule

Strings

panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat ov, xrefs: 00D47C2E
., xrefs: 00D47AB3
pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYCyrillicDecemberDuployanEthiopicExtenderFebruaryFullPathGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniNove, xrefs: 00D47BB7
panicwrap: unexpected string after type name: reflect.Value.Slice: slice index out of boundsreleased less than one physical page of memoryruntime: failed to create new OS thread (have runtime: name offset base pointer out of rangeruntime: panic before malloc h, xrefs: 00D47AA9
panicwrap: unexpected string after package name: reflect.Value.Slice: slice of unaddressable arrayruntime: unexpected waitm - semaphore out of syncs.allocCount != s.nelems && freeIndex == s.nelemsslice bounds out of range [::%x] with capacity %ysweeper left ou, xrefs: 00D479FD
value method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit.WithDeadline(1907348632812595367431640625<not Stringer>CertCloseStoreComputerNameExCreateProces, xrefs: 00D47B0E
called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not f, xrefs: 00D47B91
panicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding, xrefs: 00D47C85

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: called using nil *, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not f$ pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYCyrillicDecemberDuployanEthiopicExtenderFebruaryFullPathGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniNove$.$panicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding$panicwrap: no ) in reflect.Value.Bytesreflect.Value.Fieldreflect.Value.Floatreflect.Value.Indexreflect.Value.IsNilreflect.Value.Sliceruntime: g0 stack [runtime: pcdata is runtime: preempt g0semaRoot rotateLeftskip this directorystopm holding lockssysMemStat ov$panicwrap: unexpected string after package name: reflect.Value.Slice: slice of unaddressable arrayruntime: unexpected waitm - semaphore out of syncs.allocCount != s.nelems && freeIndex == s.nelemsslice bounds out of range [::%x] with capacity %ysweeper left ou$panicwrap: unexpected string after type name: reflect.Value.Slice: slice index out of boundsreleased less than one physical page of memoryruntime: failed to create new OS thread (have runtime: name offset base pointer out of rangeruntime: panic before malloc h$value method xadd64 failedxchg64 failed}sched={pc: needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args -thread limit.WithDeadline(1907348632812595367431640625<not Stringer>CertCloseStoreComputerNameExCreateProces
API String ID: 0-4115153
Opcode ID: 11a1cad86df39c618be2487bb719c5c5ef638aaad2c9ca2e9b1fa83976ee27ee
Instruction ID: 936971045922a06838b9d8dfd2929e483298d29c175ae5ff896023245f2c36cb
Opcode Fuzzy Hash: 11a1cad86df39c618be2487bb719c5c5ef638aaad2c9ca2e9b1fa83976ee27ee
Instruction Fuzzy Hash: A191ADB49083459FC328EF29D18565EBBE1FB88300F108D2EE89997351DB74A948CF62

Function 00D621D0 Relevance: 10.1, Strings: 8, Instructions: 123COMMON

Download Yara Rule

Strings

pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit127.0.0.1:53152587890625762939453125Bidi_ControlCreateThreadGetAddrInfoWGetConsoleCPGetLastErrorGetLengt, xrefs: 00D62389
MB; allocated Module32FirstWNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRCodeNameErrorRegSetValueExWReleaseCaptureResourceHeaderSetFilePointerTranslateNameWVirtualProtectallocfreetracebad allocCountbad restart PCbad span statefile too, xrefs: 00D62302
sweeper left outstanding across sweep generationsattempt to execute system stack code on user stackcompileCallback: function argument frame too largego package net: dynamic selection of DNS resolvermallocgc called with gcphase == _GCmarkterminationrecursive c, xrefs: 00D623C2
MB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointQyzylorda Standard TimeRegisterRawInputDevicesRtlGetNtVersionNumbers, xrefs: 00D62339
pacer: sweep done at heap size pattern contains path separatorreflect: Len of non-array type resetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds, xrefs: 00D622CB
1, xrefs: 00D623CB
pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday((BADINDEX), bound = , limit = .localhost/dev/stdin/etc/hosts122070312561035156258.8.8.8:53AdditionalBad varintCancelIoEx, xrefs: 00D62363
mismatched begin/end of activeSweepnetwork dropped connection on resetno such multicast network interfacepersistentalloc: align is too largepidleput: P has non-empty run queueruntime: close polldesc w/o unblockruntime: createevent failed; errno=runtime: incons, xrefs: 00D623AC

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday((BADINDEX), bound = , limit = .localhost/dev/stdin/etc/hosts122070312561035156258.8.8.8:53AdditionalBad varintCancelIoEx$ pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit127.0.0.1:53152587890625762939453125Bidi_ControlCreateThreadGetAddrInfoWGetConsoleCPGetLastErrorGetLengt$1$MB during sweep; swept Marquesas Standard TimeMauritius Standard TimeNoncharacter_Code_PointQyzylorda Standard TimeRegisterRawInputDevicesRtlGetNtVersionNumbers$MB; allocated Module32FirstWNetUserGetInfoOther_ID_StartPattern_SyntaxProcess32NextWQuotation_MarkRCodeNameErrorRegSetValueExWReleaseCaptureResourceHeaderSetFilePointerTranslateNameWVirtualProtectallocfreetracebad allocCountbad restart PCbad span statefile too$mismatched begin/end of activeSweepnetwork dropped connection on resetno such multicast network interfacepersistentalloc: align is too largepidleput: P has non-empty run queueruntime: close polldesc w/o unblockruntime: createevent failed; errno=runtime: incons$pacer: sweep done at heap size pattern contains path separatorreflect: Len of non-array type resetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds$sweeper left outstanding across sweep generationsattempt to execute system stack code on user stackcompileCallback: function argument frame too largego package net: dynamic selection of DNS resolvermallocgc called with gcphase == _GCmarkterminationrecursive c
API String ID: 0-4281379557
Opcode ID: b1f704a9d802d0f8033a4cfb8b13eedc08b1c285200fbfe6244a1dd531d339dc
Instruction ID: bed6e035f186fe51749311e72b73e9ebe2ff07af10e9ff517e5ed7e7dd9e7b4d
Opcode Fuzzy Hash: b1f704a9d802d0f8033a4cfb8b13eedc08b1c285200fbfe6244a1dd531d339dc
Instruction Fuzzy Hash: 9E51BF74508B498FC304EF28D58566EBBE0FF88704F41892DF89997351EB38D989DB62

Function 004036F4 Relevance: 9.1, APIs: 6, Instructions: 125threadnetworktimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 004036FA
SetWaitableTimer.KERNEL32(?,?,?,00000000,00000000,00000000,?,00000000,FFFFD8F0,000000FF), ref: 0040373C
WSAWaitForMultipleEvents.WS2_32(00000004,?,00000000,000000FF,00000000), ref: 004037A9
GetCurrentThreadId.KERNEL32 ref: 004037D4
GetLastError.KERNEL32(?,00000000,000000FF,00000000), ref: 00403824
WSAGetLastError.WS2_32(?,00000000,000000FF,00000000), ref: 0040385A

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: CurrentErrorLastThread$EventsMultipleTimerWaitWaitable
String ID:
API String ID: 2359244674-0
Opcode ID: 7a95554388df9ffa05f0ca8be486daf809be1cd59ad6b74a47654642fb49a861
Instruction ID: d0cb84f42dce55f451c247b37bdbfd9a62020505dc6032d2bffc0c99e870abb3
Opcode Fuzzy Hash: 7a95554388df9ffa05f0ca8be486daf809be1cd59ad6b74a47654642fb49a861
Instruction Fuzzy Hash: 6B41A4B1600601ABD7509F25C8847A6BFA8FF04716F10813BF918E7780D738E910CBD9

Function 2BB79C30 Relevance: 9.1, APIs: 6, Instructions: 108COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 2BB79C3F

Part of subcall function 2BB7F673: __FF_MSGBANNER.LIBCMT ref: 2BB7F68C
Part of subcall function 2BB7F673: __NMSG_WRITE.LIBCMT ref: 2BB7F693
Part of subcall function 2BB7F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C,2BB88E76), ref: 2BB7F6B8

_free.LIBCMT ref: 2BB79C63
_memset.LIBCMT ref: 2BB79CBB

Part of subcall function 2BB7A610: GetObjectW.GDI32(?,00000054,?), ref: 2BB7A62E

CreateDIBSection.GDI32(00000000,00000008,00000000,00000000,00000000,00000000), ref: 2BB79CD3
_free.LIBCMT ref: 2BB79CE4
_free.LIBCMT ref: 2BB79D23

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: _free$AllocateCreateHeapObjectSection_malloc_memset
String ID:
API String ID: 1756752955-0
Opcode ID: 1b85008b96ada0e2d383cfb5e194cf6deb6f5e94fe00adbe64b0f1d2c23ee71e
Instruction ID: 55fa400e2844b73246ce5547a5038c0409fd9c68f8ac13829e504c89e9869592
Opcode Fuzzy Hash: 1b85008b96ada0e2d383cfb5e194cf6deb6f5e94fe00adbe64b0f1d2c23ee71e
Instruction Fuzzy Hash: 9F319EB3A003056BEB00EE35D985B4677F8FF5C210F00853ADA69C7251E7B1E554DB94

Function 2BB75080 Relevance: 9.1, APIs: 6, Instructions: 107networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000002FF), ref: 2BB750CA
WSASetLastError.WS2_32(0000139F), ref: 2BB750E2
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,?,00000000,000000FF), ref: 2BB750EC

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: d105b0a5702878a58421cf85be4a6132aad998ead066d6ebc3b984a93c96e023
Instruction ID: 5a1c1f93168d28ddd2498cb0338d0c95e3d21ce30faf01070e3dab040e21830f
Opcode Fuzzy Hash: d105b0a5702878a58421cf85be4a6132aad998ead066d6ebc3b984a93c96e023
Instruction Fuzzy Hash: 00319E72A04A44AFDB10DF54D986B6AB3F8FB58711F00455EE925C3A81E73AE900DB50

Function 2D4D5070 Relevance: 9.1, APIs: 6, Instructions: 107networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000002FF), ref: 2D4D50BA
WSASetLastError.WS2_32(0000139F), ref: 2D4D50D2
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,?,00000000,000000FF), ref: 2D4D50DC

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: f21917e7188906d920138227d8897881bef6c170bc3c7b26955a0713e4d8b446
Instruction ID: b029e2976add04bb905ad7dfdd738bd52f7cdb983d0c9501a11d5947c8e48193
Opcode Fuzzy Hash: f21917e7188906d920138227d8897881bef6c170bc3c7b26955a0713e4d8b446
Instruction Fuzzy Hash: 23319E72A08744ABD750CF94DC96B6AB3A8FB49B11F10861EED15D3780EB7AA900CB51

Function 00412112 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 0041213A

Part of subcall function 00411CAA: __getptd.LIBCMT ref: 00411CB8
Part of subcall function 00411CAA: __getptd.LIBCMT ref: 00411CC6

__getptd.LIBCMT ref: 00412144

Part of subcall function 00408ED3: __getptd_noexit.LIBCMT ref: 00408ED6
Part of subcall function 00408ED3: __amsg_exit.LIBCMT ref: 00408EE3

__getptd.LIBCMT ref: 00412152
__getptd.LIBCMT ref: 00412160
__getptd.LIBCMT ref: 0041216B
_CallCatchBlock2.LIBCMT ref: 00412191

Part of subcall function 00411D4F: __CallSettingFrame@12.LIBCMT ref: 00411D9B

Part of subcall function 00412238: __getptd.LIBCMT ref: 00412247
Part of subcall function 00412238: __getptd.LIBCMT ref: 00412255

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: fd4a92490cbc899ac98f70116765d36f6fc7f8cdfa2070052d1149f4a38fa6a6
Instruction ID: fcbabd17db7e7d7feae69ea6cd2cf2e848f2f635890fe2a857be5d148f226903
Opcode Fuzzy Hash: fd4a92490cbc899ac98f70116765d36f6fc7f8cdfa2070052d1149f4a38fa6a6
Instruction Fuzzy Hash: 7D11E471C003099FDB00EFA5C545BEE7BB0BF08314F10846EF854AB291EB789A559F95

Function 2BA0FF6D Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 2BA0FF95

Part of subcall function 2BA0FA76: __getptd.LIBCMT ref: 2BA0FA84
Part of subcall function 2BA0FA76: __getptd.LIBCMT ref: 2BA0FA92

__getptd.LIBCMT ref: 2BA0FF9F

Part of subcall function 2BA0381A: __getptd_noexit.LIBCMT ref: 2BA0381D
Part of subcall function 2BA0381A: __amsg_exit.LIBCMT ref: 2BA0382A

__getptd.LIBCMT ref: 2BA0FFAD
__getptd.LIBCMT ref: 2BA0FFBB
__getptd.LIBCMT ref: 2BA0FFC6
_CallCatchBlock2.LIBCMT ref: 2BA0FFEC

Part of subcall function 2BA0FB1B: __CallSettingFrame@12.LIBCMT ref: 2BA0FB67

Part of subcall function 2BA10093: __getptd.LIBCMT ref: 2BA100A2
Part of subcall function 2BA10093: __getptd.LIBCMT ref: 2BA100B0

Memory Dump Source

Source File: 00000000.00000002.4113322478.000000002B9F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 2B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b9f0000_L8RabfF1Hu.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 5f1381efd39d468ef928fc2953ab13acdae555040b7c1ee41bdff31c76f18644
Instruction ID: e760f457c0e2fe6759c98db2faccfdef774a089a30717318630cdf9a10da8143
Opcode Fuzzy Hash: 5f1381efd39d468ef928fc2953ab13acdae555040b7c1ee41bdff31c76f18644
Instruction Fuzzy Hash: 9A11E471E04209AFDF00DFA4D946BAD7BB5FB28310F10C8A9E914A7250DB399A159F90

Function 2BB905AE Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 2BB905D6

Part of subcall function 2BB900B7: __getptd.LIBCMT ref: 2BB900C5
Part of subcall function 2BB900B7: __getptd.LIBCMT ref: 2BB900D3

__getptd.LIBCMT ref: 2BB905E0

Part of subcall function 2BB83E5B: __getptd_noexit.LIBCMT ref: 2BB83E5E
Part of subcall function 2BB83E5B: __amsg_exit.LIBCMT ref: 2BB83E6B

__getptd.LIBCMT ref: 2BB905EE
__getptd.LIBCMT ref: 2BB905FC
__getptd.LIBCMT ref: 2BB90607
_CallCatchBlock2.LIBCMT ref: 2BB9062D

Part of subcall function 2BB9015C: __CallSettingFrame@12.LIBCMT ref: 2BB901A8

Part of subcall function 2BB906D4: __getptd.LIBCMT ref: 2BB906E3
Part of subcall function 2BB906D4: __getptd.LIBCMT ref: 2BB906F1

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: f4aa3345b3163fdf45d9034bb25a2554db11ba6644b10e3f464d933a3c7a99d2
Instruction ID: e5a385cd360cdea59e98d09f55776903135846862d966c489174901faa6df714
Opcode Fuzzy Hash: f4aa3345b3163fdf45d9034bb25a2554db11ba6644b10e3f464d933a3c7a99d2
Instruction Fuzzy Hash: 9611E6B1C01609DFDF10DFA4D885AEDBBB0FF28311F108469E829AB250DB389A559F60

Function 2D500F25 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 2D500F4D

Part of subcall function 2D500ADD: __getptd.LIBCMT ref: 2D500AEB
Part of subcall function 2D500ADD: __getptd.LIBCMT ref: 2D500AF9

__getptd.LIBCMT ref: 2D500F57

Part of subcall function 2D4DA728: __getptd_noexit.LIBCMT ref: 2D4DA72B
Part of subcall function 2D4DA728: __amsg_exit.LIBCMT ref: 2D4DA738

__getptd.LIBCMT ref: 2D500F65
__getptd.LIBCMT ref: 2D500F73
__getptd.LIBCMT ref: 2D500F7E
_CallCatchBlock2.LIBCMT ref: 2D500FA4

Part of subcall function 2D500B82: __CallSettingFrame@12.LIBCMT ref: 2D500BCE

Part of subcall function 2D50104B: __getptd.LIBCMT ref: 2D50105A
Part of subcall function 2D50104B: __getptd.LIBCMT ref: 2D501068

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 9c7f8393ab1b84367e66ddefc6d6c03b875c64c86d5f302bcef533ab21453751
Instruction ID: 740a9762c3bf9982c5ca7b46916400a4929bc8f124832e0314d2ab34e0c2d040
Opcode Fuzzy Hash: 9c7f8393ab1b84367e66ddefc6d6c03b875c64c86d5f302bcef533ab21453751
Instruction Fuzzy Hash: 1011E4B18082099FDF40DFA4D485AED7BB0FF2831AF11846AE954BB250DB799A119F50

Function 0040C2CE Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040C2DA

Part of subcall function 00408ED3: __getptd_noexit.LIBCMT ref: 00408ED6
Part of subcall function 00408ED3: __amsg_exit.LIBCMT ref: 00408EE3

__amsg_exit.LIBCMT ref: 0040C2FA
__lock.LIBCMT ref: 0040C30A
InterlockedDecrement.KERNEL32(?), ref: 0040C327
_free.LIBCMT ref: 0040C33A
InterlockedIncrement.KERNEL32(2B652CE0), ref: 0040C352

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 5423ed9c77f17453b4a84e2a0bd2f1e74877f8f3f1af5c8a278faa57b84d9df5
Instruction ID: 095bc330861c957b7bc5d6d03b7a1656886a9a78c482a86a341b07cc9b8e2ce4
Opcode Fuzzy Hash: 5423ed9c77f17453b4a84e2a0bd2f1e74877f8f3f1af5c8a278faa57b84d9df5
Instruction Fuzzy Hash: 34016132A54711EBD715AB66948579E7760AB04715F14C23BEC00B73C1C73CA981DBDE

Function 2BB84885 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 2BB84891

Part of subcall function 2BB83E5B: __getptd_noexit.LIBCMT ref: 2BB83E5E
Part of subcall function 2BB83E5B: __amsg_exit.LIBCMT ref: 2BB83E6B

__amsg_exit.LIBCMT ref: 2BB848B1
__lock.LIBCMT ref: 2BB848C1
InterlockedDecrement.KERNEL32(?), ref: 2BB848DE
_free.LIBCMT ref: 2BB848F1
InterlockedIncrement.KERNEL32(2BEC1658), ref: 2BB84909

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 0f2335385b83d6e94e281822110f31b3fa03f062aa8c768bfe07a86ee9180978
Instruction ID: 42721ff60efced39d89247788761e4a55f514da900f805a9905bbeaa274a3901
Opcode Fuzzy Hash: 0f2335385b83d6e94e281822110f31b3fa03f062aa8c768bfe07a86ee9180978
Instruction Fuzzy Hash: 92016D31D01F619BEF50DF64A44576DB3A0FF28B11F080115EA50A7290CB78E542CFD2

Function 2D4DDA4E Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 2D4DDA5A

Part of subcall function 2D4DA728: __getptd_noexit.LIBCMT ref: 2D4DA72B
Part of subcall function 2D4DA728: __amsg_exit.LIBCMT ref: 2D4DA738

__amsg_exit.LIBCMT ref: 2D4DDA7A
__lock.LIBCMT ref: 2D4DDA8A
InterlockedDecrement.KERNEL32(?), ref: 2D4DDAA7
_free.LIBCMT ref: 2D4DDABA
InterlockedIncrement.KERNEL32(2D5E1658), ref: 2D4DDAD2

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: b1ad32763d7dbbf0de788aca6235bffef0242590f4f5b085647dcf6d29147597
Instruction ID: 7f5b81e07828401b59337218a9c82af3222f3f8cbbb05a6ddba41ba0b8eb6f5f
Opcode Fuzzy Hash: b1ad32763d7dbbf0de788aca6235bffef0242590f4f5b085647dcf6d29147597
Instruction Fuzzy Hash: 2001C437948B219BCB81DB64846976D77B0BF15F21F25810BDA0177384CB786941CFD9

Function 2BB79BA0 Relevance: 9.0, APIs: 6, Instructions: 42COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 2BB79BD2
EnterCriticalSection.KERNEL32(2BB9FB64,?,?,?,2BB79B7B), ref: 2BB79BE3
EnterCriticalSection.KERNEL32(2BB9FB64,?,?,?,2BB79B7B), ref: 2BB79BF8
GdiplusShutdown.GDIPLUS(00000000,?,?,?,2BB79B7B), ref: 2BB79C04
LeaveCriticalSection.KERNEL32(2BB9FB64,?,?,?,2BB79B7B), ref: 2BB79C15
LeaveCriticalSection.KERNEL32(2BB9FB64,?,?,?,2BB79B7B), ref: 2BB79C1C

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$EnterLeave$DeleteGdiplusObjectShutdown
String ID:
API String ID: 4268643673-0
Opcode ID: 993f2ea64f6aff838cd354a579ab13bcbf8fafaf700cd36c5ffd9ab04a979c55
Instruction ID: 05f7aff36826bb3b189a4fced6bd6885f1b7f02680002ad8cdd48958fc1a9760
Opcode Fuzzy Hash: 993f2ea64f6aff838cd354a579ab13bcbf8fafaf700cd36c5ffd9ab04a979c55
Instruction Fuzzy Hash: 6B01A9B1D01A05EF8B04EFAA99D8419BBA4FF58325361816EE15887256C776D403CFA4

Function 2BB748D0 Relevance: 9.0, APIs: 6, Instructions: 36sleepsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 2BB748E1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 2BB748EC
Sleep.KERNEL32(00000258), ref: 2BB748F9
CloseHandle.KERNEL32(?), ref: 2BB74914
CloseHandle.KERNEL32(?), ref: 2BB7491D
Sleep.KERNEL32(0000012C), ref: 2BB7492E

Part of subcall function 2BB73F60: GetCurrentThreadId.KERNEL32 ref: 2BB73F65
Part of subcall function 2BB73F60: send.WS2_32(?,2BB949C0,00000010,00000000), ref: 2BB73FC6
Part of subcall function 2BB73F60: SetEvent.KERNEL32(?), ref: 2BB73FE9
Part of subcall function 2BB73F60: InterlockedExchange.KERNEL32(?,00000000), ref: 2BB73FF5
Part of subcall function 2BB73F60: WSACloseEvent.WS2_32(?), ref: 2BB74003
Part of subcall function 2BB73F60: shutdown.WS2_32(?,00000001), ref: 2BB7401B
Part of subcall function 2BB73F60: closesocket.WS2_32(?), ref: 2BB74025

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Close$EventHandleObjectSingleSleepWait$CurrentExchangeInterlockedThreadclosesocketsendshutdown
String ID:
API String ID: 1019945655-0
Opcode ID: e7cc6ed13a6877fbe98b032081b9d1c39ea0ed533b59c7ddfc89f479bb6d7f1f
Instruction ID: 52810e421c7a56ec7d3dc913e5278d09b40eb9c1115bdd1ab06541bb9d30824e
Opcode Fuzzy Hash: e7cc6ed13a6877fbe98b032081b9d1c39ea0ed533b59c7ddfc89f479bb6d7f1f
Instruction Fuzzy Hash: BBF09632604A045BC610EB69CD80C56F3E9EFC8720B108709E26583294CA75E802CFA0

Function 2D4D48E0 Relevance: 9.0, APIs: 6, Instructions: 36sleepsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 2D4D48F1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 2D4D48FC
Sleep.KERNEL32(00000258), ref: 2D4D4909
CloseHandle.KERNEL32(?), ref: 2D4D4924
CloseHandle.KERNEL32(?), ref: 2D4D492D
Sleep.KERNEL32(0000012C), ref: 2D4D493E

Part of subcall function 2D4D3F70: GetCurrentThreadId.KERNEL32 ref: 2D4D3F75
Part of subcall function 2D4D3F70: send.WS2_32(?,2D52A8F8,00000010,00000000), ref: 2D4D3FD6
Part of subcall function 2D4D3F70: SetEvent.KERNEL32(?), ref: 2D4D3FF9
Part of subcall function 2D4D3F70: InterlockedExchange.KERNEL32(?,00000000), ref: 2D4D4005
Part of subcall function 2D4D3F70: WSACloseEvent.WS2_32(?), ref: 2D4D4013
Part of subcall function 2D4D3F70: shutdown.WS2_32(?,00000001), ref: 2D4D402B
Part of subcall function 2D4D3F70: closesocket.WS2_32(?), ref: 2D4D4035

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Close$EventHandleObjectSingleSleepWait$CurrentExchangeInterlockedThreadclosesocketsendshutdown
String ID:
API String ID: 1019945655-0
Opcode ID: 545c4c1e68a7e09f89153775ebb1a38189be7d0cb21ec29c0762d1fb5e02a36c
Instruction ID: fb01ed68dd37076b2da3451eb3e4df53236231b7983bd49f32137ad98fa36bae
Opcode Fuzzy Hash: 545c4c1e68a7e09f89153775ebb1a38189be7d0cb21ec29c0762d1fb5e02a36c
Instruction Fuzzy Hash: CCF036722047045BC624EB69CC94E5AF3F9EFC9761B11C709E25997394CAB4EC01CB64

Function 004042AA Relevance: 9.0, APIs: 6, Instructions: 32sleepsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 004042BA
WaitForSingleObject.KERNEL32(?,000000FF), ref: 004042C4
Sleep.KERNEL32(00000258), ref: 004042D1
CloseHandle.KERNEL32(?), ref: 004042EB
CloseHandle.KERNEL32(?), ref: 004042F3
Sleep.KERNEL32(0000012C), ref: 00404304

Part of subcall function 00403C7D: GetCurrentThreadId.KERNEL32 ref: 00403C86
Part of subcall function 00403C7D: send.WS2_32(?,00415448,00000010,00000000), ref: 00403CE8
Part of subcall function 00403C7D: SetEvent.KERNEL32(00040000,?,?,?,?,00000000,74DEDFA0,?,?,00403560,?,CUdpSocket::Start,00000000), ref: 00403D02
Part of subcall function 00403C7D: InterlockedExchange.KERNEL32(?,00000000), ref: 00403D0D
Part of subcall function 00403C7D: WSACloseEvent.WS2_32(?), ref: 00403D1B
Part of subcall function 00403C7D: shutdown.WS2_32(?,00000001), ref: 00403D2F
Part of subcall function 00403C7D: closesocket.WS2_32(?), ref: 00403D38

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: Close$EventHandleObjectSingleSleepWait$CurrentExchangeInterlockedThreadclosesocketsendshutdown
String ID:
API String ID: 1019945655-0
Opcode ID: 122fd41c9cd677b32bc68af6c66a200dab2fec3eff63c8d90cc2e578fa59da4f
Instruction ID: 4b2c8b2a7b3dc4d18322a45cfcb91b7d253c379b6d449c84c8e7a21dbd02c130
Opcode Fuzzy Hash: 122fd41c9cd677b32bc68af6c66a200dab2fec3eff63c8d90cc2e578fa59da4f
Instruction Fuzzy Hash: D0F08231204604AFD620AF69DC48D4AFBE5EF85721B154629F265A32F4CB71AD01DB58

Function 2BB73300 Relevance: 9.0, APIs: 6, Instructions: 32synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 2BB73311
Sleep.KERNEL32(00000258), ref: 2BB7331E
InterlockedExchange.KERNEL32(?,00000000), ref: 2BB73326
WaitForSingleObject.KERNEL32(?,000000FF), ref: 2BB73332
WaitForSingleObject.KERNEL32(?,000000FF), ref: 2BB7333A
Sleep.KERNEL32(0000012C), ref: 2BB7334B

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: ObjectSingleWait$Sleep$ExchangeInterlocked
String ID:
API String ID: 3137405945-0
Opcode ID: 461dbc907178c4eaff0dc5317c1191f8c0ad7a0ca5b44acd0838e24ffcb1c105
Instruction ID: e411c92504f9160ba8676f1a29f12b416825d2cf784fa1f449d12bae3b9346e6
Opcode Fuzzy Hash: 461dbc907178c4eaff0dc5317c1191f8c0ad7a0ca5b44acd0838e24ffcb1c105
Instruction Fuzzy Hash: 22F08272604B146BD7109BA9CC84D56F3E8EF89334B204709F261832D0CAB5E802CF60

Function 00D50C00 Relevance: 8.9, Strings: 7, Instructions: 144COMMON

Download Yara Rule

Strings

runtime: typeBitsBulkBarrier without typestopTheWorld: not stopped (stopwait != 0)strconv: illegal AppendInt/FormatInt basetime: Reset called on uninitialized Timer173472347597680709441192448139190673828125867361737988403547205962240695953369140625MapIter.Valu, xrefs: 00D50E32
), xrefs: 00D50E3B
with GC prog,M3.2.0,M11.1.0476837158203125: no frame (sp=<invalid Value>ASCII_Hex_DigitCreateHardLinkWCreateWindowExWDeviceIoControlDuplicateHandleFailed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetStartupInfoWHanif, xrefs: 00D50D3C
runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime: unblock on closing polldescruntime: wrong goroutine in newstackryuFtoaFixed64 called with prec > 18startm: , xrefs: 00D50D57, 00D50E1C
but memory size because dotdotdot in async preempt to non-Go memory , locked to thread/etc/nsswitch.conf298023223876953125Arab Standard TimeCaucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGC worker (active)GetCompu, xrefs: 00D50DE8
runtime: typeBitsBulkBarrier with type ryuFtoaFixed32 called with negative prectime: Stop called on uninitialized Timer34694469519536141888238489627838134765625MapIter.Next called on exhausted iteratorattempted to add zero-sized address rangebinary: varint ov, xrefs: 00D50D12, 00D50D94
of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = .WithCancel/dev/stderr/dev/st, xrefs: 00D50DBE

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: but memory size because dotdotdot in async preempt to non-Go memory , locked to thread/etc/nsswitch.conf298023223876953125Arab Standard TimeCaucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGC worker (active)GetCompu$ of size (targetpc= , plugin: KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = .WithCancel/dev/stderr/dev/st$ with GC prog,M3.2.0,M11.1.0476837158203125: no frame (sp=<invalid Value>ASCII_Hex_DigitCreateHardLinkWCreateWindowExWDeviceIoControlDuplicateHandleFailed to find Failed to load FlushViewOfFileGetAdaptersInfoGetCommandLineWGetProcessTimesGetStartupInfoWHanif$)$runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime: sudog with non-nil waitlinkruntime: unblock on closing polldescruntime: wrong goroutine in newstackryuFtoaFixed64 called with prec > 18startm: $runtime: typeBitsBulkBarrier with type ryuFtoaFixed32 called with negative prectime: Stop called on uninitialized Timer34694469519536141888238489627838134765625MapIter.Next called on exhausted iteratorattempted to add zero-sized address rangebinary: varint ov$runtime: typeBitsBulkBarrier without typestopTheWorld: not stopped (stopwait != 0)strconv: illegal AppendInt/FormatInt basetime: Reset called on uninitialized Timer173472347597680709441192448139190673828125867361737988403547205962240695953369140625MapIter.Valu
API String ID: 0-3627125284
Opcode ID: d6fd31a4f50d161b80922ebfdf8dd3f468d7d1d0787e414e59eb22536c6cf168
Instruction ID: d732dae0d6b9fe7236b732f09726967e0789807eb888eaf2eb9e52d87362325c
Opcode Fuzzy Hash: d6fd31a4f50d161b80922ebfdf8dd3f468d7d1d0787e414e59eb22536c6cf168
Instruction Fuzzy Hash: 2151EFB49097448FC704EF29D19466ABBE0FF88704F45886DF8C89B352EB34D949DB62

Function 00D4A900 Relevance: 8.9, Strings: 7, Instructions: 123COMMON

Download Yara Rule

Strings

runtime: s.allocCount= s.allocCount > s.nelemsschedule: holding lockssegment length too longshrinkstack at bad timeskipping Question Classspan has no free stacksstack growth after forksyntax error in patternsystem huge page size (too many pointers (>10)unexpec, xrefs: 00D4AA8D
freeIndex is not validgetenv before env initheadTailIndex overflowinteger divide by zerointerface conversion: invalid address familykernel32.dll not foundminpc or maxpc invalidmissing ']' in addressnetwork is unreachablenon-Go function at pc=oldoverflow is not, xrefs: 00D4AA6D
s.allocCount > s.nelemsschedule: holding lockssegment length too longshrinkstack at bad timeskipping Question Classspan has no free stacksstack growth after forksyntax error in patternsystem huge page size (too many pointers (>10)unexpected address typeunpacki, xrefs: 00D4AA57
1, xrefs: 00D4AAF8
s.allocCount != s.nelems && freeIndex == s.nelemsslice bounds out of range [::%x] with capacity %ysweeper left outstanding across sweep generationsattempt to execute system stack code on user stackcompileCallback: function argument frame too largego package ne, xrefs: 00D4AAEF
s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = .WithCancel/dev/stderr/dev/stdout30517578125: frame.sp=ClassHESIODCloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeGetKeyS, xrefs: 00D4AA23, 00D4AABB
s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriod, xrefs: 00D4A9F5

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = .WithCancel/dev/stderr/dev/stdout30517578125: frame.sp=ClassHESIODCloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTypeGetKeyS$1$freeIndex is not validgetenv before env initheadTailIndex overflowinteger divide by zerointerface conversion: invalid address familykernel32.dll not foundminpc or maxpc invalidmissing ']' in addressnetwork is unreachablenon-Go function at pc=oldoverflow is not$runtime: s.allocCount= s.allocCount > s.nelemsschedule: holding lockssegment length too longshrinkstack at bad timeskipping Question Classspan has no free stacksstack growth after forksyntax error in patternsystem huge page size (too many pointers (>10)unexpec$s.allocCount != s.nelems && freeIndex == s.nelemsslice bounds out of range [::%x] with capacity %ysweeper left outstanding across sweep generationsattempt to execute system stack code on user stackcompileCallback: function argument frame too largego package ne$s.allocCount > s.nelemsschedule: holding lockssegment length too longshrinkstack at bad timeskipping Question Classspan has no free stacksstack growth after forksyntax error in patternsystem huge page size (too many pointers (>10)unexpected address typeunpacki$s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriod
API String ID: 0-530480006
Opcode ID: 8ba7981541ba4beec5b2a052fd0a29a0699b8eb6acb97582d7f8b92b4cf8ba39
Instruction ID: b4301192e1d139969f68623edbf5bf93ff9ee650816fae2f75dcdfd981c1796d
Opcode Fuzzy Hash: 8ba7981541ba4beec5b2a052fd0a29a0699b8eb6acb97582d7f8b92b4cf8ba39
Instruction Fuzzy Hash: BD51ABB45087449FC344EF29C19566EBBE0EF88708F51886DE8C887282EB75D949DB73

Function 00D78F10 Relevance: 8.8, Strings: 7, Instructions: 97COMMON

Download Yara Rule

Strings

runtime: casfrom_Gscanstatus failed gp=stack growth not allowed in system callsuspendG from non-preemptible goroutinetraceback: unexpected SPWRITE function transport endpoint is already connected13877787807814456755295395851135253906256938893903907228377647697, xrefs: 00D78F7D
casfrom_Gscanstatus: gp->status is not in scan statemallocgc called without a P or outside bootstrappingruntime.SetFinalizer: pointer not in allocated blockruntime: GetQueuedCompletionStatusEx failed (errno= runtime: use of FixAlloc_Alloc before FixAlloc_Init, xrefs: 00D79009
, oldval=, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticFindCloseHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanPalmyreneSamaritanSeptemberSundaneseTypeCNAMETypeHINFOTypeMINF, xrefs: 00D78F9F, 00D79046
runtime: casfrom_Gscanstatus bad oldval gp=runtime: releaseSudog with non-nil gp.paramruntime:stoplockedm: lockedg (atomicstatus=unfinished open-coded defers in deferreturnunknown runnable goroutine during bootstrapactive sweepers found at start of mark phasec, xrefs: 00D79024
7, xrefs: 00D790B9
casfrom_Gscanstatus:top gp->status is not in scan stategentraceback callback cannot be used with non-zero skipmheap.freeSpanLocked - invalid free of user arena chunkos: invalid use of WriteAt on file opened with O_APPENDreflect: internal error: invalid use of , xrefs: 00D790B0
, newval=, oldval=, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticFindCloseHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanPalmyreneSamaritanSeptemberSundaneseTypeCNAMETypeHINF, xrefs: 00D78FC9, 00D79070

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: , newval=, oldval=, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticFindCloseHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanPalmyreneSamaritanSeptemberSundaneseTypeCNAMETypeHINF$, oldval=, size = , tail = -07:00:00244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticFindCloseHex_DigitInheritedInterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanPalmyreneSamaritanSeptemberSundaneseTypeCNAMETypeHINFOTypeMINF$7$casfrom_Gscanstatus: gp->status is not in scan statemallocgc called without a P or outside bootstrappingruntime.SetFinalizer: pointer not in allocated blockruntime: GetQueuedCompletionStatusEx failed (errno= runtime: use of FixAlloc_Alloc before FixAlloc_Init$casfrom_Gscanstatus:top gp->status is not in scan stategentraceback callback cannot be used with non-zero skipmheap.freeSpanLocked - invalid free of user arena chunkos: invalid use of WriteAt on file opened with O_APPENDreflect: internal error: invalid use of $runtime: casfrom_Gscanstatus bad oldval gp=runtime: releaseSudog with non-nil gp.paramruntime:stoplockedm: lockedg (atomicstatus=unfinished open-coded defers in deferreturnunknown runnable goroutine during bootstrapactive sweepers found at start of mark phasec$runtime: casfrom_Gscanstatus failed gp=stack growth not allowed in system callsuspendG from non-preemptible goroutinetraceback: unexpected SPWRITE function transport endpoint is already connected13877787807814456755295395851135253906256938893903907228377647697
API String ID: 0-1521500050
Opcode ID: c173ebcedf29f679b305a0fbef8b04d8b993ffec91ddc9f863be3616abbe70a5
Instruction ID: b35f3b0b01b38ab3845721f1cb4cf7528529417d1605ba3038169f8ad6f8002d
Opcode Fuzzy Hash: c173ebcedf29f679b305a0fbef8b04d8b993ffec91ddc9f863be3616abbe70a5
Instruction Fuzzy Hash: C941BDB4409B058ED700FF68D59966EBBE1EF84704F45882DF89887252FB34D8889B72

Function 2D4E4FC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

Part of subcall function 2D4E6430: _malloc.LIBCMT ref: 2D4E6437

__wgetenv.LIBCMT ref: 2D4E5081
_swscanf.LIBCMT ref: 2D4E509F

Strings

x, xrefs: 2D4E509B
JPEGMEM, xrefs: 2D4E5079
%ld%c, xrefs: 2D4E5095

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: __wgetenv_malloc_swscanf
String ID: %ld%c$JPEGMEM$x
API String ID: 33067021-3402169052
Opcode ID: 19c7855dea971c7f60c9d04fb2ede5af69868079b7294aed89626b6c667eb4cd
Instruction ID: a50e70ae5d79159937f2edae19fd541f019f89b76b152a73a6a219632e1073c4
Opcode Fuzzy Hash: 19c7855dea971c7f60c9d04fb2ede5af69868079b7294aed89626b6c667eb4cd
Instruction Fuzzy Hash: 44314BB0900704AFC724CF5AD9C045BFBF8FB48691B904A2EE54EAB650D375E6418FD2

Function 2D4D41F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,ENM-,2D4D42CE,00000000,?,?,2D4D4E45,?,?,?,?,00000000,000000FF), ref: 2D4D41F8
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,000000FF), ref: 2D4D4206
LeaveCriticalSection.KERNEL32(?), ref: 2D4D4267
SetEvent.KERNEL32(?), ref: 2D4D4282

Strings

ENM-, xrefs: 2D4D41F0

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID: ENM-
API String ID: 3394196147-4152539876
Opcode ID: 5ec06a1b4cf4ee52887c4125967203cfc596b657653291f20e01695070b6fb01
Instruction ID: ddeeffe3024374088cf580450877b0aaf54b39ca58a56506178a35db19f03278
Opcode Fuzzy Hash: 5ec06a1b4cf4ee52887c4125967203cfc596b657653291f20e01695070b6fb01
Instruction Fuzzy Hash: 7A1106B1600B059FD758CFB4C594AA6B7F9BF48301B51C92EE45E97701EB34E901CB50

Function 2BB9095B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 2BB9096E

Part of subcall function 2BB908C9: ___BuildCatchObjectHelper.LIBCMT ref: 2BB908FF

_UnwindNestedFrames.LIBCMT ref: 2BB90985
___FrameUnwindToState.LIBCMT ref: 2BB90993

Strings

csm, xrefs: 2BB9095D
csm, xrefs: 2BB9096A, 2BB9097F, 2BB90992, 2BB909B0, 2BB909C0

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: a4ec08a577bcb042cc7356b16b645f83b0b4d35d15726398ffe3570c0dbe416a
Instruction ID: 8ceea76fe24a6e08d7412256bc39b5075fe1df9dcf65261de8b445f648ea423c
Opcode Fuzzy Hash: a4ec08a577bcb042cc7356b16b645f83b0b4d35d15726398ffe3570c0dbe416a
Instruction Fuzzy Hash: 6301F231401909BBEF129F55EC85EAA7F6AEF29390F808024FD5855160D736D9B1EFA0

Function 2D5012D2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 2D5012E5

Part of subcall function 2D501240: ___BuildCatchObjectHelper.LIBCMT ref: 2D501276

_UnwindNestedFrames.LIBCMT ref: 2D5012FC
___FrameUnwindToState.LIBCMT ref: 2D50130A

Strings

csm, xrefs: 2D5012E1, 2D5012F6, 2D501309, 2D501327, 2D501337
csm, xrefs: 2D5012D4

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction ID: 038f8a4448cf181f760d0af570fc333ae7314e5d1b9233f503ac2edaf9c6bf8f
Opcode Fuzzy Hash: 5a0efde82555800522ebcbcdf0ebfc514e59fc27468206ba67c06b53666bf625
Instruction Fuzzy Hash: BD01123100010ABBCF165F55CC41EEA7F6AFF58395F104424FE18A5160DBB2D9A1DAA5

Function 2BB7B7E9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Console,00000000,00000002), ref: 2BB7B800
RegDeleteValueW.ADVAPI32(?,IpDatespecial), ref: 2BB7B810
RegCloseKey.ADVAPI32(?), ref: 2BB7B81B

Strings

Console, xrefs: 2BB7B7F6
IpDatespecial, xrefs: 2BB7B80A

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Console$IpDatespecial
API String ID: 849931509-1840232981
Opcode ID: 42d518e5eda0f23fee2d6421d0fcc409ee8c1b2f54e2a03be47774ae67943f38
Instruction ID: 045612064d1bf660b5177687a6252461de1dc710664a80e06f35208748a8e168
Opcode Fuzzy Hash: 42d518e5eda0f23fee2d6421d0fcc409ee8c1b2f54e2a03be47774ae67943f38
Instruction Fuzzy Hash: E7E08672A55640AFE7149B60AD8EFA97754FB8C311F00451DF6C4A21418516E405CF65

Function 00D41620 Relevance: 8.0, Strings: 6, Instructions: 455COMMON

Download Yara Rule

Strings

ermsfileftpsfunchttpicmpidleigmpint8itabkindmdnsopenpipepop3readrootsbrksmtpsse3trueuintunix ... MB, and got= max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-09301562578125<nil>AdlamAprilBamumBatakBuhidClassDograErrorGreekKhmerLat, xrefs: 00D41683
avx2basebindbitsbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeaddialermsfileftpsfunchttpicmpidleigmpint8itabkindmdnsopenpipepop3readrootsbrksmtpsse3trueuintunix ... MB, and got= max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-0930, xrefs: 00D41A96, 00D41AAE
pclmulqdqpreemptedprofBlockpsapi.dllquestionsrecover: reflect: rwxrwxrwxscavtracestackpooltracebackwbufSpans} stack=[ netGo = MB goal, flushGen gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= sweepgen sweepgen= ta, xrefs: 00D4169C
sse41sse42ssse3sudogsweeptraceuint8usagewrite B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not , val .local.onion390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopti, xrefs: 00D41899, 00D418B5
rdtscpreturnselectsocketstringstructsweep sysmontelnettimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type ::ffff:AvestanBengaliBrailleChanDirCopySid, xrefs: 00D416B5
popcntrdtscpreturnselectsocketstringstructsweep sysmontelnettimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type ::ffff:AvestanBengaliBrailleChanDirC, xrefs: 00D417FE, 00D41815

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: avx2basebindbitsbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeaddialermsfileftpsfunchttpicmpidleigmpint8itabkindmdnsopenpipepop3readrootsbrksmtpsse3trueuintunix ... MB, and got= max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-0930$ermsfileftpsfunchttpicmpidleigmpint8itabkindmdnsopenpipepop3readrootsbrksmtpsse3trueuintunix ... MB, and got= max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-09301562578125<nil>AdlamAprilBamumBatakBuhidClassDograErrorGreekKhmerLat$pclmulqdqpreemptedprofBlockpsapi.dllquestionsrecover: reflect: rwxrwxrwxscavtracestackpooltracebackwbufSpans} stack=[ netGo = MB goal, flushGen gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= sweepgen sweepgen= ta$popcntrdtscpreturnselectsocketstringstructsweep sysmontelnettimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type ::ffff:AvestanBengaliBrailleChanDirC$rdtscpreturnselectsocketstringstructsweep sysmontelnettimersuint16uint32uint64 (scan (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type ::ffff:AvestanBengaliBrailleChanDirCopySid$sse41sse42ssse3sudogsweeptraceuint8usagewrite B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not , val .local.onion390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopti
API String ID: 0-934299793
Opcode ID: 33898b417fc6ef78bd8176416e761c5d4666e85d51a6753c6dee89c2d1680b1f
Instruction ID: 50e1de8500d454c634cbb07732d94133d095e2ea36237318c86df597dd8c6ecc
Opcode Fuzzy Hash: 33898b417fc6ef78bd8176416e761c5d4666e85d51a6753c6dee89c2d1680b1f
Instruction Fuzzy Hash: 6622B0B950934ACFC314DF19D890B4ABBE1FB95308F04482DE9454B362EB74E989DFA1

Function 00D5C670 Relevance: 7.7, Strings: 6, Instructions: 189COMMON

Download Yara Rule

Strings

greyobject: obj not pointer-alignedmheap.freeSpanLocked - invalid freemismatched begin/end of activeSweepnetwork dropped connection on resetno such multicast network interfacepersistentalloc: align is too largepidleput: P has non-empty run queueruntime: close , xrefs: 00D5C925
marking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value, xrefs: 00D5C90F
#, xrefs: 00D5C92E
basebindbitsbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeaddialermsfileftpsfunchttpicmpidleigmpint8itabkindmdnsopenpipepop3readrootsbrksmtpsse3trueuintunix ... MB, and got= max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-09301562, xrefs: 00D5C8AC
runtime: marking free object runtime: p.gcMarkWorkerMode= runtime: split stack overflowruntime: sudog with non-nil cruntime: summary max pages = runtime: traceback stuck. pc=scanobject of a noscan objectsemacquire not on the G stackstring concatenation too lon, xrefs: 00D5C813
found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit127.0.0.1:5315258789062576293945, xrefs: 00D5C83D

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit127.0.0.1:5315258789062576293945$#$basebindbitsbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeaddialermsfileftpsfunchttpicmpidleigmpint8itabkindmdnsopenpipepop3readrootsbrksmtpsse3trueuintunix ... MB, and got= max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-09301562$greyobject: obj not pointer-alignedmheap.freeSpanLocked - invalid freemismatched begin/end of activeSweepnetwork dropped connection on resetno such multicast network interfacepersistentalloc: align is too largepidleput: P has non-empty run queueruntime: close $marking free objectmarkroot: bad indexmissing deferreturnmspan.sweep: state=notesleep not on g0ntdll.dll not foundnwait > work.nprocspanic during mallocpanic during panicpanic holding lockspanicwrap: no ( in panicwrap: no ) in reflect.Value.Bytesreflect.Value$runtime: marking free object runtime: p.gcMarkWorkerMode= runtime: split stack overflowruntime: sudog with non-nil cruntime: summary max pages = runtime: traceback stuck. pc=scanobject of a noscan objectsemacquire not on the G stackstring concatenation too lon
API String ID: 0-2204192756
Opcode ID: 642c277c22d4b83f8dec7e47febe9e738feb75d23ee36c315ada38933831b533
Instruction ID: dcb6dfa8a6d4131a9f34bddeb8290befa751b448207546d5d4120c252cbb8db4
Opcode Fuzzy Hash: 642c277c22d4b83f8dec7e47febe9e738feb75d23ee36c315ada38933831b533
Instruction Fuzzy Hash: A28149745097459FD710EF25C480B6ABBE0EF89704F48996DEC888B392E734D949CFA2

Function 00D97D30 Relevance: 7.7, Strings: 6, Instructions: 177COMMON

Download Yara Rule

Strings

goroutine invalid IPinvalidptrmSpanInUsemyhostnamenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptskipping: stackLarget.Kind == time.Date(time.Localtracefree(tracegc()unixpacketunknown pcuser32.dllws2_32.dll of size (targetp, xrefs: 00D97E6D
&O, xrefs: 00D97D6B
unknown wait reasonwinmm.dll not foundzero length segment markroot jobs done to unallocated span37252902984619140625Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGet, xrefs: 00D97DA8
, locked to thread/etc/nsswitch.conf298023223876953125Arab Standard TimeCaucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGC worker (active)GetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWIran Sta, xrefs: 00D97F70
minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYCyrillicDecemberDuployanEthiopicExtenderFebruaryFullPathGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKaya, xrefs: 00D97F42
(scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type ::ffff:AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitJanuaryKannadaMUI_DltMUI_StdM, xrefs: 00D97ED6

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: (scan) MB in Value> allocs dying= locks= m->g0= nmsys= pad1= pad2= s=nil text= zombie% CPU (, goid=, j0 = 19531259765625: type ::ffff:AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitJanuaryKannadaMUI_DltMUI_StdM$ minutes nalloc= newval= nfreed= pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYCyrillicDecemberDuployanEthiopicExtenderFebruaryFullPathGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKaya$&O$, locked to thread/etc/nsswitch.conf298023223876953125Arab Standard TimeCaucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGC worker (active)GetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModuleFileNameWIran Sta$goroutine invalid IPinvalidptrmSpanInUsemyhostnamenotifyListowner diedprofInsertruntime: gs.state = schedtracesemacquiresetsockoptskipping: stackLarget.Kind == time.Date(time.Localtracefree(tracegc()unixpacketunknown pcuser32.dllws2_32.dll of size (targetp$unknown wait reasonwinmm.dll not foundzero length segment markroot jobs done to unallocated span37252902984619140625Arabic Standard TimeAzores Standard TimeCertOpenSystemStoreWCreateProcessAsUserWCryptAcquireContextWEgyptian_HieroglyphsGetAcceptExSockaddrsGet
API String ID: 0-3341456098
Opcode ID: f8bf0c7d9119fc2c01dd6aaa43d2e8e41173de68da61596d69a8a1fecdad3714
Instruction ID: ca066911d32fbcede3a9f3fea659b3c055c01fcb5bec21b0dab42de7a6faa0d9
Opcode Fuzzy Hash: f8bf0c7d9119fc2c01dd6aaa43d2e8e41173de68da61596d69a8a1fecdad3714
Instruction Fuzzy Hash: E9715A742197158FC710EF64C580AAEBBE0FF88744F45882DF89897352E730E9458BB2

Function 00D769B0 Relevance: 7.7, Strings: 6, Instructions: 151COMMON

Download Yara Rule

Strings

., xrefs: 00D76B49
-Inf3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomCESTChamDashEESTGOGCJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaSASTStatThaiTypem=] = ] n=allgallpavx2basebindbitsbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeaddialermsfileftpsfunchttpicmpidleigmpint8itabkindmdnsopen, xrefs: 00D76A06
+Inf-Inf3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomCESTChamDashEESTGOGCJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaSASTStatThaiTypem=] = ] n=allgallpavx2basebindbitsbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeaddialermsfileftpsfunchttpicmpidleigmpint8itabkindmdns, xrefs: 00D76A20
-, xrefs: 00D76B59
e+, xrefs: 00D76B4E
-, xrefs: 00D76A8A

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: +Inf-Inf3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomCESTChamDashEESTGOGCJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaSASTStatThaiTypem=] = ] n=allgallpavx2basebindbitsbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeaddialermsfileftpsfunchttpicmpidleigmpint8itabkindmdns$-$-$-Inf3125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomCESTChamDashEESTGOGCJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaSASTStatThaiTypem=] = ] n=allgallpavx2basebindbitsbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeaddialermsfileftpsfunchttpicmpidleigmpint8itabkindmdnsopen$.$e+
API String ID: 0-3959786716
Opcode ID: 788bf4393db8c25f4647594eb013ce8ae751750c6045f3b4d6214897be651ba4
Instruction ID: 3e141226f0e39625833f2da75f7dd7587aea6a3d7c5b34fb6d707f85417b7fe7
Opcode Fuzzy Hash: 788bf4393db8c25f4647594eb013ce8ae751750c6045f3b4d6214897be651ba4
Instruction Fuzzy Hash: BF512871409F458EC70BEF39C06532ABA94AFA2380F44CB5EE48E76192F771D59D8262

Function 00D99070 Relevance: 7.6, Strings: 6, Instructions: 122COMMON

Download Yara Rule

Strings

not in ranges: untyped locals , not a function.WithValue(type /etc/resolv.conf0123456789ABCDEF0123456789abcdef2384185791015625AddDllDirectory, xrefs: 00D99187
base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not , val .local.onion390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticFormatFridayGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLe, xrefs: 00D9915D
., xrefs: 00D99263
runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spansync.RWMutex.Lockthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version, xrefs: 00D99132
types value=answersconnectconsolecpuproffloat32float64forcegcgctracehead = invalidlookup minpc= nil keypacer: panic: runningsyscalluintptrunknownwaitingwindowswsarecvwsasend bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= poin, xrefs: 00D991EA
runtime: text offset base pointer out of rangeruntime: type offset base pointer out of rangesignal arrived during external code executionslice bounds out of range [:%x] with length %ystopTheWorld: not stopped (status != _Pgcstop)sysGrow bounds not aligned to , xrefs: 00D9925A

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: types value=answersconnectconsolecpuproffloat32float64forcegcgctracehead = invalidlookup minpc= nil keypacer: panic: runningsyscalluintptrunknownwaitingwindowswsarecvwsasend bytes, etypes is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= poin$ base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not , val .local.onion390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticFormatFridayGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLe$ not in ranges: untyped locals , not a function.WithValue(type /etc/resolv.conf0123456789ABCDEF0123456789abcdef2384185791015625AddDllDirectory$.$runtime: text offset base pointer out of rangeruntime: type offset base pointer out of rangesignal arrived during external code executionslice bounds out of range [:%x] with length %ystopTheWorld: not stopped (status != _Pgcstop)sysGrow bounds not aligned to $runtime: textOff runtime: typeOff scanobject n == 0select (no cases)stack: frame={sp:swept cached spansync.RWMutex.Lockthread exhaustionunknown caller pcunknown type kindwait for GC cyclewine_get_version
API String ID: 0-2472165130
Opcode ID: 16d716e57c254b0d21dd24196b1c6cbe272e8242a3a7a51091218a40d5676b14
Instruction ID: 39a05bfd8b72ffbac76e2968ef4b3500e872caf428855a084ed78c9edb49cee1
Opcode Fuzzy Hash: 16d716e57c254b0d21dd24196b1c6cbe272e8242a3a7a51091218a40d5676b14
Instruction Fuzzy Hash: 1851E3B4508B058FC704EF68D49565AFBE1FF88304F44892DF88887351E734D989DB62

Function 2BB7B990 Relevance: 7.6, APIs: 5, Instructions: 116processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,6FAD02D8), ref: 2BB7B9DA
_memset.LIBCMT ref: 2BB7B9FB
_memset.LIBCMT ref: 2BB7BA4B
Process32FirstW.KERNEL32(00000000,?), ref: 2BB7BA65
Process32NextW.KERNEL32(00000000,0000022C), ref: 2BB7BAB7

Part of subcall function 2BB7F707: _malloc.LIBCMT ref: 2BB7F721

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Process32_memset$CreateFirstNextSnapshotToolhelp32_malloc
String ID:
API String ID: 2416807333-0
Opcode ID: 1913396548992c674cced25a484273b2af3dc9d56ed73b8e560f23e5b001d7cb
Instruction ID: a91780a40ba64238f93ce1307a05d28899927b36dd6f5615f206f40e800c27be
Opcode Fuzzy Hash: 1913396548992c674cced25a484273b2af3dc9d56ed73b8e560f23e5b001d7cb
Instruction Fuzzy Hash: 9841D372D00615AFEB20FF60CC95FAAB3B4EF18710F004265E9259B291EB759A41CFA5

Function 00D7E760 Relevance: 7.6, Strings: 6, Instructions: 100COMMON

Download Yara Rule

Strings

in async preempt to non-Go memory , locked to thread/etc/nsswitch.conf298023223876953125Arab Standard TimeCaucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGC worker (active)GetComputerNameExWGetExitCodeProcessGetFileA, xrefs: 00D7E898
bad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivecontext.TODOdumping heapend tracegcentersyscallgcBitsArenasgcpacertracegetaddrinfowharddecommithost is downillegal seekinvalid pathinvalid portinvalid slotiphlpapi.dllkernel32.dllmadvdont, xrefs: 00D7E8EB
%, xrefs: 00D7E877
preempt at unknown pcread-only file systemreflect.Value.Complexreflect.Value.Pointerreleasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work.nwait= stale NFS file handlestartlockedm: m has pstartm: , xrefs: 00D7E8C9
runtime: unexpected SPWRITE function setprofilebucket: profile already setstartTheWorld: inconsistent mp->nextptoo many Additionals to pack (>65535)too many Authorities to pack (>65535)value too large for defined data type11102230246251565404236316680908203125, xrefs: 00D7E86E
preempt SPWRITErecovery failedruntime error: runtime.gopanicruntime: frame runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding psync.Mutex.Locktraceback stuckunknown network already; errno= mheap.sweepgen= not in ranges: u, xrefs: 00D7E8B3

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: in async preempt to non-Go memory , locked to thread/etc/nsswitch.conf298023223876953125Arab Standard TimeCaucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGC worker (active)GetComputerNameExWGetExitCodeProcessGetFileA$%$bad g statusbad g0 stackbad recoverycan't happencas64 failedchan receivecontext.TODOdumping heapend tracegcentersyscallgcBitsArenasgcpacertracegetaddrinfowharddecommithost is downillegal seekinvalid pathinvalid portinvalid slotiphlpapi.dllkernel32.dllmadvdont$preempt SPWRITErecovery failedruntime error: runtime.gopanicruntime: frame runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding psync.Mutex.Locktraceback stuckunknown network already; errno= mheap.sweepgen= not in ranges: u$preempt at unknown pcread-only file systemreflect.Value.Complexreflect.Value.Pointerreleasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work.nwait= stale NFS file handlestartlockedm: m has pstartm: $runtime: unexpected SPWRITE function setprofilebucket: profile already setstartTheWorld: inconsistent mp->nextptoo many Additionals to pack (>65535)too many Authorities to pack (>65535)value too large for defined data type11102230246251565404236316680908203125
API String ID: 0-2997826290
Opcode ID: 93fbd1c4cbd7e4fe472008a1a12e6b1b9adc261f9b79c826467f7bc78a94e860
Instruction ID: 0432a905e3957ecf8ff22130a4e37cf604a216443e5f693287fa0dd43c582afc
Opcode Fuzzy Hash: 93fbd1c4cbd7e4fe472008a1a12e6b1b9adc261f9b79c826467f7bc78a94e860
Instruction Fuzzy Hash: 7A41E5B45087448FC314EF24D195A6ABBE1EF89704F0588ADE4D887352E774D849DB32

Function 2BB73CA0 Relevance: 7.6, APIs: 5, Instructions: 98networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000598,00000000), ref: 2BB73CBF
SetLastError.KERNEL32(00000000,?,?,2BB7399F,?,?,00000000,000000FF,00000000), ref: 2BB73CFA
GetLastError.KERNEL32(00000000), ref: 2BB73D45
WSAGetLastError.WS2_32(?,?,2BB7399F,?,?,00000000,000000FF,00000000), ref: 2BB73D7B
WSASetLastError.WS2_32(0000000D,?,?,2BB7399F,?,?,00000000,000000FF,00000000), ref: 2BB73DA2

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: 33ad439a90dd59094519ab2ea95c0f300fb8f8f8990af524ff86e9832fbd0a2e
Instruction ID: 88d11b5de03d30c7c6e9fdc6dee80cb7e51553d018750b7a51fcaee93c28afb5
Opcode Fuzzy Hash: 33ad439a90dd59094519ab2ea95c0f300fb8f8f8990af524ff86e9832fbd0a2e
Instruction Fuzzy Hash: 6031E473A442008FEF50EF78D4C8F5A77B9FB44320F108166EE29CB296D775D8829A51

Function 2D4D3CB0 Relevance: 7.6, APIs: 5, Instructions: 98networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000598,00000000), ref: 2D4D3CCF
SetLastError.KERNEL32(00000000,?,?,2D4D39AF,?,?,00000000,000000FF,00000000), ref: 2D4D3D0A
GetLastError.KERNEL32(00000000), ref: 2D4D3D55
WSAGetLastError.WS2_32(?,?,2D4D39AF,?,?,00000000,000000FF,00000000), ref: 2D4D3D8B
WSASetLastError.WS2_32(0000000D,?,?,2D4D39AF,?,?,00000000,000000FF,00000000), ref: 2D4D3DB2

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: 726eab4cfbaabfaf8bb877bc9cf033b7f3fc6bebaaf17f7c9295eab4e29e4e3a
Instruction ID: faa201223d646b7a62ea6916e2f08ac2fc153daffc78575712449fea00ef2237
Opcode Fuzzy Hash: 726eab4cfbaabfaf8bb877bc9cf033b7f3fc6bebaaf17f7c9295eab4e29e4e3a
Instruction Fuzzy Hash: B831E7736042009FEB948F68D8D8B6937B9FB44B18F50416ADE04EB386D676D881CF50

Function 00403A4A Relevance: 7.6, APIs: 5, Instructions: 85networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000598,00000000), ref: 00403A60
SetLastError.KERNEL32(00000000,?,?,0040380A,?,?,00000000,000000FF,00000000), ref: 00403A8D
WSASetLastError.WS2_32(0000000D,?,?,0040380A,?,?,00000000,000000FF,00000000), ref: 00403ACC

Part of subcall function 0040475D: WSASetLastError.WS2_32(0000000D,?,?,00000004), ref: 00404791

GetLastError.KERNEL32(?,?,0040380A,?,?,00000000,000000FF,00000000), ref: 00403AE7
WSAGetLastError.WS2_32(?,?,0040380A,?,?,00000000,000000FF,00000000), ref: 00403B1B

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: 4553924e4c1753aaf6c68622dc0239bfb570566f0682f0d170eba2cf800f41d1
Instruction ID: 4d0084e622cbc3bbcd36f696c6cce05ee0c54c2c846a4ddff4f3f44358a1dcb6
Opcode Fuzzy Hash: 4553924e4c1753aaf6c68622dc0239bfb570566f0682f0d170eba2cf800f41d1
Instruction Fuzzy Hash: DE21E3316042009BDF509F64D8C8B663F6CFB04327F10807BEE06EA2D6D779DA809E59

Function 0040CDB7 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040CDC5

Part of subcall function 00405A53: __FF_MSGBANNER.LIBCMT ref: 00405A6C
Part of subcall function 00405A53: __NMSG_WRITE.LIBCMT ref: 00405A73
Part of subcall function 00405A53: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00409550,?,00000001,?,?,0040A9D1,00000018,00415BC0,0000000C,0040AA61), ref: 00405A98

_free.LIBCMT ref: 0040CDD8

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 0d88ea8f0264c305645654b15da8d1165d077c20fb5aafa89a31a476619c3edd
Instruction ID: d18e463ee79ed6d04c99a579d1221c12e95a358cc9cb53b645eb1ca656a8f5b7
Opcode Fuzzy Hash: 0d88ea8f0264c305645654b15da8d1165d077c20fb5aafa89a31a476619c3edd
Instruction Fuzzy Hash: DC11C832504911EBCB217B75FC8479B3B94EF843A5B24423BF449FB2D0DA3C88414A9D

Function 2BB80EEB Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 2BB80EF9

Part of subcall function 2BB7F673: __FF_MSGBANNER.LIBCMT ref: 2BB7F68C
Part of subcall function 2BB7F673: __NMSG_WRITE.LIBCMT ref: 2BB7F693
Part of subcall function 2BB7F673: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C,2BB88E76), ref: 2BB7F6B8

_free.LIBCMT ref: 2BB80F0C

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: caf93037ad1e5dd5c781963d94ea10ed86a1bae01279fd0db237b5aa43d60744
Instruction ID: 9bc79156a2d49e634a4f2e08ba30810198aeb6b621288ba4f79bd1a36171d374
Opcode Fuzzy Hash: caf93037ad1e5dd5c781963d94ea10ed86a1bae01279fd0db237b5aa43d60744
Instruction Fuzzy Hash: E5110A33C08955AFCF12EF74E809E4A3765DF692F0F508235E869D7160DB35C5819B98

Function 2D4DE667 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 2D4DE675

Part of subcall function 2D4D7E03: __FF_MSGBANNER.LIBCMT ref: 2D4D7E1C
Part of subcall function 2D4D7E03: __NMSG_WRITE.LIBCMT ref: 2D4D7E23
Part of subcall function 2D4D7E03: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,2D4DADD0,00000000,00000001,00000000,?,2D4DC162,00000018,2D52AFE0,0000000C,2D4DC1F2), ref: 2D4D7E48

_free.LIBCMT ref: 2D4DE688

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: f5e84912a25f2155bea9193c4c1d2b194c4b3493418ccdf00158eb9a32ccb1f8
Instruction ID: 80c2f0b279e37182bda0aa9aa3bc6037e428d236ff00117afddcc4115f18740c
Opcode Fuzzy Hash: f5e84912a25f2155bea9193c4c1d2b194c4b3493418ccdf00158eb9a32ccb1f8
Instruction Fuzzy Hash: B6112B334042145BCFA25F749834B6A3BA4EF45EA1F6A8579FA84BB340DB34C840C6D4

Function 0040489C Relevance: 7.6, APIs: 5, Instructions: 67networkCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004048A1
EnterCriticalSection.KERNEL32(00000204,00000004,?,?,00403ABB,?,00000018,?,?,?,?,0040380A,?,?,00000000,000000FF), ref: 004048C0
WSASetLastError.WS2_32(0000000D,?,00403ABB,?,00000018,?,?,?,?,0040380A,?,?,00000000,000000FF,00000000), ref: 00404922
LeaveCriticalSection.KERNEL32(00000204,?,00403ABB,?,00000018,?,?,?,?,0040380A,?,?,00000000,000000FF,00000000), ref: 00404929

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$EnterErrorH_prologLastLeave
String ID:
API String ID: 3901379633-0
Opcode ID: c7730d73e6a25867e3433ff8df327b63a5fd5d2d185001a136fd24a6a50f7fdc
Instruction ID: 7fd4ceed18c13c8a5d0b8b1f9c1bc1ba24ab04c6e139b78cd92324f20d9880e1
Opcode Fuzzy Hash: c7730d73e6a25867e3433ff8df327b63a5fd5d2d185001a136fd24a6a50f7fdc
Instruction Fuzzy Hash: 8911E4F2600700EBCB21AF69DC01A9B77E4EB88715F10893BF702E05E0D779D5409B18

Function 00D70670 Relevance: 7.6, Strings: 6, Instructions: 60COMMON

Download Yara Rule

Strings

', xrefs: 00D706EA
Powe, xrefs: 00D706E2
owrprof.dll, xrefs: 00D70695
erRegisterSuspendResumeNotification, xrefs: 00D706D4
', xrefs: 00D706F2
powr, xrefs: 00D706A0

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: '$'$Powe$erRegisterSuspendResumeNotification$owrprof.dll$powr
API String ID: 0-2222458068
Opcode ID: 7249e036782b9c17ddb7185ac7d100ee7b7c02e137b7fb78cb4df5137bbe821d
Instruction ID: e79cd6548194068ed8c561c1efacf12a2a97be8b92959c738b7a6a0e966da3aa
Opcode Fuzzy Hash: 7249e036782b9c17ddb7185ac7d100ee7b7c02e137b7fb78cb4df5137bbe821d
Instruction Fuzzy Hash: 5121F0B4508345CFC710EF25C48575EBBE0FB88348F40892EE49897261E774EA49CFA2

Function 00402D54 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00402D72
TranslateMessage.USER32(?), ref: 00402D9D
DispatchMessageW.USER32(?), ref: 00402DA7
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00402DB6
SetLastError.KERNEL32(000005B4), ref: 00402DC3

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: Message$DispatchErrorLastMultipleObjectsPeekTranslateWait
String ID:
API String ID: 2669921780-0
Opcode ID: b77eb6e92edf501ddae86691dc781fead7b9b613f14300b90e0ddf8f25ef4160
Instruction ID: db7f95fa004f9264418f8e3931d98c2a40ec8602c9324a9199f1e7a8564a985a
Opcode Fuzzy Hash: b77eb6e92edf501ddae86691dc781fead7b9b613f14300b90e0ddf8f25ef4160
Instruction Fuzzy Hash: C70199326001157BCB206BB49C0CDEB7B9CCF41362F104332F225F10E0D5B8C901CAA8

Function 2BB72C10 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 2BB72C3F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 2BB72C55
TranslateMessage.USER32(?), ref: 2BB72C64
DispatchMessageW.USER32(?), ref: 2BB72C6A
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 2BB72C78

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsTranslateWait
String ID:
API String ID: 2015114452-0
Opcode ID: 70ae7037ee6ba439bd07f2df14b00c5eebe7cd6177b26ffed6b16759df51972d
Instruction ID: c57d58918bd2c7c552701c35798888b7563b9dbfcaa2644eb2630d3a7ebed2f0
Opcode Fuzzy Hash: 70ae7037ee6ba439bd07f2df14b00c5eebe7cd6177b26ffed6b16759df51972d
Instruction Fuzzy Hash: AD01D673E54309B6FB10E6A48D85FEA777CEB15B10F104101FB50EB0C1D6E5E4019BA5

Function 2D4D2BF0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 2D4D2C1F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 2D4D2C35
TranslateMessage.USER32(?), ref: 2D4D2C44
DispatchMessageW.USER32(?), ref: 2D4D2C4A
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 2D4D2C58

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsTranslateWait
String ID:
API String ID: 2015114452-0
Opcode ID: 3ab318c672d6fc37a676a75bdb828727bf74af88104d6b77bd976383aaaf113a
Instruction ID: 22e3b61f733a6153fd162b95b52aa36566395ad7214a550a5a48be31a5d43298
Opcode Fuzzy Hash: 3ab318c672d6fc37a676a75bdb828727bf74af88104d6b77bd976383aaaf113a
Instruction Fuzzy Hash: CF018672A403097AEA1496948C82FBA737CAB08F51F50C511FF00FA1C4D6E4ED418BB4

Function 2BB74B70 Relevance: 7.5, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000), ref: 2BB74B83
EnterCriticalSection.KERNEL32(?,?,00000000), ref: 2BB74B8D
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 2BB74BA0
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 2BB74BA3

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: f04b76ef40e4916d6522fecf1c962fba301697e759a4c2be6afb946538da2f10
Instruction ID: 7f47f2903aaa430f44ad60777eadda9edeae4c327aad00f8b91bcb4aa2c17143
Opcode Fuzzy Hash: f04b76ef40e4916d6522fecf1c962fba301697e759a4c2be6afb946538da2f10
Instruction Fuzzy Hash: 39018F72A00A108BDB10EB39EDC4B6BB7F8EF88615F050869E146C3200C739EC4ACA60

Function 2D4D4B60 Relevance: 7.5, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000), ref: 2D4D4B73
EnterCriticalSection.KERNEL32(?,?,00000000), ref: 2D4D4B7D
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 2D4D4B90
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 2D4D4B93

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 7e48b2d60447240397de1e6114f3c43d53847bd4c559c79c53cb4b5afa5b300d
Instruction ID: fb1bf4907697a5f36506a710e149c3bd6ff1c6a2e9b72621010f703ad43e2671
Opcode Fuzzy Hash: 7e48b2d60447240397de1e6114f3c43d53847bd4c559c79c53cb4b5afa5b300d
Instruction Fuzzy Hash: 87018F726043148BEB50DB29ECC4B6BB3F8EB8C616F11882AE54693600D778E849CA74

Function 00404469 Relevance: 7.5, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000), ref: 00404483
EnterCriticalSection.KERNEL32(?,?,00000000), ref: 0040448C
LeaveCriticalSection.KERNEL32(00040000,?,00000000), ref: 0040449D
LeaveCriticalSection.KERNEL32(?,?,00000000), ref: 004044A0

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1d81c267c2dd2ee18cb1b77e1a18064b36fea225c02e99e4a6f5b9c53103fe32
Instruction ID: 9a4134cfbdda298912b99d2542e78d0795e3ebe28fd59a0b54ac9fe9006386e2
Opcode Fuzzy Hash: 1d81c267c2dd2ee18cb1b77e1a18064b36fea225c02e99e4a6f5b9c53103fe32
Instruction Fuzzy Hash: 870128B2D10629AFCB01DB60CD44B9ABBE8FB48369F054466D601B3650D778ED20DBD8

Function 2BB72D30 Relevance: 7.5, APIs: 5, Instructions: 36COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 2BB72D5C
CancelIo.KERNEL32(?), ref: 2BB72D66
InterlockedExchange.KERNEL32(00000000,00000000), ref: 2BB72D6F
closesocket.WS2_32(?), ref: 2BB72D79
SetEvent.KERNEL32(00000001), ref: 2BB72D83

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CancelEventExchangeInterlockedclosesocketsetsockopt
String ID:
API String ID: 1486965892-0
Opcode ID: ffb268ed8ff5f245b8481d903b721179927cda4a9dde94acdf59b02c5919ad55
Instruction ID: 552bfc5538c2e1589b9de53540a532c8611ceaa2888e19aede2b19e1087c0df6
Opcode Fuzzy Hash: ffb268ed8ff5f245b8481d903b721179927cda4a9dde94acdf59b02c5919ad55
Instruction Fuzzy Hash: EFF03C76900B00AFD3249F54CE49F66B7B8FF49B11F100A1CF6D697680C6B5F9098BA0

Function 0040CA4F Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040CA5B

Part of subcall function 00408ED3: __getptd_noexit.LIBCMT ref: 00408ED6
Part of subcall function 00408ED3: __amsg_exit.LIBCMT ref: 00408EE3

__getptd.LIBCMT ref: 0040CA72
__amsg_exit.LIBCMT ref: 0040CA80
__lock.LIBCMT ref: 0040CA90
__updatetlocinfoEx_nolock.LIBCMT ref: 0040CAA4

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 4b24231f2d7e1c8b683d87045289aa8b3d9528e24f64161b5cead3c5c1a0605b
Instruction ID: 6cfecf7921ed10c5afc9d4d19ac6244c28915c784b6daa5a08a206f4814667bb
Opcode Fuzzy Hash: 4b24231f2d7e1c8b683d87045289aa8b3d9528e24f64161b5cead3c5c1a0605b
Instruction Fuzzy Hash: 93F06232A44714DBD621FBB59942B4E32A06B00728F10426FF844B66D2DA7C4940DE9E

Function 2BA049C5 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 2BA049D1

Part of subcall function 2BA0381A: __getptd_noexit.LIBCMT ref: 2BA0381D
Part of subcall function 2BA0381A: __amsg_exit.LIBCMT ref: 2BA0382A

__getptd.LIBCMT ref: 2BA049E8
__amsg_exit.LIBCMT ref: 2BA049F6
__lock.LIBCMT ref: 2BA04A06
__updatetlocinfoEx_nolock.LIBCMT ref: 2BA04A1A

Memory Dump Source

Source File: 00000000.00000002.4113322478.000000002B9F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 2B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b9f0000_L8RabfF1Hu.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: b8df328af2ca13b15628588c2ddeec9715aad909c858093188abaa4f1f59b7b1
Instruction ID: c0b0d21fb507e072c03ea11374cb392e6f862f2ce786c1443aa3d1b974652360
Opcode Fuzzy Hash: b8df328af2ca13b15628588c2ddeec9715aad909c858093188abaa4f1f59b7b1
Instruction Fuzzy Hash: 2BF09032A092109AEE14AB69BD42B4D37F0BF24760F198A59E604A72D1CF2459419A99

Function 2BB85006 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 2BB85012

Part of subcall function 2BB83E5B: __getptd_noexit.LIBCMT ref: 2BB83E5E
Part of subcall function 2BB83E5B: __amsg_exit.LIBCMT ref: 2BB83E6B

__getptd.LIBCMT ref: 2BB85029
__amsg_exit.LIBCMT ref: 2BB85037
__lock.LIBCMT ref: 2BB85047
__updatetlocinfoEx_nolock.LIBCMT ref: 2BB8505B

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 9e047e0660dfd7b83dcfe80d349260da53802bec81d1626899e9eb2a84428754
Instruction ID: 8f05350339b88215b23f4944e247f3fb75889f7e0f5edbb6bbdd25c48ba9c56a
Opcode Fuzzy Hash: 9e047e0660dfd7b83dcfe80d349260da53802bec81d1626899e9eb2a84428754
Instruction Fuzzy Hash: 5BF0B432905B00DFDF60DB789403B8D73A1AF3CB66F104209E659A71D2CF7895418E9A

Function 2D4DE1CF Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 2D4DE1DB

Part of subcall function 2D4DA728: __getptd_noexit.LIBCMT ref: 2D4DA72B
Part of subcall function 2D4DA728: __amsg_exit.LIBCMT ref: 2D4DA738

__getptd.LIBCMT ref: 2D4DE1F2
__amsg_exit.LIBCMT ref: 2D4DE200
__lock.LIBCMT ref: 2D4DE210
__updatetlocinfoEx_nolock.LIBCMT ref: 2D4DE224

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 491ad249b4994c465303811552df47a066a8afdc05144824a4ee4cff1cdf9fe8
Instruction ID: ec564024d572f58144c2caa6de67fbff33a9e677d64fec9fc7d9f08ea80971e5
Opcode Fuzzy Hash: 491ad249b4994c465303811552df47a066a8afdc05144824a4ee4cff1cdf9fe8
Instruction Fuzzy Hash: 0AF0F033A0C6109BDBA1DB74942AB5D32E0EF20E65F22819FDB91B72D4CB6885418A95

Function 2BB7C910 Relevance: 7.5, APIs: 5, Instructions: 33processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,000001FE), ref: 2BB7C932
GetCommandLineW.KERNEL32 ref: 2BB7C938
GetStartupInfoW.KERNEL32(?), ref: 2BB7C947
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000020,00000000,00000000,?,?), ref: 2BB7C96F
ExitProcess.KERNEL32 ref: 2BB7C977

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Process$CommandCreateExitFileInfoLineModuleNameStartup
String ID:
API String ID: 3421218197-0
Opcode ID: 1201a61f6d852d71c032e2abe70a8e86a05ae68a98798c2eab69032661593e17
Instruction ID: e99bd4d33e853987106650cb66ea468490bb08119c24add2a221e9ff8ba06b25
Opcode Fuzzy Hash: 1201a61f6d852d71c032e2abe70a8e86a05ae68a98798c2eab69032661593e17
Instruction Fuzzy Hash: 30F04931D84218ABEB209BA0CD4EFFA7778AF04B00F100294B659A70D0DA75AA45CF54

Function 2BB775B0 Relevance: 7.5, APIs: 5, Instructions: 33processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,000001FE), ref: 2BB775D2
GetCommandLineW.KERNEL32 ref: 2BB775D8
GetStartupInfoW.KERNEL32(?), ref: 2BB775E7
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000020,00000000,00000000,?,?), ref: 2BB7760F
ExitProcess.KERNEL32 ref: 2BB77617

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Process$CommandCreateExitFileInfoLineModuleNameStartup
String ID:
API String ID: 3421218197-0
Opcode ID: 3a253a8ae70d7b3bdb6424f03222c7ca42747f061458ad371377089b8b81a5a2
Instruction ID: b69d6a1d4b277f95c40fcb992d56b259323ef7a825c552878050c159be3cf9e2
Opcode Fuzzy Hash: 3a253a8ae70d7b3bdb6424f03222c7ca42747f061458ad371377089b8b81a5a2
Instruction Fuzzy Hash: E0F06D71D85319BFEB209BA0CD4EFA97778EF04B00F200294B659A70C0D675AA45CF54

Function 00405DEA Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00406CA2: _doexit.LIBCMT ref: 00406CAE

___set_flsgetvalue.LIBCMT ref: 00405DFC

Part of subcall function 00408D18: TlsGetValue.KERNEL32(?,00405E01), ref: 00408D21
Part of subcall function 00408D18: DecodePointer.KERNEL32(?,00405E01), ref: 00408D33
Part of subcall function 00408D18: TlsSetValue.KERNEL32(00000000,?,00405E01), ref: 00408D42

___fls_getvalue@4.LIBCMT ref: 00405E07

Part of subcall function 00408CF8: TlsGetValue.KERNEL32(?,?,00405E0C,00000000), ref: 00408D06

___fls_setvalue@8.LIBCMT ref: 00405E1A

Part of subcall function 00408D4C: DecodePointer.KERNEL32(?,?,?,00405E1F,00000000,?,00000000), ref: 00408D5D

GetLastError.KERNEL32(00000000,?,00000000), ref: 00405E23
ExitThread.KERNEL32 ref: 00405E2A
GetCurrentThreadId.KERNEL32 ref: 00405E30
__freefls@4.LIBCMT ref: 00405E50

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 781180411-0
Opcode ID: 3c48a067a3aa0549fe24a18bd49609324549dee87663f563c303af06a537c210
Instruction ID: b4ae7c992ac9d2fea30ac157d3b4c1675b0f8aec10a7b67d481e0a8f27335a2d
Opcode Fuzzy Hash: 3c48a067a3aa0549fe24a18bd49609324549dee87663f563c303af06a537c210
Instruction Fuzzy Hash: A5E01A7180060577DF007BB28A0A99F3A2DAD54309B50413EB990B21C2DE3D9A1256AD

Function 2BB7F9B8 Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 2BB81CD0: _doexit.LIBCMT ref: 2BB81CDC

___set_flsgetvalue.LIBCMT ref: 2BB7F9CA

Part of subcall function 2BB83CA0: TlsGetValue.KERNEL32(00000000,2BB83DF9,?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C,2BB88E76,00000000,00000000), ref: 2BB83CA9
Part of subcall function 2BB83CA0: DecodePointer.KERNEL32(?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C,2BB88E76,00000000,00000000,?,2BB83F06,0000000D), ref: 2BB83CBB
Part of subcall function 2BB83CA0: TlsSetValue.KERNEL32(00000000,?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C,2BB88E76,00000000,00000000,?,2BB83F06), ref: 2BB83CCA

___fls_getvalue@4.LIBCMT ref: 2BB7F9D5

Part of subcall function 2BB83C80: TlsGetValue.KERNEL32(?,?,2BB7F9DA,00000000), ref: 2BB83C8E

___fls_setvalue@8.LIBCMT ref: 2BB7F9E8

Part of subcall function 2BB83CD4: DecodePointer.KERNEL32(?,?,?,2BB7F9ED,00000000,?,00000000), ref: 2BB83CE5

GetLastError.KERNEL32(00000000,?,00000000), ref: 2BB7F9F1
ExitThread.KERNEL32 ref: 2BB7F9F8
GetCurrentThreadId.KERNEL32 ref: 2BB7F9FE
__freefls@4.LIBCMT ref: 2BB7FA1E

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 781180411-0
Opcode ID: 10aa0b9619351108cfba90802774e765a9f30c73b236481be5b0e43d59340e2f
Instruction ID: b3a2544fd36ca6b1a3e9b0ec68bef276487e9391c10de4a6e9fde9e81f598e83
Opcode Fuzzy Hash: 10aa0b9619351108cfba90802774e765a9f30c73b236481be5b0e43d59340e2f
Instruction Fuzzy Hash: DFE0B676C017557B8F00B7F28E1E89E7A6CAF39181F118410FE15E7011EAA9DA528FA6

Function 2D4D812A Relevance: 7.5, APIs: 5, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 2D4D90D6: _doexit.LIBCMT ref: 2D4D90E2

___set_flsgetvalue.LIBCMT ref: 2D4D813C

Part of subcall function 2D4DA56D: TlsGetValue.KERNEL32(?,2D4DA6C6,?,?,2D4D8092,2D4D8002,?,?,?,2D4D66C6,154.201.87.51,000000FF,?), ref: 2D4DA576
Part of subcall function 2D4DA56D: DecodePointer.KERNEL32(?,?,2D4D8092,2D4D8002,?,?,?,2D4D66C6,154.201.87.51,000000FF,?), ref: 2D4DA588
Part of subcall function 2D4DA56D: TlsSetValue.KERNEL32(00000000,?,?,2D4D8092,2D4D8002,?,?,?,2D4D66C6,154.201.87.51,000000FF,?), ref: 2D4DA597

___fls_getvalue@4.LIBCMT ref: 2D4D8147

Part of subcall function 2D4DA54D: TlsGetValue.KERNEL32(?,?,2D4D814C,00000000), ref: 2D4DA55B

___fls_setvalue@8.LIBCMT ref: 2D4D815A

Part of subcall function 2D4DA5A1: DecodePointer.KERNEL32(?,?,?,2D4D815F,00000000,?,00000000), ref: 2D4DA5B2

GetLastError.KERNEL32(00000000,?,00000000), ref: 2D4D8163
ExitThread.KERNEL32 ref: 2D4D816A
GetCurrentThreadId.KERNEL32 ref: 2D4D8170
__freefls@4.LIBCMT ref: 2D4D8190

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Value$DecodePointerThread$CurrentErrorExitLast___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4_doexit
String ID:
API String ID: 781180411-0
Opcode ID: bb095a0890b63bd40228db917fa933f1cec05c559dd109db34f31fbded1c6291
Instruction ID: 95f64e9d1337fdc5e0310ba4f88f8774feecd287ba46a35fed4ced955647fe26
Opcode Fuzzy Hash: bb095a0890b63bd40228db917fa933f1cec05c559dd109db34f31fbded1c6291
Instruction Fuzzy Hash: CCE04F6380C206A78B80E7F18C3A96E3A2CDF24991F1A4409EB11B3210DA689A0186A5

Function 004027E6 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(00403357,?,11111,00404F93), ref: 004027F9
CloseHandle.KERNEL32(00402CEC), ref: 00402804

Strings

,@, xrefs: 004027FE
11111, xrefs: 004027E6
2(@, xrefs: 004027F3

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: CloseHandle
String ID: 11111$2(@$,@
API String ID: 2962429428-4059779066
Opcode ID: bed0468088e098d257620ed4d2b3e8c032133e0ea60d064a87189f4edcae94f2
Instruction ID: b00ec6328a4b6071364d2a89eb99e702a5db300fa0780bd2c87cb6edba9ed167
Opcode Fuzzy Hash: bed0468088e098d257620ed4d2b3e8c032133e0ea60d064a87189f4edcae94f2
Instruction Fuzzy Hash: 18D0C9BA100A11AA87302F06E8048C6BFF6EFC5331312846ED88452224D7B068898EA4

Function 2BB79430 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 2BB7944A

Part of subcall function 2BB7EF86: std::exception::exception.LIBCMT ref: 2BB7EF9B
Part of subcall function 2BB7EF86: __CxxThrowException@8.LIBCMT ref: 2BB7EFB0
Part of subcall function 2BB7EF86: std::exception::exception.LIBCMT ref: 2BB7EFC1

std::_Xinvalid_argument.LIBCPMT ref: 2BB79482

Part of subcall function 2BB7EF39: std::exception::exception.LIBCMT ref: 2BB7EF4E
Part of subcall function 2BB7EF39: __CxxThrowException@8.LIBCMT ref: 2BB7EF63
Part of subcall function 2BB7EF39: std::exception::exception.LIBCMT ref: 2BB7EF74

Strings

invalid string position, xrefs: 2BB79445
string too long, xrefs: 2BB7947D

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1823113695-4289949731
Opcode ID: e4e997fb4f9c168f0a0ab68bebf5e18282416ba6c6dd473b1d221c993182162d
Instruction ID: 25dbe61fe3f0ccd6af1198fcfe0cff9e20d5e56b71b7f05b38ebf3cf197eaf87
Opcode Fuzzy Hash: e4e997fb4f9c168f0a0ab68bebf5e18282416ba6c6dd473b1d221c993182162d
Instruction Fuzzy Hash: B621BB337046106BDB30ED6CF880956F7F9EBAD764B20092FE2E1CB651D661D940D7A1

Function 2BB784B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 2BB784C9

Part of subcall function 2BB7EF86: std::exception::exception.LIBCMT ref: 2BB7EF9B
Part of subcall function 2BB7EF86: __CxxThrowException@8.LIBCMT ref: 2BB7EFB0
Part of subcall function 2BB7EF86: std::exception::exception.LIBCMT ref: 2BB7EFC1

std::_Xinvalid_argument.LIBCPMT ref: 2BB784E7

Strings

invalid string position, xrefs: 2BB784C4
string too long, xrefs: 2BB784E2

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: invalid string position$string too long
API String ID: 963545896-4289949731
Opcode ID: 0b45671acc94fafb44a75eaa527514b387f3f753b5aee5dbe32eda71d3476c32
Instruction ID: b60fa0428287f033e762b5f24befa3fbfc5ca3b27e0159335320184e6dd59e98
Opcode Fuzzy Hash: 0b45671acc94fafb44a75eaa527514b387f3f753b5aee5dbe32eda71d3476c32
Instruction Fuzzy Hash: 24215C327003069B8F14EF69E88186973BABF983147104669E626CB651EB30FA54DBA1

Function 2BB7D1C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 2BB7D1D4

Part of subcall function 2BB7EF39: std::exception::exception.LIBCMT ref: 2BB7EF4E
Part of subcall function 2BB7EF39: __CxxThrowException@8.LIBCMT ref: 2BB7EF63
Part of subcall function 2BB7EF39: std::exception::exception.LIBCMT ref: 2BB7EF74

_memmove.LIBCMT ref: 2BB7D20D

Strings

vector<T> too long, xrefs: 2BB7D1CF
+, xrefs: 2BB7D1FC, 2BB7D212, 2BB7D238

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long$+
API String ID: 1785806476-2622287067
Opcode ID: 08cdad3c48dead4391f1d3c25a7a8cb23c0aa45949e8870a0f65bc9a3776b977
Instruction ID: 255f22e571f0bd5e23b0de84cc4fa97c22ba9cd3b2ae9a4d4e8f96f571d98c21
Opcode Fuzzy Hash: 08cdad3c48dead4391f1d3c25a7a8cb23c0aa45949e8870a0f65bc9a3776b977
Instruction Fuzzy Hash: 0801D8B7D001115FCB00DE6DD883C3A77A9EF65290749023AEC22C7644E77AE89997A0

Function 00402DF7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00402E48
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00402E53
InterlockedExchange.KERNEL32(00000018,00000000), ref: 00402E61

Strings

{.@, xrefs: 00402E0F

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: CreateEventExchangeInterlockedStartup
String ID: {.@
API String ID: 784645330-3661501983
Opcode ID: 90b39193a522274eeca8a6f92383bc8fd567e42294c675c43f94ef2f1aa9a74a
Instruction ID: fccddcccabf2a26167574d2d3d719b0984fcb840e793beef96ebc2825708f8c5
Opcode Fuzzy Hash: 90b39193a522274eeca8a6f92383bc8fd567e42294c675c43f94ef2f1aa9a74a
Instruction Fuzzy Hash: 56118DB1900B409FC3308F2A9949993FBF8FFA5715B008A1FE5AAC2A60D7B4A145CF55

Function 004124BF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004124D2

Part of subcall function 0041242D: ___BuildCatchObjectHelper.LIBCMT ref: 00412463

_UnwindNestedFrames.LIBCMT ref: 004124E9
___FrameUnwindToState.LIBCMT ref: 004124F7

Strings

bad exception, xrefs: 004124CD

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: bad exception
API String ID: 2163707966-3837556057
Opcode ID: ca75771aede54671b8743cf01e1da2500cab9110d5ba56fc33b3986a3b5c7031
Instruction ID: 6513c378f0a9ae30c127a0beb8ab8fedb7c613c353dcefeb0c56db0572e32da0
Opcode Fuzzy Hash: ca75771aede54671b8743cf01e1da2500cab9110d5ba56fc33b3986a3b5c7031
Instruction Fuzzy Hash: 21012471000109BBDF22AF52CE41EEA3F6AFF18398F008016BD1854161D77A99F1EBA9

Function 00405170 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00405175
DeleteCriticalSection.KERNEL32(?,?,?,?,004051BF), ref: 0040519E
DeleteCriticalSection.KERNEL32(?,?,?,?,004051BF), ref: 004051A4

Strings

mQ@, xrefs: 00405182

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalDeleteSection$H_prolog
String ID: mQ@
API String ID: 267298877-1781705956
Opcode ID: 7389daedd9a974d0ba8e1020400e80ac4106051a0e3c15e22bb904bd1d2f7ba2
Instruction ID: 1febeb007378a1e643194b3c1a4e603fb0dce332d0b38df30e75f3d3b7e64777
Opcode Fuzzy Hash: 7389daedd9a974d0ba8e1020400e80ac4106051a0e3c15e22bb904bd1d2f7ba2
Instruction Fuzzy Hash: 2AE01AB2A01115ABCB04AFA99840ADEBBB8EF88714F00402BA101A3200C7F865458AA8

Function 00D5ED10 Relevance: 6.6, Strings: 5, Instructions: 325COMMON

Download Yara Rule

Strings

produced a trigger greater than the heap goalreflect: internal error: invalid method indexruntime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=transitioning GC to the same state , xrefs: 00D5F0B8
-, xrefs: 00D5F0C1
minTrigger=mswsock.dllnetpollInitnil contextreflectOffsruntime: P runtime: g runtime: p scheddetailsecur32.dllshell32.dllshort writetracealloc(unreachableuserenv.dll B (goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsign, xrefs: 00D5F05A
trigger=unixgramunknown(wsaioctl (forced) B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA (MISSING)(unknown), newval=, oldval=, size = , t, xrefs: 00D5EFF7
heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday((BADINDEX), bound = , limit = .localhost/dev/stdin/etc/hosts122070312561035156258.8.8.8:53AdditionalBad varint, xrefs: 00D5F021

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday((BADINDEX), bound = , limit = .localhost/dev/stdin/etc/hosts122070312561035156258.8.8.8:53AdditionalBad varint$-$minTrigger=mswsock.dllnetpollInitnil contextreflectOffsruntime: P runtime: g runtime: p scheddetailsecur32.dllshell32.dllshort writetracealloc(unreachableuserenv.dll B (goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsign$produced a trigger greater than the heap goalreflect: internal error: invalid method indexruntime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=transitioning GC to the same state $trigger=unixgramunknown(wsaioctl (forced) B exp.) B work ( blocked= in use) lockedg= lockedm= m->curg= marked method: ms cpu, not in [ runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=%!(EXTRA (MISSING)(unknown), newval=, oldval=, size = , t
API String ID: 0-3419957197
Opcode ID: f870aaa2beb160345296ff84c63397c6f2027d3ebd181b745bacdc1d19084768
Instruction ID: c2a15726a75dc233fdb84db028db7e54c67067c1f2c73ee9cf7ff33b220fa028
Opcode Fuzzy Hash: f870aaa2beb160345296ff84c63397c6f2027d3ebd181b745bacdc1d19084768
Instruction Fuzzy Hash: D0B16F726097219FC755DF68C5C090EF7E2ABC8704F49893DF89897391EB71EC098A92

Function 00D791C0 Relevance: 6.5, Strings: 5, Instructions: 294COMMON

Download Yara Rule

Strings

1, xrefs: 00D79516
casgstatus: waiting for Gwaiting but is Grunnabledelayed zeroing on data that may contain pointersfully empty unfreed span set block found in resetinvalid memory address or nil pointer dereferenceinvalid or incomplete multibyte or wide characternot enough sign, xrefs: 00D7950D
casgstatus: bad incoming valuescheckmark found unmarked objectentersyscallblock inconsistent fmt: unknown base; can't happeninternal error - misuse of itabinvalid network interface indexmalformed time zone informationnon in-use span in unswept listpacer: sweep, xrefs: 00D795BA
newval= nfreed= pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYCyrillicDecemberDuployanEthiopicExtenderFebruaryFullPathGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALine, xrefs: 00D79586
runtime: casgstatus: oldval=runtime: no module data for save on system g not allowed45474735088646411895751953125Central America Standard TimeCentral Pacific Standard TimeChatham Islands Standard TimeDeleteProcThreadAttributeListLockOSThread nesting overflowN., xrefs: 00D7955C

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: newval= nfreed= pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYCyrillicDecemberDuployanEthiopicExtenderFebruaryFullPathGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALine$1$casgstatus: bad incoming valuescheckmark found unmarked objectentersyscallblock inconsistent fmt: unknown base; can't happeninternal error - misuse of itabinvalid network interface indexmalformed time zone informationnon in-use span in unswept listpacer: sweep$casgstatus: waiting for Gwaiting but is Grunnabledelayed zeroing on data that may contain pointersfully empty unfreed span set block found in resetinvalid memory address or nil pointer dereferenceinvalid or incomplete multibyte or wide characternot enough sign$runtime: casgstatus: oldval=runtime: no module data for save on system g not allowed45474735088646411895751953125Central America Standard TimeCentral Pacific Standard TimeChatham Islands Standard TimeDeleteProcThreadAttributeListLockOSThread nesting overflowN.
API String ID: 0-1175832713
Opcode ID: 2f360dcec4e66b2a6893e91e1449086a79790194c1a57c25dd0f4df093b7884c
Instruction ID: 821077952ee4ef9d6a1af99546626b4f87663a354a1a172d8591d12f70a3ea4f
Opcode Fuzzy Hash: 2f360dcec4e66b2a6893e91e1449086a79790194c1a57c25dd0f4df093b7884c
Instruction Fuzzy Hash: BDC125756093458FD314EF28C0A076AFBE1FF88304F54896DE8998B362E735D885DB62

Function 00D89C60 Relevance: 6.4, Strings: 5, Instructions: 192COMMON

Download Yara Rule

Strings

stackalloc not on scheduler stackstoplockedm: inconsistent lockingsync: RUnlock of unlocked RWMutextimer period must be non-negativetoo many Answers to pack (>65535)too many levels of symbolic linksunaligned 64-bit atomic operationwaiting for unsupported file , xrefs: 00D89EEF
out of memorypowrprof.dll, xrefs: 00D89DCE
out of memory (stackalloc)persistentalloc: size == 0required key not availableruntime: bad span s.state=runtime: pcHeader: magic= segment prefix is reservedshrinking stack in libcallstartlockedm: locked to metoo many colons in addressunclosed criterion bracket, xrefs: 00D89D04
!, xrefs: 00D89EF8
stack size not a power of 2stopTheWorld: holding lockstime: invalid location nametimer when must be positivetoo many callback functionswork.nwait was > work.nproc args stack map entries for 18189894035458564758300781259094947017729282379150390625Aus Central W., xrefs: 00D89ED9

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: !$out of memory (stackalloc)persistentalloc: size == 0required key not availableruntime: bad span s.state=runtime: pcHeader: magic= segment prefix is reservedshrinking stack in libcallstartlockedm: locked to metoo many colons in addressunclosed criterion bracket$out of memorypowrprof.dll$stack size not a power of 2stopTheWorld: holding lockstime: invalid location nametimer when must be positivetoo many callback functionswork.nwait was > work.nproc args stack map entries for 18189894035458564758300781259094947017729282379150390625Aus Central W.$stackalloc not on scheduler stackstoplockedm: inconsistent lockingsync: RUnlock of unlocked RWMutextimer period must be non-negativetoo many Answers to pack (>65535)too many levels of symbolic linksunaligned 64-bit atomic operationwaiting for unsupported file
API String ID: 0-851701814
Opcode ID: b74cd7fbafdde6cbca7c18f6324ad7c672a3f9b332e72a9f6d558776f0d07cfe
Instruction ID: cebbc5bec59c516690e6fe237df28626ef23a5a11293ae7a9514e35a52d0255b
Opcode Fuzzy Hash: b74cd7fbafdde6cbca7c18f6324ad7c672a3f9b332e72a9f6d558776f0d07cfe
Instruction Fuzzy Hash: 618145746093459FC714EF29C49066AFBE1FF99700F18882DE8C98B355E734D989CBA2

Function 00D7B4C0 Relevance: 6.4, Strings: 5, Instructions: 180COMMON

Download Yara Rule

Strings

startm: m has pstopm holding psync.Mutex.Locktraceback stuckunknown network already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function.WithValue(type /etc/resolv.conf0123456789ABCDEF0123456789abcdef2384185791015625AddDllDirectory, xrefs: 00D7B733
startm: m is spinningstate not recoverabletimer data corruptionunexpected value stepunknown empty Context%SystemRoot%\system32\.localhost.localdomain4656612873077392578125Aleutian Standard TimeAtlantic Standard TimeCaucasus Standard TimeConvertSidToStringSidWC, xrefs: 00D7B749
startm: P required for spinning=truesyntax error scanning complex numberuncaching span but s.allocCount == 0user arena span is on the wrong list) is smaller than minimum page size (2220446049250313080847263336181640625_cgo_notify_runtime_init_done missingall g, xrefs: 00D7B75F
$, xrefs: 00D7B768
startm: p has runnable gsstoplockedm: not runnableunexpected '[' in addressunexpected ']' in addressunexpected fault address unexpected key value type1455191522836685180664062572759576141834259033203125Bougainville Standard TimeCentral Asia Standard TimeCertFr, xrefs: 00D7B71D

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: $$startm: P required for spinning=truesyntax error scanning complex numberuncaching span but s.allocCount == 0user arena span is on the wrong list) is smaller than minimum page size (2220446049250313080847263336181640625_cgo_notify_runtime_init_done missingall g$startm: m has pstopm holding psync.Mutex.Locktraceback stuckunknown network already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function.WithValue(type /etc/resolv.conf0123456789ABCDEF0123456789abcdef2384185791015625AddDllDirectory$startm: m is spinningstate not recoverabletimer data corruptionunexpected value stepunknown empty Context%SystemRoot%\system32\.localhost.localdomain4656612873077392578125Aleutian Standard TimeAtlantic Standard TimeCaucasus Standard TimeConvertSidToStringSidWC$startm: p has runnable gsstoplockedm: not runnableunexpected '[' in addressunexpected ']' in addressunexpected fault address unexpected key value type1455191522836685180664062572759576141834259033203125Bougainville Standard TimeCentral Asia Standard TimeCertFr
API String ID: 0-29933516
Opcode ID: 81e19115a85588b80a8fe0e82fd15a0ee155260ce30ca1b74f3dca61ebc61c70
Instruction ID: 2076705f003f3530e984c44545f7bee8d836310b8d2018585ef237c4111285ae
Opcode Fuzzy Hash: 81e19115a85588b80a8fe0e82fd15a0ee155260ce30ca1b74f3dca61ebc61c70
Instruction Fuzzy Hash: A17128B45083448FC714DF25D090B6ABBE1EF89714F19886EE8D88B362E734D945DF22

Function 00D4B7D0 Relevance: 6.4, Strings: 5, Instructions: 177COMMON

Download Yara Rule

Strings

persistentalloc: align is too largepidleput: P has non-empty run queueruntime: close polldesc w/o unblockruntime: createevent failed; errno=runtime: inconsistent read deadlineryuFtoaFixed32 called with prec > 9too many Questions to pack (>65535)traceback did n, xrefs: 00D4BA29
runtime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]unsafe.String: len out of range (types from different packages)28421709430404007434844970703125CertAddCer, xrefs: 00D4BA02
*, xrefs: 00D4BA48
persistentalloc: align is not a power of 2runtime: blocked write on closing polldescsweep: tried to preserve a user arena spansync/atomic: store of nil value into Valueunexpected signal during runtime executiongcBgMarkWorker: unexpected gcMarkWorkerModegrew he, xrefs: 00D4BA3F
persistentalloc: size == 0required key not availableruntime: bad span s.state=runtime: pcHeader: magic= segment prefix is reservedshrinking stack in libcallstartlockedm: locked to metoo many colons in addressunclosed criterion bracketunexpected type in connect, xrefs: 00D4BA55

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: *$persistentalloc: align is not a power of 2runtime: blocked write on closing polldescsweep: tried to preserve a user arena spansync/atomic: store of nil value into Valueunexpected signal during runtime executiongcBgMarkWorker: unexpected gcMarkWorkerModegrew he$persistentalloc: align is too largepidleput: P has non-empty run queueruntime: close polldesc w/o unblockruntime: createevent failed; errno=runtime: inconsistent read deadlineryuFtoaFixed32 called with prec > 9too many Questions to pack (>65535)traceback did n$persistentalloc: size == 0required key not availableruntime: bad span s.state=runtime: pcHeader: magic= segment prefix is reservedshrinking stack in libcallstartlockedm: locked to metoo many colons in addressunclosed criterion bracketunexpected type in connect$runtime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds out of range [%x:]slice bounds out of range [:%x]unsafe.String: len out of range (types from different packages)28421709430404007434844970703125CertAddCer
API String ID: 0-2652804428
Opcode ID: 093faed8e40dbce82a80fe2b40b1830dcee08c8bef2d25b1c2d33c04854be43f
Instruction ID: 249206e55aa7849a5ad0deea715e7be00e58576d359965309dab0fcfb632ce4b
Opcode Fuzzy Hash: 093faed8e40dbce82a80fe2b40b1830dcee08c8bef2d25b1c2d33c04854be43f
Instruction Fuzzy Hash: BA7138B4909349CFCB14DF24C19066ABBE1FF98314F14896EE88987311E734E949DF62

Function 00D520F0 Relevance: 6.4, Strings: 5, Instructions: 156COMMON

Download Yara Rule

Strings

out of memorypowrprof.dll, xrefs: 00D5230B
refill of span with free space remainingruntime.SetFinalizer: first argument is runtime.preemptM: duplicatehandle failedruntime: SyscallN has too many argumentsruntime: out of memory: cannot allocate runtime: typeBitsBulkBarrier with type ryuFtoaFixed32 calle, xrefs: 00D52343
(, xrefs: 00D5234C
bad sweepgen in refillcannot allocate memorycompileCallabck: type duplicated defer entryfreeIndex is not validgetenv before env initheadTailIndex overflowinteger divide by zerointerface conversion: invalid address familykernel32.dll not foundminpc or maxpc inv, xrefs: 00D5232D
span has no free spacestack not a power of 2trace reader (blocked)trace: alloc too largeunexpected method stepwirep: invalid p state) must be a power of 223283064365386962890625<invalid reflect.Value>Argentina Standard TimeAstrakhan Standard TimeCertGetCertif, xrefs: 00D522F5

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: ($bad sweepgen in refillcannot allocate memorycompileCallabck: type duplicated defer entryfreeIndex is not validgetenv before env initheadTailIndex overflowinteger divide by zerointerface conversion: invalid address familykernel32.dll not foundminpc or maxpc inv$out of memorypowrprof.dll$refill of span with free space remainingruntime.SetFinalizer: first argument is runtime.preemptM: duplicatehandle failedruntime: SyscallN has too many argumentsruntime: out of memory: cannot allocate runtime: typeBitsBulkBarrier with type ryuFtoaFixed32 calle$span has no free spacestack not a power of 2trace reader (blocked)trace: alloc too largeunexpected method stepwirep: invalid p state) must be a power of 223283064365386962890625<invalid reflect.Value>Argentina Standard TimeAstrakhan Standard TimeCertGetCertif
API String ID: 0-3704760108
Opcode ID: ec0c2001f444efa0a582d0df0dfe2732516f4a1f485609a22a110d23fcf1d3a8
Instruction ID: 84c3e452fef4bad0887f6a0f134234e822606fffd6aec6537fd7060f6be1f6fa
Opcode Fuzzy Hash: ec0c2001f444efa0a582d0df0dfe2732516f4a1f485609a22a110d23fcf1d3a8
Instruction Fuzzy Hash: 60712EB4508304CFC704EF29D49066ABBE1FF88704F45896EE9998B392D734D949DFA2

Function 2BB7D830 Relevance: 6.4, APIs: 5, Instructions: 140COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014), ref: 2BB7D868
IsBadReadPtr.KERNEL32(?,00000014), ref: 2BB7D938
SetLastError.KERNEL32(0000007F), ref: 2BB7D963

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Read$ErrorLast
String ID:
API String ID: 2715074504-0
Opcode ID: b72d14388596b86040c71d64bfdb0629b67a21d3a60a830111c40078dd1e8ac8
Instruction ID: 895e56b9ee9c1acd0df56baba72ba4e23b8cb89b9e7574c143015cd4491f1383
Opcode Fuzzy Hash: b72d14388596b86040c71d64bfdb0629b67a21d3a60a830111c40078dd1e8ac8
Instruction Fuzzy Hash: C241BDB2A00205ABDB00DF99CC80B6AF3F9FF88714F108599E96997391D775FA01DB50

Function 00D58F40 Relevance: 6.4, Strings: 5, Instructions: 139COMMON

Download Yara Rule

Strings

runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriod, xrefs: 00D590C5
>, xrefs: 00D59130
limiterEvent.stop: found wrong event in p's limiter event slotreflect: reflect.Value.Pointer on an invalid notinheap pointerruntime: internal error: misuse of lockOSThread/unlockOSThreadmalformed GOMEMLIMIT; see `go doc runtime/debug.SetMemoryLimit`File has be, xrefs: 00D59127
got= max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-09301562578125<nil>AdlamAprilBamumBatakBuhidClassDograErrorGreekKhmerLatinLimbuLocalMarchNushuOghamOriyaOsageRunicSTermTakriTamilTypeA] = (arrayclosedeferfalsefaultfilesgcinggscan, xrefs: 00D590F3
limiterEvent.stop: invalid limiter event type foundpotentially overlapping in-use allocations detectedruntime: netpoll: PostQueuedCompletionStatus failedcasfrom_Gscanstatus: gp->status is not in scan statemallocgc called without a P or outside bootstrappingrun, xrefs: 00D590A6

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: got= max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-09301562578125<nil>AdlamAprilBamumBatakBuhidClassDograErrorGreekKhmerLatinLimbuLocalMarchNushuOghamOriyaOsageRunicSTermTakriTamilTypeA] = (arrayclosedeferfalsefaultfilesgcinggscan$>$limiterEvent.stop: found wrong event in p's limiter event slotreflect: reflect.Value.Pointer on an invalid notinheap pointerruntime: internal error: misuse of lockOSThread/unlockOSThreadmalformed GOMEMLIMIT; see `go doc runtime/debug.SetMemoryLimit`File has be$limiterEvent.stop: invalid limiter event type foundpotentially overlapping in-use allocations detectedruntime: netpoll: PostQueuedCompletionStatus failedcasfrom_Gscanstatus: gp->status is not in scan statemallocgc called without a P or outside bootstrappingrun$runtime: want=s.allocCount= semaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriod
API String ID: 0-2141547664
Opcode ID: db0035c54a022bea790c4629f126aa29e28cc7fa07d2f3af45421e7c9f2b1296
Instruction ID: 1ecab7c3a61c33f07e19f4c8e425a8610f8675f22cf99f9272188a5323b136bd
Opcode Fuzzy Hash: db0035c54a022bea790c4629f126aa29e28cc7fa07d2f3af45421e7c9f2b1296
Instruction Fuzzy Hash: 68515BB15093059FC704EF39C19176EBBE1AF88344F44882DF8D893292E739C988DB62

Function 00D52FC0 Relevance: 6.4, Strings: 5, Instructions: 104COMMON

Download Yara Rule

Strings

9, xrefs: 00D5306F
runtime: found obj at *(runtime: markroot index runtime: p.searchAddr = span has no free objectsstack trace unavailablestructure needs cleaningunpacking Question.Classupdate during transition bytes failed with errno= to unused region of span2006-01-02T15:04:0, xrefs: 00D5309F
basebindbitsbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeaddialermsfileftpsfunchttpicmpidleigmpint8itabkindmdnsopenpipepop3readrootsbrksmtpsse3trueuintunix ... MB, and got= max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-09301562, xrefs: 00D5310E
runtime: checkmarks found unexpected unmarked object obj=sync: WaitGroup misuse: Add called concurrently with Waitreflect: reflect.Value.Elem on an invalid notinheap pointersync/atomic: store of inconsistently typed value into Valueaddr range base and limit ar, xrefs: 00D53066
checkmark found unmarked objectentersyscallblock inconsistent fmt: unknown base; can't happeninternal error - misuse of itabinvalid network interface indexmalformed time zone informationnon in-use span in unswept listpacer: sweep done at heap size pattern cont, xrefs: 00D53171

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: 9$basebindbitsbmi1bmi2boolcallcas1cas2cas3cas4cas5cas6chandeaddialermsfileftpsfunchttpicmpidleigmpint8itabkindmdnsopenpipepop3readrootsbrksmtpsse3trueuintunix ... MB, and got= max= ms, ptr tab= top=+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-09301562$checkmark found unmarked objectentersyscallblock inconsistent fmt: unknown base; can't happeninternal error - misuse of itabinvalid network interface indexmalformed time zone informationnon in-use span in unswept listpacer: sweep done at heap size pattern cont$runtime: checkmarks found unexpected unmarked object obj=sync: WaitGroup misuse: Add called concurrently with Waitreflect: reflect.Value.Elem on an invalid notinheap pointersync/atomic: store of inconsistently typed value into Valueaddr range base and limit ar$runtime: found obj at *(runtime: markroot index runtime: p.searchAddr = span has no free objectsstack trace unavailablestructure needs cleaningunpacking Question.Classupdate during transition bytes failed with errno= to unused region of span2006-01-02T15:04:0
API String ID: 0-2370623875
Opcode ID: 40229850ae382b78cd22026ea1ecdfada5184dbb1f2edc11f8cac443d41b045c
Instruction ID: a3b27093ecbf5e39a04e8915cb0a210624ed0f26c64dc8cf417b95fb199e537e
Opcode Fuzzy Hash: 40229850ae382b78cd22026ea1ecdfada5184dbb1f2edc11f8cac443d41b045c
Instruction Fuzzy Hash: 0D41E2B45097449FC300EF28C19576ABBE0EF84704F4588ADF8D887392E7789948CB72

Function 2BA039D3 Relevance: 6.1, APIs: 4, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtterm.LIBCMT ref: 2BA039E7
__init_pointers.LIBCMT ref: 2BA03A99
__calloc_crt.LIBCMT ref: 2BA03B07

Memory Dump Source

Source File: 00000000.00000002.4113322478.000000002B9F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 2B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b9f0000_L8RabfF1Hu.jbxd

Similarity

API ID: __calloc_crt__init_pointers__mtterm
String ID:
API String ID: 2478854527-0
Opcode ID: 76c9643fd1df18821398edaab6323fbd9f0414cbbe87c74b2baaec3723e64a7d
Instruction ID: 5f6cfe9dfb9f4bd5112adacc83c1101891aaeed9c45d4af4496b91788c14af2d
Opcode Fuzzy Hash: 76c9643fd1df18821398edaab6323fbd9f0414cbbe87c74b2baaec3723e64a7d
Instruction Fuzzy Hash: D0315C31D06620AEEF02DB75AC94B577FE4EB59BA0F10891AF910C62B1EB318455EF40

Function 0040CE64 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0040CE98
__isleadbyte_l.LIBCMT ref: 0040CECB
MultiByteToWideChar.KERNEL32(00000080,00000009,00419E2C,?,00413314,00000000,?,?,?,?,00419E2C,00413314), ref: 0040CEFC
MultiByteToWideChar.KERNEL32(00000080,00000009,00419E2C,00000001,00413314,00000000,?,?,?,?,00419E2C,00413314), ref: 0040CF6A

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: ebe8f05c9a57c5fd5cb124a9a0b237da0f49ace63b7589ef2d532e6e39a07ed0
Instruction ID: 5991f70bd21cce6904a9859843f582d2553ad971ffdd209d5f15f0e173499d61
Opcode Fuzzy Hash: ebe8f05c9a57c5fd5cb124a9a0b237da0f49ace63b7589ef2d532e6e39a07ed0
Instruction Fuzzy Hash: 4831B231A00246EFDB20DF64C8C09BA3BA5BF01311B14867AF465AB2D1E335DD41DB99

Function 2BB8A5C2 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 2BB8A5F6
__isleadbyte_l.LIBCMT ref: 2BB8A629
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 2BB8A65A
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 2BB8A6C8

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: b0ef07e57ced1386dd9484ca19f769b3d04a4064c8a8b51b1b75ddc8577c4c86
Instruction ID: 45b96b7f0ff9f1e1ce7add8dc05ef132992da20298737678881f1380155bed18
Opcode Fuzzy Hash: b0ef07e57ced1386dd9484ca19f769b3d04a4064c8a8b51b1b75ddc8577c4c86
Instruction Fuzzy Hash: 9031CD31A00286EFDF01DFA4C894EAE7BB5FF02221F1585A9E6708B0A5E331D990DF50

Function 2D4DE4B5 Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 2D4DE4E9
__isleadbyte_l.LIBCMT ref: 2D4DE51C
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 2D4DE54D
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 2D4DE5BB

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 815d0fdcfefc0745d983019aaf1ae93d169acd44b33081a3f440a7f457dee6d2
Instruction ID: 3eb5d7e5c02dc56edeb1e984e1976b3f15ac3be10cf4e35c65f66b8c3f3e43c1
Opcode Fuzzy Hash: 815d0fdcfefc0745d983019aaf1ae93d169acd44b33081a3f440a7f457dee6d2
Instruction Fuzzy Hash: 8031B032A04245EFDB51DFA4C8B4AB93BB5FF01251F2189F9E6A5AB291E331D940CB50

Function 2D4D5660 Relevance: 6.1, APIs: 4, Instructions: 102synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,9B5F627A,75C04BD0,?,00000000,2D501A01,000000FF,?,2D4D5D7C,?), ref: 2D4D568E
CloseHandle.KERNEL32(?,?,2D4D5D7C,?), ref: 2D4D5698
InterlockedExchange.KERNEL32(-00000028,?), ref: 2D4D5732
InterlockedExchange.KERNEL32(?,00CC0020), ref: 2D4D574F

Part of subcall function 2D4D69F0: ReleaseDC.USER32(00000000,?), ref: 2D4D6A46
Part of subcall function 2D4D69F0: GetDC.USER32(00000000), ref: 2D4D6A60
Part of subcall function 2D4D69F0: GetTickCount.KERNEL32 ref: 2D4D6A73
Part of subcall function 2D4D69F0: GetDC.USER32(00000000), ref: 2D4D6A98
Part of subcall function 2D4D69F0: GetDeviceCaps.GDI32(00000000,00000008), ref: 2D4D6AA5
Part of subcall function 2D4D69F0: GetDeviceCaps.GDI32(00000000,0000000A), ref: 2D4D6AAD
Part of subcall function 2D4D69F0: GetDeviceCaps.GDI32(00000000,00000076), ref: 2D4D6AB2
Part of subcall function 2D4D69F0: GetDeviceCaps.GDI32(00000000,00000075), ref: 2D4D6ABA
Part of subcall function 2D4D69F0: ReleaseDC.USER32(00000000,00000000), ref: 2D4D6AC8
Part of subcall function 2D4D69F0: GetSystemMetrics.USER32(0000004E), ref: 2D4D6AD6
Part of subcall function 2D4D69F0: GetSystemMetrics.USER32(0000004F), ref: 2D4D6AEB

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: CapsDevice$ExchangeInterlockedMetricsReleaseSystem$CloseCountHandleObjectSingleTickWait
String ID:
API String ID: 669377650-0
Opcode ID: 9291ef4f79a0af1cd48dc29079545b5a36c66f14afcdc3ec9464279bc8fca357
Instruction ID: 68a45e55c350f4c1674e456ca4e78d4d6bfcd9209471aa05fdd1788b90569f06
Opcode Fuzzy Hash: 9291ef4f79a0af1cd48dc29079545b5a36c66f14afcdc3ec9464279bc8fca357
Instruction Fuzzy Hash: E031C4B2648300EBEB60DB65CC65F6AB7E8FB09B00F20851DE905A77C0DBB4E500CB60

Function 2BB78020 Relevance: 6.1, APIs: 4, Instructions: 91stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 2BB78038
_memset.LIBCMT ref: 2BB78042
lstrlenW.KERNEL32(?), ref: 2BB7804B
lstrlenW.KERNEL32(?), ref: 2BB78056

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: lstrlen$_memset
String ID:
API String ID: 2425037729-0
Opcode ID: 3e985c02b886c9ca5bc71d7890df24df610964f09884269e129ff877d1499c40
Instruction ID: 1110179e9e7e390a7c497be99952f267209a212c12e84e46790016e65c836d23
Opcode Fuzzy Hash: 3e985c02b886c9ca5bc71d7890df24df610964f09884269e129ff877d1499c40
Instruction Fuzzy Hash: 25210673B001089FCF14EE6ADC809BE73B9EBD8720B25406DEE19C7211E731AD5197A0

Function 2BB74380 Relevance: 6.1, APIs: 4, Instructions: 70networkCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F), ref: 2BB743EC

Part of subcall function 2BB713A0: HeapAlloc.KERNEL32(00000000,00000000,?,?,?,?), ref: 2BB713CB

Part of subcall function 2BB741E0: EnterCriticalSection.KERNEL32(2BB74FB5,2BB74E55,2BB742BE,00000000,?,?,2BB74E55,?,?,?,?,00000000,000000FF), ref: 2BB741E8
Part of subcall function 2BB741E0: LeaveCriticalSection.KERNEL32(2BB74FB5,?,?,?,00000000,000000FF), ref: 2BB741F6

Part of subcall function 2BB74C70: HeapFree.KERNEL32(?,00000000,?,00000000,2BB74E55,?,2BB742C8,2BB74E55,00000000,?,?,2BB74E55,?), ref: 2BB74C97

SetLastError.KERNEL32(00000000,?), ref: 2BB743D7
SetLastError.KERNEL32(00000057), ref: 2BB74401
WSAGetLastError.WS2_32(?), ref: 2BB74410

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: ErrorLast$CriticalHeapSection$AllocEnterFreeLeave
String ID:
API String ID: 2060118545-0
Opcode ID: ed485b9e6706768811237d2bbc3b04c5dde906ee4981f75204bb3492abf8d58a
Instruction ID: 064ff8ff52905cb1dd0d0ed12fad9c1110d614351651af9511c438f3a8c71e0e
Opcode Fuzzy Hash: ed485b9e6706768811237d2bbc3b04c5dde906ee4981f75204bb3492abf8d58a
Instruction Fuzzy Hash: 3711CA37E06518AB9F00EE79E8445AEB7B8EF99333B1501B6ED1CD7200D735D90156D0

Function 2D4D4390 Relevance: 6.1, APIs: 4, Instructions: 70networkCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000139F), ref: 2D4D43FC

Part of subcall function 2D4D13A0: HeapAlloc.KERNEL32(00000000,00000000,?,?,?,?), ref: 2D4D13CB

Part of subcall function 2D4D41F0: EnterCriticalSection.KERNEL32(?,ENM-,2D4D42CE,00000000,?,?,2D4D4E45,?,?,?,?,00000000,000000FF), ref: 2D4D41F8
Part of subcall function 2D4D41F0: LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,000000FF), ref: 2D4D4206

Part of subcall function 2D4D4C60: HeapFree.KERNEL32(?,00000000,?,00000000,ENM-,?,2D4D42D8,ENM-,00000000,?,?,2D4D4E45,?), ref: 2D4D4C87

SetLastError.KERNEL32(00000000,?), ref: 2D4D43E7
SetLastError.KERNEL32(00000057), ref: 2D4D4411
WSAGetLastError.WS2_32(?), ref: 2D4D4420

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: ErrorLast$CriticalHeapSection$AllocEnterFreeLeave
String ID:
API String ID: 2060118545-0
Opcode ID: e6f67b6910a1233a797263ab0fd768d478f0fd1cdde2359aabf1d71bba94a50b
Instruction ID: 8a93a4e823b6a891af695d477402bb995b63296467d191529925f620febcc89f
Opcode Fuzzy Hash: e6f67b6910a1233a797263ab0fd768d478f0fd1cdde2359aabf1d71bba94a50b
Instruction Fuzzy Hash: E0118D33B0551897CB14DEA9A4546FF77A4EF88623F5181AEED0CF7300D635991246D4

Function 2BB73BF0 Relevance: 6.1, APIs: 4, Instructions: 58networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,2BB73ABB,00000023), ref: 2BB73C02
WSAGetLastError.WS2_32 ref: 2BB73C0D
send.WS2_32(?,00000000,00000000,00000000), ref: 2BB73C58
WSAGetLastError.WS2_32 ref: 2BB73C63

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: ErrorLast$EventSelectsend
String ID:
API String ID: 259408233-0
Opcode ID: e42ed1a7bd73ce1a1e97d66bb451efaa55f9b55ccef7e5168ff94eefabc9cb3c
Instruction ID: e7bd8b07ca855cb6a91952c575d14347b97db65dc9a5297ee33f90ae1feb4bb9
Opcode Fuzzy Hash: e42ed1a7bd73ce1a1e97d66bb451efaa55f9b55ccef7e5168ff94eefabc9cb3c
Instruction Fuzzy Hash: AE119EB2E00B009BD720DF79D9C8A47B6F9FF88710F104A2DE6A6C36A0C775E4019B50

Function 2D4D3C00 Relevance: 6.1, APIs: 4, Instructions: 58networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,2D4D3ACB,00000023), ref: 2D4D3C12
WSAGetLastError.WS2_32 ref: 2D4D3C1D
send.WS2_32(?,00000000,00000000,00000000), ref: 2D4D3C68
WSAGetLastError.WS2_32 ref: 2D4D3C73

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: ErrorLast$EventSelectsend
String ID:
API String ID: 259408233-0
Opcode ID: cf1625ad4ecdc3774e81d48ffef170f12a7f2750e1245fc4bd41a14df91d959d
Instruction ID: 2589e66b9d66f72e5ae17beb5f4e1039a0dc8ba7abcfdc3becb6b74d3698cfff
Opcode Fuzzy Hash: cf1625ad4ecdc3774e81d48ffef170f12a7f2750e1245fc4bd41a14df91d959d
Instruction Fuzzy Hash: 0011BCB32007005BD3608FB9C888A57B6F9FB88B14F508A2EEA96C3780D774E400CB10

Function 004039AE Relevance: 6.1, APIs: 4, Instructions: 57networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32(?,?,00000023), ref: 004039D5
WSAGetLastError.WS2_32 ref: 004039E0

Part of subcall function 004043F9: timeGetTime.WINMM(00000001,?,00000001,?,00403A07,?,?,00000001), ref: 00404410
Part of subcall function 004043F9: InterlockedIncrement.KERNEL32(00000001), ref: 0040441F
Part of subcall function 004043F9: InterlockedIncrement.KERNEL32(00000001), ref: 0040442C
Part of subcall function 004043F9: timeGetTime.WINMM(?,00403A07,?,?,00000001), ref: 00404444

send.WS2_32(00000000,00000000,00000000,00000000), ref: 00403A11
WSAGetLastError.WS2_32 ref: 00403A1C

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: ErrorIncrementInterlockedLastTimetime$EventSelectsend
String ID:
API String ID: 4019454066-0
Opcode ID: c8b536715abbac2a9c2d66137f3001600df013d5f35cb6fb2dbd9bf1c651087d
Instruction ID: a42d6e2f075cd056636bced3b61f9dcfa7b0659b6520da6ca5e8659a954820e6
Opcode Fuzzy Hash: c8b536715abbac2a9c2d66137f3001600df013d5f35cb6fb2dbd9bf1c651087d
Instruction Fuzzy Hash: 5F1182B12107009FD7609F7AED84967BAEDFF84321B00493EF6A2E26A0C775E944DA14

Function 0040DC06 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040DC2C

Part of subcall function 0040DA58: __fltout2.LIBCMT ref: 0040DA83

__cftog_l.LIBCMT ref: 0040DC52
__cftoe_l.LIBCMT ref: 0040DC84

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: ea5fd65fd03c56d6f964a7dcd54464c05534594c47ebaf4ba2aa54a929e69634
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: DF116D7680414AFBDF225EC4CC11CEE3F22BB18354B598526FA1868174C67AC9B5EB85

Function 2BA0B7AA Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 2BA0B7D0

Part of subcall function 2BA0B5FC: __fltout2.LIBCMT ref: 2BA0B627

__cftog_l.LIBCMT ref: 2BA0B7F6
__cftoe_l.LIBCMT ref: 2BA0B828

Memory Dump Source

Source File: 00000000.00000002.4113322478.000000002B9F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 2B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b9f0000_L8RabfF1Hu.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 7e5a9e0c5e8527710cb7d09c85cf71c59c04a0e2164b59be815cce4a909f85e1
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 2B11427240614EBBCF125F84EE51DED3F66BB2C250F848825FA5859030EA36C5B5AB81

Function 2BB8BDEB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 2BB8BE11

Part of subcall function 2BB8BC3D: __fltout2.LIBCMT ref: 2BB8BC68

__cftog_l.LIBCMT ref: 2BB8BE37
__cftoe_l.LIBCMT ref: 2BB8BE69

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: b5c1a1744ceac804d75e8d59a29d1fba6c931aaaecd97ecbcb5ff7fa554bc518
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 8B11283200014EBFCF229EA4CC52CAE3F66BB2D691B548855FA2859134C737C5B1AB91

Function 2D4DF22F Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 2D4DF255

Part of subcall function 2D4DF081: __fltout2.LIBCMT ref: 2D4DF0AC

__cftog_l.LIBCMT ref: 2D4DF27B
__cftoe_l.LIBCMT ref: 2D4DF2AD

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 3bc93febbbd925385f56d7f73b284c23311004bfaa238e143307bbe193e527c0
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 37116037000189BBCF625F84CC11CEE3F62BB19690F558514FE1869178D233CAB1AB81

Function 2BB741E0 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(2BB74FB5,2BB74E55,2BB742BE,00000000,?,?,2BB74E55,?,?,?,?,00000000,000000FF), ref: 2BB741E8
LeaveCriticalSection.KERNEL32(2BB74FB5,?,?,?,00000000,000000FF), ref: 2BB741F6
LeaveCriticalSection.KERNEL32(2BB74FB5), ref: 2BB74257
SetEvent.KERNEL32(8520468B), ref: 2BB74272

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: 874a3833d126a4639b61552c75f39ed5377bce4fd814f6080ed17bac088f0519
Instruction ID: 6b94b0a2851ea6b7335e5fe03d360cbcdec29d76553b14e4bd032e491dd340ca
Opcode Fuzzy Hash: 874a3833d126a4639b61552c75f39ed5377bce4fd814f6080ed17bac088f0519
Instruction Fuzzy Hash: BE1103B1A01B019FDB19DF74C684A96B7F9FF48301B15892DE5AE87211EB35E912CF00

Function 2BB74B00 Relevance: 6.0, APIs: 4, Instructions: 45timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(00000001,?,00000001,?,2BB73C4F,?,?,00000001), ref: 2BB74B15
InterlockedIncrement.KERNEL32(00000001), ref: 2BB74B24
InterlockedIncrement.KERNEL32(00000001), ref: 2BB74B31
timeGetTime.WINMM(?,2BB73C4F,?,?,00000001), ref: 2BB74B48

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: IncrementInterlockedTimetime
String ID:
API String ID: 159728177-0
Opcode ID: 44e6bd3e11344a8373269008ca64debfbdc4b673ba5d31846c4396afdc789fc8
Instruction ID: 2ac49f9bae538a8025082cd344b789dbcbb1d01130208f129d6f2e923c7cfc4f
Opcode Fuzzy Hash: 44e6bd3e11344a8373269008ca64debfbdc4b673ba5d31846c4396afdc789fc8
Instruction Fuzzy Hash: DE01DAB2A00B059FCB20EF7AC88094AFBF8EF5C650700892EE559C7711E775E6458FA0

Function 2D4D4AF0 Relevance: 6.0, APIs: 4, Instructions: 45timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(00000001,?,00000001,?,2D4D3C5F,?,?,00000001), ref: 2D4D4B05
InterlockedIncrement.KERNEL32(00000001), ref: 2D4D4B14
InterlockedIncrement.KERNEL32(00000001), ref: 2D4D4B21
timeGetTime.WINMM(?,2D4D3C5F,?,?,00000001), ref: 2D4D4B38

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: IncrementInterlockedTimetime
String ID:
API String ID: 159728177-0
Opcode ID: 5dff9adde3f0149367c0a28a2174c3449bae97f9d89ca54eec0445d6b8d92c48
Instruction ID: 193058a5dfbdf89a0ec84fb3d2fd21c4989c034b5f2795cfad2c591badf05c0e
Opcode Fuzzy Hash: 5dff9adde3f0149367c0a28a2174c3449bae97f9d89ca54eec0445d6b8d92c48
Instruction Fuzzy Hash: 9801C8B26007059FC760DFAAC88094AFBF8AF58A50751892EE549C7700E674E6448FA4

Function 004043F9 Relevance: 6.0, APIs: 4, Instructions: 43timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(00000001,?,00000001,?,00403A07,?,?,00000001), ref: 00404410
InterlockedIncrement.KERNEL32(00000001), ref: 0040441F
InterlockedIncrement.KERNEL32(00000001), ref: 0040442C
timeGetTime.WINMM(?,00403A07,?,?,00000001), ref: 00404444

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: IncrementInterlockedTimetime
String ID:
API String ID: 159728177-0
Opcode ID: cbece5a51b3a6d032bd39a8099e2318efa3b01153fbae82e7600b76bc2333526
Instruction ID: bde6384104bd8423008567b7916c252d24d4c82a7c3f12234b6884efd3f1fb18
Opcode Fuzzy Hash: cbece5a51b3a6d032bd39a8099e2318efa3b01153fbae82e7600b76bc2333526
Instruction Fuzzy Hash: CA011AB2500704AFC720EF6AD844A8AFBF8FF58721B00892FE949C7610D779E6048F94

Function 2BB73660 Relevance: 6.0, APIs: 4, Instructions: 42timeCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 2BB73667
_free.LIBCMT ref: 2BB7369C

Part of subcall function 2BB7F639: RtlFreeHeap.NTDLL(00000000,00000000,?,2BB83E4C,00000000,?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C,2BB88E76), ref: 2BB7F64F
Part of subcall function 2BB7F639: GetLastError.KERNEL32(00000000,?,2BB83E4C,00000000,?,2BB84500,00000000,00000001,00000000,?,2BB88DE6,00000018,2BB96448,0000000C,2BB88E76,00000000), ref: 2BB7F661

_malloc.LIBCMT ref: 2BB736D7
_memset.LIBCMT ref: 2BB736E5

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: CreateErrorFreeHeapLastTimerWaitable_free_malloc_memset
String ID:
API String ID: 3340475617-0
Opcode ID: 9fd2f24c797f0ed49cecbbf928773ecfa9a042069b8c877197cad65fe014b5a8
Instruction ID: 95d00a311461511b7676419ea4ca3c052d0cf031386c34341d67d9d72fc63636
Opcode Fuzzy Hash: 9fd2f24c797f0ed49cecbbf928773ecfa9a042069b8c877197cad65fe014b5a8
Instruction Fuzzy Hash: BB01C8B1900B44DFE720DF7A8885B97BAF9EB95214F10882ED5AE83301D635A805DF60

Function 2D4D3670 Relevance: 6.0, APIs: 4, Instructions: 42timeCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32(00000000,00000000,00000000), ref: 2D4D3677
_free.LIBCMT ref: 2D4D36AC

Part of subcall function 2D4D7DC9: RtlFreeHeap.NTDLL(00000000,00000000,?,2D4DA719,00000000,?,?,2D4D8092,2D4D8002,?,?,?,2D4D66C6,154.201.87.51,000000FF,?), ref: 2D4D7DDF
Part of subcall function 2D4D7DC9: GetLastError.KERNEL32(00000000,?,2D4DA719,00000000,?,?,2D4D8092,2D4D8002,?,?,?,2D4D66C6,154.201.87.51,000000FF,?), ref: 2D4D7DF1

_malloc.LIBCMT ref: 2D4D36E7
_memset.LIBCMT ref: 2D4D36F5

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: CreateErrorFreeHeapLastTimerWaitable_free_malloc_memset
String ID:
API String ID: 3340475617-0
Opcode ID: 105617536ba38322c0c2eba53d749cdb3255edf89a8cf31177b6a5988382613f
Instruction ID: aa21ccd0b2cabfe7cf384e80068bab81b0bdc9b4753bad95af9d3572e2d492c3
Opcode Fuzzy Hash: 105617536ba38322c0c2eba53d749cdb3255edf89a8cf31177b6a5988382613f
Instruction Fuzzy Hash: 2401DEB5900B44DFE360CF7AD895F97BBE9EB85614F11882EE5AE97301D6346804CF60

Function 2B9FF0C6 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 2B9FF0E0

Part of subcall function 2B9FF032: __FF_MSGBANNER.LIBCMT ref: 2B9FF04B
Part of subcall function 2B9FF032: __NMSG_WRITE.LIBCMT ref: 2B9FF052

std::exception::exception.LIBCMT ref: 2B9FF115
std::exception::exception.LIBCMT ref: 2B9FF12F
__CxxThrowException@8.LIBCMT ref: 2B9FF140

Memory Dump Source

Source File: 00000000.00000002.4113322478.000000002B9F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 2B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b9f0000_L8RabfF1Hu.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw_malloc
String ID:
API String ID: 2388904642-0
Opcode ID: b08fdf8cb5e3b65abb6e8e2bd981c9ae2de8ac343fbf2f6e0fd6789c4a68690e
Instruction ID: 521c8e3957ae9ece6f4357936cfaf8086e833807e246425d0fec5c9df4a97d98
Opcode Fuzzy Hash: b08fdf8cb5e3b65abb6e8e2bd981c9ae2de8ac343fbf2f6e0fd6789c4a68690e
Instruction Fuzzy Hash: C3F02831901219BBDF15DB54EC25FBE7BADEB61668F944069E900E61D0DF718A02CB41

Function 2BB7CD80 Relevance: 6.0, APIs: 4, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 2BB71420: HeapFree.KERNEL32(?,00000000,?,?,?,2BB740B1,?,00000000,2BB74039,?,74DEDFA0,2BB73648), ref: 2BB7143D
Part of subcall function 2BB71420: _free.LIBCMT ref: 2BB71459

HeapDestroy.KERNEL32(00000000), ref: 2BB7CD93
HeapCreate.KERNEL32(?,?,?), ref: 2BB7CDA5
_free.LIBCMT ref: 2BB7CDB5
HeapDestroy.KERNEL32 ref: 2BB7CDE2

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Heap$Destroy_free$CreateFree
String ID:
API String ID: 4097506873-0
Opcode ID: 2880c324605b6b509d160dd325bc99dd6861829c2b074984b75d3f58a7942e86
Instruction ID: d0dc20ebffc144a1af46ff6d36e00b6fb9d1511033272800fbf14d88d72c1ee9
Opcode Fuzzy Hash: 2880c324605b6b509d160dd325bc99dd6861829c2b074984b75d3f58a7942e86
Instruction Fuzzy Hash: A6F08CB6500A01ABE700DF24D808B23FBB8FF44B11F10451CE86987240D735E842DBA0

Function 2D4D67F0 Relevance: 6.0, APIs: 4, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 2D4D1420: HeapFree.KERNEL32(?,00000000,?,?,?,2D4D40C1,?,00000000,2D4D4049,?,74DEDFA0,2D4D3658), ref: 2D4D143D
Part of subcall function 2D4D1420: _free.LIBCMT ref: 2D4D1459

HeapDestroy.KERNEL32(00000000), ref: 2D4D6803
HeapCreate.KERNEL32(?,?,?), ref: 2D4D6815
_free.LIBCMT ref: 2D4D6825
HeapDestroy.KERNEL32 ref: 2D4D6852

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Heap$Destroy_free$CreateFree
String ID:
API String ID: 4097506873-0
Opcode ID: 72076b436f43d20f6dffff7789395ba719e185c58a6ecf858cfdb8817da0e542
Instruction ID: 69ccbbb23745689733158ac3724921a921fcb2392e721836c59c864bd8c1b120
Opcode Fuzzy Hash: 72076b436f43d20f6dffff7789395ba719e185c58a6ecf858cfdb8817da0e542
Instruction Fuzzy Hash: 6CF04FB61017029BD7508F24D858B23BBB8FF58B11F21851CEA5AA3740DB74F455CB90

Function 00403E94 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000160,00000000,00403F6B,00000000,?,?,?,?,?,004046B2), ref: 00403E9C
LeaveCriticalSection.KERNEL32(00000160,?,?,?,?,?,004046B2), ref: 00403EAA
LeaveCriticalSection.KERNEL32(00000160,?,?,?,?,?,004046B2), ref: 00403EE5
SetEvent.KERNEL32(?,?,?,?,?,?,004046B2), ref: 00403EFF

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: 2b34fbd7487a88c2ffdbcc5f6901731852a57499e5e8aa09fe9e821e20fd1f40
Instruction ID: 3e0055e65e63e15f9b4026f6d97f9a62447075b238ce6a818d3f38b7c64026c7
Opcode Fuzzy Hash: 2b34fbd7487a88c2ffdbcc5f6901731852a57499e5e8aa09fe9e821e20fd1f40
Instruction Fuzzy Hash: 1E0114B06047029BD720DF78D988AE3BBF8BF08306F00482DE65ED2651EB34EA15CB14

Function 2B9F980F Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 302COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 2B9F997F

Part of subcall function 2B9FF032: __FF_MSGBANNER.LIBCMT ref: 2B9FF04B
Part of subcall function 2B9FF032: __NMSG_WRITE.LIBCMT ref: 2B9FF052

_memcpy_s.LIBCMT ref: 2B9F9B42

Strings

&, xrefs: 2B9F98A0

Memory Dump Source

Source File: 00000000.00000002.4113322478.000000002B9F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 2B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b9f0000_L8RabfF1Hu.jbxd

Similarity

API ID: _malloc_memcpy_s
String ID: &
API String ID: 3561290194-3042966939
Opcode ID: c8a5b5b6493a3e00500570122ab972c2785b00225f4301cae1c49e60748ae0d9
Instruction ID: 599051a92cfbeae118d72528a4f1e3e444d829a3448586f6ae3620b565abaf9d
Opcode Fuzzy Hash: c8a5b5b6493a3e00500570122ab972c2785b00225f4301cae1c49e60748ae0d9
Instruction Fuzzy Hash: FFC149B1A002199FDB24CF55CCC0B9AB7B8EB98314F1085A9E70DA7241D774EA85CFA5

Function 2D4F4B30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 2D4F4C38
_memset.LIBCMT ref: 2D4F4CBB

Strings

pGO-, xrefs: 2D4F4CC3

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: _memset
String ID: pGO-
API String ID: 2102423945-227601274
Opcode ID: 7cd4a24c60c663dbf2946837b7c48c7628cd425ab0cef1b97b7567a03ceb7228
Instruction ID: 7d67f830c76b98e9a27d6809ff3a15be569e0e458fb94f98803bec9b5b83ccea
Opcode Fuzzy Hash: 7cd4a24c60c663dbf2946837b7c48c7628cd425ab0cef1b97b7567a03ceb7228
Instruction Fuzzy Hash: 60514A70500200DFDB24CF58D480B89BBA1BF48314F61846EEA5DAB3A6DB75EA41CF92

Function 2D4D4950 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,00000000,?,?,00000000,000000FF), ref: 2D4D4A05
_memmove.LIBCMT ref: 2D4D4AA3

Strings

[QM-, xrefs: 2D4D4954, 2D4D4984

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: Time_memmovetime
String ID: [QM-
API String ID: 1463837790-1346272773
Opcode ID: a21baa32c18f7acb642ba4b3f528e2a29443482b397fa40ac2ee29ac62219908
Instruction ID: eed2b08b32c09a86b5398b2822392b1447eb8d2cb44d7ef74f3678a7a8089233
Opcode Fuzzy Hash: a21baa32c18f7acb642ba4b3f528e2a29443482b397fa40ac2ee29ac62219908
Instruction Fuzzy Hash: E151D0737002029FD788CF6AC8E4A2AB7A5FF48250B55866CEA1DAB701DB30FD41C790

Function 2B9FC2CF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

_wcsrchr.LIBCMT ref: 2B9FC386
_memset.LIBCMT ref: 2B9FC3C3

Strings

D, xrefs: 2B9FC3E2

Memory Dump Source

Source File: 00000000.00000002.4113322478.000000002B9F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 2B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b9f0000_L8RabfF1Hu.jbxd

Similarity

API ID: _memset_wcsrchr
String ID: D
API String ID: 1675014779-2746444292
Opcode ID: 9448fe74a29e6cb94ba3ba7ffaf0542041cc64757f3c043286b2e5ea21082185
Instruction ID: ae8bc27796ac907f0dea4e7fe2cfc7be449ad3cb416255cfc9484ace186170fc
Opcode Fuzzy Hash: 9448fe74a29e6cb94ba3ba7ffaf0542041cc64757f3c043286b2e5ea21082185
Instruction Fuzzy Hash: ED310972E402187BEB2497A49C8AFFF777CEB14720F104165FB099A1C1DA715A06C7E5

Function 2BB7B19D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 2BB7BC70: GetDesktopWindow.USER32 ref: 2BB7BC8F
Part of subcall function 2BB7BC70: GetDC.USER32(00000000), ref: 2BB7BC9C
Part of subcall function 2BB7BC70: CreateCompatibleDC.GDI32(00000000), ref: 2BB7BCA2
Part of subcall function 2BB7BC70: GetDC.USER32(00000000), ref: 2BB7BCAD
Part of subcall function 2BB7BC70: GetDeviceCaps.GDI32(00000000,00000008), ref: 2BB7BCBA
Part of subcall function 2BB7BC70: GetDeviceCaps.GDI32(00000000,00000076), ref: 2BB7BCC2
Part of subcall function 2BB7BC70: ReleaseDC.USER32(00000000,00000000), ref: 2BB7BCD3
Part of subcall function 2BB7BC70: GetSystemMetrics.USER32(0000004C), ref: 2BB7BD78
Part of subcall function 2BB7BC70: GetSystemMetrics.USER32(0000004D), ref: 2BB7BD8D
Part of subcall function 2BB7BC70: CreateCompatibleBitmap.GDI32(?,?,00000000), ref: 2BB7BDA6
Part of subcall function 2BB7BC70: SelectObject.GDI32(?,00000000), ref: 2BB7BDB4
Part of subcall function 2BB7BC70: SetStretchBltMode.GDI32(?,00000003), ref: 2BB7BDC0
Part of subcall function 2BB7BC70: GetSystemMetrics.USER32(0000004F), ref: 2BB7BDCD
Part of subcall function 2BB7BC70: GetSystemMetrics.USER32(0000004E), ref: 2BB7BDE0

Part of subcall function 2BB7F707: _malloc.LIBCMT ref: 2BB7F721

_memset.LIBCMT ref: 2BB7B1E1
swprintf.LIBCMT ref: 2BB7B204

Strings

%s %s, xrefs: 2BB7B1F3

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: MetricsSystem$CapsCompatibleCreateDevice$BitmapDesktopModeObjectReleaseSelectStretchWindow_malloc_memsetswprintf
String ID: %s %s
API String ID: 1028806752-581060391
Opcode ID: 40b006fab6feb1c3fa4e02e7aa9b43760b13317bde3be47bff6efaed4cb33760
Instruction ID: 6bc483aa707e9a599f6fe8bd04f7c7e2125a0707792e89bbbc4dfc9aec1e32a4
Opcode Fuzzy Hash: 40b006fab6feb1c3fa4e02e7aa9b43760b13317bde3be47bff6efaed4cb33760
Instruction Fuzzy Hash: 8121B173904240ABDA10EB25AC85E5BB7F8EFF9710F04052EF4995A251EA609905CBA3

Function 2BB79100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 2BB79115

Part of subcall function 2BB7EF39: std::exception::exception.LIBCMT ref: 2BB7EF4E
Part of subcall function 2BB7EF39: __CxxThrowException@8.LIBCMT ref: 2BB7EF63
Part of subcall function 2BB7EF39: std::exception::exception.LIBCMT ref: 2BB7EF74

std::_Xinvalid_argument.LIBCPMT ref: 2BB79128

Strings

string too long, xrefs: 2BB79110, 2BB79123

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: 61f9199cb8cffe7b6a93bfdb0db29ee9b745e2354400b2dc05022b8f1a657d01
Instruction ID: a68500fb19b22510f2526c1623cc6b5688c76cf8823c783e0a42ed585638a9f5
Opcode Fuzzy Hash: 61f9199cb8cffe7b6a93bfdb0db29ee9b745e2354400b2dc05022b8f1a657d01
Instruction Fuzzy Hash: 9D11B677354740ABC721DA2CE840A16B7F9EBED621F100A6AE3E1CBA51C731D414D7B0

Function 2BB793F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 2BB7941D
std::_Xinvalid_argument.LIBCPMT ref: 2BB7944A

Strings

invalid string position, xrefs: 2BB79445

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_
String ID: invalid string position
API String ID: 3614006799-1799206989
Opcode ID: 725eba0a5827099cb55e46a0bb872b211f6068f9b85c030c37b4a7ea4f0de633
Instruction ID: 35802db1c8bb8dfb61576eba649927a30d41c22f28bcef938659b9eddcf256b5
Opcode Fuzzy Hash: 725eba0a5827099cb55e46a0bb872b211f6068f9b85c030c37b4a7ea4f0de633
Instruction Fuzzy Hash: E6012B3360021067DB20FE68D881785F3B5AF6C720F20092DE2A2DF681D771EA40D7E1

Function 00405B9A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

__output_l.LIBCMT ref: 00405BF5

Part of subcall function 00405FAB: __getptd_noexit.LIBCMT ref: 00405FAB

Strings

B, xrefs: 00405BEE

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: __getptd_noexit__output_l
String ID: B
API String ID: 2141734944-1255198513
Opcode ID: dca3843aec2e18c61b1aaaf67171e9f4d4b482581547f435c81f8f92378431a3
Instruction ID: b8908359eeb4da70edbe799f8e496e0090cc6818c12fcb609305af814f0b3247
Opcode Fuzzy Hash: dca3843aec2e18c61b1aaaf67171e9f4d4b482581547f435c81f8f92378431a3
Instruction Fuzzy Hash: C5012171D042199BEF109FA5CC01AEFBBB4EB44364F10416AF924B62C1D779A9019F6A

Function 2B9FF179 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

__output_l.LIBCMT ref: 2B9FF1D4

Part of subcall function 2B9FF2DA: __getptd_noexit.LIBCMT ref: 2B9FF2DA

Strings

B, xrefs: 2B9FF1CD

Memory Dump Source

Source File: 00000000.00000002.4113322478.000000002B9F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 2B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b9f0000_L8RabfF1Hu.jbxd

Similarity

API ID: __getptd_noexit__output_l
String ID: B
API String ID: 2141734944-1255198513
Opcode ID: 87aa76b5352f051ca7e96a60a55cb843f290c199b1586efbdbad223d858718fb
Instruction ID: 2f029da27bf44578093910de53b53b175e117391629f93ad01a370f3a7dbdc8e
Opcode Fuzzy Hash: 87aa76b5352f051ca7e96a60a55cb843f290c199b1586efbdbad223d858718fb
Instruction Fuzzy Hash: E1016971E00209ABDF108FA5DC01BEEBBB8EB18374F104255F924A6281EB789641CBA5

Function 2BB79570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 2BB7957F

Part of subcall function 2BB7EF86: std::exception::exception.LIBCMT ref: 2BB7EF9B
Part of subcall function 2BB7EF86: __CxxThrowException@8.LIBCMT ref: 2BB7EFB0
Part of subcall function 2BB7EF86: std::exception::exception.LIBCMT ref: 2BB7EFC1

_memmove.LIBCMT ref: 2BB795B5

Strings

invalid string position, xrefs: 2BB7957A

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: 867a45f740d376b5c6cd2570c0f91396ce7f88a616ee5062c69608b339503252
Instruction ID: 1b9b6f1541b233d81f95e2d5f97de90f408c4a268b13ee91aab7d1c6d8ea7182
Opcode Fuzzy Hash: 867a45f740d376b5c6cd2570c0f91396ce7f88a616ee5062c69608b339503252
Instruction Fuzzy Hash: D50184323047115FDB25DE2CE898A1A77F6DBCC9007240A28D2E1CB749D671DD425790

Function 2BB78430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 2BB78443

Part of subcall function 2BB7EF39: std::exception::exception.LIBCMT ref: 2BB7EF4E
Part of subcall function 2BB7EF39: __CxxThrowException@8.LIBCMT ref: 2BB7EF63
Part of subcall function 2BB7EF39: std::exception::exception.LIBCMT ref: 2BB7EF74

_memmove.LIBCMT ref: 2BB7846E

Strings

vector<T> too long, xrefs: 2BB7843E

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 54fb5ac7e29dab4f657e8e4bdedb5475fdfd2d6b2942602bb01eea3b7c378703
Instruction ID: e91bea20ff28aad8d33fc1c87e77de42cbce856852f1a9549606e192398baeaa
Opcode Fuzzy Hash: 54fb5ac7e29dab4f657e8e4bdedb5475fdfd2d6b2942602bb01eea3b7c378703
Instruction Fuzzy Hash: C001A2B26002058FDF24DEA9DCD693BB3E9EF64210728492DE46ACB740E670F9009B61

Function 00412238 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00411CFD: __getptd.LIBCMT ref: 00411D03
Part of subcall function 00411CFD: __getptd.LIBCMT ref: 00411D13

__getptd.LIBCMT ref: 00412247

Part of subcall function 00408ED3: __getptd_noexit.LIBCMT ref: 00408ED6
Part of subcall function 00408ED3: __amsg_exit.LIBCMT ref: 00408EE3

__getptd.LIBCMT ref: 00412255

Strings

csm, xrefs: 00412263

Memory Dump Source

Source File: 00000000.00000002.4109822186.0000000000400000.00000040.00000800.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.4109822186.000000000041D000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_L8RabfF1Hu.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: e73ea90175d92410838612ab4aa9a286e663a463a15e1347724cf804c2a66819
Instruction ID: cb4f51d3d740e1554b1129aa15b1a3d4f415be41560cfff5e3acc43c55d6d569
Opcode Fuzzy Hash: e73ea90175d92410838612ab4aa9a286e663a463a15e1347724cf804c2a66819
Instruction Fuzzy Hash: CF012C348003059FCF349F65C640AEEB3B5AF10311F24496FE44596F91DBB889E5DE89

Function 2BA10093 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 2BA100A2

Part of subcall function 2BA0381A: __getptd_noexit.LIBCMT ref: 2BA0381D
Part of subcall function 2BA0381A: __amsg_exit.LIBCMT ref: 2BA0382A

__getptd.LIBCMT ref: 2BA100B0

Strings

csm, xrefs: 2BA100BE

Memory Dump Source

Source File: 00000000.00000002.4113322478.000000002B9F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 2B9F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b9f0000_L8RabfF1Hu.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction ID: 93d25b4d856fb25e964a28115c49f700a38720d7963f0649d59ce2e816f322d4
Opcode Fuzzy Hash: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction Fuzzy Hash: 690186389143029ACFB48F20E44269DB7F8FF24211F20882FD9C1BA291CF399A85CB40

Function 2BB906D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 2BB9010A: __getptd.LIBCMT ref: 2BB90110
Part of subcall function 2BB9010A: __getptd.LIBCMT ref: 2BB90120

__getptd.LIBCMT ref: 2BB906E3

Part of subcall function 2BB83E5B: __getptd_noexit.LIBCMT ref: 2BB83E5E
Part of subcall function 2BB83E5B: __amsg_exit.LIBCMT ref: 2BB83E6B

__getptd.LIBCMT ref: 2BB906F1

Strings

csm, xrefs: 2BB906FF

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction ID: 15a78a98a4b830779fafe51f4048eb738a9fd0aeba615adbcb076815869bf955
Opcode Fuzzy Hash: b3fce28b2bddc590aa98f0218856aed1c2aaf2d0e4e6e47b24808f92d36aa4a8
Instruction Fuzzy Hash: F4016D34801B05CECF25CF62E4906ADB7F6EF28221F90483ED059D6261DB38D681CF51

Function 2D50104B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 2D500B30: __getptd.LIBCMT ref: 2D500B36
Part of subcall function 2D500B30: __getptd.LIBCMT ref: 2D500B46

__getptd.LIBCMT ref: 2D50105A

Part of subcall function 2D4DA728: __getptd_noexit.LIBCMT ref: 2D4DA72B
Part of subcall function 2D4DA728: __amsg_exit.LIBCMT ref: 2D4DA738

__getptd.LIBCMT ref: 2D501068

Strings

csm, xrefs: 2D501076

Memory Dump Source

Source File: 00000000.00000003.2070080951.000000002D4D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 2D4D0000, based on PE: true

Associated: 00000000.00000003.1934740925.000000002D532000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070104357.000000002D526000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2070144975.000000002D52D000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.2721563461.000000002D4D0000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000000.00000003.3635175774.000000002D530000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2d4d0000_L8RabfF1Hu.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: b6df51cf0bd50e8a3f4545857898d45d6830f72e6c8bdfca11c47be0234717bf
Instruction ID: 860ba4f117b18b43cfe8489408229a6874c5b42f944cd71cb649b15da557e1ee
Opcode Fuzzy Hash: b6df51cf0bd50e8a3f4545857898d45d6830f72e6c8bdfca11c47be0234717bf
Instruction Fuzzy Hash: 21014639804244CBCB288F20D470BBDB3F5AF28257F60882EE581B7291CBB1D680CF52

Function 2BB7D100 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 2BB7D11E

Part of subcall function 2BB7EF39: std::exception::exception.LIBCMT ref: 2BB7EF4E
Part of subcall function 2BB7EF39: __CxxThrowException@8.LIBCMT ref: 2BB7EF63
Part of subcall function 2BB7EF39: std::exception::exception.LIBCMT ref: 2BB7EF74

Strings

vector<T> too long, xrefs: 2BB7D119
+, xrefs: 2BB7D106

Memory Dump Source

Source File: 00000000.00000002.4113394826.000000002BB70000.00000040.00001000.00020000.00000000.sdmp, Offset: 2BB70000, based on PE: true

Associated: 00000000.00000002.4113394826.000000002BBA4000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bb70000_L8RabfF1Hu.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: vector<T> too long$+
API String ID: 1823113695-2622287067
Opcode ID: 3bcefa5b7677903908daab9ee80513a91ea7de41f13a711c285e4cef4cfdd55a
Instruction ID: 07d78be03539410f8c84ead2a895cf7bf487f387848352d0d259a985dcdda280
Opcode Fuzzy Hash: 3bcefa5b7677903908daab9ee80513a91ea7de41f13a711c285e4cef4cfdd55a
Instruction Fuzzy Hash: FBE09B67F200120B4F5CF57C8C5693D2367D7D51917584B2AEC33D7EC4F465D8405190

Function 00D6F8F0 Relevance: 5.2, Strings: 4, Instructions: 235COMMON

Download Yara Rule

Strings

4, xrefs: 00D6FB38
) *( - < > m= n=%: +00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...125625::1???ADTASTBSTCATCDTCETCSTDltEATEDTEETEOFESTGMTHDTHSTHanIDTISTJSTKSTLaoMDTMSKMSTMayMroNDTNSTNaNNkoPC=PDTPKTPSTStdTTLUTCVaiWAT\\?]:adxaesavxcgodnsendfinfm, xrefs: 00D6FB5A
runtime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding lockssegment length too longshrinkstack at bad timeskipping Question Classspan has no free stacksstack growth after forksyntax error in patternsystem huge page size (too man, xrefs: 00D6FB75
runtime: GetQueuedCompletionStatusEx failed (errno= runtime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetcompileCallback: argument size is larger than uintptrreflect.Value.Slice: string slice index out of boun, xrefs: 00D6FB2F

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: ) *( - < > m= n=%: +00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...125625::1???ADTASTBSTCATCDTCETCSTDltEATEDTEETEOFESTGMTHDTHSTHanIDTISTJSTKSTLaoMDTMSKMSTMayMroNDTNSTNaNNkoPC=PDTPKTPSTStdTTLUTCVaiWAT\\?]:adxaesavxcgodnsendfinfm$4$runtime: GetQueuedCompletionStatusEx failed (errno= runtime: use of FixAlloc_Alloc before FixAlloc_Initspan set block with unpopped elements found in resetcompileCallback: argument size is larger than uintptrreflect.Value.Slice: string slice index out of boun$runtime: netpoll failedruntime: s.allocCount= s.allocCount > s.nelemsschedule: holding lockssegment length too longshrinkstack at bad timeskipping Question Classspan has no free stacksstack growth after forksyntax error in patternsystem huge page size (too man
API String ID: 0-309874475
Opcode ID: 5420f8dda37fea19bd0cdd7d61c8ffc68625661339072cfc2380df7fd0222b9b
Instruction ID: b2ebdeaf95dd7d3db747d8a0e1102021b0e827b159e0453ace2a5c199b8c2226
Opcode Fuzzy Hash: 5420f8dda37fea19bd0cdd7d61c8ffc68625661339072cfc2380df7fd0222b9b
Instruction Fuzzy Hash: C5A158B5109B458FC710DF24D090B6EBBE1FF88348F09892DE99887381E735D949DBA6

Function 00D8A910 Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

racy sudog adjustment due to parking on channelreflect.Value.Bytes of unaddressable byte arrayruntime: CreateIoCompletionPort failed (errno= slice bounds out of range [::%x] with length %ytried to sleep scavenger from another goroutineCreateWaitableTimerEx whe, xrefs: 00D8AB91
', xrefs: 00D8AC25
nil stackbaseout of memorypowrprof.dll, xrefs: 00D8AC06
stack growth not allowed in system callsuspendG from non-preemptible goroutinetraceback: unexpected SPWRITE function transport endpoint is already connected13877787807814456755295395851135253906256938893903907228377647697925567626953125MapIter.Key called on ex, xrefs: 00D8AC1C

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: '$nil stackbaseout of memorypowrprof.dll$racy sudog adjustment due to parking on channelreflect.Value.Bytes of unaddressable byte arrayruntime: CreateIoCompletionPort failed (errno= slice bounds out of range [::%x] with length %ytried to sleep scavenger from another goroutineCreateWaitableTimerEx whe$stack growth not allowed in system callsuspendG from non-preemptible goroutinetraceback: unexpected SPWRITE function transport endpoint is already connected13877787807814456755295395851135253906256938893903907228377647697925567626953125MapIter.Key called on ex
API String ID: 0-1683106482
Opcode ID: 2517f71a1a750e7ec16975faef943ce4daf85ca4e869e4efa86be710399bf5b8
Instruction ID: 8603ebcb168ceeb7ff95bd56ba27d1cfbbb7e55342a143bbe7c9d800a6466449
Opcode Fuzzy Hash: 2517f71a1a750e7ec16975faef943ce4daf85ca4e869e4efa86be710399bf5b8
Instruction Fuzzy Hash: BCA1D1746093408FD728EF28C180A6AFBF1FF89700F15892EE99987351D770E845CB66

Function 00D497C0 Relevance: 5.2, Strings: 4, Instructions: 179COMMON

Download Yara Rule

Strings

1, xrefs: 00D49A08
runtime: unable to acquire - semaphore out of syncfatal: systemstack called from unexpected goroutinelimiterEvent.stop: invalid limiter event type foundpotentially overlapping in-use allocations detectedruntime: netpoll: PostQueuedCompletionStatus failedcasfro, xrefs: 00D499E9
runtime: unexpected waitm - semaphore out of syncs.allocCount != s.nelems && freeIndex == s.nelemsslice bounds out of range [::%x] with capacity %ysweeper left outstanding across sweep generationsattempt to execute system stack code on user stackcompileCallbac, xrefs: 00D499FF
notetsleep - waitm out of syncprotocol wrong type for socketreflect: Elem of invalid type reflect: Len of non-array typerunqputslow: queue is not fullruntime: bad g in cgocallbackruntime: bad pointer in frame runtime: found in object at *(runtime: impossible , xrefs: 00D49875

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: 1$notetsleep - waitm out of syncprotocol wrong type for socketreflect: Elem of invalid type reflect: Len of non-array typerunqputslow: queue is not fullruntime: bad g in cgocallbackruntime: bad pointer in frame runtime: found in object at *(runtime: impossible $runtime: unable to acquire - semaphore out of syncfatal: systemstack called from unexpected goroutinelimiterEvent.stop: invalid limiter event type foundpotentially overlapping in-use allocations detectedruntime: netpoll: PostQueuedCompletionStatus failedcasfro$runtime: unexpected waitm - semaphore out of syncs.allocCount != s.nelems && freeIndex == s.nelemsslice bounds out of range [::%x] with capacity %ysweeper left outstanding across sweep generationsattempt to execute system stack code on user stackcompileCallbac
API String ID: 0-42377971
Opcode ID: aefac31fbd413a0d54ccfaf9c2721616795453f4e6952c44ac8543c7da17c5cd
Instruction ID: 81f180b2a6d5f30c095d67ef2db06a6561c70cb3bea60821a9cb1d5e2adc4de2
Opcode Fuzzy Hash: aefac31fbd413a0d54ccfaf9c2721616795453f4e6952c44ac8543c7da17c5cd
Instruction Fuzzy Hash: 62716C746093519FC704DF29C090B2BBBE1AF89714F09896CE8E88B392D771D844DBB2

Function 00D6C9F0 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

, xrefs: 00D6CAB7
, xrefs: 00D6CAEF
, xrefs: 00D6CAAF
, xrefs: 00D6CA72

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: $ $ $
API String ID: 0-3535155489
Opcode ID: 80235a23d686db8796e1fc6162ba9cbbca9cb62f6f2514ae15e487f6913571fa
Instruction ID: 9f8e4459e9f07a99fb48b09d6055e36afde0aafcd3b692ec2aba6d399539ac94
Opcode Fuzzy Hash: 80235a23d686db8796e1fc6162ba9cbbca9cb62f6f2514ae15e487f6913571fa
Instruction Fuzzy Hash: E08101755087858FC324DF68C480B5AF7E1FFC9314F159A1EE489AB351EB70A885CBA2

Function 00D627B0 Relevance: 5.2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

Strings

s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit127.0.0.1:53152587890625762939453125Bidi_ControlCreateThreadGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_Con, xrefs: 00D629A0
non in-use span in unswept listpacer: sweep done at heap size pattern contains path separatorreflect: Len of non-array type resetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds, xrefs: 00D629FE
runtime: bad span s.state=runtime: pcHeader: magic= segment prefix is reservedshrinking stack in libcallstartlockedm: locked to metoo many colons in addressunclosed criterion bracketunexpected type in connectunknown ABI parameter kinduse of invalid sweepLocker, xrefs: 00D62972
sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday((BADINDEX), bound = , limit = .localhost/dev/stdin/etc/hosts122070312561035156258.8.8.8:53AdditionalBad varintCancelIoExChorasmianClassCHAOSClassCSNETCreateFileCreatePipeDeprecatedDevanagariDnsQuery_W, xrefs: 00D629CA

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit127.0.0.1:53152587890625762939453125Bidi_ControlCreateThreadGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_Con$ sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday((BADINDEX), bound = , limit = .localhost/dev/stdin/etc/hosts122070312561035156258.8.8.8:53AdditionalBad varintCancelIoExChorasmianClassCHAOSClassCSNETCreateFileCreatePipeDeprecatedDevanagariDnsQuery_W$non in-use span in unswept listpacer: sweep done at heap size pattern contains path separatorreflect: Len of non-array type resetspinning: not a spinning mruntime: cannot allocate memoryruntime: failed to commit pagesruntime: split stack overflow: slice bounds$runtime: bad span s.state=runtime: pcHeader: magic= segment prefix is reservedshrinking stack in libcallstartlockedm: locked to metoo many colons in addressunclosed criterion bracketunexpected type in connectunknown ABI parameter kinduse of invalid sweepLocker
API String ID: 0-262200758
Opcode ID: 3c855695124fa44b7073133e66db5ae5f669cf1a95397dda9d897fa8d66bbcd7
Instruction ID: 2bd26e7a5771810b48573d4c59429d8cb3ba1d5eb4803c11988573062e779995
Opcode Fuzzy Hash: 3c855695124fa44b7073133e66db5ae5f669cf1a95397dda9d897fa8d66bbcd7
Instruction Fuzzy Hash: 1F6114B45097459FC704EF28C491A6ABBE0EF88304F45896EF8D887362E734D948DF62

Function 00D43880 Relevance: 5.1, Strings: 4, Instructions: 139COMMON

Download Yara Rule

Strings

cgocall nilclobberfreeclosesocketcreated by crypt32.dllfile existsfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgetpeernamegetsocknameglobalAlloci/o timeoutmSpanManualmethodargs(minTrigger=mswsock.dllnetpollInitnil contextreflectOffsruntime: P runtime, xrefs: 00D43944
m changed unexpectedly in cgocallbackgmakechan: invalid channel element typeruntime: blocked read on free polldescruntime: sudog with non-false isSelecttime: missing Location in call to Dateunreachable method called. linker bug?2006-01-02 15:04:05.999999999 -0, xrefs: 00D43AA6
runtime: bad g in cgocallbackruntime: bad pointer in frame runtime: found in object at *(runtime: impossible type kind socket operation on non-socketsync: inconsistent mutex statesync: unlock of unlocked mutexunsafe.Slice: len out of range) not in usable addr, xrefs: 00D43981
&, xrefs: 00D43AAF

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: &$cgocall nilclobberfreeclosesocketcreated by crypt32.dllfile existsfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgetpeernamegetsocknameglobalAlloci/o timeoutmSpanManualmethodargs(minTrigger=mswsock.dllnetpollInitnil contextreflectOffsruntime: P runtime$m changed unexpectedly in cgocallbackgmakechan: invalid channel element typeruntime: blocked read on free polldescruntime: sudog with non-false isSelecttime: missing Location in call to Dateunreachable method called. linker bug?2006-01-02 15:04:05.999999999 -0$runtime: bad g in cgocallbackruntime: bad pointer in frame runtime: found in object at *(runtime: impossible type kind socket operation on non-socketsync: inconsistent mutex statesync: unlock of unlocked mutexunsafe.Slice: len out of range) not in usable addr
API String ID: 0-3996220832
Opcode ID: 7b18f659f6238cee566ef7808999af0bf318b0fa8b6b907e9a5a8ce51fce24b8
Instruction ID: 5d53234ed0088af77adff84be4ede3deb50664be479629f78d0c383a2a120521
Opcode Fuzzy Hash: 7b18f659f6238cee566ef7808999af0bf318b0fa8b6b907e9a5a8ce51fce24b8
Instruction Fuzzy Hash: 6D6193B45093408FC304EF28C095B6ABBE1FF89314F5589ADE8898B362D775E845CF66

Function 00D8B950 Relevance: 5.1, Strings: 4, Instructions: 102COMMON

Download Yara Rule

Strings

shrinking stack in libcallstartlockedm: locked to metoo many colons in addressunclosed criterion bracketunexpected type in connectunknown ABI parameter kinduse of invalid sweepLockerwakep: negative nmspinning not in stack roots range [3637978807091712951660156, xrefs: 00D8BA6F
missing stack in shrinkstackmspan.sweep: m is not lockednewproc1: new g is not Gdeadnewproc1: newg missing stackos: process already finishedprotocol driver not attachedregion exceeds uintptr rangeruntime.semasleep unexpectedruntime: casgstatus: oldval=runtime:, xrefs: 00D8BAB1
bad status in shrinkstackbad system huge page sizechansend: spurious wakeupcheckdead: no m for timercheckdead: no p for timercontext deadline exceededinconsistent poll.fdMutexinvalid cross-device linkinvalid network interfacemissing stack in newstackmissing tr, xrefs: 00D8BA9B
shrinkstack at bad timeskipping Question Classspan has no free stacksstack growth after forksyntax error in patternsystem huge page size (too many pointers (>10)unexpected address typeunpacking Question.Nameunpacking Question.Typework.nwait > work.nproc1164153, xrefs: 00D8BA85

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: bad status in shrinkstackbad system huge page sizechansend: spurious wakeupcheckdead: no m for timercheckdead: no p for timercontext deadline exceededinconsistent poll.fdMutexinvalid cross-device linkinvalid network interfacemissing stack in newstackmissing tr$missing stack in shrinkstackmspan.sweep: m is not lockednewproc1: new g is not Gdeadnewproc1: newg missing stackos: process already finishedprotocol driver not attachedregion exceeds uintptr rangeruntime.semasleep unexpectedruntime: casgstatus: oldval=runtime:$shrinking stack in libcallstartlockedm: locked to metoo many colons in addressunclosed criterion bracketunexpected type in connectunknown ABI parameter kinduse of invalid sweepLockerwakep: negative nmspinning not in stack roots range [3637978807091712951660156$shrinkstack at bad timeskipping Question Classspan has no free stacksstack growth after forksyntax error in patternsystem huge page size (too many pointers (>10)unexpected address typeunpacking Question.Nameunpacking Question.Typework.nwait > work.nproc1164153
API String ID: 0-1674947802
Opcode ID: 3a8ed21ba2e7765374d57dcc1024759c90fc213112a4bea14fc68c77e423578e
Instruction ID: ad2aa723c12e4314890e425edb766fa60bd7dced43008cc716c9cbc4789491e4
Opcode Fuzzy Hash: 3a8ed21ba2e7765374d57dcc1024759c90fc213112a4bea14fc68c77e423578e
Instruction Fuzzy Hash: F8418BB46047408FC718EF14D085B69B7E1FF84710F49886DE8898B352E775DD88DB22

Function 00D78810 Relevance: 5.1, Strings: 4, Instructions: 90COMMON

Download Yara Rule

Strings

, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentProcessIdGetSystemDire, xrefs: 00D788B6
, goid=, j0 = 19531259765625: type ::ffff:AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitJanuaryKannadaMUI_DltMUI_StdMakasarMandaicMarchenMultaniMyanmarOctoberOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboT, xrefs: 00D7888C, 00D7893C
runtime: gp: gp=runtime: getg: g=runtime: npages = runtime: range = {runtime: textAddr server misbehavingstopping the worldstreams pipe errorsync.RWMutex.RLocksystem page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called, xrefs: 00D7886A
, g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentPro, xrefs: 00D78966

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: , g->atomicstatus=, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentPro$, goid=, j0 = 19531259765625: type ::ffff:AvestanBengaliBrailleChanDirCopySidCypriotDeseretElbasanElymaicGODEBUGGranthaHanunooIO waitJanuaryKannadaMUI_DltMUI_StdMakasarMandaicMarchenMultaniMyanmarOctoberOsmanyaRadicalSharadaShavianSiddhamSinhalaSogdianSoyomboT$, gp->atomicstatus=14901161193847656257450580596923828125Altai Standard TimeBahia Standard TimeCanadian_AboriginalChina Standard TimeCreateSymbolicLinkWCryptReleaseContextEgypt Standard TimeGC mark terminationGC work not flushedGetCurrentProcessIdGetSystemDire$runtime: gp: gp=runtime: getg: g=runtime: npages = runtime: range = {runtime: textAddr server misbehavingstopping the worldstreams pipe errorsync.RWMutex.RLocksystem page size (tracebackancestorsuse of closed filevalue out of range [controller reset] called
API String ID: 0-2268457073
Opcode ID: 341ece69bc771a909cbcaa1e515ad684bd6b1c217776d0eae10b49e6e470ff7e
Instruction ID: c16258da5508c131aff0242732f7eccd9f83cbca5de6f95b59eb8956d507784c
Opcode Fuzzy Hash: 341ece69bc771a909cbcaa1e515ad684bd6b1c217776d0eae10b49e6e470ff7e
Instruction Fuzzy Hash: 1C416CB4508B448FC304EF28D595A5ABBE0FF88704F41886DE88887352EB38D948DB72

Function 00D819B0 Relevance: 5.1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

Strings

releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work.nwait= stale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverabletimer data corruptionunexpected value stepunknown , xrefs: 00D81B01
m->p= max= min= next= p->m= prev= span=% util(...), i = , not , val .local.onion390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticFormatFridayGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLycianLydianMondayRejangSCHED StringSundaySy, xrefs: 00D81A6B
releasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringsunknown portwirep: p->m=worker mode != sweepgen MB globals, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= pluginpath= s.spanclas, xrefs: 00D81A49
p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = .WithCancel/dev/stderr/dev/stdout30517578125: frame.sp=ClassHESIODCloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFile, xrefs: 00D81AB7

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: m->p= max= min= next= p->m= prev= span=% util(...), i = , not , val .local.onion390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticFormatFridayGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLycianLydianMondayRejangSCHED StringSundaySy$ p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = .WithCancel/dev/stderr/dev/stdout30517578125: frame.sp=ClassHESIODCloseHandleCreateFileWDeleteFileWDives_AkuruExitProcessFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFile$releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work.nwait= stale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverabletimer data corruptionunexpected value stepunknown $releasep: m=runtime: gp=runtime: sp=self-preemptshort bufferspanSetSpinesweepWaiterstraceStringsunknown portwirep: p->m=worker mode != sweepgen MB globals, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= pluginpath= s.spanclas
API String ID: 0-2727344510
Opcode ID: 5a596f7e63f5ec59890bdff1147033229daba748e488e86aa67be0a91f8f37dd
Instruction ID: af89f67fa978932aa2bd97c5a945e58c22cce2a820a78fb2771bcf0d0497139e
Opcode Fuzzy Hash: 5a596f7e63f5ec59890bdff1147033229daba748e488e86aa67be0a91f8f37dd
Instruction Fuzzy Hash: DB31E2B8508B458FC304EF24D19475ABBE4FF88704F45896DE8888B312E735D889DBB2

Function 00D67A20 Relevance: 5.1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

Strings

runtime: root level max pages = runtime: setevent failed; errno=runtime: stack split at bad timeruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevscanstack: goroutine not stoppedscavenger state is already wiredslic, xrefs: 00D67AD2
+, xrefs: 00D67B56
runtime: summary max pages = runtime: traceback stuck. pc=scanobject of a noscan objectsemacquire not on the G stackstring concatenation too longsyntax error scanning booleantimeBegin/EndPeriod not foundtoo many open files in system (types from different scope, xrefs: 00D67B19
root level max pages doesn't fit in summaryruntime.SetFinalizer: finalizer already setruntime.SetFinalizer: first argument is nilruntime: casfrom_Gscanstatus bad oldval gp=runtime: releaseSudog with non-nil gp.paramruntime:stoplockedm: lockedg (atomicstatus=un, xrefs: 00D67B4D

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: +$root level max pages doesn't fit in summaryruntime.SetFinalizer: finalizer already setruntime.SetFinalizer: first argument is nilruntime: casfrom_Gscanstatus bad oldval gp=runtime: releaseSudog with non-nil gp.paramruntime:stoplockedm: lockedg (atomicstatus=un$runtime: root level max pages = runtime: setevent failed; errno=runtime: stack split at bad timeruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevscanstack: goroutine not stoppedscavenger state is already wiredslic$runtime: summary max pages = runtime: traceback stuck. pc=scanobject of a noscan objectsemacquire not on the G stackstring concatenation too longsyntax error scanning booleantimeBegin/EndPeriod not foundtoo many open files in system (types from different scope
API String ID: 0-792128694
Opcode ID: 01092d97427da6b2be97115494009aa577daa14351189af1340a024a74f4d5eb
Instruction ID: c40a1ce4dc7ee8cb2920be8303b4e7f01cd1673e10add3b2ced1bc66a0a309e4
Opcode Fuzzy Hash: 01092d97427da6b2be97115494009aa577daa14351189af1340a024a74f4d5eb
Instruction Fuzzy Hash: CB313570A096058FC304EF64D59576EBBE1FF84708F50886CE8998B352EB31D949DB72

Function 00D81880 Relevance: 5.1, Strings: 4, Instructions: 76COMMON

Download Yara Rule

Strings

wirep: p->m=worker mode != sweepgen MB globals, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625: , xrefs: 00D818ED
wirep: invalid p state) must be a power of 223283064365386962890625<invalid reflect.Value>Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainCreateAcceleratorTableWDestroyEnvironmentBlockE. Africa Standard TimeE. Europe Standard TimeFreeEnvi, xrefs: 00D81975
) p->status=, cons/mark -byte limit127.0.0.1:53152587890625762939453125Bidi_ControlCreateThreadGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLoadLibraryWMeetei_MayekPahawh_HmongRCodeRefusedRCodeSuccessReadConsoleWRevertTo, xrefs: 00D81941
wirep: already in goworkbuf is not emptywrite of Go pointer ws2_32.dll not found of unexported method pcHeader.textStart= previous allocCount=, levelBits[level] = 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_Hi, xrefs: 00D81994

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: ) p->status=, cons/mark -byte limit127.0.0.1:53152587890625762939453125Bidi_ControlCreateThreadGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempPathWJoin_ControlLoadLibraryWMeetei_MayekPahawh_HmongRCodeRefusedRCodeSuccessReadConsoleWRevertTo$wirep: already in goworkbuf is not emptywrite of Go pointer ws2_32.dll not found of unexported method pcHeader.textStart= previous allocCount=, levelBits[level] = 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_Hi$wirep: invalid p state) must be a power of 223283064365386962890625<invalid reflect.Value>Argentina Standard TimeAstrakhan Standard TimeCertGetCertificateChainCreateAcceleratorTableWDestroyEnvironmentBlockE. Africa Standard TimeE. Europe Standard TimeFreeEnvi$wirep: p->m=worker mode != sweepgen MB globals, MB) workers= called from flushedWork idlethreads= is nil, not nStackRoots= pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= , gp->status=, not pointer-byte block (3814697265625:
API String ID: 0-1369897411
Opcode ID: e2f07595ae176c20f587fc77eaa686050a68e36a30a7bc84ffad652194315673
Instruction ID: 01aa71a471bf16cf5ba37f853ae4e73de0c49f74ecc82ed17ba5e16f5f20e578
Opcode Fuzzy Hash: e2f07595ae176c20f587fc77eaa686050a68e36a30a7bc84ffad652194315673
Instruction Fuzzy Hash: C731AFB46097059FD704EF69C185A5ABBF4FF88704F45C86DE88887312E774D849CBA2

Function 00D59400 Relevance: 5.1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

Strings

goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not , val .local.onion390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticFormatFridayGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLycianLydianMondayRejangSC, xrefs: 00D59493
scan missed a gstartm: m has pstopm holding psync.Mutex.Locktraceback stuckunknown network already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function.WithValue(type /etc/resolv.conf0123456789ABCDEF0123456789abcdef2384185791015625AddDllDire, xrefs: 00D59514
gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit127.0.0.1:53152587890625762939453125Bidi_Con, xrefs: 00D594E7
status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYCyrillicDecemberDuployanEthiopicExtenderFebruaryFullPathGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniNovemberOl_ChikiPhag, xrefs: 00D594BD

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%!(BADWIDTH)) p->status=, cons/mark -byte limit127.0.0.1:53152587890625762939453125Bidi_Con$ goid jobs= list= m->p= max= min= next= p->m= prev= span=% util(...), i = , not , val .local.onion390625<-chanAnswerArabicAugustBrahmiCarianChakmaCommonCopticFormatFridayGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLycianLydianMondayRejangSC$ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYCyrillicDecemberDuployanEthiopicExtenderFebruaryFullPathGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALinear_BMahajaniNovemberOl_ChikiPhag$scan missed a gstartm: m has pstopm holding psync.Mutex.Locktraceback stuckunknown network already; errno= mheap.sweepgen= not in ranges: untyped locals , not a function.WithValue(type /etc/resolv.conf0123456789ABCDEF0123456789abcdef2384185791015625AddDllDire
API String ID: 0-344297118
Opcode ID: 743c498516dfa43abf31550bf70a8055895e5f540ad6532d7aa0eff34b8fa89b
Instruction ID: 0db90dca54e3cacd4da046320ea8d3a733a1dae2ca32dc2eef54452f74fb9ece
Opcode Fuzzy Hash: 743c498516dfa43abf31550bf70a8055895e5f540ad6532d7aa0eff34b8fa89b
Instruction Fuzzy Hash: 3131ECB4508A458FC304EF28D1A56AAFBE0EF89304F41886DE8D887342E734D949DB72

Function 00D5F5D0 Relevance: 5.1, Strings: 4, Instructions: 56COMMON

Download Yara Rule

Strings

GOMEMLIMIT=GOTRACEBACKGetFileTypeGetKeyStateGetMessageWIdeographicLoadCursorWMedefaidrinMessageBoxWMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_LueOld_PersianOld_SogdianOpenProcessPau_Cin_HauRegCloseKeySetFileTimeSignWritingSoft_DottedVirtualLockWSARecv, xrefs: 00D5F667
GOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLoadImageWLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraSetCaptureWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockopt, xrefs: 00D5F5E9
?, xrefs: 00D5F6A4
malformed GOMEMLIMIT; see `go doc runtime/debug.SetMemoryLimit`File has been set to hidden, and the program continues to run...compileCallback: expected function with one uintptr-sized resultruntime.SetFinalizer: first argument was allocated into an arenarunti, xrefs: 00D5F69B

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: ?$GOMEMLIMIT=GOTRACEBACKGetFileTypeGetKeyStateGetMessageWIdeographicLoadCursorWMedefaidrinMessageBoxWMoveFileExWNandinagariNetShareAddNetShareDelNew_Tai_LueOld_PersianOld_SogdianOpenProcessPau_Cin_HauRegCloseKeySetFileTimeSignWritingSoft_DottedVirtualLockWSARecv$GOMEMLIMITGetIfEntryGetVersionGlagoliticKharoshthiLoadImageWLockFileExManichaeanOld_ItalicOld_PermicOld_TurkicOther_MathPhoenicianSaurashtraSetCaptureWSACleanupWSASocketWWSAStartupatomicand8complex128debug calldnsapi.dllexitThreadfloat32nanfloat64nangetsockopt$malformed GOMEMLIMIT; see `go doc runtime/debug.SetMemoryLimit`File has been set to hidden, and the program continues to run...compileCallback: expected function with one uintptr-sized resultruntime.SetFinalizer: first argument was allocated into an arenarunti
API String ID: 0-3384686030
Opcode ID: 90cd0d9a99ba05ec1965622ba246840a27fdc67f503e3e3441b0c33eab798495
Instruction ID: fe96f927f95832fe6abcc865ad8eaeefde0bd4d6de5e8dd658dfafddb4ea4249
Opcode Fuzzy Hash: 90cd0d9a99ba05ec1965622ba246840a27fdc67f503e3e3441b0c33eab798495
Instruction Fuzzy Hash: CA2107B08097418FCB10EF24D19562EBBE0EF88714F44896DE8D887292E735C9498B73

Function 00D6F7F0 Relevance: 5.1, Strings: 4, Instructions: 52COMMON

Download Yara Rule

Strings

) *( - < > m= n=%: +00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...125625::1???ADTASTBSTCATCDTCETCSTDltEATEDTEETEOFESTGMTHDTHSTHanIDTISTJSTKSTLaoMDTMSKMSTMayMroNDTNSTNaNNkoPC=PDTPKTPSTStdTTLUTCVaiWAT\\?]:adxaesavxcgodnsendfinfm, xrefs: 00D6F8AB
3, xrefs: 00D6F8CF
runtime: netpoll: PostQueuedCompletionStatus failed (errno= abiRegArgsType needs GC Prog, update methodValueCallFrameObjsgo package net: GODEBUG setting forcing use of Go's resolverfound bad pointer in Go heap (incorrect use of unsafe or cgo?)limiterEvent.sto, xrefs: 00D6F881
runtime: netpoll: PostQueuedCompletionStatus failedcasfrom_Gscanstatus: gp->status is not in scan statemallocgc called without a P or outside bootstrappingruntime.SetFinalizer: pointer not in allocated blockruntime: GetQueuedCompletionStatusEx failed (errno= r, xrefs: 00D6F8C6

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: ) *( - < > m= n=%: +00+01+03+04+05+06+07+08+09+10+11+12+13+14-01-02-03-04-05-06-08-09-11-12...125625::1???ADTASTBSTCATCDTCETCSTDltEATEDTEETEOFESTGMTHDTHSTHanIDTISTJSTKSTLaoMDTMSKMSTMayMroNDTNSTNaNNkoPC=PDTPKTPSTStdTTLUTCVaiWAT\\?]:adxaesavxcgodnsendfinfm$3$runtime: netpoll: PostQueuedCompletionStatus failed (errno= abiRegArgsType needs GC Prog, update methodValueCallFrameObjsgo package net: GODEBUG setting forcing use of Go's resolverfound bad pointer in Go heap (incorrect use of unsafe or cgo?)limiterEvent.sto$runtime: netpoll: PostQueuedCompletionStatus failedcasfrom_Gscanstatus: gp->status is not in scan statemallocgc called without a P or outside bootstrappingruntime.SetFinalizer: pointer not in allocated blockruntime: GetQueuedCompletionStatusEx failed (errno= r
API String ID: 0-2483050640
Opcode ID: 3bac27a39d252f31503136edc8ec64f5c23ba959ab1d7f58d35dc2919e81a148
Instruction ID: ddc722a7bffed67afdaa77ae37e9fc69ef3800ec1b1b0386d493089c5a1d8346
Opcode Fuzzy Hash: 3bac27a39d252f31503136edc8ec64f5c23ba959ab1d7f58d35dc2919e81a148
Instruction Fuzzy Hash: 3B21E0B4408B059FD300EF24D19576ABBE4FF84744F44886DE8C883352E7799948DBB2

Function 00D790E0 Relevance: 5.1, Strings: 4, Instructions: 51COMMON

Download Yara Rule

Strings

castogscanstatuscontext canceledgc: unswept spangcshrinkstackoffhostLookupOrder=integer overflowinvalid argumentinvalid exchangeinvalid g statusmSpanList.insertmSpanList.removemessage too longmissing stackmapno colon on lineno route to hostnon-Go functionnon-, xrefs: 00D7919D
runtime: castogscanstatus oldval=runtime: failed mSpanList.insert runtime: failed to decommit pagesruntime: goroutine stack exceeds runtime: memory allocated by OS [runtime: name offset out of rangeruntime: text offset out of rangeruntime: type offset out of r, xrefs: 00D7913F
newval= nfreed= pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYCyrillicDecemberDuployanEthiopicExtenderFebruaryFullPathGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALine, xrefs: 00D79169
!, xrefs: 00D79148

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: newval= nfreed= pointer stack=[ status %!Month(48828125AcceptExArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYCyrillicDecemberDuployanEthiopicExtenderFebruaryFullPathGeorgianGoStringGujaratiGurmukhiHiraganaJavaneseKatakanaKayah_LiLinear_ALine$!$castogscanstatuscontext canceledgc: unswept spangcshrinkstackoffhostLookupOrder=integer overflowinvalid argumentinvalid exchangeinvalid g statusmSpanList.insertmSpanList.removemessage too longmissing stackmapno colon on lineno route to hostnon-Go functionnon-$runtime: castogscanstatus oldval=runtime: failed mSpanList.insert runtime: failed to decommit pagesruntime: goroutine stack exceeds runtime: memory allocated by OS [runtime: name offset out of rangeruntime: text offset out of rangeruntime: type offset out of r
API String ID: 0-2947785840
Opcode ID: 5057c9eba885431d2404f6fe21b0592070cc9340a7d0870187aa3b37a7b1b9a7
Instruction ID: 759d5ccb6285fe2d424e4cd046e7ac09ac7953e49aca558c845ddd11fc849b05
Opcode Fuzzy Hash: 5057c9eba885431d2404f6fe21b0592070cc9340a7d0870187aa3b37a7b1b9a7
Instruction Fuzzy Hash: D111C0B4509B459EC700EF24C19976EBBE1EF84344F80C86DE88887252EB3498498B72

Function 00D43FE0 Relevance: 5.0, Strings: 4, Instructions: 35COMMON

Download Yara Rule

Strings

Go pointer stored into non-Go memoryUnable to determine system directoryaccessed data from freed user arena accessing a corrupted shared librarycompressed name in SRV resource datalfstack node allocated from the heapmethod ABI and value ABI don't alignruntime:, xrefs: 00D4406A
write of Go pointer ws2_32.dll not found of unexported method pcHeader.textStart= previous allocCount=, levelBits[level] = 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeBelarus St, xrefs: 00D4400C
to non-Go memory , locked to thread/etc/nsswitch.conf298023223876953125Arab Standard TimeCaucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGC worker (active)GetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModul, xrefs: 00D44036
$, xrefs: 00D44073

Memory Dump Source

Source File: 00000000.00000002.4111084810.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000000.00000002.4111063178.0000000000D40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111213293.0000000000E12000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111292539.0000000000F05000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111313460.0000000000F08000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111331187.0000000000F09000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111349496.0000000000F0A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111367703.0000000000F16000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111385259.0000000000F17000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F19000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F1F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F23000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111404497.0000000000F3F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111481703.0000000000F7B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111555274.0000000001002000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4111573292.0000000001003000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d40000_L8RabfF1Hu.jbxd

Similarity

API ID:
String ID: to non-Go memory , locked to thread/etc/nsswitch.conf298023223876953125Arab Standard TimeCaucasian_AlbanianCommandLineToArgvWCreateFileMappingWCuba Standard TimeFiji Standard TimeGC worker (active)GetComputerNameExWGetExitCodeProcessGetFileAttributesWGetModul$$$Go pointer stored into non-Go memoryUnable to determine system directoryaccessed data from freed user arena accessing a corrupted shared librarycompressed name in SRV resource datalfstack node allocated from the heapmethod ABI and value ABI don't alignruntime:$write of Go pointer ws2_32.dll not found of unexported method pcHeader.textStart= previous allocCount=, levelBits[level] = 186264514923095703125931322574615478515625AdjustTokenPrivilegesAlaskan Standard TimeAnatolian_HieroglyphsArabian Standard TimeBelarus St
API String ID: 0-517412102
Opcode ID: 3cfd0d1f80366765857aec6a138acc03e1597e0f106c9a46057c15f01ecccb26
Instruction ID: 27f4e1bbbaa999a0c87d364991f36deadda47d6652895249dabb8b01e1843cd1
Opcode Fuzzy Hash: 3cfd0d1f80366765857aec6a138acc03e1597e0f106c9a46057c15f01ecccb26
Instruction Fuzzy Hash: 92018CB4408A059FD700EF64D19966ABBE5EF88304F00C86DF88887652EB35D889DB72

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report L8RabfF1Hu.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: L8RabfF1Hu.exePID: 7572, Parent PID: 2580

General

Windows Analysis Report
L8RabfF1Hu.exe

Function 2BB75430 Relevance: 91.4, APIs: 40, Strings: 12, Instructions: 440
stringnetworklibraryCOMMON

Function 2BB7DF10 Relevance: 61.6, APIs: 24, Strings: 11, Instructions: 354
sleepregistrysynchronizationCOMMON

Function 2BB7BC70 Relevance: 54.6, APIs: 27, Strings: 4, Instructions: 351
windowCOMMON

Function 2BB76A70 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 141
memoryCOMMON

Function 2BB76150 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 222
stringcomregistryCOMMON

Function 2BB79E50 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 314
windowCOMMON

Function 00402832 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 243
registrymemoryCOMMON

Function 2BB72DA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 203
networkstringtimeCOMMON

Function 00402EDD Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 173
networkstringtimeCOMMON

Function 2BB7AD10 Relevance: 30.1, APIs: 12, Strings: 5, Instructions: 346
registryCOMMON

Function 00404D97 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 147
sleepsynchronizationCOMMON

Function 2BB7A6F0 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 254
COMMON

Function 2BB75F40 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 88
sleepstringsynchronizationCOMMON

Function 2BB7DA30 Relevance: 21.3, APIs: 14, Instructions: 254
COMMON

Function 2BB762B6 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 125
stringregistryCOMMON

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre