Edit tour

Windows Analysis Report
5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Overview

General Information

Sample name:	5935c1f1a7da8e42028da77013b80635afdd605866569.exe
Analysis ID:	1581261
MD5:	50656c1c5404fe2fd6981b05a2225251
SHA1:	a7163da901731ac994b8a18f47dd1273b2cf60ae
SHA256:	5935c1f1a7da8e42028da77013b80635afdd6058665699fae1d857e1c7495e80
Tags:	exeValleyRATuser-abuse_ch
Infos:

Detection

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Found stalling execution ending in API Sleep call

Tries to detect sandboxes / dynamic malware analysis system (QueryWinSAT)

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after accessing registry keys)

Installs a global mouse hook

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

5935c1f1a7da8e42028da77013b80635afdd605866569.exe (PID: 1616 cmdline: "C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe" MD5: 50656C1C5404FE2FD6981B05A2225251)

cleanup

Suricata Signatures

ET MALWARE Anonymous RAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T09:13:23.181258+0100	2052875	1	A Network Trojan was detected	192.168.2.6	49707	18.167.52.240	6666	TCP
2024-12-27T09:14:33.258217+0100	2052875	1	A Network Trojan was detected	192.168.2.6	49711	18.167.52.240	6666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Virustotal: Detection: 69%			Perma Link
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	File opened: [:	Jump to behavior

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028D9BC0 GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,lstrcpyW,lstrcpyW,lstrcatW,

0_2_028D9BC0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.6:49707 -> 18.167.52.240:6666
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.6:49711 -> 18.167.52.240:6666

Source: global traffic

TCP traffic: 192.168.2.6:49707 -> 18.167.52.240:6666

Source: Joe Sandbox View

ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240
Source: unknown	TCP traffic detected without corresponding DNS query: 18.167.52.240

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028D3670 select,recv,_errno,_errno,_errno,

0_2_028D3670

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: [esc]

0_2_028E2280

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028E2280 Sleep,SleepEx,GetTickCount,OpenClipboard,GetClipboardData,GlobalSize,GlobalLock,wsprintfW,GlobalUnlock,CloseClipboard,GetKeyState,lstrlenW,lstrlenW,lstrlenW,wsprintfW,wsprintfW,wsprintfW,lstrlenW,

0_2_028E2280

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

0_2_028E2280

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028DEE40 GetDesktopWindow,GetDC,CreateCompatibleDC,GetDC,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateCompatibleBitmap,SelectObject,SetStretchBltMode,GetSystemMetrics,GetSystemMetrics,StretchBlt,GetDIBits,DeleteObject,DeleteObject,ReleaseDC,DeleteObject,DeleteObject,ReleaseDC,

0_2_028DEE40

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028E1F2A DeleteFileW,ReleaseMutex,DirectInput8Create,GetTickCount,GetKeyState,

0_2_028E1F2A

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Jump to behavior

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028DE2F7 ExitProcess,ExitWindowsEx,	0_2_028DE2F7
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028DE327 ExitWindowsEx,	0_2_028DE327
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028DE348 ExitWindowsEx,	0_2_028DE348

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028F02A4	0_2_028F02A4
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028D3370	0_2_028D3370
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028D86F0	0_2_028D86F0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028E1790	0_2_028E1790
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028D77A0	0_2_028D77A0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028D67A0	0_2_028D67A0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028DB2B0	0_2_028DB2B0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028ECAF0	0_2_028ECAF0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028E6210	0_2_028E6210
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028FCA74	0_2_028FCA74
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028D3BB0	0_2_028D3BB0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028EB340	0_2_028EB340
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028D98B0	0_2_028D98B0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028F38D0	0_2_028F38D0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028D2850	0_2_028D2850
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028F11B0	0_2_028F11B0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028DF9F0	0_2_028DF9F0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028EB104	0_2_028EB104
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028D5930	0_2_028D5930
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028EC15C	0_2_028EC15C
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028D9170	0_2_028D9170
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028ED638	0_2_028ED638
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028DEE40	0_2_028DEE40
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028DF780	0_2_028DF780
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028F2F80	0_2_028F2F80
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028FCFB0	0_2_028FCFB0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028FBFC0	0_2_028FBFC0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028EF7F8	0_2_028EF7F8
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028D9710	0_2_028D9710
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028F9F10	0_2_028F9F10
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028F0724	0_2_028F0724
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028FB75C	0_2_028FB75C
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028EACE0	0_2_028EACE0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028DC400	0_2_028DC400
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028F0D10	0_2_028F0D10
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF073D0	0_2_00007FF7EAF073D0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF03390	0_2_00007FF7EAF03390
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF06F70	0_2_00007FF7EAF06F70
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF06860	0_2_00007FF7EAF06860
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF16C50	0_2_00007FF7EAF16C50
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF124BC	0_2_00007FF7EAF124BC
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF06C80	0_2_00007FF7EAF06C80
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF0C28C	0_2_00007FF7EAF0C28C
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF0A30C	0_2_00007FF7EAF0A30C
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF16130	0_2_00007FF7EAF16130
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF0E1C0	0_2_00007FF7EAF0E1C0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF14898	0_2_00007FF7EAF14898
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF158CC	0_2_00007FF7EAF158CC
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF02880	0_2_00007FF7EAF02880
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF0AD44	0_2_00007FF7EAF0AD44
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_0288F251	0_2_0288F251
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028A2A51	0_2_028A2A51
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_02891261	0_2_02891261
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_02887271	0_2_02887271
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_02886271	0_2_02886271
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_02889381	0_2_02889381
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_02882321	0_2_02882321
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028A01F5	0_2_028A01F5
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_0288E911	0_2_0288E911
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_02891941	0_2_02891941
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_02883681	0_2_02883681
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_0288BED1	0_2_0288BED1
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_02882E41	0_2_02882E41
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_0289A7B1	0_2_0289A7B1
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028A07E1	0_2_028A07E1
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_02895CE1	0_2_02895CE1
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_02885401	0_2_02885401
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_0289BC2D	0_2_0289BC2D
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_02888C41	0_2_02888C41
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_0289FD75	0_2_0289FD75

Source: classification engine

Classification label: mal80.spyw.evad.winEXE@1/1@0/1

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028DAB60 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,	0_2_028DAB60
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028D90B0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,	0_2_028D90B0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028D8F30 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,OpenProcess,	0_2_028D8F30
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028D9590 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	0_2_028D9590

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028D8430 GetDriveTypeW,GetDiskFreeSpaceExW,GlobalMemoryStatusEx,

0_2_028D8430

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028D7150 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

0_2_028D7150

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028D77A0 lstrcatW,lstrcatW,CoCreateInstance,wsprintfW,RegOpenKeyExW,RegQueryValueExW,lstrcatW,lstrcatW,RegCloseKey,lstrlenW,lstrcatW,

0_2_028D77A0

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Mutant created: \Sessions\1\BaseNamedObjects\2024.12.22

Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Virustotal: Detection: 69%
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

File read: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Jump to behavior

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: hid.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25E609E4-B259-11CF-BFC7-444553540000}\InProcServer32

Jump to behavior

Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028E1790 GetVersionExW,LoadLibraryA,GetProcAddress,SetProcessMitigationPolicy,Sleep,SleepEx,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,EnumWindows,Sleep,EnumWindows,Sleep,CreateEventA,RegOpenKeyExW,Sleep,SleepEx,RegOpenKeyExW,RegQueryValueExW,Sleep,SleepEx,WaitForSingleObject,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,

0_2_028E1790

Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Static PE information: real checksum: 0x2bb4f should be: 0x20cf6

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028FF94B push rbp; retf		0_2_028FF974
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028A0755 pushfd ; ret		0_2_028A075A

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028DE29A OpenEventLogW,ClearEventLogW,CloseEventLog,

0_2_028DE29A

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Key value created or modified: HKEY_CURRENT_USER\Console\1 d33f351a4aeea5e608853d1a56661059

Jump to behavior

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Stalling execution: Execution stalls by calling Sleep

graph_0-38122

Tries to detect sandboxes / dynamic malware analysis system (QueryWinSAT)

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{05DF8D13-C355-47F4-A11E-851B338CEFB8}

Jump to behavior

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Window / User API: threadDelayed 1421	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Window / User API: threadDelayed 648	Jump to behavior
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Window / User API: foregroundWindowGot 1676	Jump to behavior

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep			graph_0-38119
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_0-38190

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028D9BC0 GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,lstrcpyW,lstrcpyW,lstrcatW,

0_2_028D9BC0

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028D67A0 gethostname,gethostbyname,inet_ntoa,inet_ntoa,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,GetLocalTime,wsprintfW,lstrlenW,RegSetValueExW,RegCloseKey,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,GetTickCount,_localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,

0_2_028D67A0

Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe, 00000000.00000002.3384549180.0000000000B63000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<<

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	API call chain: ExitProcess graph end node			graph_0-37758
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	API call chain: ExitProcess graph end node			graph_0-37755

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028E4F50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_028E4F50

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

0_2_028E1790

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028D7EA0 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,LookupAccountSidW,GetLastError,GetProcessHeap,HeapFree,

0_2_028D7EA0

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028E1790 GetVersionExW,LoadLibraryA,GetProcAddress,SetProcessMitigationPolicy,Sleep,SleepEx,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,EnumWindows,Sleep,EnumWindows,Sleep,CreateEventA,RegOpenKeyExW,Sleep,SleepEx,RegOpenKeyExW,RegQueryValueExW,Sleep,SleepEx,WaitForSingleObject,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,	0_2_028E1790
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028E4F50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_028E4F50
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028EC444 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_028EC444
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF08580 SetUnhandledExceptionFilter,GetConsoleWindow,ShowWindow,GetCurrentThreadId,PostThreadMessageA,GetInputState,CreateThread,WaitForSingleObject,CloseHandle,Sleep,	0_2_00007FF7EAF08580
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF08AD0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7EAF08AD0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF0CF6C SetUnhandledExceptionFilter,	0_2_00007FF7EAF0CF6C
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_00007FF7EAF0A5F4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7EAF0A5F4

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028D98B0 GetSystemDirectoryA,CreateProcessA,VirtualAllocEx,WriteProcessMemory,GetThreadContext,SetThreadContext,ResumeThread,

0_2_028D98B0

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028D9170 GetSystemDirectoryA,CreateProcessA,OpenProcess,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,GetModuleFileNameA,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,ResumeThread,		0_2_028D9170
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: 0_2_028DA670 VirtualAllocEx,TerminateProcess,OpenProcess,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,VirtualFreeEx,		0_2_028DA670

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: GetSystemDirectoryA,CreateProcessA,OpenProcess,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,GetModuleFileNameA,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\System32\svchost.exe

0_2_028D9170

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028DFD50 lstrlenW,ShellExecuteW,

0_2_028DFD50

Source: DisplaySessionContainers.log.0.dr	Binary or memory string: :]Program Manager
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe, 00000000.00000003.2252438873.000000000447E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 54HDD:1WW 223 Gb Free 168 Gb Mem: 8 Gb Free3 Gb Microsoft Basic Render Driver 0 5140 Microsoft Basic Render Driver 0 5140 Program Manager
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe, 00000000.00000003.2252388901.00000000043F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .2.6 0 min138727Windows 10 Pro10.0.190454HDD:1WW 223 Gb Free 168 Gb Mem: 8 Gb Free3 Gb Microsoft Basic Render Driver 0 5140 Microsoft Basic Render Driver 0 5140 Program Manager
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe, 00000000.00000002.3384488992.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager((

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: gethostname,gethostbyname,inet_ntoa,inet_ntoa,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,GetLocalTime,wsprintfW,lstrlenW,RegSetValueExW,RegCloseKey,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,GetTickCount,_localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,	0_2_028D67A0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW,	0_2_028F629C
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: EnumSystemLocalesA,	0_2_028F63CC
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW,	0_2_028EE8A0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: GetLocaleInfoW,	0_2_028FF190
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: _getptd,GetLocaleInfoA,	0_2_028F5E54
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,free,	0_2_028F7664
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,	0_2_028F5FCC
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: GetLocaleInfoW,	0_2_028F5F3C
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: _getptd,EnumSystemLocalesA,GetUserDefaultLCID,GetLocaleInfoW,GetLocaleInfoW,GetACP,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,_itow_s,	0_2_028F64D0
Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Code function: EnumSystemLocalesA,	0_2_028F6464

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028E2140 GetForegroundWindow,GetWindowTextW,lstrlenW,GetLocalTime,wsprintfW,

0_2_028E2140

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028F02A4 _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,free,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_028F02A4

Source: C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Code function: 0_2_028D8220 GetCurrentProcessId,wsprintfW,GetVersionExW,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,wsprintfW,

0_2_028D8220

Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: acs.exe
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: vsserv.exe
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: avcenter.exe
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: kxetray.exe
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: avp.exe
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: cfp.exe
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: KSafeTray.exe
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: 360Safe.exe
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: rtvscan.exe
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: 360tray.exe
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: TMBMSRV.exe
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: ashDisp.exe
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: 360Tray.exe
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: avgwdsvc.exe
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: AYAgent.aye
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: QUHLPSVC.EXE
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: RavMonD.exe
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: Mcshield.exe
Source: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe	Binary or memory string: K7TSecurity.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Modify Registry	121 Input Capture	2 System Time Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Access Token Manipulation	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	121 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	211 Process Injection	211 Process Injection	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	16 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5935c1f1a7da8e42028da77013b80635afdd605866569.exe	69%	Virustotal		Browse
5935c1f1a7da8e42028da77013b80635afdd605866569.exe	63%	ReversingLabs	Win64.Backdoor.Farfli

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
18.167.52.240	unknown	United States		16509	AMAZON-02US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581261
Start date and time:	2024-12-27 09:12:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5935c1f1a7da8e42028da77013b80635afdd605866569.exe
Detection:	MAL
Classification:	mal80.spyw.evad.winEXE@1/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 67 Number of non-executed functions: 287
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:14:16	API Interceptor	4244x Sleep call for process: 5935c1f1a7da8e42028da77013b80635afdd605866569.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	aD7D9fkpII.exe	Get hash	malicious	Vidar	Browse	18.238.49.124
	http://www.finanzamthessen.de	Get hash	malicious	Unknown	Browse	54.75.69.192
	installer.bat	Get hash	malicious	Vidar	Browse	108.139.47.108
	din.exe	Get hash	malicious	Vidar	Browse	18.238.49.74
	db0fa4b8db0333367e9bda3ab68b8042.sh4.elf	Get hash	malicious	Mirai, Gafgyt	Browse	54.126.82.77
	RpcSecurity.mips.elf	Get hash	malicious	Unknown	Browse	54.217.10.153
	RpcSecurity.x86_64.elf	Get hash	malicious	Unknown	Browse	34.243.160.129
	feiwbps.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	most-mips.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	http://kxyaiaqyijjz.com	Get hash	malicious	Unknown	Browse	13.227.8.126

Process:	C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe
File Type:	data
Category:	dropped
Size (bytes):	28104
Entropy (8bit):	3.647386146735342
Encrypted:	false
SSDEEP:	96:BuCuCu3u3u3u3u3u3uEuEuEuEuEuEuEuhuhuhuhuhuhuhuBuBuBuBuBuBuBuBukl:Jvvvvvvvs
MD5:	0B317461A37C655A019D82A72017A297
SHA1:	BCCEA3AADD8542E44F1237DBFAEB4FF2A6B6D090
SHA-256:	D40836B9700B2010BF960BD84E34F5D7F0B088D01C93436D58DEB8EFFBD1A089
SHA-512:	5CD8B13286AADEDA02B71AB6841A221CD50254DDEC76DE507882EFA80545D93E01E0DB0B90E9BFC828DD46D7DF82184AA427C6540EE28DE458FCB287A36B3A09
Malicious:	false
Reputation:	low
Preview:	....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.4.-.1.2.-.2.7. . .3.:.1.3.:.2.6.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.4.-.1.2.-.2.7. . .3.:.1.3.:.2.6.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.4.-.1.2.-.2.7. . .3.:.1.3.:.2.7.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.4.-.1.2.-.2.7. . .3.:.1.3.:.2.7.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.4.-.1.2.-.2.7. . .3.:.1.3.:.2.7.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.4.-.1.2.-.2.7. . .3.:.1.3.:.2.7.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.4.-.1.2.-.2.7. . .3.:.1.3.:.2.7.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.4.-.1.2.-.2.7. . .3.:.1.3.:.2.7.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.4.-.1.2.-.2.7. . .3.:.1.3.:.2.8.....[..Q.[:.].....[..h..

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.106153315383464
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	5935c1f1a7da8e42028da77013b80635afdd605866569.exe
File size:	133'632 bytes
MD5:	50656c1c5404fe2fd6981b05a2225251
SHA1:	a7163da901731ac994b8a18f47dd1273b2cf60ae
SHA256:	5935c1f1a7da8e42028da77013b80635afdd6058665699fae1d857e1c7495e80
SHA512:	7634d2540e6ad35dc870fadf57822533daf42e61e6f4ebc3a352e8b6bc2cd590ec3126ede5e570c42f00a84149b834a4274c66bdbbccfdd7a18a1a65bedaf27f
SSDEEP:	3072:lO55k/y5dAj+BMTYlgEQnB+Y+pek7+3OrFZeUqe6o3:lO5n5d56TYZQnB+Dpekyyqm
TLSH:	24D37D4733A450F9D4A78279C9A24A06E7B374660735A3CF17A086BA2F137D1BD3A331
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........VF.g.F.g.F.g.)...+.g.)...M.g.)...k.g.O...M.g.F.f...g.)...K.g.)...G.g.RichF.g.........................PE..d.....ld.........."

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140009a74
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x646C86AC [Tue May 23 09:26:04 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	fb51ede541a9ad63bf23d302e319d2a0

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F6740903528h
dec eax
add esp, 28h
jmp 00007F67408FF70Bh
int3
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], edi
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 60h
dec eax
mov edi, edx
dec eax
mov ebx, ecx
dec eax
lea ecx, dword ptr [ebp-40h]
dec eax
lea edx, dword ptr [0000EAE5h]
inc ecx
mov eax, 00000040h
call 00007F67408FE8DFh
dec eax
lea edx, dword ptr [ebp+10h]
dec eax
mov ecx, edi
dec eax
mov dword ptr [ebp-18h], ebx
dec eax
mov dword ptr [ebp-10h], edi
call 00007F6740907595h
dec esp
mov ebx, eax
dec eax
mov dword ptr [ebp+10h], eax
dec eax
mov dword ptr [ebp-08h], eax
dec eax
test edi, edi
je 00007F67408FF8ADh
test byte ptr [edi], 00000008h
mov ecx, 01994000h
je 00007F67408FF897h
mov dword ptr [ebp-20h], ecx
jmp 00007F67408FF89Eh
mov eax, dword ptr [ebp-20h]
dec ebp
test ebx, ebx
cmove eax, ecx
mov dword ptr [ebp-20h], eax
inc esp
mov eax, dword ptr [ebp-28h]
mov edx, dword ptr [ebp-3Ch]
mov ecx, dword ptr [ebp-40h]
dec esp
lea ecx, dword ptr [ebp-20h]
call dword ptr [0000E7AFh]
dec esp
lea ebx, dword ptr [esp+60h]
dec ecx
mov ebx, dword ptr [ebx+18h]
dec ecx
mov edi, dword ptr [ebx+20h]
dec ecx
mov esp, ebx
pop ebp
ret
int3
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 00000088h
dec eax
lea ecx, dword ptr [00016781h]
call dword ptr [0000E7B3h]
dec eax
mov eax, dword ptr [0001686Ch]

Rich Headers

Programming Language:

[ C ] VS2010 build 30319
[ASM] VS2010 build 30319
[C++] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1d028	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x27000	0x1b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x25000	0x1578	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x28000	0x2f8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x18000	0x438	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x16606	0x16800	9cde0d8ddbf108908aa730f375bc1766	False	0.5621636284722222	zlib compressed data	6.429037086317127	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x18000	0x5d3a	0x5e00	b44503f0aa67867070e1b6433af825a5	False	0.3683926196808511	data	4.8111582224132965	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1e000	0x6770	0x2200	9b1a57cf7f5d98e8e32b50a56536c716	False	0.22012867647058823	data	2.698421581190009	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x25000	0x1578	0x1600	6b2fcd8de66b48f900df2c9c6b6db832	False	0.4728338068181818	data	5.019696142888745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x27000	0x1b4	0x200	5f882a758b6b0045acd02c3e0551be90	False	0.486328125	data	5.112623549532036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x28000	0x5be	0x600	3b9d434e2274fd734402fea8d43c6f67	False	0.3587239583333333	data	3.4572271853315204	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x27058	0x15a	ASCII text, with CRLF line terminators	English	United States	0.5491329479768786

Imports

DLL	Import
KERNEL32.dll	HeapCreate, EnterCriticalSection, DeleteCriticalSection, WaitForSingleObject, SetEvent, Sleep, CreateEventA, GetLastError, CloseHandle, GetCurrentThreadId, SwitchToThread, SetLastError, WideCharToMultiByte, lstrlenW, ResetEvent, CreateEventW, CancelIo, TryEnterCriticalSection, SetWaitableTimer, CreateWaitableTimerW, GetThreadContext, SetThreadContext, LeaveCriticalSection, GetExitCodeProcess, CreateProcessA, GetSystemDirectoryA, VirtualAllocEx, WriteProcessMemory, ResumeThread, FreeLibrary, SetUnhandledExceptionFilter, GetCurrentProcess, LoadLibraryW, GetConsoleWindow, CreateFileW, GetProcAddress, GetLocalTime, IsDebuggerPresent, GetCurrentProcessId, CreateThread, LCMapStringW, WriteConsoleW, SetStdHandle, GetStringTypeW, MultiByteToWideChar, HeapDestroy, InitializeCriticalSectionAndSpinCount, HeapFree, HeapAlloc, VirtualAlloc, OpenProcess, VirtualFree, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, GetConsoleMode, FlushFileBuffers, GetConsoleCP, SetFilePointer, GetSystemTimeAsFileTime, GetTickCount, QueryPerformanceCounter, GetStartupInfoW, GetFileType, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, RtlUnwindEx, FlsAlloc, FlsFree, FlsSetValue, FlsGetValue, HeapReAlloc, HeapSize, GetProcessHeap, ExitThread, DecodePointer, EncodePointer, GetCommandLineW, RaiseException, RtlPcToFileHeader, TerminateProcess, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, HeapSetInformation, GetVersion, GetModuleHandleW, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameW
USER32.dll	DispatchMessageW, PostThreadMessageA, PeekMessageW, TranslateMessage, MsgWaitForMultipleObjects, ShowWindow, GetInputState, wsprintfW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteValueW, RegQueryValueExW, RegCreateKeyW, RegSetValueExW
WS2_32.dll	WSAWaitForMultipleEvents, WSAIoctl, connect, WSAStartup, select, WSAResetEvent, setsockopt, recv, socket, closesocket, gethostbyname, send, WSASetLastError, WSACreateEvent, shutdown, WSAEventSelect, WSAEnumNetworkEvents, WSAGetLastError, WSACloseEvent, htons, WSACleanup
WINMM.dll	timeGetTime

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T09:13:23.181258+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.6	49707	18.167.52.240	6666	TCP
2024-12-27T09:14:33.258217+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.6	49711	18.167.52.240	6666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 09:13:22.965904951 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:23.179773092 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:23.179883957 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:23.181257963 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:23.300745010 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:24.733376026 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:24.733822107 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:24.853626966 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:24.853646040 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:24.853657961 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.283133984 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.283149004 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.283160925 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.283173084 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.283185005 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.283212900 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.283257961 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.283353090 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.283366919 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.283396959 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.283431053 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.283478022 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.283529997 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.283548117 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.283585072 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.291299105 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.338253975 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.403534889 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.445431948 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.517971992 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.517993927 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.518052101 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.522090912 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.522214890 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.522260904 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.530528069 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.530631065 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.530688047 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.538903952 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.539005995 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.539068937 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.547363043 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.547501087 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.547553062 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.555740118 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.555800915 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.555854082 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.564126015 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.564240932 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.564291000 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.572554111 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.572659969 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.572700024 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.580915928 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.581026077 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.581067085 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.589411974 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.589482069 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.589529991 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.597755909 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.597918987 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.597960949 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.753245115 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.753396988 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.753443956 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.756278038 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.757474899 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.757525921 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.757534027 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.763672113 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.763729095 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.763773918 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.769855976 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.769920111 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.769964933 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.776043892 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.776104927 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.776161909 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.782295942 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.782346010 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.782373905 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.788449049 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.788530111 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.788549900 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.794707060 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.794780970 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.794790030 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.800885916 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.800971031 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.801016092 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.807090044 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.807162046 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.807176113 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.813256979 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.813313007 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.813349009 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.826632977 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.826654911 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.826747894 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.826777935 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.826791048 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.826829910 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.831877947 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.831935883 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.831970930 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.838263988 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.838329077 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.838340044 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.844363928 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.844476938 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.988914967 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.988977909 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.989053965 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.991048098 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.991187096 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.991241932 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:25.995646954 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.995748997 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:25.995798111 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.000238895 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.000364065 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.000418901 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.004847050 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.004955053 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.005007982 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.009490013 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.009597063 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.009643078 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.014071941 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.014153957 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.014229059 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.018726110 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.018850088 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.018896103 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.023310900 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.023448944 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.023541927 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.027911901 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.028053045 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.028111935 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.032639027 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.032744884 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.032790899 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.037125111 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.037244081 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.037309885 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.041768074 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.041867971 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.041938066 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.046376944 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.046488047 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.046536922 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.051018000 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.051074982 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.051126003 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.055571079 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.055672884 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.055725098 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.060168028 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.060282946 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.060343981 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.064806938 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.064894915 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.064945936 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.069413900 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.069503069 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.069555998 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.074031115 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.074120045 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.074181080 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.078633070 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.078716040 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.078777075 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.083261967 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.083352089 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.083411932 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.087893009 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.087969065 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.088011980 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.092710018 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.092730045 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.092787981 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.097201109 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.097356081 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.097404957 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.224234104 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.224363089 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.224405050 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.225887060 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.225965977 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.226012945 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.229024887 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.229151964 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.229204893 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.232273102 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.232340097 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.232372046 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.235474110 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.235529900 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.235572100 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.238615036 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.238693953 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.238734961 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.241820097 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.241911888 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.241945028 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.245037079 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.245122910 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.245168924 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.248219967 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.248347998 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.248387098 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.251446009 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.251518011 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.251570940 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.254590034 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.254842043 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.254898071 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.257963896 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.258049965 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.258115053 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.260994911 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.261109114 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.261143923 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.264240980 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.264342070 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.264374971 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.267417908 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.267493010 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.267534018 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.270585060 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.270679951 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.270719051 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.273853064 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.273926020 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.273960114 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.276968956 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.277065039 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.277101040 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.280149937 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.280250072 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.280297041 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.283349991 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.283457994 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.283510923 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.286582947 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.286665916 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.286700010 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.289747000 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.289819956 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.289870977 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.292960882 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.293072939 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.293106079 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.296138048 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.296246052 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.296288013 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.299388885 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.299443960 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.299479961 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.302544117 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.302656889 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.302700043 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.305749893 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.305865049 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.305953026 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.308980942 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.309114933 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.309158087 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.312143087 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.312263966 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.312305927 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.315344095 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.315413952 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.315454006 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.318523884 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.318600893 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.318648100 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.321693897 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.321815014 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.321865082 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.324937105 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.325025082 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.325068951 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.328114033 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.328139067 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.328180075 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.331295013 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.331394911 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.331443071 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.334500074 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.334630013 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.334688902 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.337758064 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.337798119 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.337842941 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.340871096 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.340996981 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.341037035 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.344062090 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.344160080 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.344202042 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.459673882 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.459804058 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.459878922 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.460763931 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.460880995 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.460917950 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.462980032 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.463145971 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.463185072 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.465167999 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.465265036 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.465300083 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.467529058 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.467633009 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.467674971 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.469563007 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.469656944 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.469697952 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.471687078 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.471877098 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.471927881 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.473851919 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.473965883 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.474014997 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.476008892 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.476119041 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.476161957 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.478173971 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.478204966 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.478249073 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.480278015 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.480401039 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.480438948 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.482429981 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.482539892 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.482575893 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.484601974 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.484719038 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.484757900 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.486766100 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.486840010 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.486881018 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.488888025 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.488976955 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.489020109 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.491064072 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.491149902 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.491190910 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.493189096 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.493304968 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.493340015 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.495362997 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.495424986 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.495461941 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.497461081 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.497560978 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.497600079 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.499655962 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.499756098 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.499794006 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.501827002 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.501948118 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.501986027 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.503920078 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.504012108 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.504049063 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:26.506102085 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.506148100 CET	6666	49707	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:26.506189108 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:27.540399075 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:27.660123110 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:27.660342932 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:29.523704052 CET	49707	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:32.697664976 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:32.817348003 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:32.817365885 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:32.817378998 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:32.817425013 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:32.817439079 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:33.257385015 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:33.257770061 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:33.377274036 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:44.336445093 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:44.455924034 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:44.892631054 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:13:44.945488930 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:45.005944014 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:13:45.125447989 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:14:01.164321899 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:14:01.283919096 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:14:01.721401930 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:14:01.773597002 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:14:01.821191072 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:14:01.940655947 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:14:17.148679018 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:14:17.268444061 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:14:17.704492092 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:14:17.758002996 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:14:17.784280062 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:14:17.903825045 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:14:33.258217096 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:14:33.377880096 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:14:33.814455032 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:14:33.867410898 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:14:33.913177967 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:14:34.032744884 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:14:49.742523909 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:14:49.863822937 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:14:50.300931931 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:14:50.351799011 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:14:50.406220913 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:14:50.525857925 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:15:05.633459091 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:15:05.753118038 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:15:06.190376043 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:15:06.242503881 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:15:06.281430960 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:15:06.401001930 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:15:21.945733070 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:15:22.065335989 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:15:22.501754045 CET	6666	49711	18.167.52.240	192.168.2.6
Dec 27, 2024 09:15:22.554995060 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:15:22.646748066 CET	49711	6666	192.168.2.6	18.167.52.240
Dec 27, 2024 09:15:22.766292095 CET	6666	49711	18.167.52.240	192.168.2.6

Target ID:	0
Start time:	03:13:19
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\5935c1f1a7da8e42028da77013b80635afdd605866569.exe"
Imagebase:	0x7ff7eaf00000
File size:	133'632 bytes
MD5 hash:	50656C1C5404FE2FD6981B05A2225251
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	68.7%
Signature Coverage:	32.7%
Total number of Nodes:	1321
Total number of Limit Nodes:	77

Executed Functions

Function 00007FF7EAF073D0 Relevance: 98.9, APIs: 31, Strings: 25, Instructions: 870stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7EAF072A0: lstrlenW.KERNEL32 ref: 00007FF7EAF072CF
Part of subcall function 00007FF7EAF072A0: lstrlenW.KERNEL32 ref: 00007FF7EAF072F0
Part of subcall function 00007FF7EAF072A0: lstrlenW.KERNEL32 ref: 00007FF7EAF072FC

lstrlenW.KERNEL32 ref: 00007FF7EAF07459
lstrlenW.KERNEL32 ref: 00007FF7EAF0746C
lstrlenW.KERNEL32 ref: 00007FF7EAF07548
lstrlenW.KERNEL32 ref: 00007FF7EAF0755B
lstrlenW.KERNEL32 ref: 00007FF7EAF07628
lstrlenW.KERNEL32 ref: 00007FF7EAF0763B
lstrlenW.KERNEL32 ref: 00007FF7EAF0774E
lstrlenW.KERNEL32 ref: 00007FF7EAF07761
lstrlenW.KERNEL32 ref: 00007FF7EAF07810
lstrlenW.KERNEL32 ref: 00007FF7EAF07823
lstrlenW.KERNEL32 ref: 00007FF7EAF078D0
lstrlenW.KERNEL32 ref: 00007FF7EAF078E3
lstrlenW.KERNEL32 ref: 00007FF7EAF07990
lstrlenW.KERNEL32 ref: 00007FF7EAF079A3
lstrlenW.KERNEL32 ref: 00007FF7EAF07A50
lstrlenW.KERNEL32 ref: 00007FF7EAF07A63
lstrlenW.KERNEL32 ref: 00007FF7EAF07B10
lstrlenW.KERNEL32 ref: 00007FF7EAF07B23
lstrlenW.KERNEL32 ref: 00007FF7EAF07BD0
lstrlenW.KERNEL32 ref: 00007FF7EAF07BE3
lstrlenW.KERNEL32 ref: 00007FF7EAF07C90
lstrlenW.KERNEL32 ref: 00007FF7EAF07CA3
RegOpenKeyExW.KERNEL32 ref: 00007FF7EAF07D81
RegQueryValueExW.KERNEL32 ref: 00007FF7EAF07DB5
RegQueryValueExW.ADVAPI32 ref: 00007FF7EAF07DFC
lstrlenW.KERNEL32 ref: 00007FF7EAF07E31
lstrlenW.KERNEL32 ref: 00007FF7EAF07E3D
lstrlenW.KERNEL32 ref: 00007FF7EAF07EF7
lstrlenW.KERNEL32 ref: 00007FF7EAF07F0A
lstrlenW.KERNEL32 ref: 00007FF7EAF07FFC
lstrlenW.KERNEL32 ref: 00007FF7EAF08008

Strings

sx:, xrefs: 00007FF7EAF07816
IpDate, xrefs: 00007FF7EAF07DA2, 00007FF7EAF07DED
p3:, xrefs: 00007FF7EAF07600, 00007FF7EAF07FD4
t3:, xrefs: 00007FF7EAF0762E
t1:, xrefs: 00007FF7EAF0745F
o2:, xrefs: 00007FF7EAF07536, 00007FF7EAF07EE5
Console, xrefs: 00007FF7EAF07D55
dd:, xrefs: 00007FF7EAF076E4
p1:, xrefs: 00007FF7EAF07431, 00007FF7EAF07E09
bb:, xrefs: 00007FF7EAF07726
kl:, xrefs: 00007FF7EAF07BD6
bd:, xrefs: 00007FF7EAF07C96
t2:, xrefs: 00007FF7EAF0754E, 00007FF7EAF07EFD
fz:, xrefs: 00007FF7EAF07710
cl:, xrefs: 00007FF7EAF076FA
|p1:18.167.52.240|o1:6666|t1:1|p2:18.167.52.240|o2:8888|t2:1|p3:127.0.0.1|o3:80|t3:1|dd:1|cl:1|fz:, xrefs: 00007FF7EAF073FC
o1:, xrefs: 00007FF7EAF07447, 00007FF7EAF07E1F
jp:, xrefs: 00007FF7EAF07754
bz:, xrefs: 00007FF7EAF0773C
dl:, xrefs: 00007FF7EAF07A56
ll:, xrefs: 00007FF7EAF07996
sh:, xrefs: 00007FF7EAF07B16
p2:, xrefs: 00007FF7EAF07520, 00007FF7EAF07ECF
bh:, xrefs: 00007FF7EAF078D6
o3:, xrefs: 00007FF7EAF07616, 00007FF7EAF07FEA

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: lstrlen$QueryValue$Open
String ID: Console$IpDate$bb:$bd:$bh:$bz:$cl:$dd:$dl:$fz:$jp:$kl:$ll:$o1:$o2:$o3:$p1:$p2:$p3:$sh:$sx:$t1:$t2:$t3:$|p1:18.167.52.240|o1:6666|t1:1|p2:18.167.52.240|o2:8888|t2:1|p3:127.0.0.1|o3:80|t3:1|dd:1|cl:1|fz:
API String ID: 1772312705-1842159516
Opcode ID: e7c24950faba3f9ac85f5f069f5f95afb0107786a1c82c81ace9b637109b25c1
Instruction ID: 6cc1d33fd0f8a2d28dc61fb577e4f503f088f1b74fdbe13e34014b29340081ff
Opcode Fuzzy Hash: e7c24950faba3f9ac85f5f069f5f95afb0107786a1c82c81ace9b637109b25c1
Instruction Fuzzy Hash: 7A720361E0995A8AFB21BB14A4847F8F7A1FF54788FC090F3C90E06691EE7CE546C761

Function 028D67A0 Relevance: 93.1, APIs: 37, Strings: 16, Instructions: 394
registrystringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 028E55F8: malloc.LIBCMT ref: 028E5612

gethostname.WS2_32 ref: 028D6851
gethostbyname.WS2_32 ref: 028D685E
inet_ntoa.WS2_32 ref: 028D687C

Part of subcall function 028E6574: _errno.LIBCMT ref: 028E6592
Part of subcall function 028E6574: _invalid_parameter_noinfo.LIBCMT ref: 028E659E

Part of subcall function 028E6574: _errno.LIBCMT ref: 028E65E0

inet_ntoa.WS2_32 ref: 028D68CD
MultiByteToWideChar.KERNEL32 ref: 028D692A
MultiByteToWideChar.KERNEL32 ref: 028D694C
GetLastInputInfo.USER32 ref: 028D695F
GetTickCount.KERNEL32 ref: 028D6965
wsprintfW.USER32 ref: 028D6999
MultiByteToWideChar.KERNEL32 ref: 028D69B8
MultiByteToWideChar.KERNEL32 ref: 028D69DD
GetSystemInfo.KERNEL32 ref: 028D6A15
wsprintfW.USER32 ref: 028D6A2D
GetForegroundWindow.USER32 ref: 028D6A52
GetWindowTextW.USER32 ref: 028D6A6D
lstrlenW.KERNEL32 ref: 028D6A7A
lstrlenW.KERNEL32 ref: 028D6AE9
RegOpenKeyExW.ADVAPI32 ref: 028D6B51
RegQueryValueExW.ADVAPI32 ref: 028D6B8F
RegCloseKey.ADVAPI32 ref: 028D6BB4
GetLocalTime.KERNEL32 ref: 028D6BCC
wsprintfW.USER32 ref: 028D6C0E
lstrlenW.KERNEL32 ref: 028D6C1B
RegSetValueExW.ADVAPI32 ref: 028D6C48
RegCloseKey.ADVAPI32 ref: 028D6C6D
GetModuleHandleW.KERNEL32 ref: 028D6C94
GetProcAddress.KERNEL32 ref: 028D6CA4
GetNativeSystemInfo.KERNEL32 ref: 028D6CB3
GetSystemInfo.KERNEL32 ref: 028D6CB7
wsprintfW.USER32 ref: 028D6D00
GetCurrentProcessId.KERNEL32 ref: 028D6D0E
GetTickCount.KERNEL32 ref: 028D6D89
_localtime64.LIBCMT ref: 028D6DB9
wsprintfW.USER32 ref: 028D6E05
GetLocaleInfoW.KERNEL32 ref: 028D6E20
GetSystemDirectoryW.KERNEL32 ref: 028D6E32
GetCurrentHwProfileW.ADVAPI32 ref: 028D6E3C

Strings

d, xrefs: 028D6B82
X64, xrefs: 028D6E77
INSTALLTIME, xrefs: 028D6B69, 028D6C26
1.0, xrefs: 028D6AD1
AppEvents, xrefs: 028D6A85
X64 %s, xrefs: 028D6CF9
2024.12.22, xrefs: 028D6B0A
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 028D6BFB
REMARK, xrefs: 028D6AF6
%d min, xrefs: 028D6992
GetNativeSystemInfo, xrefs: 028D6C9A
kernel32.dll, xrefs: 028D6C75
x64, xrefs: 028D6CDE
GROUP, xrefs: 028D6A9A
Network, xrefs: 028D6A8C
x86, xrefs: 028D6CE7

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Infowsprintf$ByteCharMultiSystemWide$lstrlen$CloseCountCurrentTickValueWindow_errnoinet_ntoa$AddressDirectoryForegroundHandleInputLastLocalLocaleModuleNativeOpenProcProcessProfileQueryTextTime_invalid_parameter_noinfo_localtime64gethostbynamegethostnamemalloc
String ID: %4d.%2d.%2d-%2d:%2d:%2d$%d min$1.0$2024.12.22$AppEvents$GROUP$GetNativeSystemInfo$INSTALLTIME$Network$REMARK$X64$X64 %s$d$kernel32.dll$x64$x86
API String ID: 2649121426-1201274903
Opcode ID: 2792e9292747eacc2d82a570bd3b44eff9c4a32ed52e924556e4200a2f871bce
Instruction ID: eddb3aa5c4f50c6142397b68f185af759814eef3bc4172fa8b6b04d68d2699ee
Opcode Fuzzy Hash: 2792e9292747eacc2d82a570bd3b44eff9c4a32ed52e924556e4200a2f871bce
Instruction Fuzzy Hash: EC12B33A301A8696EB64DF64E8443DD7375F784748F808126DB4E97BA8EF38C629C744

Function 028E1790 Relevance: 70.3, APIs: 27, Strings: 13, Instructions: 325
sleepregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32 ref: 028E17EF
LoadLibraryA.KERNEL32 ref: 028E181B
GetProcAddress.KERNEL32 ref: 028E182B
SetProcessMitigationPolicy.KERNELBASE ref: 028E1840
Sleep.KERNEL32 ref: 028E1856
CloseHandle.KERNEL32 ref: 028E1891
GetLocalTime.KERNEL32 ref: 028E18AC
wsprintfW.USER32 ref: 028E18FE
SetUnhandledExceptionFilter.KERNEL32 ref: 028E190B
CloseHandle.KERNEL32 ref: 028E1931
EnumWindows.USER32 ref: 028E1AAD
Sleep.KERNEL32 ref: 028E1AC5
EnumWindows.USER32 ref: 028E1ADC
Sleep.KERNEL32 ref: 028E1B1C
CreateEventA.KERNEL32 ref: 028E1B77
RegOpenKeyExW.ADVAPI32 ref: 028E1BF0

Part of subcall function 028DFE20: RegQueryInfoKeyW.ADVAPI32 ref: 028DFE96
Part of subcall function 028DFE20: RegEnumValueW.ADVAPI32 ref: 028DFF47

Sleep.KERNEL32 ref: 028E1C25
RegOpenKeyExW.ADVAPI32 ref: 028E1C5B
RegQueryValueExW.ADVAPI32 ref: 028E1C8A
Sleep.KERNEL32 ref: 028E1D0E
WaitForSingleObject.KERNEL32 ref: 028E1D3F
CloseHandle.KERNEL32 ref: 028E1D48
Sleep.KERNEL32 ref: 028E1D53
WaitForSingleObject.KERNEL32 ref: 028E1D78
CloseHandle.KERNEL32 ref: 028E1D81
Sleep.KERNEL32 ref: 028E1D9B
CloseHandle.KERNEL32 ref: 028E1DB7

Strings

kernel32.dll, xrefs: 028E1814
SetProcessMitigationPolicy, xrefs: 028E1824
IpDatespecial, xrefs: 028E1C7C
8888, xrefs: 028E19D6
6666, xrefs: 028E19B5, 028E19E2, 028E1A48, 028E1AF3, 028E1B33
18.167.52.240, xrefs: 028E199D
Console, xrefs: 028E1C4D
6666, xrefs: 028E19A9
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 028E18F0
127.0.0.1, xrefs: 028E1A24
18.167.52.240, xrefs: 028E198D, 028E1A30, 028E1B02, 028E1B9F
Console\1, xrefs: 028E1BE2
18.167.52.240, xrefs: 028E19CA

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Sleep$CloseHandle$Enum$ObjectOpenQuerySingleValueWaitWindows$AddressCreateEventExceptionFilterInfoLibraryLoadLocalMitigationPolicyProcProcessTimeUnhandledVersionwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$127.0.0.1$18.167.52.240$18.167.52.240$18.167.52.240$6666$6666$8888$Console$Console\1$IpDatespecial$SetProcessMitigationPolicy$kernel32.dll
API String ID: 1083268199-361133965
Opcode ID: bdb9c4e33c25981459183bdd5fcad290da9cd96111aafd0d8ab5f1457d56a297
Instruction ID: 9ea2214b54fb232cbf4c8a1dbc52b07f720d3cda9fd541c001667de20640a618
Opcode Fuzzy Hash: bdb9c4e33c25981459183bdd5fcad290da9cd96111aafd0d8ab5f1457d56a297
Instruction Fuzzy Hash: 2CF1823E611B81C6EB60EF26E84839933B5F795749F808126DA4E87BA4DF3CC558CB44

Function 028E2280 Relevance: 51.0, APIs: 18, Strings: 11, Instructions: 223
stringclipboardsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 028E2308
SleepEx.KERNEL32 ref: 028E230E
GetTickCount.KERNEL32 ref: 028E2325
OpenClipboard.USER32 ref: 028E2333
GetClipboardData.USER32 ref: 028E233E
GlobalSize.KERNEL32 ref: 028E2353
GlobalLock.KERNEL32 ref: 028E2360
wsprintfW.USER32 ref: 028E23BE
GlobalUnlock.KERNEL32 ref: 028E23E3
CloseClipboard.USER32 ref: 028E23F0
GetKeyState.USER32 ref: 028E2485
lstrlenW.KERNEL32 ref: 028E24DF
lstrlenW.KERNEL32 ref: 028E24FF
lstrlenW.KERNEL32 ref: 028E2527
wsprintfW.USER32 ref: 028E254D
wsprintfW.USER32 ref: 028E256C
wsprintfW.USER32 ref: 028E259F
lstrlenW.KERNEL32 ref: 028E25ED

Strings

[, xrefs: 028E23AF
5, xrefs: 028E24B8
f, xrefs: 028E25B9
), xrefs: 028E24AF
9, xrefs: 028E247D
%s%s, xrefs: 028E2540
5, xrefs: 028E2583
), xrefs: 028E257E
%s%s, xrefs: 028E2558
%s%s, xrefs: 028E258B
[esc], xrefs: 028E22F5

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: lstrlenwsprintf$ClipboardGlobal$Sleep$CloseCountDataLockOpenSizeStateTickUnlock
String ID: [$%s%s$%s%s$%s%s$)$)$5$5$9$[esc]$f
API String ID: 1110909968-2084089848
Opcode ID: fd62010aee9e1f65e8bc601fa6e7217b611779bc7b81e03675f5539e201a9306
Instruction ID: 153ce50ad5f7fe6283ea9c001ee957d73cbe862a242e63c9b0f9a5db5bfeab94
Opcode Fuzzy Hash: fd62010aee9e1f65e8bc601fa6e7217b611779bc7b81e03675f5539e201a9306
Instruction Fuzzy Hash: 9E91B13D610B4186EF54DF25EA683A933A9FB46B88F448025DE4F977A8DF38C255C740

Function 00007FF7EAF06860 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 213
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32 ref: 00007FF7EAF068C7
RegQueryValueExW.ADVAPI32 ref: 00007FF7EAF068FC
RegQueryValueExW.ADVAPI32 ref: 00007FF7EAF06961
VirtualAlloc.KERNEL32 ref: 00007FF7EAF06993
RegCloseKey.ADVAPI32 ref: 00007FF7EAF069C4
VirtualFree.KERNEL32 ref: 00007FF7EAF06A10
VirtualAlloc.KERNEL32 ref: 00007FF7EAF06B4E
RegCreateKeyW.ADVAPI32 ref: 00007FF7EAF06BD5
RegDeleteValueW.KERNEL32 ref: 00007FF7EAF06BED
RegSetValueExW.KERNEL32 ref: 00007FF7EAF06C13
RegCloseKey.KERNEL32 ref: 00007FF7EAF06C20
SleepEx.KERNEL32 ref: 00007FF7EAF06C55

Strings

., xrefs: 00007FF7EAF06A60
c9cb53ecfed9c0deec10651b37c64103, xrefs: 00007FF7EAF069CE
Console\1, xrefs: 00007FF7EAF06899, 00007FF7EAF06BC7
d33f351a4aeea5e608853d1a56661059, xrefs: 00007FF7EAF068ED, 00007FF7EAF06952, 00007FF7EAF06BE6, 00007FF7EAF06BFA
l, xrefs: 00007FF7EAF06A72
n, xrefs: 00007FF7EAF06A84

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Value$Virtual$AllocCloseQuery$CreateDeleteFreeOpenSleep
String ID: .$Console\1$c9cb53ecfed9c0deec10651b37c64103$d33f351a4aeea5e608853d1a56661059$l$n
API String ID: 544495302-326781106
Opcode ID: 5694b7b157a9f67dd129e53dc4729af0b4b0346885f9078a4b7e41d62d996c72
Instruction ID: 59269e1a5e7d958d70f302719a373c205d25e2be30ccdbe2bac9da2fa7963d3c
Opcode Fuzzy Hash: 5694b7b157a9f67dd129e53dc4729af0b4b0346885f9078a4b7e41d62d996c72
Instruction Fuzzy Hash: A3B19031B18B8285FB60AF21E8807E9B760FF89788F8040B6DA4D47A95DF7DD104C766

Function 00007FF7EAF03390 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 168
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32 ref: 00007FF7EAF033C1
timeGetTime.WINMM ref: 00007FF7EAF033D0
socket.WS2_32 ref: 00007FF7EAF03405
lstrlenW.KERNEL32 ref: 00007FF7EAF03432
WideCharToMultiByte.KERNEL32 ref: 00007FF7EAF03456
lstrlenW.KERNEL32 ref: 00007FF7EAF03470
WideCharToMultiByte.KERNEL32 ref: 00007FF7EAF03493
gethostbyname.WS2_32 ref: 00007FF7EAF034A0
htons.WS2_32 ref: 00007FF7EAF034C8
connect.WS2_32 ref: 00007FF7EAF034F2

Strings

4 =X, xrefs: 00007FF7EAF033A2
0u, xrefs: 00007FF7EAF03575

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$EventResetTimeconnectgethostbynamehtonssockettime
String ID: 0u$4 =X
API String ID: 950253168-1377006627
Opcode ID: 1ebe5ea999ada77dc3c15e7a43abbca18abc7bbb5c037e0ba44f4efe06a9ee2b
Instruction ID: 0ab9432e5e24e7f7f676910236bd05c2df657e2875342dfc8f7a32930fa03830
Opcode Fuzzy Hash: 1ebe5ea999ada77dc3c15e7a43abbca18abc7bbb5c037e0ba44f4efe06a9ee2b
Instruction Fuzzy Hash: 08814D72608B8186E720DF61F4803AAF7A5FB88B98F404276EB8E47B54CF3CD1458B45

Function 028D8220 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 117
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 028D8255
wsprintfW.USER32 ref: 028D826C

Part of subcall function 028D8040: GetCurrentProcessId.KERNEL32 ref: 028D805D
Part of subcall function 028D8040: OpenProcess.KERNEL32 ref: 028D806D
Part of subcall function 028D8040: OpenProcessToken.ADVAPI32 ref: 028D8095
Part of subcall function 028D8040: CloseHandle.KERNEL32 ref: 028D80A2

GetVersionExW.KERNEL32 ref: 028D829B
GetCurrentProcess.KERNEL32 ref: 028D82C4
OpenProcessToken.ADVAPI32 ref: 028D82D5
GetTokenInformation.ADVAPI32 ref: 028D82FF
GetLastError.KERNEL32 ref: 028D8309
LocalAlloc.KERNEL32 ref: 028D8323
GetTokenInformation.ADVAPI32 ref: 028D834B
GetSidSubAuthorityCount.ADVAPI32 ref: 028D8359
GetSidSubAuthority.ADVAPI32 ref: 028D8368
LocalFree.KERNEL32 ref: 028D8373
CloseHandle.KERNEL32 ref: 028D8386
wsprintfW.USER32 ref: 028D83E5

Strings

NO/, xrefs: 028D83CB
None/%s, xrefs: 028D83D4
-N/, xrefs: 028D83C2

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Process$Token$CurrentOpen$AuthorityCloseHandleInformationLocalwsprintf$AllocCountErrorFreeLastVersion
String ID: -N/$NO/$None/%s
API String ID: 4155081256-3095023699
Opcode ID: 156903efc4c30b3064e602a5478d3855fb76486e49a3ac96cbacddef7d45d756
Instruction ID: 714de6ce04b94903219604189be11887101f45babfe35a51cda734f1348eb735
Opcode Fuzzy Hash: 156903efc4c30b3064e602a5478d3855fb76486e49a3ac96cbacddef7d45d756
Instruction Fuzzy Hash: 9351503D214B85C6EB64DF11F99879A7360F799B88F485025EB4E87B58DF38C149CB00

Function 028D3370 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 168
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32 ref: 028D33A1
timeGetTime.WINMM ref: 028D33B0
socket.WS2_32 ref: 028D33E5
lstrlenW.KERNEL32 ref: 028D3412
WideCharToMultiByte.KERNEL32 ref: 028D3436
lstrlenW.KERNEL32 ref: 028D3450
WideCharToMultiByte.KERNEL32 ref: 028D3473
gethostbyname.WS2_32 ref: 028D3480
htons.WS2_32 ref: 028D34A8
connect.WS2_32 ref: 028D34D2

Strings

0u, xrefs: 028D3555

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$EventResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 950253168-3203441087
Opcode ID: 2ae06a9d799ad217e1939a4cc30cfbc6fb037babddfd49fabee5cbe1934be173
Instruction ID: 3f790538cb259051bb6372313de50cfec0007b17b4b619c12d450a24af80c0d5
Opcode Fuzzy Hash: 2ae06a9d799ad217e1939a4cc30cfbc6fb037babddfd49fabee5cbe1934be173
Instruction Fuzzy Hash: 21715C7A204B8186DB60CF65F44435AB7A5F788B98F008129EB8E57FA8CF3CD149CB04

Function 028F02A4 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 292
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.LIBCMT ref: 028F02CF

Part of subcall function 028F2F3C: _amsg_exit.LIBCMT ref: 028F2F66

_get_daylight.LIBCMT ref: 028F02E5

Part of subcall function 028F1040: _errno.LIBCMT ref: 028F1049
Part of subcall function 028F1040: _invalid_parameter_noinfo.LIBCMT ref: 028F1054

_get_daylight.LIBCMT ref: 028F02FA

Part of subcall function 028F0FE0: _errno.LIBCMT ref: 028F0FE9
Part of subcall function 028F0FE0: _invalid_parameter_noinfo.LIBCMT ref: 028F0FF4

_get_daylight.LIBCMT ref: 028F030F

Part of subcall function 028F1010: _errno.LIBCMT ref: 028F1019
Part of subcall function 028F1010: _invalid_parameter_noinfo.LIBCMT ref: 028F1024

___lc_codepage_func.LIBCMT ref: 028F031C

Part of subcall function 028EA9F0: _getptd.LIBCMT ref: 028EA9F4

Part of subcall function 028F7890: __wtomb_environ.LIBCMT ref: 028F78C0

free.LIBCMT ref: 028F038D

Part of subcall function 028E5500: HeapFree.KERNEL32 ref: 028E5516
Part of subcall function 028E5500: _errno.LIBCMT ref: 028E5520
Part of subcall function 028E5500: GetLastError.KERNEL32 ref: 028E5528

free.LIBCMT ref: 028F03F6
GetTimeZoneInformation.KERNEL32 ref: 028F0409
WideCharToMultiByte.KERNEL32 ref: 028F04BF
WideCharToMultiByte.KERNEL32 ref: 028F0512

Strings

Eastern Summer Time, xrefs: 028F0507
Eastern Standard Time, xrefs: 028F04B4

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$ByteCharMultiWidefree$ErrorFreeHeapInformationLastTimeZone___lc_codepage_func__wtomb_environ_amsg_exit_getptd_lock
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 2532449802-239921721
Opcode ID: f91c17d29854aadb682cdbf4e47c338baa74f186de59bed70dfdc49f14942dd6
Instruction ID: da20429174381401e5fd22059d06c80bbadaacd88bdec3bb80664c38a57f988e
Opcode Fuzzy Hash: f91c17d29854aadb682cdbf4e47c338baa74f186de59bed70dfdc49f14942dd6
Instruction Fuzzy Hash: 15B1E43E2043908EDB64DF29E49475A7BA6F7C5784F818125DB8ED3B6ADB38C412CB01

Function 028D77A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 199
stringregistrycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32 ref: 028D785B
lstrcatW.KERNEL32 ref: 028D786B

Part of subcall function 028DAB60: GetCurrentProcess.KERNEL32 ref: 028DAB77
Part of subcall function 028DAB60: OpenProcessToken.ADVAPI32 ref: 028DAB88
Part of subcall function 028DAB60: LookupPrivilegeValueW.ADVAPI32 ref: 028DABA8
Part of subcall function 028DAB60: AdjustTokenPrivileges.ADVAPI32 ref: 028DABD0
Part of subcall function 028DAB60: GetLastError.KERNEL32 ref: 028DABD6
Part of subcall function 028DAB60: CloseHandle.KERNEL32 ref: 028DABE6

Part of subcall function 028DA860: CreateToolhelp32Snapshot.KERNEL32 ref: 028DA897

CoCreateInstance.OLE32 ref: 028D78B6
wsprintfW.USER32 ref: 028D79B3
RegOpenKeyExW.ADVAPI32 ref: 028D79DA
RegQueryValueExW.ADVAPI32 ref: 028D7A28
lstrcatW.KERNEL32 ref: 028D7A3C
lstrcatW.KERNEL32 ref: 028D7A4C
RegCloseKey.ADVAPI32 ref: 028D7A56

Part of subcall function 028D76B0: CreateToolhelp32Snapshot.KERNEL32 ref: 028D76F1
Part of subcall function 028D76B0: Process32FirstW.KERNEL32 ref: 028D7710
Part of subcall function 028D76B0: Process32NextW.KERNEL32 ref: 028D7750
Part of subcall function 028D76B0: CloseHandle.KERNEL32 ref: 028D775D

lstrlenW.KERNEL32 ref: 028D7A8D
lstrcatW.KERNEL32 ref: 028D7AA1

Part of subcall function 028DA7B0: GetModuleHandleA.KERNEL32 ref: 028DA7BD
Part of subcall function 028DA7B0: GetProcAddress.KERNEL32 ref: 028DA7D5
Part of subcall function 028DA7B0: GetProcAddress.KERNEL32 ref: 028DA7EC
Part of subcall function 028DA7B0: GetProcAddress.KERNEL32 ref: 028DA803

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 028D79A8

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: lstrcat$AddressCloseCreateHandleProc$OpenProcessProcess32SnapshotTokenToolhelp32Value$AdjustCurrentErrorFirstInstanceLastLookupModuleNextPrivilegePrivilegesQuerylstrlenwsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}
API String ID: 1729154408-4035668053
Opcode ID: 2cc4f5f27ffffb8a2ccb8d492bd126fd03bcc1ac993aa5b4277202d1db652280
Instruction ID: 0bd3a492f5749de69de172fcc131eaba136dc17c27a6670d490a5cb707e01713
Opcode Fuzzy Hash: 2cc4f5f27ffffb8a2ccb8d492bd126fd03bcc1ac993aa5b4277202d1db652280
Instruction Fuzzy Hash: C891683A700B808AEB10DF6AE84479D7BB1F789B98F504126DE4D97B68DF38C559CB40

Function 028D7EA0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 102
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 028D66B0: SysFreeString.OLEAUT32 ref: 028D670D
Part of subcall function 028D66B0: SysAllocString.OLEAUT32 ref: 028D6759

GetTokenInformation.ADVAPI32 ref: 028D7F16
GetLastError.KERNEL32 ref: 028D7F20
GetProcessHeap.KERNEL32 ref: 028D7F33
HeapAlloc.KERNEL32 ref: 028D7F42
GetTokenInformation.ADVAPI32 ref: 028D7F6E
LookupAccountSidW.ADVAPI32 ref: 028D7FAC
GetLastError.KERNEL32 ref: 028D7FB6
GetProcessHeap.KERNEL32 ref: 028D8006
HeapFree.KERNEL32 ref: 028D8014

Strings

NONE_MAPPED, xrefs: 028D7FC3
Network, xrefs: 028D7EA0

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Heap$AllocErrorFreeInformationLastProcessStringToken$AccountLookup
String ID: NONE_MAPPED$Network
API String ID: 1972796461-3150097737
Opcode ID: 8113f941a4de608807758112df11e72a60d86c4884b026946c1f4e66eb8542e5
Instruction ID: 543f31a01dab9d65c7cbb1f5c6302f93589262cb64e32016781f3554d3abfc3d
Opcode Fuzzy Hash: 8113f941a4de608807758112df11e72a60d86c4884b026946c1f4e66eb8542e5
Instruction Fuzzy Hash: B741A03E305A8186EB209F15F84479AB3A5FB99B99F848135DB4D87B18EF3DC449CB00

Function 00007FF7EAF06F70 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 169
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32 ref: 00007FF7EAF06FB0
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF7EAF07077
CreateEventW.KERNEL32 ref: 00007FF7EAF070B8
CreateEventW.KERNEL32 ref: 00007FF7EAF070E6
CreateEventW.KERNEL32 ref: 00007FF7EAF07114
timeGetTime.WINMM ref: 00007FF7EAF0722A
CreateEventW.KERNEL32 ref: 00007FF7EAF0723F
CreateEventW.KERNEL32 ref: 00007FF7EAF07253

Strings

<, xrefs: 00007FF7EAF06FFE
<, xrefs: 00007FF7EAF06FF7

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CreateEvent$CountCriticalInitializeSectionSpinTimetime
String ID: <$<
API String ID: 4111701721-213342407
Opcode ID: 203e18af1a8a4e1e889c7495eccf5284d8b72f4a964f0ba929df4dc58f6d7ff2
Instruction ID: c82acbb5b3ae07878f3187a9737be1121e786660947e1b2a089c3f44b9734236
Opcode Fuzzy Hash: 203e18af1a8a4e1e889c7495eccf5284d8b72f4a964f0ba929df4dc58f6d7ff2
Instruction Fuzzy Hash: A3818832611B9286F744AF30E8947AD37A9FB44F4CF48423AEE494B799CF788151CB61

Function 028D9BC0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 85stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 028D9C1C
lstrcmpiW.KERNEL32 ref: 028D9C5B
lstrcmpiW.KERNEL32 ref: 028D9C6F
QueryDosDeviceW.KERNEL32 ref: 028D9CA0
lstrlenW.KERNEL32 ref: 028D9CAF
lstrcpyW.KERNEL32 ref: 028D9CE3
lstrcpyW.KERNEL32 ref: 028D9D2E
lstrcatW.KERNEL32 ref: 028D9D3B

Strings

B:\, xrefs: 028D9C65
A:\, xrefs: 028D9C49

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: lstrcmpilstrcpy$DeviceDriveLogicalQueryStringslstrcatlstrlen
String ID: A:\$B:\
API String ID: 1889997506-1009255891
Opcode ID: 195c15b6208fbb33efc9ae23a30a98022802357f617ac369b918550c39e8a5e0
Instruction ID: a31f3c2bd46042f11cf8ee7185f17ee42c3ec63318bdd44f95e08a74f8175258
Opcode Fuzzy Hash: 195c15b6208fbb33efc9ae23a30a98022802357f617ac369b918550c39e8a5e0
Instruction Fuzzy Hash: 6A31AF6E304A85C5EB709B12E8443AF73A4F798B89F485121CE8E87B58EF3CC149CB04

Function 00007FF7EAF08580 Relevance: 15.0, APIs: 10, Instructions: 34threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7EAF0858B
GetConsoleWindow.KERNEL32 ref: 00007FF7EAF08591
ShowWindow.USER32 ref: 00007FF7EAF0859C
GetCurrentThreadId.KERNEL32 ref: 00007FF7EAF085A2
PostThreadMessageA.USER32 ref: 00007FF7EAF085B2
GetInputState.USER32 ref: 00007FF7EAF085B8

Part of subcall function 00007FF7EAF073D0: lstrlenW.KERNEL32 ref: 00007FF7EAF07459
Part of subcall function 00007FF7EAF073D0: lstrlenW.KERNEL32 ref: 00007FF7EAF0746C
Part of subcall function 00007FF7EAF073D0: lstrlenW.KERNEL32 ref: 00007FF7EAF07548
Part of subcall function 00007FF7EAF073D0: lstrlenW.KERNEL32 ref: 00007FF7EAF0755B

CreateThread.KERNEL32 ref: 00007FF7EAF085DE
WaitForSingleObject.KERNEL32 ref: 00007FF7EAF085F1
CloseHandle.KERNEL32 ref: 00007FF7EAF085FE
Sleep.KERNEL32 ref: 00007FF7EAF08609

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: lstrlen$Thread$Window$CloseConsoleCreateCurrentExceptionFilterHandleInputMessageObjectPostShowSingleSleepStateUnhandledWait
String ID:
API String ID: 3551332608-0
Opcode ID: 152ae417eb4b62f33c842a60702934fe7b1e65802cfc5c2bd98c8d5dbe26bc31
Instruction ID: 855d6742b6dde96cd836eb68a60f4ee2360ece0c6f11b01b194a9ee620fb55d6
Opcode Fuzzy Hash: 152ae417eb4b62f33c842a60702934fe7b1e65802cfc5c2bd98c8d5dbe26bc31
Instruction Fuzzy Hash: 93014C20E18A4282F714FB71BD197A9B3A1BFA8B15FC441F6D80E52171DE3CE40983A2

Function 028D8430 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32 ref: 028D849A
GetDiskFreeSpaceExW.KERNEL32 ref: 028D84BE
GlobalMemoryStatusEx.KERNEL32 ref: 028D8525

Strings

HDD:%d, xrefs: 028D8539
:, xrefs: 028D847E
@, xrefs: 028D84EE
%sFree%d Gb , xrefs: 028D8567

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: DiskDriveFreeGlobalMemorySpaceStatusType
String ID: %sFree%d Gb $:$@$HDD:%d
API String ID: 3475944273-3501811827
Opcode ID: 1e499d2353234789bc0f3bbbd974805f3cb9744872628ca8bd1c944a6ef7e3b2
Instruction ID: f2fbfcdbc9daa9a34c7c1bd9550c519b7e18d4a0dfc4e374f786c45fa6f306a1
Opcode Fuzzy Hash: 1e499d2353234789bc0f3bbbd974805f3cb9744872628ca8bd1c944a6ef7e3b2
Instruction Fuzzy Hash: EF31083A209B848AD760DB15F84478BB3A5F389798F905126EBCD83B18DF3CC556CB40

Function 028E1F2A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75keyboardfilesynchronizationCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32 ref: 028E1F35
ReleaseMutex.KERNEL32 ref: 028E1F42
DirectInput8Create.DINPUT8 ref: 028E1F63
GetTickCount.KERNEL32 ref: 028E201B
GetKeyState.USER32 ref: 028E202C

Strings

<, xrefs: 028E1FE6

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CountCreateDeleteDirectFileInput8MutexReleaseStateTick
String ID: <
API String ID: 2984771027-4251816714
Opcode ID: 794a973563893a6e02867e1dece6a2a631e052adb30d0c29cd87686f54a10446
Instruction ID: 7368ca2e7ddd73e44b026531f8b97dc0bf3ee2cceeecfbf10f5077e4ac610c61
Opcode Fuzzy Hash: 794a973563893a6e02867e1dece6a2a631e052adb30d0c29cd87686f54a10446
Instruction Fuzzy Hash: 50314939B00A4686EF008F26E48C3993768F785F99F404016CE9E87B65CF3EC499C740

Function 028E2140 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringtimeCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 028E216F
GetWindowTextW.USER32 ref: 028E218C
lstrlenW.KERNEL32 ref: 028E21C6
GetLocalTime.KERNEL32 ref: 028E21D5
wsprintfW.USER32 ref: 028E2225

Part of subcall function 028E2080: WaitForSingleObject.KERNEL32 ref: 028E2097
Part of subcall function 028E2080: CreateFileW.KERNEL32 ref: 028E20C9
Part of subcall function 028E2080: SetFilePointer.KERNEL32 ref: 028E20EE
Part of subcall function 028E2080: lstrlenW.KERNEL32 ref: 028E20F7
Part of subcall function 028E2080: WriteFile.KERNEL32 ref: 028E2115
Part of subcall function 028E2080: CloseHandle.KERNEL32 ref: 028E211E
Part of subcall function 028E2080: ReleaseMutex.KERNEL32 ref: 028E212B

Strings

[, xrefs: 028E221E

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: File$Windowlstrlen$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleTextTimeWaitWritewsprintf
String ID: [
API String ID: 3163932117-4056885943
Opcode ID: 30f4a5cc845f9885c17a13a4536afd42848a4aee3713c5614b34f0b927973e27
Instruction ID: 87d27cd73c2225579c029e1fa4b55790f48e05600d334183fe11b58de05273d0
Opcode Fuzzy Hash: 30f4a5cc845f9885c17a13a4536afd42848a4aee3713c5614b34f0b927973e27
Instruction Fuzzy Hash: 17317135618A42D5EB50DF56F85836AB3A6FBC4744F408025EA8E83A68EF7CC558CF40

Function 028D7150 Relevance: 7.6, APIs: 5, Instructions: 89processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 028D71B9
Process32FirstW.KERNEL32 ref: 028D71D8
Process32NextW.KERNEL32 ref: 028D720F
CloseHandle.KERNEL32 ref: 028D721C
CloseHandle.KERNEL32 ref: 028D7258

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 478adfaa53224f4c646a90ac3974a5860d44690c717c694f81840881146ffb29
Instruction ID: 3bfe4f5a7543a43ac91e71d806810abd8cb90502b1973d3693b3706b5f1f754b
Opcode Fuzzy Hash: 478adfaa53224f4c646a90ac3974a5860d44690c717c694f81840881146ffb29
Instruction Fuzzy Hash: 9A31856D314A8185DB60CB29E94836AB371FB44BA8F848325EE7A437D8EF38C559C700

Function 028D3670 Relevance: 7.6, APIs: 5, Instructions: 74networkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 028D3705
recv.WS2_32 ref: 028D372B
_errno.LIBCMT ref: 028D3737
_errno.LIBCMT ref: 028D3741
_errno.LIBCMT ref: 028D374E

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$recvselect
String ID:
API String ID: 4102763267-0
Opcode ID: 2fa3fcdfbfff1ada99c1fbd57706c81b73ce2c85aaf825a0551b3d147105e37e
Instruction ID: 632953dc3cbc476a90b03be7ae13a54637a6556378b96eedf677fa55e5c9c7e4
Opcode Fuzzy Hash: 2fa3fcdfbfff1ada99c1fbd57706c81b73ce2c85aaf825a0551b3d147105e37e
Instruction Fuzzy Hash: FB317FBE214AC082DB609B29E95876E73A1F789F88F445175CB5E87B58DF38C0488F06

Function 028D86F0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 377COMMON

Download Yara Rule

APIs

CreateDXGIFactory.DXGI ref: 028D8760

Strings

%s%s %d*%d , xrefs: 028D8BAD
vector<T> too long, xrefs: 028D88DF, 028D88EC, 028D8C33, 028D8C40
%s%s %d %d , xrefs: 028D8960

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CreateFactory
String ID: %s%s %d %d $%s%s %d*%d $vector<T> too long
API String ID: 1145517477-257307503
Opcode ID: fa8402bfd6ce440d6ff4b8cf1932907d5849ae49a8771a0e948cbd0e09370c9a
Instruction ID: 81ef9ec9ce8797f52247585b016118de99d82e43b1d435d315e81e4c53c5458f
Opcode Fuzzy Hash: fa8402bfd6ce440d6ff4b8cf1932907d5849ae49a8771a0e948cbd0e09370c9a
Instruction Fuzzy Hash: 22D1E57E715A8886DF10CF66E8442AE7361F744BE8F544621DE6E97B98DF38C44AC700

Function 028DF2E0 Relevance: 34.7, APIs: 23, Instructions: 201
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32 ref: 028DF32A
GlobalLock.KERNEL32 ref: 028DF336
GlobalUnlock.KERNEL32 ref: 028DF34D
CreateStreamOnHGlobal.OLE32 ref: 028DF362
EnterCriticalSection.KERNEL32 ref: 028DF3AB
LeaveCriticalSection.KERNEL32 ref: 028DF3BE
GdipCreateBitmapFromStream.GDIPLUS ref: 028DF3EE
GdipDisposeImage.GDIPLUS ref: 028DF405
GdipDisposeImage.GDIPLUS ref: 028DF423
CreateStreamOnHGlobal.OLE32 ref: 028DF442
GetHGlobalFromStream.OLE32 ref: 028DF46D
GlobalLock.KERNEL32 ref: 028DF478
GlobalFree.KERNEL32 ref: 028DF493
DeleteObject.GDI32 ref: 028DF598
EnterCriticalSection.KERNEL32 ref: 028DF5A5
EnterCriticalSection.KERNEL32 ref: 028DF5BA
GdiplusShutdown.GDIPLUS ref: 028DF5CC
LeaveCriticalSection.KERNEL32 ref: 028DF5E0
LeaveCriticalSection.KERNEL32 ref: 028DF5ED
GlobalFree.KERNEL32 ref: 028DF5F6

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Global$CriticalSection$Stream$CreateEnterGdipLeave$DisposeFreeFromImageLock$AllocBitmapDeleteGdiplusObjectShutdownUnlock
String ID:
API String ID: 562715702-0
Opcode ID: 6b4c91a67da076fc5ed7ed7d3bbb601d668363ccad180db4f24a8162a4e7ad9d
Instruction ID: 3dd616ae4adac2deffa9f164a10cea0af366f0c5f851d4bc6a091546009b6a69
Opcode Fuzzy Hash: 6b4c91a67da076fc5ed7ed7d3bbb601d668363ccad180db4f24a8162a4e7ad9d
Instruction Fuzzy Hash: FC91273A701B418AEB20DB65E95839D73B5F758BA8F004625CE5E97BA8DF38C01AC744

Function 028DCEB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GdipGetImageEncodersSize.GDIPLUS ref: 028DCEEE
malloc.LIBCMT ref: 028DCF5A
free.LIBCMT ref: 028DCF86
GdipGetImageEncoders.GDIPLUS ref: 028DCF9F
free.LIBCMT ref: 028DCFB6
free.LIBCMT ref: 028DD08B
GdipCreateBitmapFromScan0.GDIPLUS ref: 028DD0D2
GdipSaveImageToStream.GDIPLUS ref: 028DD0E9
GdipDisposeImage.GDIPLUS ref: 028DD0F6
free.LIBCMT ref: 028DD10B
GdipCreateBitmapFromHBITMAP.GDIPLUS ref: 028DD125
GdipSaveImageToStream.GDIPLUS ref: 028DD13C
GdipDisposeImage.GDIPLUS ref: 028DD149
free.LIBCMT ref: 028DD166
GdipDisposeImage.GDIPLUS ref: 028DD175
free.LIBCMT ref: 028DD186

Strings

&, xrefs: 028DD0BD

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Gdip$Image$free$Dispose$BitmapCreateEncodersFromSaveStream$Scan0Sizemalloc
String ID: &
API String ID: 1890951399-3042966939
Opcode ID: e0ed32bbd0eb4801e97fe57168b3cc2a34007f8c0d42ba3f378bbdf0d85cf80f
Instruction ID: 2f479f38dcb002b6bce0f095927ba6ad7103d0d5bd7e578bf8679ccd7041cdc8
Opcode Fuzzy Hash: e0ed32bbd0eb4801e97fe57168b3cc2a34007f8c0d42ba3f378bbdf0d85cf80f
Instruction Fuzzy Hash: 0771B32F300A8196DF149F35D9447E96365FB59BACF888622DF1D8BB94EF28C549C300

Function 028DCA90 Relevance: 27.3, APIs: 18, Instructions: 283
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GdipGetImagePixelFormat.GDIPLUS ref: 028DCACF
GdipGetImageHeight.GDIPLUS ref: 028DCB38
GdipGetImageWidth.GDIPLUS ref: 028DCB56
GdipGetImagePaletteSize.GDIPLUS ref: 028DCB9C
malloc.LIBCMT ref: 028DCC02

Part of subcall function 028E5540: _FF_MSGBANNER.LIBCMT ref: 028E5570
Part of subcall function 028E5540: HeapAlloc.KERNEL32 ref: 028E5595
Part of subcall function 028E5540: _callnewh.LIBCMT ref: 028E55AE
Part of subcall function 028E5540: _errno.LIBCMT ref: 028E55B9
Part of subcall function 028E5540: _errno.LIBCMT ref: 028E55C4

free.LIBCMT ref: 028DCC2B
GdipGetImagePalette.GDIPLUS ref: 028DCC4A
GdipBitmapLockBits.GDIPLUS ref: 028DCD07
free.LIBCMT ref: 028DCD26
GdipCreateBitmapFromScan0.GDIPLUS ref: 028DCE1F
GdipGetImageGraphicsContext.GDIPLUS ref: 028DCE34
GdipDrawImageI.GDIPLUS ref: 028DCE4C
GdipDeleteGraphics.GDIPLUS ref: 028DCE55
GdipDisposeImage.GDIPLUS ref: 028DCE5E
free.LIBCMT ref: 028DCD46

Part of subcall function 028E5500: HeapFree.KERNEL32 ref: 028E5516
Part of subcall function 028E5500: _errno.LIBCMT ref: 028E5520
Part of subcall function 028E5500: GetLastError.KERNEL32 ref: 028E5528

memcpy_s.LIBCMT ref: 028DCD8C
GdipBitmapUnlockBits.GDIPLUS ref: 028DCDC8
free.LIBCMT ref: 028DCE76

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Gdip$Image$free$Bitmap_errno$BitsGraphicsHeapPalette$AllocContextCreateDeleteDisposeDrawErrorFormatFreeFromHeightLastLockPixelScan0SizeUnlockWidth_callnewhmallocmemcpy_s
String ID:
API String ID: 1886978121-0
Opcode ID: ccb23ed171d4cd8e54f1606d82e2a7903b7ec18b8e2fd00ef13bc64af06bfe3b
Instruction ID: b9a9855064bb60bef8d4957d92f2720e1d0beefb884dd9b38318e0f400458601
Opcode Fuzzy Hash: ccb23ed171d4cd8e54f1606d82e2a7903b7ec18b8e2fd00ef13bc64af06bfe3b
Instruction Fuzzy Hash: 12B159BE3006808ADB20DF25D8487993BA5FB48B9CF458926DF1ACBB54DF38D549C744

Function 028D8D20 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 82
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 028D8D35
GetProcAddress.KERNEL32 ref: 028D8D51
FreeLibrary.KERNEL32 ref: 028D8E7D

Part of subcall function 028E57BC: _vswprintf_s_l.LIBCMT ref: 028E57D6

Part of subcall function 028D8CA0: GetModuleHandleW.KERNEL32 ref: 028D8CCB
Part of subcall function 028D8CA0: GetProcAddress.KERNEL32 ref: 028D8CDB
Part of subcall function 028D8CA0: GetNativeSystemInfo.KERNEL32 ref: 028D8CEB

RegOpenKeyExW.ADVAPI32 ref: 028D8E17
RegQueryValueExW.ADVAPI32 ref: 028D8E42
RegCloseKey.ADVAPI32 ref: 028D8E67

Strings

RtlGetNtVersionNumbers, xrefs: 028D8D47
ntdll.dll, xrefs: 028D8D2B
%d.%d.%d, xrefs: 028D8D96
ProductName, xrefs: 028D8E2E
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 028D8DF6

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: AddressLibraryProc$CloseFreeHandleInfoLoadModuleNativeOpenQuerySystemValue_vswprintf_s_l
String ID: %d.%d.%d$ProductName$RtlGetNtVersionNumbers$SOFTWARE\Microsoft\Windows NT\CurrentVersion$ntdll.dll
API String ID: 1477497710-3190923360
Opcode ID: 9a6095186e03b76efae6a3eae714c10ad3fa5ee1170803ccf761aa8016e5e9c0
Instruction ID: 02901b4eb8dcb7e6ec858c28d3b8c424951f5da4cac6ed3ff5d2e2f035cffaa4
Opcode Fuzzy Hash: 9a6095186e03b76efae6a3eae714c10ad3fa5ee1170803ccf761aa8016e5e9c0
Instruction Fuzzy Hash: F931C23A21678486DB60DB21F94475A73A0F7C9BA8F445221EF9E47B98EF3CC549CB00

Function 00007FF7EAF080E0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 140synchronizationCOMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 00007FF7EAF08114

Part of subcall function 00007FF7EAF09128: malloc.LIBCMT ref: 00007FF7EAF09142

SleepEx.KERNEL32 ref: 00007FF7EAF0828D
CreateEventA.KERNEL32 ref: 00007FF7EAF082E4
SleepEx.KERNEL32 ref: 00007FF7EAF08333
WaitForSingleObject.KERNEL32 ref: 00007FF7EAF0833F

Part of subcall function 00007FF7EAF03230: WSAStartup.WS2_32 ref: 00007FF7EAF032AF
Part of subcall function 00007FF7EAF03230: CreateEventW.KERNEL32 ref: 00007FF7EAF032C0

Part of subcall function 00007FF7EAF092D0: _errno.LIBCMT ref: 00007FF7EAF092EF
Part of subcall function 00007FF7EAF092D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF092FB

Part of subcall function 00007FF7EAF092D0: _errno.LIBCMT ref: 00007FF7EAF0932B

CloseHandle.KERNEL32 ref: 00007FF7EAF08350
CloseHandle.KERNEL32 ref: 00007FF7EAF08360

Strings

18.167.52.240, xrefs: 00007FF7EAF0817E, 00007FF7EAF08221, 00007FF7EAF082A5
6666, xrefs: 00007FF7EAF081A6, 00007FF7EAF081D3, 00007FF7EAF08239, 00007FF7EAF08296

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Sleep$CloseCreateEventHandle_errno$ObjectSingleStartupWait_invalid_parameter_noinfomalloc
String ID: 18.167.52.240$6666
API String ID: 407272786-3645304592
Opcode ID: 13c9adc974c42543c4138414809006d942cbbcd1fe96e939a7d0cf87f8cfa7a0
Instruction ID: 649ade150604454f5e322007c9cba3d9979dc3d6b5b1d49368afa15e2fe5a952
Opcode Fuzzy Hash: 13c9adc974c42543c4138414809006d942cbbcd1fe96e939a7d0cf87f8cfa7a0
Instruction Fuzzy Hash: 22612731A0868285F620BB20E9803FAB760FF94794FD041B6D94E47AA5DF3CE945C776

Function 00007FF7EAF06690 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 67registrysleepCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32 ref: 00007FF7EAF066EC
RegDeleteValueW.KERNEL32 ref: 00007FF7EAF066FE
RegSetValueExW.KERNEL32 ref: 00007FF7EAF06726
RegCloseKey.KERNEL32 ref: 00007FF7EAF06731
OpenProcess.KERNEL32 ref: 00007FF7EAF06770
GetExitCodeProcess.KERNEL32 ref: 00007FF7EAF06783
Sleep.KERNEL32 ref: 00007FF7EAF0679C

Strings

IpDates_info, xrefs: 00007FF7EAF066F7, 00007FF7EAF06709
SOFTWARE, xrefs: 00007FF7EAF066D0

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: OpenProcessValue$CloseCodeDeleteExitSleep
String ID: IpDates_info$SOFTWARE
API String ID: 864241144-2243437601
Opcode ID: 7273320449914747eef314da4b35d0b3e2dae11081ca32cb48a94620bb4d36a9
Instruction ID: dafe24bcaf00cee12f1f7166eca688c172555175f7d95a97d80e0c7175fecb49
Opcode Fuzzy Hash: 7273320449914747eef314da4b35d0b3e2dae11081ca32cb48a94620bb4d36a9
Instruction Fuzzy Hash: 5931A631A1CA0282FB50AB10F9847B9B7A2FF84794FC001F6E54D426A9DF7CE545CB66

Function 028D8040 Relevance: 15.1, APIs: 10, Instructions: 126COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 028D805D
OpenProcess.KERNEL32 ref: 028D806D
OpenProcessToken.ADVAPI32 ref: 028D8095
CloseHandle.KERNEL32 ref: 028D80A2
SysStringLen.OLEAUT32 ref: 028D80F0
SysStringLen.OLEAUT32 ref: 028D8103
CloseHandle.KERNEL32 ref: 028D816D
CloseHandle.KERNEL32 ref: 028D8176
SysFreeString.OLEAUT32 ref: 028D81AC
SysFreeString.OLEAUT32 ref: 028D81E9

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: String$CloseHandleProcess$FreeOpen$CurrentToken
String ID:
API String ID: 3697972778-0
Opcode ID: d65573670d91d4a2319d9bf601b7591871b764b4696a34e88597c2945c6666e4
Instruction ID: 1c8847c3dd3d2198489a1ded9c480bc85d1a3f4078006d4c2e3ec509c536efcc
Opcode Fuzzy Hash: d65573670d91d4a2319d9bf601b7591871b764b4696a34e88597c2945c6666e4
Instruction Fuzzy Hash: 4841632E206B8082DE64DF25E8547697365FB84B9CF488225CE9E87B94DF3CC44EC741

Function 00007FF7EAF098FC Relevance: 15.1, APIs: 10, Instructions: 87COMMON

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 00007FF7EAF09966
_FF_MSGBANNER.LIBCMT ref: 00007FF7EAF09991
_RTC_Initialize.LIBCMT ref: 00007FF7EAF099AA
_amsg_exit.LIBCMT ref: 00007FF7EAF099BE
GetCommandLineW.KERNEL32 ref: 00007FF7EAF099C3
__wsetargv.LIBCMT ref: 00007FF7EAF099DC
_amsg_exit.LIBCMT ref: 00007FF7EAF099EA
_amsg_exit.LIBCMT ref: 00007FF7EAF099FD
_cinit.LIBCMT ref: 00007FF7EAF09A07
_amsg_exit.LIBCMT ref: 00007FF7EAF09A12

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _amsg_exit$CommandInitializeLine__wsetargv_cinit
String ID:
API String ID: 2949660345-0
Opcode ID: bc546b9b31afb54ae0084185d84276419e05a16c241d08c8ffe122babf2c2063
Instruction ID: 4fdcda00ff374cb7a7867a2d97ea207f93c2e09db5d134e8178eb831f00fa8ea
Opcode Fuzzy Hash: bc546b9b31afb54ae0084185d84276419e05a16c241d08c8ffe122babf2c2063
Instruction Fuzzy Hash: F8310621E0860386FB507BA499D13F9E395AF9134CFC101B7D65D862D2EE3CE8408673

Function 028D7B10 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 117registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 028D7B79
RegQueryInfoKeyW.ADVAPI32 ref: 028D7BD4
RegEnumKeyExW.ADVAPI32 ref: 028D7C69
lstrlenW.KERNEL32 ref: 028D7C73
lstrlenW.KERNEL32 ref: 028D7C82

Part of subcall function 028E6188: _errno.LIBCMT ref: 028E61A7
Part of subcall function 028E6188: _invalid_parameter_noinfo.LIBCMT ref: 028E61B3

Part of subcall function 028E6188: _errno.LIBCMT ref: 028E61FD

RegCloseKey.ADVAPI32 ref: 028D7CCB
lstrlenW.KERNEL32 ref: 028D7CE8

Strings

Software\Tencent\Plugin\VAS, xrefs: 028D7B5D

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: lstrlen$_errno$CloseEnumInfoOpenQuery_invalid_parameter_noinfo
String ID: Software\Tencent\Plugin\VAS
API String ID: 47975445-3343197220
Opcode ID: c999c8a281e2b3a4ed3081eb0bd0c9aac123fefd782ea822af9aa039a62f908a
Instruction ID: 97f2dcfe52b988b414265eeb00a52e9dcea6e255db70b4dea1fc7032ee9ea2ea
Opcode Fuzzy Hash: c999c8a281e2b3a4ed3081eb0bd0c9aac123fefd782ea822af9aa039a62f908a
Instruction Fuzzy Hash: FD51603A614B819AE760DF25F89079EB3A5F799748F900126DB8E87F58DF38C149CB40

Function 028E2080 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 40filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 028E2097
CreateFileW.KERNEL32 ref: 028E20C9
SetFilePointer.KERNEL32 ref: 028E20EE
lstrlenW.KERNEL32 ref: 028E20F7
WriteFile.KERNEL32 ref: 028E2115
CloseHandle.KERNEL32 ref: 028E211E
ReleaseMutex.KERNEL32 ref: 028E212B

Strings

C:\ProgramData\DisplaySessionContainers.log, xrefs: 028E20A9

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID: C:\ProgramData\DisplaySessionContainers.log
API String ID: 4202892810-820907713
Opcode ID: e66edca27f0b4b472a47d301f0d453ed1a843aabc931c6e442c329c9c8bb1688
Instruction ID: 4a43111d4395d06cb71ac0360d4b044e54d51ffcd1592611bcd6652ea30cfbef
Opcode Fuzzy Hash: e66edca27f0b4b472a47d301f0d453ed1a843aabc931c6e442c329c9c8bb1688
Instruction Fuzzy Hash: 1D115B79215A4182EB508F66F90C75A7360FB98BB8F448320DA6E43BE8CF7CC049CB04

Function 028DEC90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 028E55F8: malloc.LIBCMT ref: 028E5612

GetLastInputInfo.USER32 ref: 028DECDA
GetTickCount.KERNEL32 ref: 028DECE0
wsprintfW.USER32 ref: 028DED14
GetForegroundWindow.USER32 ref: 028DED1A
GetWindowTextW.USER32 ref: 028DED32

Strings

%d min, xrefs: 028DED0D

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Window$CountForegroundInfoInputLastTextTickmallocwsprintf
String ID: %d min
API String ID: 4179731349-1947832151
Opcode ID: 47f7d039e9d6e6dcd37607c5423cdecd98a03ecb57830f996f9afe5b2c21c89e
Instruction ID: a37ce3fe6b0558ac208666f8201fce2f531a9baf0ac39270572fdde1cb204e00
Opcode Fuzzy Hash: 47f7d039e9d6e6dcd37607c5423cdecd98a03ecb57830f996f9afe5b2c21c89e
Instruction Fuzzy Hash: 1041B47A3046C09ADB24DF2AE55479EB761F785B88F844125DF4E8BB58DF38C509CB01

Function 028D7D40 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 82comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 028D7D4A
CoCreateInstance.OLE32 ref: 028D7D6E
SysFreeString.OLEAUT32 ref: 028D7E38
CoUninitialize.OLE32 ref: 028D7E85

Strings

Network, xrefs: 028D7D40
FriendlyName, xrefs: 028D7E20

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CreateFreeInitializeInstanceStringUninitialize
String ID: FriendlyName$Network
API String ID: 841178590-1437807293
Opcode ID: 85724eb1235deb858d208dd5baec3e034e629cdd9d5c200151cad6a771ccc146
Instruction ID: 34679a44bf4a1fd730891002e1121db95cf19d61c14288f491124e4d057594a6
Opcode Fuzzy Hash: 85724eb1235deb858d208dd5baec3e034e629cdd9d5c200151cad6a771ccc146
Instruction Fuzzy Hash: A931ED3A214A8592DB60DF35E48479E6760F7C8F99F558012DB8E83B24DF38C549CB00

Function 00007FF7EAF03690 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74networkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 00007FF7EAF03725
recv.WS2_32 ref: 00007FF7EAF0374B
_errno.LIBCMT ref: 00007FF7EAF03757
_errno.LIBCMT ref: 00007FF7EAF03761
_errno.LIBCMT ref: 00007FF7EAF0376E

Strings

4 =X, xrefs: 00007FF7EAF03699

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$recvselect
String ID: 4 =X
API String ID: 4102763267-3147943113
Opcode ID: 9990d17f50331093fb9b0363c6e75c664667ad3c976c3c73e9e25bfe87bb2aa3
Instruction ID: 4d8703312324cf633fc1ebf91cbb4c28c0f355595c8211ae985f37c8e7874652
Opcode Fuzzy Hash: 9990d17f50331093fb9b0363c6e75c664667ad3c976c3c73e9e25bfe87bb2aa3
Instruction Fuzzy Hash: C4315471A1CA8281F7706B25E4953FAB790EB85BCCF844276DA4D47B95DF3CD0448B22

Function 028D8CA0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 028D8CCB
GetProcAddress.KERNEL32 ref: 028D8CDB
GetNativeSystemInfo.KERNEL32 ref: 028D8CEB
GetSystemInfo.KERNEL32 ref: 028D8CEF

Strings

GetNativeSystemInfo, xrefs: 028D8CD1
kernel32.dll, xrefs: 028D8CA6

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 3433367815-192647395
Opcode ID: 13fcd9e8e1cc8ddc9bbf0ad522e0ae51a73a5c5d350313a27b70b9d8622c7569
Instruction ID: 232f6f68cda5be39c623e19156e7e5d8550d147da1e16c8a47f0d77f83284631
Opcode Fuzzy Hash: 13fcd9e8e1cc8ddc9bbf0ad522e0ae51a73a5c5d350313a27b70b9d8622c7569
Instruction Fuzzy Hash: 43F03C39616F85C6EAA19B10F85435A73A0F798704F900529D7CE83B94EF3CC2AA8B00

Function 00007FF7EAF03860 Relevance: 9.2, APIs: 6, Instructions: 154memorythreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7EAF03883
VirtualAlloc.KERNEL32 ref: 00007FF7EAF03910
VirtualFree.KERNEL32 ref: 00007FF7EAF03952
VirtualAlloc.KERNEL32 ref: 00007FF7EAF039DF
VirtualFree.KERNEL32 ref: 00007FF7EAF03A21
GetCurrentThreadId.KERNEL32 ref: 00007FF7EAF03AE3

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Virtual$AllocCurrentFreeThread
String ID:
API String ID: 1155560630-0
Opcode ID: eb27e00e9777afcec1ecae8671a7664ff76521af7566e1bcea2fe3ccdd58d001
Instruction ID: 7d9ac559ba17499742eb8b30f1a9c2f1802556eb63bb4f1acbebaa00f10a1b86
Opcode Fuzzy Hash: eb27e00e9777afcec1ecae8671a7664ff76521af7566e1bcea2fe3ccdd58d001
Instruction Fuzzy Hash: 49719E32718A8197E758AB35E2803A9F3A0FB44788F908176DB9D83745DF38E4A5CB51

Function 028D85C0 Relevance: 9.1, APIs: 6, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 028D8625
RegQueryValueExW.ADVAPI32 ref: 028D866D
lstrcmpW.KERNEL32 ref: 028D8683
RegCloseKey.ADVAPI32 ref: 028D86AC
RegCloseKey.ADVAPI32 ref: 028D86B7

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Close$OpenQueryValuelstrcmp
String ID:
API String ID: 4288439342-0
Opcode ID: 5ba0c6a4ae43ac7c70eeb89abb2e9c4d94923e3d8f8256d1aab8c99e794dd8ff
Instruction ID: 67c8d7b5be9a230ed3aeeb139eb85063f8484e28dc062896737607e254d0eaee
Opcode Fuzzy Hash: 5ba0c6a4ae43ac7c70eeb89abb2e9c4d94923e3d8f8256d1aab8c99e794dd8ff
Instruction Fuzzy Hash: F6214139315A4085EB60CB16FD8875BB360FBD5BA8F405225AA5E83B98DF3CC449CB04

Function 00007FF7EAF094DC Relevance: 9.1, APIs: 6, Instructions: 63threadCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7EAF09507
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF09512
_getptd.LIBCMT ref: 00007FF7EAF09538
CreateThread.KERNEL32 ref: 00007FF7EAF0958D
GetLastError.KERNEL32 ref: 00007FF7EAF09598
free.LIBCMT ref: 00007FF7EAF095A3

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CreateErrorLastThread_errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 3283625137-0
Opcode ID: 3cde405814183ac50174b4c7b06ee0a655b453fe3172371e7738c2e9b2a32393
Instruction ID: 9e8689a6e601391d2869f3832ee6d6662ff89f36c176454f100258e0a824ec22
Opcode Fuzzy Hash: 3cde405814183ac50174b4c7b06ee0a655b453fe3172371e7738c2e9b2a32393
Instruction Fuzzy Hash: C0216221A0878185FA14BB66A5C03FAF394BF84B94F844276EE5D437D6DF3CE0118751

Function 028E59EC Relevance: 9.1, APIs: 6, Instructions: 63threadCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 028E5A17
_invalid_parameter_noinfo.LIBCMT ref: 028E5A22
_getptd.LIBCMT ref: 028E5A48
CreateThread.KERNEL32 ref: 028E5A9D
GetLastError.KERNEL32 ref: 028E5AA8
free.LIBCMT ref: 028E5AB3

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CreateErrorLastThread_errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 3283625137-0
Opcode ID: f57b21b93f7480828c31ff222aa3995ca76bdcec9e50c3faea9c1f6e3ebba8ed
Instruction ID: 82981989c1cd1f4fa44b4cfcb39a7fa244156b4a31bba4977b24d65444e9a65b
Opcode Fuzzy Hash: f57b21b93f7480828c31ff222aa3995ca76bdcec9e50c3faea9c1f6e3ebba8ed
Instruction Fuzzy Hash: 1E21A43D20578086DF14EF69A94075EB395FB86BE4F848225AF6A83B94DF3CC054CB01

Function 028D7580 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 21synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32 ref: 028D75A4
CreateMutexExW.KERNEL32 ref: 028D75AA

Strings

2024.12.22, xrefs: 028D7599

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CreateMutex
String ID: 2024.12.22
API String ID: 1964310414-3603465377
Opcode ID: 6210562134dc5eede192222c5ea401127a187638d05ffd9fc90648adeca70dfe
Instruction ID: 0ab0390ec1d0a00d72c8c0c289b93e1ac680017e98e8a6f272d54bac261cb58a
Opcode Fuzzy Hash: 6210562134dc5eede192222c5ea401127a187638d05ffd9fc90648adeca70dfe
Instruction Fuzzy Hash: 85F05839201B46C1EF349B20F80935E73A1F799754F80862AD28E42AA4CF3CC198CB05

Function 028D76B0 Relevance: 7.6, APIs: 5, Instructions: 56processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 028D76F1
Process32FirstW.KERNEL32 ref: 028D7710
Process32NextW.KERNEL32 ref: 028D7750
CloseHandle.KERNEL32 ref: 028D775D
CloseHandle.KERNEL32 ref: 028D7786

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 3a7b7e445d32a1e76cb5637bfd21b29d3af22d0c2a4da0e23c7962526df16ec8
Instruction ID: fbe8a685efc39bed9be51f28171ba05f9eeeb3340a37b9fbda41a26f57ef93dd
Opcode Fuzzy Hash: 3a7b7e445d32a1e76cb5637bfd21b29d3af22d0c2a4da0e23c7962526df16ec8
Instruction Fuzzy Hash: 6C21753D21568185DF64DB25F54836AB7A1FBD8B98F448325DA5E87B98EF3CC109CB00

Function 028DDB80 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 028DDBE9
RegQueryValueExW.ADVAPI32 ref: 028DDC13

Strings

Console, xrefs: 028DDBC3
IpDatespecial, xrefs: 028DDC04

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: OpenQueryValue
String ID: Console$IpDatespecial
API String ID: 4153817207-1840232981
Opcode ID: bf165943aeba814d157865850bb6df82e150dbbb55006ae38269879ef9c7d549
Instruction ID: 8beadae7357ec82fbd0b0bd0a69fa2d3aeac0844642ff32b77592aac609db9b2
Opcode Fuzzy Hash: bf165943aeba814d157865850bb6df82e150dbbb55006ae38269879ef9c7d549
Instruction Fuzzy Hash: 2A21D03B709AA099E3608B61F84479D7764F34879CF848122EE8813B88CF38C19ECB04

Function 00007FF7EAF09128 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 00007FF7EAF09136
malloc.LIBCMT ref: 00007FF7EAF09142

Part of subcall function 00007FF7EAF09070: _FF_MSGBANNER.LIBCMT ref: 00007FF7EAF090A0
Part of subcall function 00007FF7EAF09070: HeapAlloc.KERNEL32(?,?,00B34BF300000000,00007FF7EAF0C050,?,?,ceil,00007FF7EAF0D951,?,?,?,00007FF7EAF0D9FB,?,?,00000000,00007FF7EAF0B951), ref: 00007FF7EAF090C5
Part of subcall function 00007FF7EAF09070: _callnewh.LIBCMT ref: 00007FF7EAF090DE
Part of subcall function 00007FF7EAF09070: _errno.LIBCMT ref: 00007FF7EAF090E9
Part of subcall function 00007FF7EAF09070: _errno.LIBCMT ref: 00007FF7EAF090F4

std::exception::exception.LIBCMT ref: 00007FF7EAF091AF

Strings

bad allocation, xrefs: 00007FF7EAF0917F

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _callnewh_errno$AllocHeapmallocstd::exception::exception
String ID: bad allocation
API String ID: 2837191506-2104205924
Opcode ID: 4f08dc12cc9b3052129dc1c476ad1ada57a0f8fd3b1b96a9833c9c367f9ae114
Instruction ID: ec62f737772ebeab485aeaf56ea366662ff9ac351b148e535563b19bc612c94b
Opcode Fuzzy Hash: 4f08dc12cc9b3052129dc1c476ad1ada57a0f8fd3b1b96a9833c9c367f9ae114
Instruction Fuzzy Hash: 5C010562E1870790FA10BB60A8C02F4E3A0AF64388FC400B3D95D436A2FE7CE545C772

Function 028D9D50 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 028D9D8A
GetProcessImageFileNameW.PSAPI ref: 028D9DA6
CloseHandle.KERNEL32 ref: 028D9DB3
CloseHandle.KERNEL32 ref: 028D9DD1

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CloseHandleProcess$FileImageNameOpen
String ID:
API String ID: 93767460-0
Opcode ID: f9ca6d39da2e8c6a3f8d5f910570484524346d4c253cc5b6543d40e07020b5bd
Instruction ID: 75784148851ae6d9eed4629f7961907b3cdac7be3c9c378a003b061f21e35425
Opcode Fuzzy Hash: f9ca6d39da2e8c6a3f8d5f910570484524346d4c253cc5b6543d40e07020b5bd
Instruction Fuzzy Hash: B801006D31578182EF24DB26E59835663A1BB59B88F448135CA4EC7744EF3CD0458700

Function 00007FF7EAF0945C Relevance: 6.0, APIs: 4, Instructions: 32threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7EAF09491
ExitThread.KERNEL32 ref: 00007FF7EAF09499
GetCurrentThreadId.KERNEL32 ref: 00007FF7EAF094A0
_freefls.LIBCMT ref: 00007FF7EAF094D1

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Thread$CurrentErrorExitLast_freefls
String ID:
API String ID: 217443660-0
Opcode ID: c1032e5ba32211df7021af190faab52d392a270f38cd16aa57ea7f747e353cbe
Instruction ID: 0fe16816e30c0c1145d19f5a619280c9f3ba66c5754b91637dbea9b9c00e5a6d
Opcode Fuzzy Hash: c1032e5ba32211df7021af190faab52d392a270f38cd16aa57ea7f747e353cbe
Instruction Fuzzy Hash: 67011928E08B4681FA14BB7194993FDA394AF19B88FD444B6C90D47393EE3DE44583B2

Function 00007FF7EAF03310 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF7EAF0334D
CancelIo.KERNEL32 ref: 00007FF7EAF0335A
closesocket.WS2_32 ref: 00007FF7EAF0336A
SetEvent.KERNEL32 ref: 00007FF7EAF03374

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CancelEventclosesocketsetsockopt
String ID:
API String ID: 852421847-0
Opcode ID: 77c2693313518921cd1b9c8efffd3d9e865a5c66b2e60eb56a87be25d9ebaed2
Instruction ID: aa8df7f8426ca7a4bf1b8beebc1e68e1098a9496297c7fb30699a938f96314fa
Opcode Fuzzy Hash: 77c2693313518921cd1b9c8efffd3d9e865a5c66b2e60eb56a87be25d9ebaed2
Instruction Fuzzy Hash: 16F08C36604B8187E7149F25E5543AAB331FB84BA4F940376CBAD07AE4CF39D0698B41

Function 00007FF7EAF03C10 Relevance: 6.0, APIs: 4, Instructions: 22synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF7EAF03C20
SleepEx.KERNEL32 ref: 00007FF7EAF03C2B
WaitForSingleObject.KERNEL32 ref: 00007FF7EAF03C40
WaitForSingleObject.KERNEL32 ref: 00007FF7EAF03C50

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ObjectSingleWait$Sleep
String ID:
API String ID: 2961732021-0
Opcode ID: bc31317e1241cbe88b87a2fddbfd8f69b2015d3f2dce8f37f5b894eda6bc4ee3
Instruction ID: ab4f2486e63b38e1a70e38723147cf339d89b60bb117c29568a2fa94f2b6bfd5
Opcode Fuzzy Hash: bc31317e1241cbe88b87a2fddbfd8f69b2015d3f2dce8f37f5b894eda6bc4ee3
Instruction Fuzzy Hash: E6F05E3260494886F740EB75DC043A87360FB99B24F5407B2CA3D462D4CF38C445C7A1

Function 028DFE20 Relevance: 4.7, APIs: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 028DFE96
RegEnumValueW.ADVAPI32 ref: 028DFF47

Part of subcall function 028E55F8: malloc.LIBCMT ref: 028E5612

Part of subcall function 028E55F8: _callnewh.LIBCMT ref: 028E5606
Part of subcall function 028E55F8: std::exception::exception.LIBCMT ref: 028E567F

RegCloseKey.ADVAPI32 ref: 028E0110

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CloseEnumInfoQueryValue_callnewhmallocstd::exception::exception
String ID:
API String ID: 1242514309-0
Opcode ID: c725728409d11bb8dfae7c0a04911617864f3dcb5282e5a2d09a2b0ca641f9d8
Instruction ID: 26618552a669550ac50cee01c381e292e2e09e02a29c73cfd8921a140fc3f625
Opcode Fuzzy Hash: c725728409d11bb8dfae7c0a04911617864f3dcb5282e5a2d09a2b0ca641f9d8
Instruction Fuzzy Hash: CB81BD3A701B408ADB00DF6AE884B9D73B9F789B98F414226EE6E87B64DF34C555C700

Function 00007FF7EAF03C80 Relevance: 4.7, APIs: 3, Instructions: 152memorytimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7EAF01080: VirtualAlloc.KERNEL32 ref: 00007FF7EAF010F8
Part of subcall function 00007FF7EAF01080: VirtualFree.KERNELBASE ref: 00007FF7EAF01133

timeGetTime.WINMM(?,?,?,?,?,00007FF7EAF037C7), ref: 00007FF7EAF03D24
VirtualAlloc.KERNEL32(?,?,?,?,?,00007FF7EAF037C7), ref: 00007FF7EAF03E3F
VirtualFree.KERNEL32(?,?,?,?,?,00007FF7EAF037C7), ref: 00007FF7EAF03E77

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Virtual$AllocFree$Timetime
String ID:
API String ID: 3637049079-0
Opcode ID: 8ce211443598bf1f6c326811457363ddd0ba4b37b6d2bd6c62702337309cfaff
Instruction ID: 7de30076cd0c29c30016efacf6acb232307432356be9101a5ce8df8f0ee33da6
Opcode Fuzzy Hash: 8ce211443598bf1f6c326811457363ddd0ba4b37b6d2bd6c62702337309cfaff
Instruction Fuzzy Hash: B5619632A15A5286FB14AB29D08CBBFB3A4FB48B84F81427ADA4D43794DF38E445C751

Function 028DC7D0 Relevance: 4.5, APIs: 3, Instructions: 31COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 028DC7F0
GdiplusStartup.GDIPLUS ref: 028DC82C
LeaveCriticalSection.KERNEL32 ref: 028DC846

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalSection$EnterGdiplusLeaveStartup
String ID:
API String ID: 389129658-0
Opcode ID: da60f929d78d2f63b72fb7356355eb002dbfafbd2e5e2885638b90ebbc7f88c4
Instruction ID: dc09233d41ac66261ba41deb6952976b9c47facad84bab6810497b1d11df0ff9
Opcode Fuzzy Hash: da60f929d78d2f63b72fb7356355eb002dbfafbd2e5e2885638b90ebbc7f88c4
Instruction Fuzzy Hash: 7C014476604B82C2DB509F16FA48399F3F9F7A5744F842116E68983AA4DF7CC16ECB00

Function 00007FF7EAF09EC8 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 00007FF7EAF09EDE
GetVersion.KERNEL32 ref: 00007FF7EAF09EF0
HeapSetInformation.KERNEL32 ref: 00007FF7EAF09F0E

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 548033a4c8ebb5abcb3e3bdf629b7b62b8a0c9b1179596de6b3cb96c9a1ceea0
Instruction ID: 215f3b36c9cd09c9fabeb23a56dd6f1ecd76edb7d6f802dd7de70e9ff1d9c4e5
Opcode Fuzzy Hash: 548033a4c8ebb5abcb3e3bdf629b7b62b8a0c9b1179596de6b3cb96c9a1ceea0
Instruction Fuzzy Hash: 3AE09B35A19A8382FB457710A8457F5A350FFA4345FC000B6D90D02754DF3CD445C7B5

Function 028EBD14 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 028EBD2A
GetVersion.KERNEL32 ref: 028EBD3C
HeapSetInformation.KERNEL32 ref: 028EBD5A

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 7cfbc3600ba10913be0d99bf369f62085571deb7fe8177c71bd152516bdef674
Instruction ID: 5ec4e13f7134745644d71027540a1eb0398b93727b000eb76401c13986629646
Opcode Fuzzy Hash: 7cfbc3600ba10913be0d99bf369f62085571deb7fe8177c71bd152516bdef674
Instruction Fuzzy Hash: 6BE0D87C71264582FF945B16F84D7593311F7A9744F809025EA4F43B98DF3CC0858B14

Function 00007FF7EAF174F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF7EAF17520

Strings

4 =X, xrefs: 00007FF7EAF174FB

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Startup
String ID: 4 =X
API String ID: 724789610-3147943113
Opcode ID: 69ce0e59409c3ed63e01fee79cb91035653ccaefa39d6bbe4741f0a49fc59aaf
Instruction ID: 99dce01016fde1ca4a2983dd248e56ad1c5c980d977af8ddd127c5230f0710bd
Opcode Fuzzy Hash: 69ce0e59409c3ed63e01fee79cb91035653ccaefa39d6bbe4741f0a49fc59aaf
Instruction Fuzzy Hash: 27F03A35A14A85DAF710EF20D8551E8B3A4FB58308FC48472E94D87755DE3CE1148B21

Function 028800DC Relevance: 3.4, APIs: 2, Instructions: 391memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 02880157
LoadLibraryA.KERNEL32 ref: 028802BD

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 22a59f860d870a6bcf201ec3191bb530606b5caa03c236b8628a20c22f198a64
Instruction ID: 4d83cfec7248e37888c27e07c34585f5994348a7dad43cf171009cd6886be184
Opcode Fuzzy Hash: 22a59f860d870a6bcf201ec3191bb530606b5caa03c236b8628a20c22f198a64
Instruction Fuzzy Hash: 75B1D839754E0A8FCB28EE69C885675B3E0FB54319B15413DD88EC7242EB74E896C7C1

Function 028D66B0 Relevance: 3.1, APIs: 2, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 028D670D
SysAllocString.OLEAUT32 ref: 028D6759

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 37c7eda1fc14ccb20b40b4972395f454460bfd1e1c29be7e040f8245d3cdd862
Instruction ID: 14d6c4f5f622f56a231310ce0c41e7d0ee059619809907040b1ab30ed795f344
Opcode Fuzzy Hash: 37c7eda1fc14ccb20b40b4972395f454460bfd1e1c29be7e040f8245d3cdd862
Instruction Fuzzy Hash: B721803D202B5982EF199F65F1603286368AF54BA8F1887298B6D8BB94FF7CC4158740

Function 00007FF7EAF03B10 Relevance: 3.1, APIs: 2, Instructions: 66networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF7EAF03B73
send.WS2_32 ref: 00007FF7EAF03BC0

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 993fe9fb8bd5cda1ffd7d49de116850fd78509aad300088003f3a940471f662b
Instruction ID: fb9cb3ad073220135a77a26249ae1262d528695652d53223ab9f5149e3820f7d
Opcode Fuzzy Hash: 993fe9fb8bd5cda1ffd7d49de116850fd78509aad300088003f3a940471f662b
Instruction Fuzzy Hash: DA21DB61A08A9240F3606B16B8853BAF794FB84BDCF445272DF9D83B51EF7CD4428305

Function 028D3A40 Relevance: 3.1, APIs: 2, Instructions: 66networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 028D3AA3
send.WS2_32 ref: 028D3AF0

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: d0ae4d2fbc79c699570b411c092e8fac233cba77cf9ac9c238a55a0d91b9a40b
Instruction ID: 7f87e2b987bdf44f611c4246d3d3987b4d24265894e1cb0df49e9a790ac9bc6b
Opcode Fuzzy Hash: d0ae4d2fbc79c699570b411c092e8fac233cba77cf9ac9c238a55a0d91b9a40b
Instruction Fuzzy Hash: CE11D32E704B9041D3209B26F88472ABB54F789BD8F142161EF5993B55EBB9C09A8B06

Function 00007FF7EAF08650 Relevance: 3.0, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 00007FF7EAF08681
free.LIBCMT ref: 00007FF7EAF086C4

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CreateHeapfree
String ID:
API String ID: 2345683253-0
Opcode ID: d06350443261b5c44dc0382cd6166cd32f98e0a7bcc8923f0c5a309339592e20
Instruction ID: 706cff9b211aa3d61cd1b68198163028e29cc646a431204c1f0483f7bf09fdb3
Opcode Fuzzy Hash: d06350443261b5c44dc0382cd6166cd32f98e0a7bcc8923f0c5a309339592e20
Instruction Fuzzy Hash: 3D119AB29257608AF740DF28E08025977F8FB48F88F64413AEB4957758CF78D882CB80

Function 028E0170 Relevance: 3.0, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 028E01A1
free.LIBCMT ref: 028E01E4

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CreateHeapfree
String ID:
API String ID: 2345683253-0
Opcode ID: 6c657b53ada8c9f01a0f0a1edcf13a14d995f6341b0ef4ccad47483f73e8ef91
Instruction ID: 6aa9594bf3655fd095627c6f6f7d8b88ca307f7192923661972a7a50d63cd53e
Opcode Fuzzy Hash: 6c657b53ada8c9f01a0f0a1edcf13a14d995f6341b0ef4ccad47483f73e8ef91
Instruction Fuzzy Hash: 83115EB6511760CAEB54CF29E48030937B9F748F48F64551AEB4997718CB78C492CB84

Function 00007FF7EAF037E0 Relevance: 3.0, APIs: 2, Instructions: 37timeCOMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 00007FF7EAF0380B
timeGetTime.WINMM ref: 00007FF7EAF0382F

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: 88df6c9814dd7951e769eaa4fec861968935f3fc4ebb5d812e480bd371ef65fc
Instruction ID: d42594fa8c2574090d23f4a32b57f1d085133e512805aa9b2307c45b5fc784e0
Opcode Fuzzy Hash: 88df6c9814dd7951e769eaa4fec861968935f3fc4ebb5d812e480bd371ef65fc
Instruction Fuzzy Hash: FE01B126A0864587F7649B24D2C83BDA7A0FB44B88F8443B6C75E03AD0CF7CE4A4C702

Function 028D37C0 Relevance: 3.0, APIs: 2, Instructions: 37sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 028D37EB
timeGetTime.WINMM ref: 028D380F

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: 8ba189807d10781ce9f7bbddadc3a74c6f7bd83e01ef95e7953e346e1cdbb878
Instruction ID: b7393f53c8aec5a671ef95a3532eb7d38da00e98d3295d5f3ae2f0b1e16ab4d2
Opcode Fuzzy Hash: 8ba189807d10781ce9f7bbddadc3a74c6f7bd83e01ef95e7953e346e1cdbb878
Instruction Fuzzy Hash: C0018F3A714680C7D7648B69D28832C3771F348B89F445264DB5A83BA0CFB8C0A9CB02

Function 028E1DD0 Relevance: 3.0, APIs: 2, Instructions: 20synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 028E1DFB
WaitForSingleObject.KERNEL32 ref: 028E1E0E

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: fe1e6dd7a0d7d9773822c04724471c00a9c4c89ee4f5eb478abf33e2b4483c6e
Instruction ID: df601ad8daa1fcf3333944552a12be87efcce0a40c97054925c9041608e12bf9
Opcode Fuzzy Hash: fe1e6dd7a0d7d9773822c04724471c00a9c4c89ee4f5eb478abf33e2b4483c6e
Instruction Fuzzy Hash: 19E0D839E01B4181EBA0DB25BC4D34537A1F3A4314F518225D55D827A4EF3C84548300

Function 00007FF7EAF01080 Relevance: 2.6, APIs: 2, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF7EAF010F8
VirtualFree.KERNELBASE ref: 00007FF7EAF01133

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 26e2137525513526dd013d54ad7f142b8e6e46a3c1df15383bd1b51481be757a
Instruction ID: 35c79e5ffbfb7bd8a59c47efeff57541fed7df613d91b8c078e077eb5b34075a
Opcode Fuzzy Hash: 26e2137525513526dd013d54ad7f142b8e6e46a3c1df15383bd1b51481be757a
Instruction Fuzzy Hash: B9412632704A8587E70DEB2AE8506AAF3A5FB94BC8F448139EE4E83758DF38D551C750

Function 00007FF7EAF011F0 Relevance: 2.6, APIs: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF7EAF01261
VirtualFree.KERNELBASE ref: 00007FF7EAF01295

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 95b57b51fc333e6316162f6326f5110e0a83f6deb2dcaf3171337f97a5765aa6
Instruction ID: 1a937fcf5cd94a8e3f10498964f7abc450b95847910129c679fe13ffea269c9c
Opcode Fuzzy Hash: 95b57b51fc333e6316162f6326f5110e0a83f6deb2dcaf3171337f97a5765aa6
Instruction Fuzzy Hash: 9E21DA32B149418BE744DB2AE180359B3A1FB48B84F948172EB4DD3748DF38E8E28B44

Function 028D1140 Relevance: 2.6, APIs: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 028D11B1
VirtualFree.KERNEL32 ref: 028D11E5

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: a7907fc47371d8ea5bd45931dab553867b38b76e3d69a2c4af86bce9e67ffd8b
Instruction ID: c12f5804fd62ea646867717274cf6444bb086eacbac6160dbdca3d44a237b539
Opcode Fuzzy Hash: a7907fc47371d8ea5bd45931dab553867b38b76e3d69a2c4af86bce9e67ffd8b
Instruction Fuzzy Hash: 1A21C33A714A408BDB44CB2EE544319B3A1F788B84F549521EB5ED7B08EF34D8E28B40

Function 00007FF7EAF09430 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF7EAF09434

Part of subcall function 00007FF7EAF0BA34: _amsg_exit.LIBCMT ref: 00007FF7EAF0BA4A

Part of subcall function 00007FF7EAF0940C: ExitThread.KERNEL32 ref: 00007FF7EAF09428

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ExitThread_amsg_exit_getptd
String ID:
API String ID: 449628364-0
Opcode ID: 556d5509b120e02cdcca8f06fb680f1e7bbffed6d54eb6d90fa9cde67232f795
Instruction ID: 8df9157f90119fe8ec56e670f30d4d37c4ece91402e0d2693f11c781c6923695
Opcode Fuzzy Hash: 556d5509b120e02cdcca8f06fb680f1e7bbffed6d54eb6d90fa9cde67232f795
Instruction Fuzzy Hash: 8DC0CA25E4624182EA08737188EA7FC4391AFCAB08F8090B2E50E43383DD3C945A8222

Function 00007FF7EAF0940C Relevance: 1.5, APIs: 1, Instructions: 10threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7EAF0B9B0: GetLastError.KERNEL32(?,?,?,00007FF7EAF0938D,?,?,?,?,00007FF7EAF14BEE,?,?,?,?,00007FF7EAF12ED1), ref: 00007FF7EAF0B9BA
Part of subcall function 00007FF7EAF0B9B0: FlsGetValue.KERNEL32(?,?,?,00007FF7EAF0938D,?,?,?,?,00007FF7EAF14BEE,?,?,?,?,00007FF7EAF12ED1), ref: 00007FF7EAF0B9C8
Part of subcall function 00007FF7EAF0B9B0: FlsSetValue.KERNEL32(?,?,?,00007FF7EAF0938D,?,?,?,?,00007FF7EAF14BEE,?,?,?,?,00007FF7EAF12ED1), ref: 00007FF7EAF0B9F4
Part of subcall function 00007FF7EAF0B9B0: GetCurrentThreadId.KERNEL32 ref: 00007FF7EAF0BA08
Part of subcall function 00007FF7EAF0B9B0: SetLastError.KERNEL32(?,?,?,00007FF7EAF0938D,?,?,?,?,00007FF7EAF14BEE,?,?,?,?,00007FF7EAF12ED1), ref: 00007FF7EAF0BA20

ExitThread.KERNEL32 ref: 00007FF7EAF09428

Part of subcall function 00007FF7EAF0BB8C: FlsGetValue.KERNEL32(?,?,?,00007FF7EAF09426), ref: 00007FF7EAF0BBA5
Part of subcall function 00007FF7EAF0BB8C: FlsSetValue.KERNEL32(?,?,?,00007FF7EAF09426), ref: 00007FF7EAF0BBB6
Part of subcall function 00007FF7EAF0BB8C: _freefls.LIBCMT ref: 00007FF7EAF0BBBF

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Value$ErrorLastThread$CurrentExit_freefls
String ID:
API String ID: 1216290073-0
Opcode ID: c93bf5a72a887f659e3f866e1ba6ff3216b61a395110430233b074b26d48111d
Instruction ID: bf72d3d0a52fcfb4f751e2f77eda2b72e55794c97272aa7dba443a3afce5a05a
Opcode Fuzzy Hash: c93bf5a72a887f659e3f866e1ba6ff3216b61a395110430233b074b26d48111d
Instruction Fuzzy Hash: 94C08C70F0934A82FE28337126E52F883400F28304F8814BAC90E06383FC3CE40443B2

Function 028D10E5 Relevance: 1.3, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 028D110C

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ac64d664bca9eaf09b1e62a913a8b077522c2f8223a1a4bdc2504cfe2bb5c86c
Instruction ID: 8b6cbf1b96ebda42381e0478f7a0827f8afd4396de459d027a3ee3384e9d4bdb
Opcode Fuzzy Hash: ac64d664bca9eaf09b1e62a913a8b077522c2f8223a1a4bdc2504cfe2bb5c86c
Instruction Fuzzy Hash: 64E06D3A712B8086CB54CF66E540619B3A1FB98FC8F489025DF4E97B48CF38C995CB80

Non-executed Functions

Function 028D9170 Relevance: 59.7, APIs: 25, Strings: 9, Instructions: 202libraryloaderprocessCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 028D91FB
CreateProcessA.KERNEL32 ref: 028D925E
OpenProcess.KERNEL32 ref: 028D9283
LoadLibraryA.KERNEL32 ref: 028D92B1
GetProcAddress.KERNEL32 ref: 028D92C1
LoadLibraryA.KERNEL32 ref: 028D92D2
GetProcAddress.KERNEL32 ref: 028D92E2
LoadLibraryA.KERNEL32 ref: 028D92F3
GetProcAddress.KERNEL32 ref: 028D9303
LoadLibraryA.KERNEL32 ref: 028D9314
GetProcAddress.KERNEL32 ref: 028D9324
GetCurrentProcess.KERNEL32 ref: 028D932E
GetProcessId.KERNEL32 ref: 028D9337
GetModuleFileNameA.KERNEL32 ref: 028D936B
VirtualAllocEx.KERNEL32 ref: 028D93A1
WriteProcessMemory.KERNEL32 ref: 028D93C4

Strings

WaitForSingleObject, xrefs: 028D931A
@, xrefs: 028D9415
Windows\System32\svchost.exe, xrefs: 028D9201
OpenProcess, xrefs: 028D92B7
ExitProcess, xrefs: 028D92D8
WinExec, xrefs: 028D92F9
Kernel32.dll, xrefs: 028D92AA, 028D92C7, 028D92E8, 028D9309
%s%s, xrefs: 028D920F
h, xrefs: 028D91DB

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Process$AddressLibraryLoadProc$AllocCreateCurrentDirectoryFileMemoryModuleNameOpenSystemVirtualWrite
String ID: %s%s$@$ExitProcess$Kernel32.dll$OpenProcess$WaitForSingleObject$WinExec$Windows\System32\svchost.exe$h
API String ID: 675209239-4110464286
Opcode ID: 9824fc9f801ac9446955b509d6a082b84ccc1552d28283745faa0f6f4afccaeb
Instruction ID: 67126f7b2720ae9d5192f5383e4eea0340e904dbe85241430621c551239cd9f5
Opcode Fuzzy Hash: 9824fc9f801ac9446955b509d6a082b84ccc1552d28283745faa0f6f4afccaeb
Instruction Fuzzy Hash: 57917D39311B8586EB25DF21F85879A73A5F799B88F808025DE4E47B98EF3CC249C744

Function 028DEE40 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 302windowCOMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 028DEE81
GetDC.USER32 ref: 028DEE8A
CreateCompatibleDC.GDI32 ref: 028DEE96
GetDC.USER32 ref: 028DEEA2
GetDeviceCaps.GDI32 ref: 028DEEB3
GetDeviceCaps.GDI32 ref: 028DEEC3
ReleaseDC.USER32 ref: 028DEEE0
GetSystemMetrics.USER32 ref: 028DEEFE
GetSystemMetrics.USER32 ref: 028DEF34
GetSystemMetrics.USER32 ref: 028DEF87
GetSystemMetrics.USER32 ref: 028DEFA1
CreateCompatibleBitmap.GDI32 ref: 028DEFBF
SelectObject.GDI32 ref: 028DEFD3
SetStretchBltMode.GDI32 ref: 028DEFE1
GetSystemMetrics.USER32 ref: 028DEFEC
GetSystemMetrics.USER32 ref: 028DF006
StretchBlt.GDI32 ref: 028DF04C
GetDIBits.GDI32 ref: 028DF0F1

Part of subcall function 028E55F8: malloc.LIBCMT ref: 028E5612

DeleteObject.GDI32 ref: 028DF1A4
DeleteObject.GDI32 ref: 028DF1AE
ReleaseDC.USER32 ref: 028DF1B9
DeleteObject.GDI32 ref: 028DF247
DeleteObject.GDI32 ref: 028DF251
ReleaseDC.USER32 ref: 028DF25C

Strings

gfff, xrefs: 028DEF3E
, xrefs: 028DF00C
gfff, xrefs: 028DEF18

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: MetricsSystem$Object$Delete$Release$CapsCompatibleCreateDeviceStretch$BitmapBitsDesktopModeSelectWindowmalloc
String ID: $gfff$gfff
API String ID: 1524144516-4202476792
Opcode ID: def623edb80c87d52716188d59f6cbe23e369145c77c97f09f6b75824db44acb
Instruction ID: 96b144945b1d16b2976333ca529d9aa1e34656cea8f441053c2e62aeccc96550
Opcode Fuzzy Hash: def623edb80c87d52716188d59f6cbe23e369145c77c97f09f6b75824db44acb
Instruction Fuzzy Hash: 94C1AF3A715B408AEB15DF76E44435D73A2FB99B88F018225DE0AABB58EF38C455C740

Function 028F2F80 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 465COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 028F2FD6
_errno.LIBCMT ref: 028F2FDD
_invalid_parameter_noinfo.LIBCMT ref: 028F2FE8

Strings

U, xrefs: 028F3564

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 13e3c0b180565f59dbcc39e4a1048adf26dd2fecb52a09595ad189047fdb76f0
Instruction ID: d298c9805f69e022a8db607b0de924140518b9370013e0e0b0bfaee9687d7e39
Opcode Fuzzy Hash: 13e3c0b180565f59dbcc39e4a1048adf26dd2fecb52a09595ad189047fdb76f0
Instruction Fuzzy Hash: D502EF3E214AC586DB61CF29E4483AAB761F798B88F544116EF8E87B68DF3DC145CB10

Function 00007FF7EAF0E1C0 Relevance: 42.5, APIs: 22, Strings: 2, Instructions: 465COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF7EAF0E216
_errno.LIBCMT ref: 00007FF7EAF0E21D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF0E228

Strings

U, xrefs: 00007FF7EAF0E7A4
4 =X, xrefs: 00007FF7EAF0E1E5

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U$4 =X
API String ID: 3902385426-2517535541
Opcode ID: 059fcb8d0d384e491ef6770d9f73524f45f969136b4973030bd1143b1e84cbf4
Instruction ID: 225d62db87c464cc2603d673b63d446acea035fb660597fb0457bedf9cb5f02b
Opcode Fuzzy Hash: 059fcb8d0d384e491ef6770d9f73524f45f969136b4973030bd1143b1e84cbf4
Instruction Fuzzy Hash: AD12E532A0864286FB20AF25E4943FAE7A1FB94748F940177DA4D87795DF3CE445CB22

Function 00007FF7EAF0C28C Relevance: 34.0, APIs: 16, Strings: 3, Instructions: 722COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7EAF0ABF8: _getptd.LIBCMT ref: 00007FF7EAF0AC0A

_errno.LIBCMT ref: 00007FF7EAF0C2FF
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF0C30A
_fileno.LIBCMT ref: 00007FF7EAF0C343
_errno.LIBCMT ref: 00007FF7EAF0C3B6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF0C3C1
write_multi_char.LIBCMT ref: 00007FF7EAF0C9AB
write_multi_char.LIBCMT ref: 00007FF7EAF0C9DD
write_multi_char.LIBCMT ref: 00007FF7EAF0CA7E
free.LIBCMT ref: 00007FF7EAF0CA96
write_char.LIBCMT ref: 00007FF7EAF0CBE9
write_char.LIBCMT ref: 00007FF7EAF0CC14

Strings

@, xrefs: 00007FF7EAF0C32F
4 =X, xrefs: 00007FF7EAF0C2AB
, xrefs: 00007FF7EAF0C97B

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: write_multi_char$_errno_invalid_parameter_noinfowrite_char$_fileno_getptdfree
String ID: $@$4 =X
API String ID: 1084558760-3397723757
Opcode ID: d243f7bfa6fd055a53a23daff3e65f4d6fa7b73664807df99c45da9877ccf527
Instruction ID: 344c46987539f1a1a9c610b0a697c606669e4045692c7bece0f0e388324c29f6
Opcode Fuzzy Hash: d243f7bfa6fd055a53a23daff3e65f4d6fa7b73664807df99c45da9877ccf527
Instruction Fuzzy Hash: AF52C262D0C68286FB64AB1494843FEEFA0BB4578CF9450B7DA4D476D5CF3CE8428762

Function 00007FF7EAF0AD44 Relevance: 34.0, APIs: 16, Strings: 3, Instructions: 705COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7EAF0ABF8: _getptd.LIBCMT ref: 00007FF7EAF0AC0A

_errno.LIBCMT ref: 00007FF7EAF0ADB2
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF0ADBD
_fileno.LIBCMT ref: 00007FF7EAF0ADF5
_errno.LIBCMT ref: 00007FF7EAF0AE66
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF0AE71
write_multi_char.LIBCMT ref: 00007FF7EAF0B43E
write_multi_char.LIBCMT ref: 00007FF7EAF0B470
write_multi_char.LIBCMT ref: 00007FF7EAF0B51C
free.LIBCMT ref: 00007FF7EAF0B535
write_char.LIBCMT ref: 00007FF7EAF0B674
write_char.LIBCMT ref: 00007FF7EAF0B695

Strings

, xrefs: 00007FF7EAF0B40E
@, xrefs: 00007FF7EAF0ADE1
4 =X, xrefs: 00007FF7EAF0AD63

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: write_multi_char$_errno_invalid_parameter_noinfowrite_char$_fileno_getptdfree
String ID: $@$4 =X
API String ID: 1084558760-3397723757
Opcode ID: 658b0638e96a2018847d66b84efea279705a0a6da686782ae5e0afd207c87506
Instruction ID: 03190aef60c9c2323877da4febadd6e977c8b715212709ee9fa7412c8961c6b9
Opcode Fuzzy Hash: 658b0638e96a2018847d66b84efea279705a0a6da686782ae5e0afd207c87506
Instruction Fuzzy Hash: 4E52D172A0C64286FB25AB1594A43FEEBA1BF4178CF9400B7DA4D476D4CF3DE9418722

Function 028EF7F8 Relevance: 32.2, APIs: 16, Strings: 2, Instructions: 721COMMON

Download Yara Rule

APIs

Part of subcall function 028E5D58: _getptd.LIBCMT ref: 028E5D6A

_errno.LIBCMT ref: 028EF86B
_invalid_parameter_noinfo.LIBCMT ref: 028EF876
_fileno.LIBCMT ref: 028EF8AF
_errno.LIBCMT ref: 028EF922
_invalid_parameter_noinfo.LIBCMT ref: 028EF92D
write_multi_char.LIBCMT ref: 028EFF17
write_multi_char.LIBCMT ref: 028EFF49
write_multi_char.LIBCMT ref: 028EFFEA
free.LIBCMT ref: 028F0002
write_char.LIBCMT ref: 028F0155
write_char.LIBCMT ref: 028F0180

Strings

, xrefs: 028EFEE7
@, xrefs: 028EF89B

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: write_multi_char$_errno_invalid_parameter_noinfowrite_char$_fileno_getptdfree
String ID: $@
API String ID: 1084558760-1077428164
Opcode ID: 31021c2067d085c0454d8c7067c24b124113c16c95e1c297d08e01cef2dc35d1
Instruction ID: ab0d5349679adca94cd67f1f10bb41e03b1d6b7c7c06121a9ce645976fc2e843
Opcode Fuzzy Hash: 31021c2067d085c0454d8c7067c24b124113c16c95e1c297d08e01cef2dc35d1
Instruction Fuzzy Hash: 3242037E6086948AEF258B68D54436E6B61F79678CF245016DF8FCBEA9CB38D440CB01

Function 028ECAF0 Relevance: 32.2, APIs: 16, Strings: 2, Instructions: 705COMMON

Download Yara Rule

APIs

Part of subcall function 028E5D58: _getptd.LIBCMT ref: 028E5D6A

_errno.LIBCMT ref: 028ECB5E
_invalid_parameter_noinfo.LIBCMT ref: 028ECB69
_fileno.LIBCMT ref: 028ECBA1
_errno.LIBCMT ref: 028ECC12
_invalid_parameter_noinfo.LIBCMT ref: 028ECC1D
write_multi_char.LIBCMT ref: 028ED1EA
write_multi_char.LIBCMT ref: 028ED21C
write_multi_char.LIBCMT ref: 028ED2C8
free.LIBCMT ref: 028ED2E1
write_char.LIBCMT ref: 028ED420
write_char.LIBCMT ref: 028ED441

Strings

, xrefs: 028ED1BA
@, xrefs: 028ECB8D

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: write_multi_char$_errno_invalid_parameter_noinfowrite_char$_fileno_getptdfree
String ID: $@
API String ID: 1084558760-1077428164
Opcode ID: 05a20d28553c211704cee2d079a16fefcc52b84031c588591049e201ff99e02a
Instruction ID: 62fefb7d633ac7e3749a7d248cfcaa3508b2d992e620bbbd1c89b7f68148f47c
Opcode Fuzzy Hash: 05a20d28553c211704cee2d079a16fefcc52b84031c588591049e201ff99e02a
Instruction Fuzzy Hash: 3942457EA0868486EF24CB69D44436E6B65F747B8CF185406DF4FCBAA8DB78C449CB01

Function 028F64D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 194COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 028F64EB

Part of subcall function 028EE2A0: _amsg_exit.LIBCMT ref: 028EE2B6

GetUserDefaultLCID.KERNEL32 ref: 028F65EB
GetLocaleInfoW.KERNEL32 ref: 028F664F
IsValidCodePage.KERNEL32 ref: 028F66C1
IsValidLocale.KERNEL32 ref: 028F66D7
GetLocaleInfoA.KERNEL32 ref: 028F6751
GetLocaleInfoA.KERNEL32 ref: 028F676E
_itow_s.LIBCMT ref: 028F678C

Strings

ACP, xrefs: 028F6618
OCP, xrefs: 028F662B
Norwegian-Nynorsk, xrefs: 028F6712

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Locale$Info$Valid$CodeDefaultPageUser_amsg_exit_getptd_itow_s
String ID: ACP$Norwegian-Nynorsk$OCP
API String ID: 1236750932-4064345498
Opcode ID: 17f155d1a20899a33dc3228db81f5d43d89035944164128f7a0bb378649ebebe
Instruction ID: 7ab7c6d06e18200ff91f4fc05eb18c2957e979c226a7cdc980734d9c8838e0ca
Opcode Fuzzy Hash: 17f155d1a20899a33dc3228db81f5d43d89035944164128f7a0bb378649ebebe
Instruction Fuzzy Hash: 9C71DE7E30079186EBA59F25D5487A973A9FB48B48F488626CF2EC7688EF7CC445C701

Function 028DF780 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 143stringprocessCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 028DF813
lstrlenW.KERNEL32 ref: 028DF835
wsprintfW.USER32 ref: 028DF891
ExpandEnvironmentStringsW.KERNEL32 ref: 028DF8F8
lstrcatW.KERNEL32 ref: 028DF933
lstrcatW.KERNEL32 ref: 028DF940
lstrcpyW.KERNEL32 ref: 028DF94E
CreateProcessW.KERNEL32 ref: 028DF9BD

Strings

"%1, xrefs: 028DF8FE
, xrefs: 028DF822
h, xrefs: 028DF964
%s\shell\open\command, xrefs: 028DF883
WinSta0\Default, xrefs: 028DF970

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: lstrcatlstrlen$CreateEnvironmentExpandProcessStringslstrcpywsprintf
String ID: $"%1$%s\shell\open\command$WinSta0\Default$h
API String ID: 1783372451-2159495357
Opcode ID: 54d531e1116d6a20a640fdccb851d837489f22f5e5196c252e91730f8c9a5c56
Instruction ID: 0b5eb0a88798eccc3d46784c9cc3e21669526fcd5f9d0d100c3232f5f4578d14
Opcode Fuzzy Hash: 54d531e1116d6a20a640fdccb851d837489f22f5e5196c252e91730f8c9a5c56
Instruction Fuzzy Hash: 7951503A711A86A5EF20DF65E8543ED73A6FB99748F844025CB4E87E58EF38C209C741

Function 028D9710 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 112libraryloaderfileCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 028D9746
GetProcAddress.KERNEL32 ref: 028D9759
GetProcAddress.KERNEL32 ref: 028D976C
GetProcAddress.KERNEL32 ref: 028D977F
GetProcAddress.KERNEL32 ref: 028D9792
CreateFileW.KERNEL32 ref: 028D97FF
WriteFile.KERNEL32 ref: 028D984F
CloseHandle.KERNEL32 ref: 028D9872

Strings

InternetOpenW, xrefs: 028D974C
wininet.dll, xrefs: 028D973C
InternetOpenUrlW, xrefs: 028D975F
InternetCloseHandle, xrefs: 028D9772
InternetReadFile, xrefs: 028D9785

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: AddressProc$File$CloseCreateHandleLibraryLoadWrite
String ID: InternetCloseHandle$InternetOpenUrlW$InternetOpenW$InternetReadFile$wininet.dll
API String ID: 933684181-1032619545
Opcode ID: d6150c431756500377e6d13ee1469ee8492a15e05ab10de94b05086a6ef9d668
Instruction ID: b7b27b94bd24c2b573569d01ee7613bbfa8390320f8f1da65be1704b8690faea
Opcode Fuzzy Hash: d6150c431756500377e6d13ee1469ee8492a15e05ab10de94b05086a6ef9d668
Instruction Fuzzy Hash: E941CF2930165686EF20DF22F954B5A6360FB89BE8F445126EF4E47B94EF3CC04ACB04

Function 028A2A51 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 704COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 028A2AA7
_errno.LIBCMT ref: 028A2AAE
_invalid_parameter_noinfo.LIBCMT ref: 028A2AB9

Strings

U, xrefs: 028A3035

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: bdc9c5b48201d5cab8793ea432b9ced24bb94fac02a96976a29fb9171e5abc2b
Instruction ID: b977864dd5898da505a8c2e416c17c9fe04f67546c856305926c36bf3ba70eac
Opcode Fuzzy Hash: bdc9c5b48201d5cab8793ea432b9ced24bb94fac02a96976a29fb9171e5abc2b
Instruction Fuzzy Hash: CD221739218A498BE729DF2CC8557BAB3E1FB85704F54065EE88BC3155DF78E442CB82

Function 00007FF7EAF06C80 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 101threadinjectionprocessCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 00007FF7EAF06D2B
CreateProcessA.KERNEL32 ref: 00007FF7EAF06D92
VirtualAllocEx.KERNEL32 ref: 00007FF7EAF06DC1
WriteProcessMemory.KERNEL32 ref: 00007FF7EAF06DE0
GetThreadContext.KERNEL32 ref: 00007FF7EAF06E01
SetThreadContext.KERNEL32 ref: 00007FF7EAF06E1F
ResumeThread.KERNEL32 ref: 00007FF7EAF06E31

Strings

h, xrefs: 00007FF7EAF06CF5
Windows\System32\tracerpt.exe, xrefs: 00007FF7EAF06D31
4 =X, xrefs: 00007FF7EAF06C90
%s%s, xrefs: 00007FF7EAF06D40
@, xrefs: 00007FF7EAF06DB6

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Thread$ContextProcess$AllocCreateDirectoryMemoryResumeSystemVirtualWrite
String ID: %s%s$@$Windows\System32\tracerpt.exe$h$4 =X
API String ID: 4033188109-199312535
Opcode ID: ccbe77caa5910820af2e6a65459cec20809b89b451be36ee65506754dcdfb72f
Instruction ID: 05b0c9f72bcf443d1ee7a28430eb7945a8be01a55bf4dac9a78ec49cc42cd489
Opcode Fuzzy Hash: ccbe77caa5910820af2e6a65459cec20809b89b451be36ee65506754dcdfb72f
Instruction Fuzzy Hash: 9E419032608A82C5F720DF21E8407AAF3A5FB88B88F844076DA8D57A59DF7DD114CB51

Function 028F11B0 Relevance: 20.3, APIs: 13, Instructions: 753COMMON

Download Yara Rule

APIs

Part of subcall function 028E5D58: _getptd.LIBCMT ref: 028E5D6A

_errno.LIBCMT ref: 028F1227
_invalid_parameter_noinfo.LIBCMT ref: 028F1232
DecodePointer.KERNEL32 ref: 028F180C
DecodePointer.KERNEL32 ref: 028F184D
DecodePointer.KERNEL32 ref: 028F1872
write_multi_char.LIBCMT ref: 028F190C
write_multi_char.LIBCMT ref: 028F1941
write_char.LIBCMT ref: 028F198D
write_multi_char.LIBCMT ref: 028F19E5
free.LIBCMT ref: 028F1A0C
_errno.LIBCMT ref: 028F1CC7
_invalid_parameter_noinfo.LIBCMT ref: 028F1CD2

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: DecodePointerwrite_multi_char$_errno_invalid_parameter_noinfo$_getptdfreewrite_char
String ID:
API String ID: 3562693915-0
Opcode ID: bc92f02487514a25376101322b4642a7744a5028b2d178466429d84a6f2868f6
Instruction ID: a711cc220d32b991230f36e2e0b35b8f7aec75b10f13093c2da677b170d037c6
Opcode Fuzzy Hash: bc92f02487514a25376101322b4642a7744a5028b2d178466429d84a6f2868f6
Instruction Fuzzy Hash: EB42117E608684C6EBA48B69D44837E7BB1F781B98F284116DF4EC7B94EB78C440CB40

Function 00007FF7EAF0A30C Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 159fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 00007FF7EAF0A351
_set_error_mode.LIBCMT ref: 00007FF7EAF0A362
GetModuleFileNameW.KERNEL32 ref: 00007FF7EAF0A3C4

Part of subcall function 00007FF7EAF0A740: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7EAF0A7E2), ref: 00007FF7EAF0A758

GetStdHandle.KERNEL32 ref: 00007FF7EAF0A4D9
WriteFile.KERNEL32 ref: 00007FF7EAF0A536

Strings

..., xrefs: 00007FF7EAF0A416
Microsoft Visual C++ Runtime Library, xrefs: 00007FF7EAF0A47D
4 =X, xrefs: 00007FF7EAF0A327
ceil, xrefs: 00007FF7EAF0A31C
<program name unknown>, xrefs: 00007FF7EAF0A3D3
Runtime Error!Program: , xrefs: 00007FF7EAF0A391

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: File_set_error_mode$CurrentHandleModuleNameProcessWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $ceil$4 =X
API String ID: 2183313154-3943113617
Opcode ID: 44de1f721c027da7a128cc94a5ad70c9ea0fd816ea6c17f66893cfbd735dff7b
Instruction ID: 6d5706290bc592306c7152fc107d373b0c09b1a09142fd288f91cfe61ced44b8
Opcode Fuzzy Hash: 44de1f721c027da7a128cc94a5ad70c9ea0fd816ea6c17f66893cfbd735dff7b
Instruction Fuzzy Hash: 5951F026B1864242FA24F725A4957FAE391FF84788FC041B3EE5D43AC6DF3CE5058622

Function 028DF9F0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 138registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 028DFA66
RegQueryValueExW.ADVAPI32 ref: 028DFAD9
lstrcpyW.KERNEL32 ref: 028DFC30
RegCloseKey.ADVAPI32 ref: 028DFC42
RegCloseKey.ADVAPI32 ref: 028DFC4D

Strings

%08X, xrefs: 028DFBDE

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Close$OpenQueryValuelstrcpy
String ID: %08X
API String ID: 2032971926-3773563069
Opcode ID: c2a72af7cd4d9dea37f8adda51eae86c958a48e7627d6465d88933fe7cc9852a
Instruction ID: 06065408d5b29283b646ff4580d71f46ef6575faa07505c900f5e2621bc064ae
Opcode Fuzzy Hash: c2a72af7cd4d9dea37f8adda51eae86c958a48e7627d6465d88933fe7cc9852a
Instruction Fuzzy Hash: 6851927A318A8096EB60CB15E48475BB3A1F7D5794F844121EB8E83FA8DF3CC14ADB04

Function 028D98B0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 102threadinjectionprocessCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 028D9950
CreateProcessA.KERNEL32 ref: 028D99B8
VirtualAllocEx.KERNEL32 ref: 028D99E9
WriteProcessMemory.KERNEL32 ref: 028D9A0A
GetThreadContext.KERNEL32 ref: 028D9A24
SetThreadContext.KERNEL32 ref: 028D9A3E
ResumeThread.KERNEL32 ref: 028D9A51

Strings

Windows\System32\svchost.exe, xrefs: 028D9956
@, xrefs: 028D99DE
h, xrefs: 028D9924
%s%s, xrefs: 028D9964

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Thread$ContextProcess$AllocCreateDirectoryMemoryResumeSystemVirtualWrite
String ID: %s%s$@$Windows\System32\svchost.exe$h
API String ID: 4033188109-2160973000
Opcode ID: b6f8f76f77b8939cad6e718b63c87dbebd1556e480dab9f1ae0319387c511c4a
Instruction ID: 390215165185c2c497c2b470b60d9eea567588275cad9da068edc00740af0cae
Opcode Fuzzy Hash: b6f8f76f77b8939cad6e718b63c87dbebd1556e480dab9f1ae0319387c511c4a
Instruction Fuzzy Hash: ED41AE3A204BC185EB20CF65F84479AB7A5F788788F444125DB8D9BE68DF7CC219CB04

Function 028D8F30 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 028D8F45
OpenProcessToken.ADVAPI32 ref: 028D8F58
LookupPrivilegeValueW.ADVAPI32 ref: 028D8F78
AdjustTokenPrivileges.ADVAPI32 ref: 028D8FA2
CloseHandle.KERNEL32 ref: 028D8FAD
GetModuleHandleA.KERNEL32 ref: 028D8FBA
GetProcAddress.KERNEL32 ref: 028D8FCA
OpenProcess.KERNEL32 ref: 028D9002

Strings

NtDll.dll, xrefs: 028D8FB3
SeDebugPrivilege, xrefs: 028D8F67
NtSetInformationProcess, xrefs: 028D8FC0

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Process$HandleOpenToken$AddressAdjustCloseCurrentLookupModulePrivilegePrivilegesProcValue
String ID: NtDll.dll$NtSetInformationProcess$SeDebugPrivilege
API String ID: 2787840106-1577477132
Opcode ID: d7562ad186f9c76f12a185dc633e30c61f1f79ca552b767149f0c40940437c0f
Instruction ID: e27568fa1a767d33c850b0cbfea2177013eaa0e3b9a056ce89ee5fd683413f71
Opcode Fuzzy Hash: d7562ad186f9c76f12a185dc633e30c61f1f79ca552b767149f0c40940437c0f
Instruction Fuzzy Hash: 9621807A315B4586EB50DB61F45835A73A0FBD9B48F804125DB4E87B54EF7CC18ACB40

Function 028DC400 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 169timeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 028DC440
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 028DC507
CreateEventW.KERNEL32 ref: 028DC548
CreateEventW.KERNEL32 ref: 028DC576
CreateEventW.KERNEL32 ref: 028DC5A4
timeGetTime.WINMM ref: 028DC6BA
CreateEventW.KERNEL32 ref: 028DC6CF
CreateEventW.KERNEL32 ref: 028DC6E3

Strings

<, xrefs: 028DC487
<, xrefs: 028DC48E

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CreateEvent$CountCriticalInitializeSectionSpinTimetime
String ID: <$<
API String ID: 4111701721-213342407
Opcode ID: 50d1c9d799ae0883ac624c27727ad0547cbe81534f72b6f884d53c983f92a473
Instruction ID: 2110bebd26c98d5c72a9815c1eb0569d6bfd8b1ecc0268e4df6df264f5f8ae7d
Opcode Fuzzy Hash: 50d1c9d799ae0883ac624c27727ad0547cbe81534f72b6f884d53c983f92a473
Instruction Fuzzy Hash: 7F818876201B9186E7489F34E85879D33A9F744F48F18823EEF598BB98CF798055CB60

Function 028ED638 Relevance: 17.2, APIs: 11, Instructions: 726COMMON

Download Yara Rule

APIs

Part of subcall function 028E5D58: _getptd.LIBCMT ref: 028E5D6A

_errno.LIBCMT ref: 028ED6AF
_invalid_parameter_noinfo.LIBCMT ref: 028ED6BA
DecodePointer.KERNEL32 ref: 028EDC76
DecodePointer.KERNEL32 ref: 028EDCB7
DecodePointer.KERNEL32 ref: 028EDCDC
write_multi_char.LIBCMT ref: 028EDD6E
write_multi_char.LIBCMT ref: 028EDDA3
write_char.LIBCMT ref: 028EDDF2
write_multi_char.LIBCMT ref: 028EDE4A

Part of subcall function 028ED58C: _errno.LIBCMT ref: 028ED5B0

free.LIBCMT ref: 028EDE71

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: DecodePointerwrite_multi_char$_errno$_getptd_invalid_parameter_noinfofreewrite_char
String ID:
API String ID: 1806013980-0
Opcode ID: ad5dc8c6d453ef80dc2af73f091d094140f259a576a89b482918a6d22b0a735b
Instruction ID: 189f530c822dec93b6449408759e4d16cb33aa3ad7e2b5de6f9c8bcb50911e59
Opcode Fuzzy Hash: ad5dc8c6d453ef80dc2af73f091d094140f259a576a89b482918a6d22b0a735b
Instruction Fuzzy Hash: 3F42017E60868486EF248B69E44036E77B9F783B98F145416DF4BCBB94EB79C448CB00

Function 028EC15C Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 159fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 028EC1A1
_set_error_mode.LIBCMT ref: 028EC1B2
GetModuleFileNameW.KERNEL32 ref: 028EC214
GetStdHandle.KERNEL32 ref: 028EC329
WriteFile.KERNEL32 ref: 028EC386

Strings

..., xrefs: 028EC266
Runtime Error!Program: , xrefs: 028EC1E1
<program name unknown>, xrefs: 028EC223
Microsoft Visual C++ Runtime Library, xrefs: 028EC2CD

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: File_set_error_mode$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1085760375-4022980321
Opcode ID: e5986bc7307d270abcff6f1ccec38af2cc00fd336f8f20fecfb491107040158e
Instruction ID: 69982ca35bf66393e366a1ce22db2913d8ef5ca909e099dd46f748b4eeeef9a3
Opcode Fuzzy Hash: e5986bc7307d270abcff6f1ccec38af2cc00fd336f8f20fecfb491107040158e
Instruction Fuzzy Hash: E251D52EB0479086EF24DB7AB81475A7356FB8AB84F984526DE6E83B44DF3CC105CB05

Function 00007FF7EAF08AD0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7EAF09B2F
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7EAF09B4E
RtlVirtualUnwind.KERNEL32 ref: 00007FF7EAF09B9A
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7EAF0A727), ref: 00007FF7EAF09C0C
SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7EAF0A727), ref: 00007FF7EAF09C24
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7EAF0A727), ref: 00007FF7EAF09C31
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7EAF0A727), ref: 00007FF7EAF09C4A
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF7EAF0A727), ref: 00007FF7EAF09C58

Strings

4 =X, xrefs: 00007FF7EAF09BF4

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID: 4 =X
API String ID: 3778485334-3147943113
Opcode ID: a174535eb0d5241deb48ece9e46a2be905d6ec3f467502f47f0e199c436921ae
Instruction ID: 892bd083428e974f403ab27af8fa4103743f9fa18d0cdffa4f5e49cf1cc3f98f
Opcode Fuzzy Hash: a174535eb0d5241deb48ece9e46a2be905d6ec3f467502f47f0e199c436921ae
Instruction Fuzzy Hash: 6431FA36908B4689F750AB10F4903EAF3A0FB54794FD001B7D98D42BA5DF7CE5448762

Function 02895CE1 Relevance: 15.4, APIs: 10, Instructions: 379COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02895D03
_invalid_parameter_noinfo.LIBCMT ref: 02895D0F
_errno.LIBCMT ref: 02895D39
__tzset.LIBCMT ref: 02895D56
_get_daylight.LIBCMT ref: 02895D5F
_get_daylight.LIBCMT ref: 02895D70
_get_daylight.LIBCMT ref: 02895D81
_isindst.LIBCMT ref: 02895DC5
_isindst.LIBCMT ref: 02895E15
__getgmtimebuf.LIBCMT ref: 0289600F

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: d0b0b07664f7923d28e5a94db292f98a3d0de7146a782759a966602d04d626a2
Instruction ID: ed0813c3c4fcaeaac69ef199322f016f544b91a4867d3daf61a8bf0e6b22bd2d
Opcode Fuzzy Hash: d0b0b07664f7923d28e5a94db292f98a3d0de7146a782759a966602d04d626a2
Instruction Fuzzy Hash: C7A1F538720A0D4BDF1CAF3CC8993B576D6FB58309B88817EE806CA695EF39C4418B41

Function 028E6210 Relevance: 15.3, APIs: 10, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 028E6232
_invalid_parameter_noinfo.LIBCMT ref: 028E623E
_errno.LIBCMT ref: 028E6268
__tzset.LIBCMT ref: 028E6285
_get_daylight.LIBCMT ref: 028E628E
_get_daylight.LIBCMT ref: 028E629F
_get_daylight.LIBCMT ref: 028E62B0
_isindst.LIBCMT ref: 028E62F4
_isindst.LIBCMT ref: 028E6344
__getgmtimebuf.LIBCMT ref: 028E653E

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: ca602d25d8eb287b63d5ce25630cc380058b8eb99ea07defbe7c3c6da1f0924f
Instruction ID: 820789775021fee70863bd54ec0aa169aef708c3e5a5f8eee273a2780575df4b
Opcode Fuzzy Hash: ca602d25d8eb287b63d5ce25630cc380058b8eb99ea07defbe7c3c6da1f0924f
Instruction Fuzzy Hash: F781C5BBB007558BDF68DF39C95576967AAEB55788F049026DB0ECBB49FB38D1008B00

Function 00007FF7EAF0A5F4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7EAF0A661
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7EAF0A679
RtlVirtualUnwind.KERNEL32 ref: 00007FF7EAF0A6B3
IsDebuggerPresent.KERNEL32 ref: 00007FF7EAF0A6E9
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7EAF0A6F3
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7EAF0A6FE

Strings

4 =X, xrefs: 00007FF7EAF0A611
ceil, xrefs: 00007FF7EAF0A600

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID: ceil$4 =X
API String ID: 1239891234-3982518086
Opcode ID: 3144257c3ae2fa2d6dbd42b967809008da2bff6455cce039acfe86bdf2b0df6d
Instruction ID: 4250cfbdc0ea01a0a1323c1beb38bc346e2983fc72913900fe7883aefdb12f0c
Opcode Fuzzy Hash: 3144257c3ae2fa2d6dbd42b967809008da2bff6455cce039acfe86bdf2b0df6d
Instruction Fuzzy Hash: BB315332608B8186EB20EF25E4403EEB3A4FB94798F90017AEA9D43B95DF3CD545CB51

Function 00007FF7EAF124BC Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7EAF0ABF8: _getptd.LIBCMT ref: 00007FF7EAF0AC0A

_errno.LIBCMT ref: 00007FF7EAF1250C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF12516
_errno.LIBCMT ref: 00007FF7EAF12538
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF12544
_errno.LIBCMT ref: 00007FF7EAF1256C
_cftoe_l.LIBCMT ref: 00007FF7EAF125B0

Strings

gfffffff, xrefs: 00007FF7EAF1283B

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$_cftoe_l_getptd
String ID: gfffffff
API String ID: 1282097019-1523873471
Opcode ID: c07b627f99c2cd4ae9dd9b17e96f21b7b9fb9e47b31fd93882c95997571751ba
Instruction ID: c5d420298dce70629d0015d25c8a9a841df4d11106513d505661060a2b53f4c4
Opcode Fuzzy Hash: c07b627f99c2cd4ae9dd9b17e96f21b7b9fb9e47b31fd93882c95997571751ba
Instruction Fuzzy Hash: 8CB14563B0838646FB119B6585843EDABA5EB217D4F848673CB5D077D6EB3CE411C322

Function 028F9F10 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 028E5D58: _getptd.LIBCMT ref: 028E5D6A

_errno.LIBCMT ref: 028F9F60
_invalid_parameter_noinfo.LIBCMT ref: 028F9F6A
_errno.LIBCMT ref: 028F9F8C
_invalid_parameter_noinfo.LIBCMT ref: 028F9F98
_errno.LIBCMT ref: 028F9FC0
_cftoe_l.LIBCMT ref: 028FA004

Strings

gfffffff, xrefs: 028FA28F

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$_cftoe_l_getptd
String ID: gfffffff
API String ID: 1282097019-1523873471
Opcode ID: 40567e23988eced43aa24d02cbaa15b7a2f64439647f845c3efe33468047d7e4
Instruction ID: 1871c5289f8bbbd4beb2bd903bd865a3f8ac960a973e8f5cd3d9cda7b6ee3947
Opcode Fuzzy Hash: 40567e23988eced43aa24d02cbaa15b7a2f64439647f845c3efe33468047d7e4
Instruction Fuzzy Hash: F1A1526F7043C88ADB89CB29D6403AD7BA5E7127E8F15C621CF5E87B95E7398064C301

Function 028DA670 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75injectionmemorysynchronizationCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32 ref: 028DA6A2
WriteProcessMemory.KERNEL32 ref: 028DA70E
WriteProcessMemory.KERNEL32 ref: 028DA735
CreateRemoteThread.KERNEL32 ref: 028DA75A
WaitForSingleObject.KERNEL32 ref: 028DA76B
VirtualFreeEx.KERNEL32 ref: 028DA782

Strings

@, xrefs: 028DA69A

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: MemoryProcessVirtualWrite$AllocCreateFreeObjectRemoteSingleThreadWait
String ID: @
API String ID: 1392168757-2766056989
Opcode ID: 1d0e15d9e6b6db6943f3edc044253c50b2dda0163e44e70869125fe5ad0bacd3
Instruction ID: f2097ec537379fc0f2bfc9e8e023f5cc70b1c2546a0cfb51b55a15b4eae31215
Opcode Fuzzy Hash: 1d0e15d9e6b6db6943f3edc044253c50b2dda0163e44e70869125fe5ad0bacd3
Instruction Fuzzy Hash: CE311A3A205B8486E764CB25F90874AB7A4F799B94F648225EBCC43F58DF3CC155CB44

Function 028DAB60 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 028DAB77
OpenProcessToken.ADVAPI32 ref: 028DAB88
LookupPrivilegeValueW.ADVAPI32 ref: 028DABA8
AdjustTokenPrivileges.ADVAPI32 ref: 028DABD0
GetLastError.KERNEL32 ref: 028DABD6
CloseHandle.KERNEL32 ref: 028DABE6

Strings

SeDebugPrivilege, xrefs: 028DAB97

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3398352648-2896544425
Opcode ID: f912f805f90fedc5f3d9f29b34704b1a31fd86a9546a1cec50171bf6703898f4
Instruction ID: 0cb67ba9960ca358b3e2bbb56d5162af18b7ae297e64d076320563e8e27a5e41
Opcode Fuzzy Hash: f912f805f90fedc5f3d9f29b34704b1a31fd86a9546a1cec50171bf6703898f4
Instruction Fuzzy Hash: F4018C76225B4686EB40CF21F88835A73B0F798B48F805125EA8E83B68DF3CC049CB40

Function 028E4F50 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 028EBA43
RtlLookupFunctionEntry.KERNEL32 ref: 028EBA62
RtlVirtualUnwind.KERNEL32 ref: 028EBAAE
IsDebuggerPresent.KERNEL32 ref: 028EBB20
SetUnhandledExceptionFilter.KERNEL32 ref: 028EBB38
UnhandledExceptionFilter.KERNEL32 ref: 028EBB45
GetCurrentProcess.KERNEL32 ref: 028EBB5E
TerminateProcess.KERNEL32 ref: 028EBB6C

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: 2aa89304d9d681174ee0ff907444ba6424267dead1d14bc8b1f46d942951e3dd
Instruction ID: 25985ba7a98c2eac8b8b6dff86b642a2142ba4c53f1178f7e04c37dc89955e2f
Opcode Fuzzy Hash: 2aa89304d9d681174ee0ff907444ba6424267dead1d14bc8b1f46d942951e3dd
Instruction Fuzzy Hash: 21312739205B85C9EB50DF16F88835A73B4FB89758F505126DA8E83B68EF7CC0A4CB40

Function 0289FD75 Relevance: 10.9, APIs: 7, Instructions: 423COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 0289FDA0
_get_daylight.LIBCMT ref: 0289FDB6

Part of subcall function 028A0B11: _errno.LIBCMT ref: 028A0B1A
Part of subcall function 028A0B11: _invalid_parameter_noinfo.LIBCMT ref: 028A0B25

_get_daylight.LIBCMT ref: 0289FDCB

Part of subcall function 028A0AB1: _errno.LIBCMT ref: 028A0ABA
Part of subcall function 028A0AB1: _invalid_parameter_noinfo.LIBCMT ref: 028A0AC5

_get_daylight.LIBCMT ref: 0289FDE0

Part of subcall function 028A0AE1: _errno.LIBCMT ref: 028A0AEA
Part of subcall function 028A0AE1: _invalid_parameter_noinfo.LIBCMT ref: 028A0AF5

___lc_codepage_func.LIBCMT ref: 0289FDED

Part of subcall function 0289A4C1: _getptd.LIBCMT ref: 0289A4C5

Part of subcall function 028A7361: __wtomb_environ.LIBCMT ref: 028A7391

free.LIBCMT ref: 0289FE5E

Part of subcall function 02894FD1: _errno.LIBCMT ref: 02894FF1

free.LIBCMT ref: 0289FEC7

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$free$___lc_codepage_func__wtomb_environ_getptd_lock
String ID:
API String ID: 4268574505-0
Opcode ID: d84b3293b7d0006dc2a3b2afcdc44030fb0f6c8a1eb7d561264536ec50d206b1
Instruction ID: ac07305967cf64de0ebafa6adffffe6d5af6f3fdb2afd699700b23621c017d0f
Opcode Fuzzy Hash: d84b3293b7d0006dc2a3b2afcdc44030fb0f6c8a1eb7d561264536ec50d206b1
Instruction Fuzzy Hash: F7C1B23C6187444FE728EF2C98A276AB7D6FB8A704F58552E948FC3251DF3494028A82

Function 028EE8A0 Relevance: 10.6, APIs: 7, Instructions: 142COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 028EE904

Part of subcall function 028EAAE0: Sleep.KERNEL32 ref: 028EAB25

free.LIBCMT ref: 028EE982
free.LIBCMT ref: 028EE9C9
GetLocaleInfoW.KERNEL32 ref: 028EEA00
GetLocaleInfoW.KERNEL32 ref: 028EEA2A
free.LIBCMT ref: 028EEA37
GetLocaleInfoW.KERNEL32 ref: 028EEA62

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: InfoLocalefree$ErrorLastSleep
String ID:
API String ID: 3746651342-0
Opcode ID: 5519c9807eee6a0047a542e4cefa6600c4a1490a0af2f159daff0e5801246efa
Instruction ID: fe54fabcd741aa48617ef0d768c85b5d612b6c524e5bc42eaab78a0602111a73
Opcode Fuzzy Hash: 5519c9807eee6a0047a542e4cefa6600c4a1490a0af2f159daff0e5801246efa
Instruction Fuzzy Hash: 9641192EB1174442EFB5AB25A91473A62C6BBAABD9F408025CE4FC7B58EF3CC401C701

Function 028DE29A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

OpenEventLogW.ADVAPI32 ref: 028DE2C7
ClearEventLogW.ADVAPI32 ref: 028DE2DA
CloseEventLog.ADVAPI32 ref: 028DE2E3

Strings

Security, xrefs: 028DE2A5
System, xrefs: 028DE2B0
Application, xrefs: 028DE29A

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: Application$Security$System
API String ID: 1391105993-2169399579
Opcode ID: 96663923b0ee05f66fc94d5c4e2f229e10f6e7c594b8d536ad0441e8402e872b
Instruction ID: 7cb543560839694bf5fc660d53a51a14c13d018654e13be47226f8e1b0e66e61
Opcode Fuzzy Hash: 96663923b0ee05f66fc94d5c4e2f229e10f6e7c594b8d536ad0441e8402e872b
Instruction Fuzzy Hash: 2AF0AF3A202B80C9EB159B21F84439473A4F748758F0484368E4D47B54EF38C099C304

Function 028EC444 Relevance: 9.1, APIs: 6, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 028EC4B1
RtlLookupFunctionEntry.KERNEL32 ref: 028EC4C9
RtlVirtualUnwind.KERNEL32 ref: 028EC503
IsDebuggerPresent.KERNEL32 ref: 028EC539
SetUnhandledExceptionFilter.KERNEL32 ref: 028EC543
UnhandledExceptionFilter.KERNEL32 ref: 028EC54E

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 7b0809cecf96b8a01d63112d00e5d37b825e3b344302d590ad5ba3818eb37c96
Instruction ID: 0e384c35fd564ee2407e5950722a93dc3465e099240c2eaa2b5aacd713ab5c2f
Opcode Fuzzy Hash: 7b0809cecf96b8a01d63112d00e5d37b825e3b344302d590ad5ba3818eb37c96
Instruction Fuzzy Hash: 1331A43A604F8186DB64CF29E8447AE73A4F789758F500226EF9E83B58EF38C545CB00

Function 028D90B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 028D90C3
OpenProcessToken.ADVAPI32 ref: 028D90D6
LookupPrivilegeValueW.ADVAPI32 ref: 028D9105
AdjustTokenPrivileges.ADVAPI32 ref: 028D914A

Strings

SeDebugPrivilege, xrefs: 028D90FC

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 2349140579-2896544425
Opcode ID: 54d9294af7c7f8491c8ebf4ea155e670f436f307aa670cb1e1a1b6be12c31483
Instruction ID: f7c6315c5255c599860320eb131c8666b1d7dc4d2c6e3f28d5eda2a3e88cf810
Opcode Fuzzy Hash: 54d9294af7c7f8491c8ebf4ea155e670f436f307aa670cb1e1a1b6be12c31483
Instruction Fuzzy Hash: B611217A205B8186EB509F65F45934AB3A0F7D9B48F845026EA8E87F58DF7DC419CB00

Function 028D3BB0 Relevance: 7.8, APIs: 5, Instructions: 251memorytimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 028D3C7A
VirtualAlloc.KERNEL32 ref: 028D3CEF
VirtualFree.KERNEL32 ref: 028D3D29
VirtualAlloc.KERNEL32 ref: 028D3E85
VirtualFree.KERNEL32 ref: 028D3EBA

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Virtual$AllocFree$Timetime
String ID:
API String ID: 3637049079-0
Opcode ID: d02a2a73f8a004f25326808967a150621f58b1e4c2b4bce21b140e42ef69546e
Instruction ID: f13e2bf1efabbaecacaacf62496a241d97d534ac708609566f1ca4828529eddc
Opcode Fuzzy Hash: d02a2a73f8a004f25326808967a150621f58b1e4c2b4bce21b140e42ef69546e
Instruction Fuzzy Hash: E091DD7A300A849BCB19DF3AD144B6D77A6F748B88F408529DB0AC7B54DF34D4A9CB81

Function 028D5930 Relevance: 7.8, APIs: 5, Instructions: 250memorytimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 028D5A08
VirtualAlloc.KERNEL32 ref: 028D5A83
VirtualFree.KERNEL32 ref: 028D5ABD
VirtualAlloc.KERNEL32 ref: 028D5C27
VirtualFree.KERNEL32 ref: 028D5C5C

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Virtual$AllocFree$Timetime
String ID:
API String ID: 3637049079-0
Opcode ID: 4ff45d25d52f66431eb5be40b81c55b6477ffb433d7455a93790e8431ec41cdf
Instruction ID: b01716dcfa48d2dcb51707d0b1c27e49e94f3ac3482e6535dc4604e72c7bbc30
Opcode Fuzzy Hash: 4ff45d25d52f66431eb5be40b81c55b6477ffb433d7455a93790e8431ec41cdf
Instruction Fuzzy Hash: 1D91E37A300A549BCB18CF29D194B6D77A5F748B88F84852ADF0AC7B14DF38D5A9C780

Function 028F5FCC Relevance: 7.7, APIs: 5, Instructions: 165COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 028F5FF3

Part of subcall function 028EE2A0: _amsg_exit.LIBCMT ref: 028EE2B6

GetLocaleInfoA.KERNEL32 ref: 028F6028
GetLocaleInfoA.KERNEL32 ref: 028F6080
GetLocaleInfoA.KERNEL32 ref: 028F6174

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: InfoLocale$_amsg_exit_getptd
String ID:
API String ID: 3133215516-0
Opcode ID: dead16b1a6ba469c63c8a61ff96b8993c456faa74c4168f296e844b6e85b633a
Instruction ID: b051c19f3ed6483db947471231d2c77b988755bf1655c9eb73dcc31994a73321
Opcode Fuzzy Hash: dead16b1a6ba469c63c8a61ff96b8993c456faa74c4168f296e844b6e85b633a
Instruction Fuzzy Hash: 30618C3A710A85D7DB9DCF65DA447D9B365F78874AF40422AC72ACB744EB39E064CB00

Function 028F7664 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 028F76AF
GetLocaleInfoW.KERNEL32 ref: 028F7740
WideCharToMultiByte.KERNEL32 ref: 028F777B
free.LIBCMT ref: 028F778F

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: InfoLocale$ByteCharMultiWidefree
String ID:
API String ID: 40707599-0
Opcode ID: c80688ba1b9f851c9412ce80711782beb1f4ad3b40fdb5a11edd4d0460e1a132
Instruction ID: 2b6ab0d56156e4987884f0f697b9f2fbb57e913fee3493522da523189fac38a0
Opcode Fuzzy Hash: c80688ba1b9f851c9412ce80711782beb1f4ad3b40fdb5a11edd4d0460e1a132
Instruction Fuzzy Hash: 9031833E211B808AEB509F2AD80075AB7E6F754BE8F584626EB6D87B94DF38C501C710

Function 00007FF7EAF16130 Relevance: 7.0, Strings: 5, Instructions: 796COMMONLIBRARYCODE

Download Yara Rule

Strings

4 =X, xrefs: 00007FF7EAF1614C
1#INF, xrefs: 00007FF7EAF16296
1#IND, xrefs: 00007FF7EAF1625F
1#QNAN, xrefs: 00007FF7EAF162CD
1#SNAN, xrefs: 00007FF7EAF1621A

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$4 =X
API String ID: 0-1388562485
Opcode ID: e04492fe7783e9350fb6ad516c2b891bc40bfb42d811b819843ac43adcea1734
Instruction ID: cf6b6b7b7aaf13aefbb1e83319d43883e62e07aec498a437ad9280485faf421c
Opcode Fuzzy Hash: e04492fe7783e9350fb6ad516c2b891bc40bfb42d811b819843ac43adcea1734
Instruction Fuzzy Hash: 2362E676F182528AF764DF648010BFD77B1BB64348F8080B6DE0967A86EB3CE915C761

Function 028EB340 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 028EB379

Part of subcall function 028EE2A0: _amsg_exit.LIBCMT ref: 028EE2B6

Part of subcall function 028EB104: _getptd.LIBCMT ref: 028EB13E

Part of subcall function 028EAA60: malloc.LIBCMT ref: 028EAA8B
Part of subcall function 028EAA60: Sleep.KERNEL32 ref: 028EAA9E

free.LIBCMT ref: 028EB5D6
free.LIBCMT ref: 028EB60D
free.LIBCMT ref: 028EB61A

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free$_getptd$Sleep_amsg_exitmalloc
String ID:
API String ID: 1310838139-0
Opcode ID: 2980bdb756061afc6e72b67229e365e27a3a28a73530a03ba02c86501d62df8a
Instruction ID: 2fbcbe1f858550141c906ab49a945708b9278b29e7b091bb879df4c76af2f5f7
Opcode Fuzzy Hash: 2980bdb756061afc6e72b67229e365e27a3a28a73530a03ba02c86501d62df8a
Instruction Fuzzy Hash: 2391DF7E2056859ADF24DF2AE58479AB7A1F78A78CF504126DF4E87B14EF38D041CB00

Function 00007FF7EAF158CC Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 613COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7EAF1592F
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF1593A

Strings

4 =X, xrefs: 00007FF7EAF158E8

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: 4 =X
API String ID: 2959964966-3147943113
Opcode ID: 83054cf6376330cdffa8c0059fbe92ae39825d7729f5d374ebb6e6e75b54dafc
Instruction ID: 09d492bd514f122d12df111e26392ffda499f9c306c1d440fb7b5598e6a47151
Opcode Fuzzy Hash: 83054cf6376330cdffa8c0059fbe92ae39825d7729f5d374ebb6e6e75b54dafc
Instruction Fuzzy Hash: B432B462F082428AF764AF6580807FCA7A2BB30749FD440B7CE49576C7DA3DE945C722

Function 028FBFC0 Relevance: 5.8, Strings: 4, Instructions: 795COMMONLIBRARYCODE

Download Yara Rule

Strings

1#SNAN, xrefs: 028FC0AA
1#IND, xrefs: 028FC0EF
1#QNAN, xrefs: 028FC15D
1#INF, xrefs: 028FC126

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 0-2761157908
Opcode ID: 7df000bd44c2d7560c978c0048061725c1add1b8a1df7d99afdefb37d4ab0dba
Instruction ID: 484c97cac885e4f7ae988ccfadf25692ef54a1aabcbd2dc43c85d2462f723024
Opcode Fuzzy Hash: 7df000bd44c2d7560c978c0048061725c1add1b8a1df7d99afdefb37d4ab0dba
Instruction Fuzzy Hash: 6C52C07FB246598EE764CFB9C010BAD37B2B75478CB40941ADF0AA7E48E7388615CB44

Function 028A07E1 Relevance: 4.8, APIs: 3, Instructions: 302COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 028A0802
_invalid_parameter_noinfo.LIBCMT ref: 028A080E
_errno.LIBCMT ref: 028A083B

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 243fa11f22f8bdf27a2221707ecb54d1361e1111186494d5edbf34577f52ae8c
Instruction ID: d2b6b4239962568d227a3f0ed2fcfd6786266ff0c65df58ca39efc0d38e99291
Opcode Fuzzy Hash: 243fa11f22f8bdf27a2221707ecb54d1361e1111186494d5edbf34577f52ae8c
Instruction Fuzzy Hash: 03812775764C0A0FE70C9E2C8C6A3B476C6F7E831671C927EE44BCF7A6EA24D4428641

Function 028F38D0 Relevance: 4.7, APIs: 3, Instructions: 199fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 028F390A

Part of subcall function 028F2C08: _errno.LIBCMT ref: 028F2C11
Part of subcall function 028F2C08: _invalid_parameter_noinfo.LIBCMT ref: 028F2C1C

ReadFile.KERNEL32 ref: 028F39F7

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: FileRead_errno_fileno_invalid_parameter_noinfo
String ID:
API String ID: 1416837532-0
Opcode ID: 3a3ec2f55cd54558fe5de868b9918b022e0d17a6c42f39f02246569c1c4eee53
Instruction ID: dfe213819c28f914f310ced9d6dc9e6d7b95d5f1689d8cdf4884a15bb0d9aeb6
Opcode Fuzzy Hash: 3a3ec2f55cd54558fe5de868b9918b022e0d17a6c42f39f02246569c1c4eee53
Instruction Fuzzy Hash: 1571352E305BC89ADBA1DF26D5843A97B65F740BD8F58419ADF4D83B98DB38C482C700

Function 028F629C Relevance: 4.6, APIs: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 028F62BE

Part of subcall function 028EE2A0: _amsg_exit.LIBCMT ref: 028EE2B6

GetLocaleInfoA.KERNEL32 ref: 028F62F3

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: InfoLocale_amsg_exit_getptd
String ID:
API String ID: 488165793-0
Opcode ID: 6cac92d1c63c1ae72f1024ad2edac1f8a35ca82fe6274423d9bdfd73cb260d8f
Instruction ID: 62c51be1458361ea6a5a9729255f8d26457d1e56319320b142787d82f4e16f40
Opcode Fuzzy Hash: 6cac92d1c63c1ae72f1024ad2edac1f8a35ca82fe6274423d9bdfd73cb260d8f
Instruction Fuzzy Hash: 8F219C3A314AC5D7DBA88F65D9447DAB3A2F788749F444226972ECB644EF38E064CB01

Function 0288E911 Relevance: 4.2, Strings: 3, Instructions: 440COMMON

Download Yara Rule

Strings

gfff, xrefs: 0288E9E9
gfff, xrefs: 0288EA0F
, xrefs: 0288EADD

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: malloc
String ID: $gfff$gfff
API String ID: 2803490479-4202476792
Opcode ID: c3e908681918788f643dfaf2f53a5c456d5ccb5fda57e6a8831e1b144d632076
Instruction ID: 329f47e20454535b94b5d7042c2277968a504fd6f6fb8c01337537915a9fa0e2
Opcode Fuzzy Hash: c3e908681918788f643dfaf2f53a5c456d5ccb5fda57e6a8831e1b144d632076
Instruction Fuzzy Hash: 65D1B234A28B0C8FDB59EF7CD44936D77E2FF59305F14422AA44AD7251EB349852CB81

Function 02886271 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 617COMMON

Download Yara Rule

APIs

Part of subcall function 028950C9: malloc.LIBCMT ref: 028950E3

Part of subcall function 02896045: _errno.LIBCMT ref: 02896063
Part of subcall function 02896045: _invalid_parameter_noinfo.LIBCMT ref: 0289606F

Part of subcall function 02896045: _errno.LIBCMT ref: 028960B1

_localtime64.LIBCMT ref: 0288688A

Part of subcall function 028952B1: _errno.LIBCMT ref: 028952D0
Part of subcall function 028952B1: _invalid_parameter_noinfo.LIBCMT ref: 028952DC

Strings

d, xrefs: 02886653

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$_localtime64malloc
String ID: d
API String ID: 3448128200-2564639436
Opcode ID: cfb5ec3b757334179c745541fa8331162734935ea313afeefcc79cfe94a5bac1
Instruction ID: 6c9271e7083ed6dc7bb9864d636e615ddeb7b150ceb64b036b9515bb7ae2e196
Opcode Fuzzy Hash: cfb5ec3b757334179c745541fa8331162734935ea313afeefcc79cfe94a5bac1
Instruction Fuzzy Hash: 1C229839618A098FDB19FF68DC95AEAB7E5FB94301F10462AD44BC3150EF34E645CB82

Function 028FB75C Relevance: 3.6, APIs: 2, Instructions: 613COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 028FB7BF
_invalid_parameter_noinfo.LIBCMT ref: 028FB7CA

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: 5431c1d8e3f254c7f1352d9a337a4c3612d24c5e5c7be4990a54c71fefd81f21
Instruction ID: d5588d634a1b3a4af485ba18e76489eb9dcf93b447b987c7bab3d8671265aaf1
Opcode Fuzzy Hash: 5431c1d8e3f254c7f1352d9a337a4c3612d24c5e5c7be4990a54c71fefd81f21
Instruction Fuzzy Hash: 9322107FB142888AEBA48F69D0407EC3762B74C78CF94401ADF4AE7B88E7398546C701

Function 028A01F5 Relevance: 3.3, APIs: 2, Instructions: 311COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 028A0467
_get_daylight.LIBCMT ref: 028A04ED

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _get_daylight
String ID:
API String ID: 4143689357-0
Opcode ID: a7799652e9771fadd063df120e63502b2c124946250e25ebb5e0f696f08c898f
Instruction ID: 61b14a953da8639039eecd2dc9d6e44f795c396941fc4bb243924e3b9cd931ad
Opcode Fuzzy Hash: a7799652e9771fadd063df120e63502b2c124946250e25ebb5e0f696f08c898f
Instruction Fuzzy Hash: 68914879B186054FE70CDE28DDA27B573D6F799308F18D13ED887CB695EA30E5028682

Function 0289BC2D Relevance: 3.2, APIs: 2, Instructions: 240COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 0289BC72
_set_error_mode.LIBCMT ref: 0289BC83

Part of subcall function 02895C59: _errno.LIBCMT ref: 02895C78
Part of subcall function 02895C59: _invalid_parameter_noinfo.LIBCMT ref: 02895C84

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _set_error_mode$_errno_invalid_parameter_noinfo
String ID:
API String ID: 1239817535-0
Opcode ID: e5986bc7307d270abcff6f1ccec38af2cc00fd336f8f20fecfb491107040158e
Instruction ID: ad68e01c63c0f254289622f5a16e19edc888636be9ab934cfe3ff3dff03e5dc4
Opcode Fuzzy Hash: e5986bc7307d270abcff6f1ccec38af2cc00fd336f8f20fecfb491107040158e
Instruction Fuzzy Hash: 4751E63C7189084B9F2CEF2CA85966E72DAEB89308F04862EE45FC3195DF34D5468B46

Function 028F0724 Relevance: 3.2, APIs: 2, Instructions: 235COMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 028F0996

Part of subcall function 028F1010: _errno.LIBCMT ref: 028F1019
Part of subcall function 028F1010: _invalid_parameter_noinfo.LIBCMT ref: 028F1024

_get_daylight.LIBCMT ref: 028F0A1C

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _get_daylight$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3559991230-0
Opcode ID: 693b50c2c61a72bb5be5a43c63dc8e884891f7c57c6b944760cd3464cf5c7f55
Instruction ID: e0c21d06ed718b789a1a43d49e5c3d7437fd24a3afb62842960e016de35bab88
Opcode Fuzzy Hash: 693b50c2c61a72bb5be5a43c63dc8e884891f7c57c6b944760cd3464cf5c7f55
Instruction Fuzzy Hash: 4781467AB142448FD75CCB28ED91768B796F3E8344F549126DF49CBB99EB38E6008B40

Function 028F5E54 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 028F5E7B

Part of subcall function 028EE2A0: _amsg_exit.LIBCMT ref: 028EE2B6

GetLocaleInfoA.KERNEL32 ref: 028F5EB0

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: InfoLocale_amsg_exit_getptd
String ID:
API String ID: 488165793-0
Opcode ID: 51102d7755fad0e582a275416b1c3174a81ae3107a3855978bba4bc94c3584c9
Instruction ID: 358f489b2c26383b4a6520877b7baf16d771840379a8d334de83ebae71a41269
Opcode Fuzzy Hash: 51102d7755fad0e582a275416b1c3174a81ae3107a3855978bba4bc94c3584c9
Instruction Fuzzy Hash: 8311AF3A310B8497DB68CF65E8493CAB3A1F388B84F844126CB5D87B14DB3CD525CB40

Function 028DE2F7 Relevance: 3.0, APIs: 2, Instructions: 23shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 028D8E90: GetModuleFileNameW.KERNEL32 ref: 028D8EBB
Part of subcall function 028D8E90: GetCommandLineW.KERNEL32 ref: 028D8EC1
Part of subcall function 028D8E90: GetStartupInfoW.KERNEL32 ref: 028D8ECF
Part of subcall function 028D8E90: CreateProcessW.KERNEL32 ref: 028D8F12
Part of subcall function 028D8E90: ExitProcess.KERNEL32 ref: 028D8F1B

ExitProcess.KERNEL32 ref: 028DE2FF

Part of subcall function 028D9590: GetCurrentProcess.KERNEL32 ref: 028D95A7
Part of subcall function 028D9590: OpenProcessToken.ADVAPI32 ref: 028D95BA
Part of subcall function 028D9590: LookupPrivilegeValueW.ADVAPI32 ref: 028D95E5
Part of subcall function 028D9590: AdjustTokenPrivileges.ADVAPI32 ref: 028D9608
Part of subcall function 028D9590: GetLastError.KERNEL32 ref: 028D960E
Part of subcall function 028D9590: CloseHandle.KERNEL32 ref: 028D961D

ExitWindowsEx.USER32 ref: 028DE315

Part of subcall function 028D9590: CloseHandle.KERNEL32 ref: 028D9638

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Process$Exit$CloseHandleToken$AdjustCommandCreateCurrentErrorFileInfoLastLineLookupModuleNameOpenPrivilegePrivilegesStartupValueWindows
String ID:
API String ID: 2667809516-0
Opcode ID: 3c0d1a23d52f457355619f8c4f60c2d13a0e5bbfb86ce9e69f907c3db4830095
Instruction ID: b2d41a966feee7c1203addc0d4b50785492968611be9e41a2eb85ca6b0b024c1
Opcode Fuzzy Hash: 3c0d1a23d52f457355619f8c4f60c2d13a0e5bbfb86ce9e69f907c3db4830095
Instruction Fuzzy Hash: 56E0863F60544495F369B774F51539D6311BB44765F0485378B5A829C5DE3CC0DDCB01

Function 02888C41 Relevance: 2.8, Strings: 2, Instructions: 328COMMON

Download Yara Rule

Strings

@, xrefs: 02888EE6
h, xrefs: 02888CAC

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID: @$h
API String ID: 0-1029331998
Opcode ID: 356ccbaab360810557ff1889964b79b5fb888c02031f73d35a44d1c4fd0df39d
Instruction ID: 27762613a9d2623f486b6cbeb1abf4486bed076e165239158e91fe6553c2f0b5
Opcode Fuzzy Hash: 356ccbaab360810557ff1889964b79b5fb888c02031f73d35a44d1c4fd0df39d
Instruction Fuzzy Hash: 86B18330618B488FEB69EF28DC593AA77E1FB98305F10452EA44BC3150DF78D546CB86

Function 0288BED1 Relevance: 2.7, Strings: 2, Instructions: 239COMMON

Download Yara Rule

Strings

<, xrefs: 0288BF58
<, xrefs: 0288BF5F

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID: <$<
API String ID: 0-213342407
Opcode ID: 98a197b1dfcb439f9b42374c2483925932d179a832b92e6ab5457db0d87ca901
Instruction ID: 38e847dd3a705a313a3865105cd5877e6251d0fe0582574b7cd3f495a3d943df
Opcode Fuzzy Hash: 98a197b1dfcb439f9b42374c2483925932d179a832b92e6ab5457db0d87ca901
Instruction Fuzzy Hash: 119119B4614B198FDBA8DF28D4D43953BE5FB48704F1842BEAC0ECE25ADBB485458B90

Function 0288F251 Relevance: 2.7, Strings: 2, Instructions: 220COMMON

Download Yara Rule

Strings

, xrefs: 0288F2F3
h, xrefs: 0288F435

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID: $h
API String ID: 0-1972213566
Opcode ID: 124b82c8d50a204065bd587dc34c92b796fd0174f8e441d9f7b48019000610ec
Instruction ID: 91e5e38d3eb0ded376538a91c20b211af719ced19d7835ece3b8677a548301d9
Opcode Fuzzy Hash: 124b82c8d50a204065bd587dc34c92b796fd0174f8e441d9f7b48019000610ec
Instruction Fuzzy Hash: CA61A439518A4D8BDF25FF18DC546EA73A1FBA8309F54412AD44BD3150DF38D645CB82

Function 02889381 Relevance: 2.7, Strings: 2, Instructions: 164COMMON

Download Yara Rule

Strings

h, xrefs: 028893F5
@, xrefs: 028894AF

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID: @$h
API String ID: 0-1029331998
Opcode ID: 5025959564ab3faa289aa8550610bf0afeee09811a97fb26354f2346fbb6e16f
Instruction ID: a3a566408ab49b9b1499f91fbfe114b434e87e9e962004bbbdcec8f2fccf6499
Opcode Fuzzy Hash: 5025959564ab3faa289aa8550610bf0afeee09811a97fb26354f2346fbb6e16f
Instruction Fuzzy Hash: 5151A074618B888FDB24EF58DC856AAB7E6FB98305F10452EE48AC3250DF78D505CB87

Function 00007FF7EAF02880 Relevance: 1.8, Strings: 1, Instructions: 599COMMON

Download Yara Rule

Strings

[RO] %ld bytes, xrefs: 00007FF7EAF029CA, 00007FF7EAF02F28, 00007FF7EAF0308F

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID: [RO] %ld bytes
API String ID: 0-772938740
Opcode ID: 1ed3bb2f404239d74be1f07793ca469e9cb85950aa033daddafdfd33a72f81d3
Instruction ID: 511e930f789b74f9b75abf24e222ed0d90a02f442f307295d1f217a06ac89859
Opcode Fuzzy Hash: 1ed3bb2f404239d74be1f07793ca469e9cb85950aa033daddafdfd33a72f81d3
Instruction Fuzzy Hash: 6D52DF336092C48FD329CF28A44039EBBA0F765B48F44817ADBC987B45DB78E954CB61

Function 028D2850 Relevance: 1.8, Strings: 1, Instructions: 599COMMON

Download Yara Rule

Strings

[RO] %ld bytes, xrefs: 028D299A, 028D2EF8, 028D305F

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID: [RO] %ld bytes
API String ID: 0-772938740
Opcode ID: 60834e6f4583ff2073803517480cd448bedc657b73e3056a1d09e1ab8287d4ec
Instruction ID: ba3a9f1e845b61119af660b495a047b55e15871f9ad714e57dad00cbbcd50aa9
Opcode Fuzzy Hash: 60834e6f4583ff2073803517480cd448bedc657b73e3056a1d09e1ab8287d4ec
Instruction Fuzzy Hash: 3A429F7B2092C48FC329CF29A44079EBBA0F355B48F448129DBC5C7B4ADB78E959CB51

Function 028EB104 Relevance: 1.7, APIs: 1, Instructions: 156COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 028EB13E

Part of subcall function 028EE2A0: _amsg_exit.LIBCMT ref: 028EE2B6

Part of subcall function 028EBCB0: _errno.LIBCMT ref: 028EBCC8
Part of subcall function 028EBCB0: _invalid_parameter_noinfo.LIBCMT ref: 028EBCD4

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _amsg_exit_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 1050512615-0
Opcode ID: c734b78b09f0df059d01da3ff51f27225a04348e713e504a92a3e1d944d1a0e4
Instruction ID: 44e4e1c8678829f092336b99642841772fb3b5889e9c5bbe6258c8a999ebf06f
Opcode Fuzzy Hash: c734b78b09f0df059d01da3ff51f27225a04348e713e504a92a3e1d944d1a0e4
Instruction Fuzzy Hash: C351A02E31468586EF64DB66A55076EA796FB86BDCF4884219F4FC7B08DF38C006CB01

Function 028F5F3C Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 028F5F70

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b6433f08f774cc9b7ccbf9f35c9ffbfafaf009a608a4a475b2de2a5dd20ebf61
Instruction ID: 0c8b80eba92a433e3c2ffd24984a199dd5a97c8fff0bd9984434d45c73a4e2f9
Opcode Fuzzy Hash: b6433f08f774cc9b7ccbf9f35c9ffbfafaf009a608a4a475b2de2a5dd20ebf61
Instruction Fuzzy Hash: 0A01D83E600A85CADB644B69E4407597761F384F88FDA8061EB8EC7B05CB2CC5828744

Function 028F63CC Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32 ref: 028F641C

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 86c6855a89ec0db458ed3bf3d980259346bfaeada53e02e6f2725571e57c10e3
Instruction ID: 7d92df7ee3e45537ac6ea48e185e268fb4ec824c57a996cd0edb47873a4deb5d
Opcode Fuzzy Hash: 86c6855a89ec0db458ed3bf3d980259346bfaeada53e02e6f2725571e57c10e3
Instruction Fuzzy Hash: DE01D6BE6007148BEB589F34D15A36933A1F764B0DF48C215CB2D82399D7B8C1A4C781

Function 028F6464 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32 ref: 028F6499

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 77f7268211c430a149d89f8c5cb0cfbd65e001ec13637245fec6bc435423f769
Instruction ID: 99091079749e71b8cbea75a60bb3c954e699b7687d02ee8d48a62c1b84a8781c
Opcode Fuzzy Hash: 77f7268211c430a149d89f8c5cb0cfbd65e001ec13637245fec6bc435423f769
Instruction Fuzzy Hash: 7BF02BAE700A1886FB58AF35D0153A633A6E3E4B0DF18C111C71DC239EEBBCC1958741

Function 028DE327 Relevance: 1.5, APIs: 1, Instructions: 18shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 028D9590: GetCurrentProcess.KERNEL32 ref: 028D95A7
Part of subcall function 028D9590: OpenProcessToken.ADVAPI32 ref: 028D95BA
Part of subcall function 028D9590: LookupPrivilegeValueW.ADVAPI32 ref: 028D95E5
Part of subcall function 028D9590: AdjustTokenPrivileges.ADVAPI32 ref: 028D9608
Part of subcall function 028D9590: GetLastError.KERNEL32 ref: 028D960E
Part of subcall function 028D9590: CloseHandle.KERNEL32 ref: 028D961D

ExitWindowsEx.USER32 ref: 028DE336

Part of subcall function 028D9590: CloseHandle.KERNEL32 ref: 028D9638

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 1224073a08023476192b8fdb180ad1ba590ad23baeb0f21c7d276e99a92b5457
Instruction ID: 45de81537a67077ff7faff6b094a2b8702fc25851d356fc8e97148deb99e9d79
Opcode Fuzzy Hash: 1224073a08023476192b8fdb180ad1ba590ad23baeb0f21c7d276e99a92b5457
Instruction Fuzzy Hash: C8D0123F61544095F366A775F501799A711B784765F4441368A5E46581DE3880D9C601

Function 028DE348 Relevance: 1.5, APIs: 1, Instructions: 18shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 028D9590: GetCurrentProcess.KERNEL32 ref: 028D95A7
Part of subcall function 028D9590: OpenProcessToken.ADVAPI32 ref: 028D95BA
Part of subcall function 028D9590: LookupPrivilegeValueW.ADVAPI32 ref: 028D95E5
Part of subcall function 028D9590: AdjustTokenPrivileges.ADVAPI32 ref: 028D9608
Part of subcall function 028D9590: GetLastError.KERNEL32 ref: 028D960E
Part of subcall function 028D9590: CloseHandle.KERNEL32 ref: 028D961D

ExitWindowsEx.USER32 ref: 028DE357

Part of subcall function 028D9590: CloseHandle.KERNEL32 ref: 028D9638

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 3fc61ff9c0979fd17788cd91d3c036018cd6bdd26dea6f5539fe8350fcd86185
Instruction ID: d8126345d5ca357c836fd299438b89926311b62cef858636243e9d2940be1e5e
Opcode Fuzzy Hash: 3fc61ff9c0979fd17788cd91d3c036018cd6bdd26dea6f5539fe8350fcd86185
Instruction Fuzzy Hash: 03D0173F61544495F3A6AB39F9017A9A321B788769F0482368A9E86681DE3880DACA01

Function 02882E41 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

0u, xrefs: 02883026

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID: 0u
API String ID: 0-3203441087
Opcode ID: 230c60ee35afb213df79a87b6159f30a0b26ac14629d54ba8f8f21aec2be995b
Instruction ID: c2aa270302961f46b3011133093ccbdd333d747400bb96b6363cc0392691c119
Opcode Fuzzy Hash: 230c60ee35afb213df79a87b6159f30a0b26ac14629d54ba8f8f21aec2be995b
Instruction Fuzzy Hash: D191617061CB488FE764EF28D84576AB7E1FB99714F10492EE48BC3250DB38E446CB86

Function 00007FF7EAF0CF6C Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7EAF0CF77

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9a8ff2a500159e3ed63b44506368299f85c51e85dfafb5f360626af238714718
Instruction ID: a1e53be5e36486221e1f705eca7dac018b0df6cad0ef1f41355889184830acae
Opcode Fuzzy Hash: 9a8ff2a500159e3ed63b44506368299f85c51e85dfafb5f360626af238714718
Instruction Fuzzy Hash: D6B09212E15402C1E604BB219C811E053A06B6C325FD004B2C00D801A0DE3CD1DB8762

Function 02891941 Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

<, xrefs: 02891AB7

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: c07425efecb83c25766c60701dcc59ee6e7abd3dac11c29688f564b4543a0967
Instruction ID: ae91c3686f8154c6a1f007a7ef2a7bb3a6190077deec957ff8e6f471c19af0a9
Opcode Fuzzy Hash: c07425efecb83c25766c60701dcc59ee6e7abd3dac11c29688f564b4543a0967
Instruction Fuzzy Hash: 3D51A334308A488FEB54EF28D849B6A77E5FB99304F40855EE44FC72A0DB79E805CB42

Function 028EACE0 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

_.,, xrefs: 028EAD60

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID: _.,
API String ID: 0-2709443920
Opcode ID: 7ba8c07e4631684e0d76da1a4f5ad0135142228191c63919e84cd2b37062d56e
Instruction ID: 78cbf08ed32af47007dceffbee01d4f68aca719a7e5171fe393c2cc754fb3fdb
Opcode Fuzzy Hash: 7ba8c07e4631684e0d76da1a4f5ad0135142228191c63919e84cd2b37062d56e
Instruction Fuzzy Hash: 7F41E12E7007864AEF7CEA35D415B6A3752E78AB88F584915DF8BC3A45DF78C841C700

Function 02882321 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a26efb2382bebc86a84c9b0f4c2d4f5d906f26eebd129ee0a5fc2402c688c2c
Instruction ID: 88698e2c379df2fff3e4b15c5e3a5029ef4f7203a5ae90f78e8edcd59ee06689
Opcode Fuzzy Hash: 4a26efb2382bebc86a84c9b0f4c2d4f5d906f26eebd129ee0a5fc2402c688c2c
Instruction Fuzzy Hash: 62528F346187858FC729DF1C84816A9BBE0FB59700F5489AEDCCACB746D770E846CB92

Function 028DB2B0 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69569ac12d3564895eabb157a727b03a37ed29424b7d8047274a8acab6f1ff88
Instruction ID: d5c2b7c60478b80d222925273dd7cd70df83afe1f29c8a27d17ffb241f25a53e
Opcode Fuzzy Hash: 69569ac12d3564895eabb157a727b03a37ed29424b7d8047274a8acab6f1ff88
Instruction Fuzzy Hash: E322C577B785504BD71CCB19E892FA977A2F394308709A52CEA17D3F44DA3DEA06CA00

Function 02891261 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: fe5c5f6412552521fe62fd147e46515a6ebc7e01adc23d764eccdfe49d4ade41
Instruction ID: 3bd075255669f21688fe14bced20dc4fae777da0792a67a53d19e5d70c12dd4d
Opcode Fuzzy Hash: fe5c5f6412552521fe62fd147e46515a6ebc7e01adc23d764eccdfe49d4ade41
Instruction Fuzzy Hash: F902A638518648CFEB29EF28EC897E977E5FB89305F44462AD44BC71A0DF389545CB82

Function 02883681 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d85790fe404774060850294cd7f9e8d6fe2b40ab218384e9ddc9023300c67734
Instruction ID: e38ce0e6b1a5ee9a5208b43ec187280b5c0f9cc1a51108837c7c48f33aba1e50
Opcode Fuzzy Hash: d85790fe404774060850294cd7f9e8d6fe2b40ab218384e9ddc9023300c67734
Instruction Fuzzy Hash: 06B1F038608E098FDB0DEF2CC495A79B3E2FB95705714866DE85AC7645DB30E892CBC1

Function 02885401 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5221c24a0aca7a35ce8e6bb95fda48a6eff604485ecec7086a039e45792fa10a
Instruction ID: b1a24064cadd87863f0bc210a26beccb7cdd087f54d6c67533027f64e92965ff
Opcode Fuzzy Hash: 5221c24a0aca7a35ce8e6bb95fda48a6eff604485ecec7086a039e45792fa10a
Instruction Fuzzy Hash: E6B12238618E098FDB1DEF2CC485679B3E2FB94305B55822DE85AC7645DB34E892CBC0

Function 02887271 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc4f5f27ffffb8a2ccb8d492bd126fd03bcc1ac993aa5b4277202d1db652280
Instruction ID: a4f78d3bb4bffa5e4c14ed7e8e30a9f7eaeb6bd566719e08f6ff3313759d7af5
Opcode Fuzzy Hash: 2cc4f5f27ffffb8a2ccb8d492bd126fd03bcc1ac993aa5b4277202d1db652280
Instruction Fuzzy Hash: 1EA1A27851CA488FDB69EF28D8856ADB7F1FB98304F10416EE44ED7165DB34D902CB82

Function 0289A7B1 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba8c07e4631684e0d76da1a4f5ad0135142228191c63919e84cd2b37062d56e
Instruction ID: 8889dc7894011d479605347a5c8daf19b39a6b3bb3d6585f4e3f2dc7e9706715
Opcode Fuzzy Hash: 7ba8c07e4631684e0d76da1a4f5ad0135142228191c63919e84cd2b37062d56e
Instruction Fuzzy Hash: F541A13C628A584FEF2DEF38885937B72D2FB48315F1A8929D49BC3150DF24C5428682

Function 00007FF7EAF16C50 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction ID: 3c12c5bb227c18dbaae7baa3be4ad809cbc707bc63a4f0b09042fb336cd737a3
Opcode Fuzzy Hash: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction Fuzzy Hash: 2F512572B182A28BF7988F18E404FA8BB95F7A4341F91D079DB1687F42DA79DC50CB01

Function 028FCA74 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction ID: 2c0d21c8ead52aebce7ead54163a1774e92f6e166cc424545923d55fe5e22a58
Opcode Fuzzy Hash: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction Fuzzy Hash: 1E51BC7EB142A98BD768CF18E444F683BA9F794389B61E03ADB16D7F00D676C9508B00

Function 028FF190 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c14b011a5a207f0c8fe644fcfeb4399b44a10c7d0e28e6a25ea0f7d6a4dbd0
Instruction ID: 8778e7e83d16e065e4fce36e7db848534574805b5a9b7e0a51b750f06c51b123
Opcode Fuzzy Hash: 19c14b011a5a207f0c8fe644fcfeb4399b44a10c7d0e28e6a25ea0f7d6a4dbd0
Instruction Fuzzy Hash: 5411B48F58E9C50AE6B38A288CA908C2F55F4B3B2434D704FCB48CBBC1E75605598B56

Function 028A4A9D Relevance: 107.8, APIs: 86, Instructions: 270COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 028A4AB2

Part of subcall function 02894FD1: _errno.LIBCMT ref: 02894FF1

free.LIBCMT ref: 028A4ABB
free.LIBCMT ref: 028A4AC4
free.LIBCMT ref: 028A4ACD
free.LIBCMT ref: 028A4AD6
free.LIBCMT ref: 028A4ADF
free.LIBCMT ref: 028A4AE7
free.LIBCMT ref: 028A4AF0
free.LIBCMT ref: 028A4AF9
free.LIBCMT ref: 028A4B02
free.LIBCMT ref: 028A4B0B
free.LIBCMT ref: 028A4B14
free.LIBCMT ref: 028A4B1D
free.LIBCMT ref: 028A4B26
free.LIBCMT ref: 028A4B2F
free.LIBCMT ref: 028A4B38
free.LIBCMT ref: 028A4B44
free.LIBCMT ref: 028A4B50
free.LIBCMT ref: 028A4B5C
free.LIBCMT ref: 028A4B68
free.LIBCMT ref: 028A4B74
free.LIBCMT ref: 028A4B80
free.LIBCMT ref: 028A4B8C
free.LIBCMT ref: 028A4B98
free.LIBCMT ref: 028A4BA4
free.LIBCMT ref: 028A4BB0
free.LIBCMT ref: 028A4BBC
free.LIBCMT ref: 028A4BC8
free.LIBCMT ref: 028A4BD4
free.LIBCMT ref: 028A4BE0
free.LIBCMT ref: 028A4BEC
free.LIBCMT ref: 028A4BF8
free.LIBCMT ref: 028A4C04
free.LIBCMT ref: 028A4C10
free.LIBCMT ref: 028A4C1C
free.LIBCMT ref: 028A4C28
free.LIBCMT ref: 028A4C34
free.LIBCMT ref: 028A4C40
free.LIBCMT ref: 028A4C4C
free.LIBCMT ref: 028A4C58
free.LIBCMT ref: 028A4C64
free.LIBCMT ref: 028A4C70
free.LIBCMT ref: 028A4C7C
free.LIBCMT ref: 028A4C88
free.LIBCMT ref: 028A4C94
free.LIBCMT ref: 028A4CA0
free.LIBCMT ref: 028A4CAC
free.LIBCMT ref: 028A4CB8
free.LIBCMT ref: 028A4CC4
free.LIBCMT ref: 028A4CD0
free.LIBCMT ref: 028A4CDC
free.LIBCMT ref: 028A4CE8
free.LIBCMT ref: 028A4CF4
free.LIBCMT ref: 028A4D00
free.LIBCMT ref: 028A4D0C
free.LIBCMT ref: 028A4D18
free.LIBCMT ref: 028A4D24
free.LIBCMT ref: 028A4D30
free.LIBCMT ref: 028A4D3C
free.LIBCMT ref: 028A4D48
free.LIBCMT ref: 028A4D54
free.LIBCMT ref: 028A4D60
free.LIBCMT ref: 028A4D6C
free.LIBCMT ref: 028A4D78
free.LIBCMT ref: 028A4D84
free.LIBCMT ref: 028A4D90
free.LIBCMT ref: 028A4D9C
free.LIBCMT ref: 028A4DA8
free.LIBCMT ref: 028A4DB4
free.LIBCMT ref: 028A4DC0
free.LIBCMT ref: 028A4DCC
free.LIBCMT ref: 028A4DD8
free.LIBCMT ref: 028A4DE4
free.LIBCMT ref: 028A4DF0
free.LIBCMT ref: 028A4DFC
free.LIBCMT ref: 028A4E08
free.LIBCMT ref: 028A4E14
free.LIBCMT ref: 028A4E20
free.LIBCMT ref: 028A4E2C
free.LIBCMT ref: 028A4E38
free.LIBCMT ref: 028A4E44
free.LIBCMT ref: 028A4E50
free.LIBCMT ref: 028A4E5C
free.LIBCMT ref: 028A4E68
free.LIBCMT ref: 028A4E74
free.LIBCMT ref: 028A4E80

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 9aa16b22ebdf764a21f270bcfe908f430863055a3e440207fba421ff0d466c6d
Instruction ID: 0773fe2ccead1a9d17f1ac1780de1ff9d746ba6e8bc3eb41134a73665262cb56
Opcode Fuzzy Hash: 9aa16b22ebdf764a21f270bcfe908f430863055a3e440207fba421ff0d466c6d
Instruction Fuzzy Hash: A0A1653C12150A8FDA9DEBACC9E87A93353BF48340F888175884DCAD66CF525C97CB52

Function 00007FF7EAF10A90 Relevance: 107.7, APIs: 86, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF7EAF10AA5

Part of subcall function 00007FF7EAF09030: HeapFree.KERNEL32(?,?,00000000,00007FF7EAF0BA1C,?,?,?,00007FF7EAF0938D,?,?,?,?,00007FF7EAF14BEE), ref: 00007FF7EAF09046
Part of subcall function 00007FF7EAF09030: _errno.LIBCMT ref: 00007FF7EAF09050
Part of subcall function 00007FF7EAF09030: GetLastError.KERNEL32(?,?,00000000,00007FF7EAF0BA1C,?,?,?,00007FF7EAF0938D,?,?,?,?,00007FF7EAF14BEE), ref: 00007FF7EAF09058

free.LIBCMT ref: 00007FF7EAF10AAE
free.LIBCMT ref: 00007FF7EAF10AB7
free.LIBCMT ref: 00007FF7EAF10AC0
free.LIBCMT ref: 00007FF7EAF10AC9
free.LIBCMT ref: 00007FF7EAF10AD2
free.LIBCMT ref: 00007FF7EAF10ADA
free.LIBCMT ref: 00007FF7EAF10AE3
free.LIBCMT ref: 00007FF7EAF10AEC
free.LIBCMT ref: 00007FF7EAF10AF5
free.LIBCMT ref: 00007FF7EAF10AFE
free.LIBCMT ref: 00007FF7EAF10B07
free.LIBCMT ref: 00007FF7EAF10B10
free.LIBCMT ref: 00007FF7EAF10B19
free.LIBCMT ref: 00007FF7EAF10B22
free.LIBCMT ref: 00007FF7EAF10B2B
free.LIBCMT ref: 00007FF7EAF10B37
free.LIBCMT ref: 00007FF7EAF10B43
free.LIBCMT ref: 00007FF7EAF10B4F
free.LIBCMT ref: 00007FF7EAF10B5B
free.LIBCMT ref: 00007FF7EAF10B67
free.LIBCMT ref: 00007FF7EAF10B73
free.LIBCMT ref: 00007FF7EAF10B7F
free.LIBCMT ref: 00007FF7EAF10B8B
free.LIBCMT ref: 00007FF7EAF10B97
free.LIBCMT ref: 00007FF7EAF10BA3
free.LIBCMT ref: 00007FF7EAF10BAF
free.LIBCMT ref: 00007FF7EAF10BBB
free.LIBCMT ref: 00007FF7EAF10BC7
free.LIBCMT ref: 00007FF7EAF10BD3
free.LIBCMT ref: 00007FF7EAF10BDF
free.LIBCMT ref: 00007FF7EAF10BEB
free.LIBCMT ref: 00007FF7EAF10BF7
free.LIBCMT ref: 00007FF7EAF10C03
free.LIBCMT ref: 00007FF7EAF10C0F
free.LIBCMT ref: 00007FF7EAF10C1B
free.LIBCMT ref: 00007FF7EAF10C27
free.LIBCMT ref: 00007FF7EAF10C33
free.LIBCMT ref: 00007FF7EAF10C3F
free.LIBCMT ref: 00007FF7EAF10C4B
free.LIBCMT ref: 00007FF7EAF10C57
free.LIBCMT ref: 00007FF7EAF10C63
free.LIBCMT ref: 00007FF7EAF10C6F
free.LIBCMT ref: 00007FF7EAF10C7B
free.LIBCMT ref: 00007FF7EAF10C87
free.LIBCMT ref: 00007FF7EAF10C93
free.LIBCMT ref: 00007FF7EAF10C9F
free.LIBCMT ref: 00007FF7EAF10CAB
free.LIBCMT ref: 00007FF7EAF10CB7
free.LIBCMT ref: 00007FF7EAF10CC3
free.LIBCMT ref: 00007FF7EAF10CCF
free.LIBCMT ref: 00007FF7EAF10CDB
free.LIBCMT ref: 00007FF7EAF10CE7
free.LIBCMT ref: 00007FF7EAF10CF3
free.LIBCMT ref: 00007FF7EAF10CFF
free.LIBCMT ref: 00007FF7EAF10D0B
free.LIBCMT ref: 00007FF7EAF10D17
free.LIBCMT ref: 00007FF7EAF10D23
free.LIBCMT ref: 00007FF7EAF10D2F
free.LIBCMT ref: 00007FF7EAF10D3B
free.LIBCMT ref: 00007FF7EAF10D47
free.LIBCMT ref: 00007FF7EAF10D53
free.LIBCMT ref: 00007FF7EAF10D5F
free.LIBCMT ref: 00007FF7EAF10D6B
free.LIBCMT ref: 00007FF7EAF10D77
free.LIBCMT ref: 00007FF7EAF10D83
free.LIBCMT ref: 00007FF7EAF10D8F
free.LIBCMT ref: 00007FF7EAF10D9B
free.LIBCMT ref: 00007FF7EAF10DA7
free.LIBCMT ref: 00007FF7EAF10DB3
free.LIBCMT ref: 00007FF7EAF10DBF
free.LIBCMT ref: 00007FF7EAF10DCB
free.LIBCMT ref: 00007FF7EAF10DD7
free.LIBCMT ref: 00007FF7EAF10DE3
free.LIBCMT ref: 00007FF7EAF10DEF
free.LIBCMT ref: 00007FF7EAF10DFB
free.LIBCMT ref: 00007FF7EAF10E07
free.LIBCMT ref: 00007FF7EAF10E13
free.LIBCMT ref: 00007FF7EAF10E1F
free.LIBCMT ref: 00007FF7EAF10E2B
free.LIBCMT ref: 00007FF7EAF10E37
free.LIBCMT ref: 00007FF7EAF10E43
free.LIBCMT ref: 00007FF7EAF10E4F
free.LIBCMT ref: 00007FF7EAF10E5B
free.LIBCMT ref: 00007FF7EAF10E67
free.LIBCMT ref: 00007FF7EAF10E73

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 60a7ffa4d2c1c72e481c1fc4b58fd09ff59adc118a18aaad8529e092a6129a8d
Instruction ID: 5bcf74847ec1f71c81c62bd7876690b6f4ae374e411437fb1c0617dd5f937cc5
Opcode Fuzzy Hash: 60a7ffa4d2c1c72e481c1fc4b58fd09ff59adc118a18aaad8529e092a6129a8d
Instruction Fuzzy Hash: E7A1652262A54281F641BBB1C9E53FD5338AFC4B88FC48177D94D4B167DE36D846C3A2

Function 028F4FCC Relevance: 107.7, APIs: 86, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 028F4FE1

Part of subcall function 028E5500: HeapFree.KERNEL32 ref: 028E5516
Part of subcall function 028E5500: _errno.LIBCMT ref: 028E5520
Part of subcall function 028E5500: GetLastError.KERNEL32 ref: 028E5528

free.LIBCMT ref: 028F4FEA
free.LIBCMT ref: 028F4FF3
free.LIBCMT ref: 028F4FFC
free.LIBCMT ref: 028F5005
free.LIBCMT ref: 028F500E
free.LIBCMT ref: 028F5016
free.LIBCMT ref: 028F501F
free.LIBCMT ref: 028F5028
free.LIBCMT ref: 028F5031
free.LIBCMT ref: 028F503A
free.LIBCMT ref: 028F5043
free.LIBCMT ref: 028F504C
free.LIBCMT ref: 028F5055
free.LIBCMT ref: 028F505E
free.LIBCMT ref: 028F5067
free.LIBCMT ref: 028F5073
free.LIBCMT ref: 028F507F
free.LIBCMT ref: 028F508B
free.LIBCMT ref: 028F5097
free.LIBCMT ref: 028F50A3
free.LIBCMT ref: 028F50AF
free.LIBCMT ref: 028F50BB
free.LIBCMT ref: 028F50C7
free.LIBCMT ref: 028F50D3
free.LIBCMT ref: 028F50DF
free.LIBCMT ref: 028F50EB
free.LIBCMT ref: 028F50F7
free.LIBCMT ref: 028F5103
free.LIBCMT ref: 028F510F
free.LIBCMT ref: 028F511B
free.LIBCMT ref: 028F5127
free.LIBCMT ref: 028F5133
free.LIBCMT ref: 028F513F
free.LIBCMT ref: 028F514B
free.LIBCMT ref: 028F5157
free.LIBCMT ref: 028F5163
free.LIBCMT ref: 028F516F
free.LIBCMT ref: 028F517B
free.LIBCMT ref: 028F5187
free.LIBCMT ref: 028F5193
free.LIBCMT ref: 028F519F
free.LIBCMT ref: 028F51AB
free.LIBCMT ref: 028F51B7
free.LIBCMT ref: 028F51C3
free.LIBCMT ref: 028F51CF
free.LIBCMT ref: 028F51DB
free.LIBCMT ref: 028F51E7
free.LIBCMT ref: 028F51F3
free.LIBCMT ref: 028F51FF
free.LIBCMT ref: 028F520B
free.LIBCMT ref: 028F5217
free.LIBCMT ref: 028F5223
free.LIBCMT ref: 028F522F
free.LIBCMT ref: 028F523B
free.LIBCMT ref: 028F5247
free.LIBCMT ref: 028F5253
free.LIBCMT ref: 028F525F
free.LIBCMT ref: 028F526B
free.LIBCMT ref: 028F5277
free.LIBCMT ref: 028F5283
free.LIBCMT ref: 028F528F
free.LIBCMT ref: 028F529B
free.LIBCMT ref: 028F52A7
free.LIBCMT ref: 028F52B3
free.LIBCMT ref: 028F52BF
free.LIBCMT ref: 028F52CB
free.LIBCMT ref: 028F52D7
free.LIBCMT ref: 028F52E3
free.LIBCMT ref: 028F52EF
free.LIBCMT ref: 028F52FB
free.LIBCMT ref: 028F5307
free.LIBCMT ref: 028F5313
free.LIBCMT ref: 028F531F
free.LIBCMT ref: 028F532B
free.LIBCMT ref: 028F5337
free.LIBCMT ref: 028F5343
free.LIBCMT ref: 028F534F
free.LIBCMT ref: 028F535B
free.LIBCMT ref: 028F5367
free.LIBCMT ref: 028F5373
free.LIBCMT ref: 028F537F
free.LIBCMT ref: 028F538B
free.LIBCMT ref: 028F5397
free.LIBCMT ref: 028F53A3
free.LIBCMT ref: 028F53AF

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 0e9540d22471b7dd108d06f0be332723ceb878cd7aa320ea0431e20c62856042
Instruction ID: a2dd737dd722abdfc80dc5808c55cf7c3535c3f23cc2fcf6bb1a74325d961d5b
Opcode Fuzzy Hash: 0e9540d22471b7dd108d06f0be332723ceb878cd7aa320ea0431e20c62856042
Instruction Fuzzy Hash: 5D81542E251644C5DF45BB39C8942AE2323ABC7F4CFC44532CA4FDB935EE29C8458B92

Function 028DE457 Relevance: 49.3, APIs: 12, Strings: 16, Instructions: 280stringregistrysleepCOMMON

Download Yara Rule

APIs

Part of subcall function 028E55F8: malloc.LIBCMT ref: 028E5612

RegOpenKeyExW.ADVAPI32 ref: 028DE492
RegDeleteValueW.ADVAPI32 ref: 028DE4A3
RegSetValueExW.ADVAPI32 ref: 028DE4CE
RegCloseKey.ADVAPI32 ref: 028DE534
lstrlenW.KERNEL32 ref: 028DE5C7
lstrlenW.KERNEL32 ref: 028DE5D7
lstrlenW.KERNEL32 ref: 028DE6BD
lstrlenW.KERNEL32 ref: 028DE6CD

Part of subcall function 028E55F8: _callnewh.LIBCMT ref: 028E5606
Part of subcall function 028E55F8: std::exception::exception.LIBCMT ref: 028E567F

Part of subcall function 028E57E0: _errno.LIBCMT ref: 028E57FF
Part of subcall function 028E57E0: _invalid_parameter_noinfo.LIBCMT ref: 028E580B

lstrlenW.KERNEL32 ref: 028DE7AD
lstrlenW.KERNEL32 ref: 028DE7BD
RegCloseKey.ADVAPI32 ref: 028DE86C
Sleep.KERNEL32 ref: 028DE877

Strings

o2:, xrefs: 028DE6A8
t1:, xrefs: 028DE5CD, 028DE60F
8888, xrefs: 028DE6A1
o1:, xrefs: 028DE5B2
IpDate, xrefs: 028DE49C, 028DE4B9
t2:, xrefs: 028DE6C3, 028DE6FF
18.167.52.240, xrefs: 028DE592
t3:, xrefs: 028DE7B3, 028DE7EF
6666, xrefs: 028DE5AB
p1:, xrefs: 028DE599
Console, xrefs: 028DE476
p2:, xrefs: 028DE68F
127.0.0.1, xrefs: 028DE778
p3:, xrefs: 028DE77F
o3:, xrefs: 028DE798
18.167.52.240, xrefs: 028DE688

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: lstrlen$CloseValue$DeleteOpenSleep_callnewh_errno_invalid_parameter_noinfomallocstd::exception::exception
String ID: 127.0.0.1$18.167.52.240$18.167.52.240$6666$8888$Console$IpDate$o1:$o2:$o3:$p1:$p2:$p3:$t1:$t2:$t3:
API String ID: 2396878867-1653562285
Opcode ID: e71c70711d2cbcba282e6d90cad3fe243393a462fc4bf32383e2c8666d460caa
Instruction ID: 0fd0a33679a3010cd0b72534bbffb0f298c1cea7b9e173f5469a3ecae3287d67
Opcode Fuzzy Hash: e71c70711d2cbcba282e6d90cad3fe243393a462fc4bf32383e2c8666d460caa
Instruction Fuzzy Hash: F6B1F26DB01A5691EF10AF25E6887AC2762F755FC9F809026CE0E9BB54DF3CC14AC341

Function 00007FF7EAF0DC88 Relevance: 42.1, APIs: 16, Strings: 8, Instructions: 136libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,?,00007FF7EAF010E2), ref: 00007FF7EAF0DCCD
GetProcAddress.KERNEL32(?,?,?,?,00007FF7EAF010E2), ref: 00007FF7EAF0DCE9
EncodePointer.KERNEL32(?,?,?,?,00007FF7EAF010E2), ref: 00007FF7EAF0DCFB
GetProcAddress.KERNEL32(?,?,?,?,00007FF7EAF010E2), ref: 00007FF7EAF0DD12
EncodePointer.KERNEL32(?,?,?,?,00007FF7EAF010E2), ref: 00007FF7EAF0DD1B
GetProcAddress.KERNEL32(?,?,?,?,00007FF7EAF010E2), ref: 00007FF7EAF0DD32
EncodePointer.KERNEL32(?,?,?,?,00007FF7EAF010E2), ref: 00007FF7EAF0DD3B
GetProcAddress.KERNEL32(?,?,?,?,00007FF7EAF010E2), ref: 00007FF7EAF0DD52
EncodePointer.KERNEL32(?,?,?,?,00007FF7EAF010E2), ref: 00007FF7EAF0DD5B
GetProcAddress.KERNEL32(?,?,?,?,00007FF7EAF010E2), ref: 00007FF7EAF0DD7A
EncodePointer.KERNEL32(?,?,?,?,00007FF7EAF010E2), ref: 00007FF7EAF0DD83
DecodePointer.KERNEL32(?,?,?,?,00007FF7EAF010E2), ref: 00007FF7EAF0DDB6
DecodePointer.KERNEL32(?,?,?,?,00007FF7EAF010E2), ref: 00007FF7EAF0DDC6
DecodePointer.KERNEL32(?,?,?,?,00007FF7EAF010E2), ref: 00007FF7EAF0DE1C
DecodePointer.KERNEL32(?,?,?,?,00007FF7EAF010E2), ref: 00007FF7EAF0DE3D
DecodePointer.KERNEL32(?,?,?,?,00007FF7EAF010E2), ref: 00007FF7EAF0DE57

Strings

USER32.DLL, xrefs: 00007FF7EAF0DCC6
GetProcessWindowStation, xrefs: 00007FF7EAF0DD70
4 =X, xrefs: 00007FF7EAF0DC97
GetActiveWindow, xrefs: 00007FF7EAF0DD01
GetLastActivePopup, xrefs: 00007FF7EAF0DD21
MessageBoxW, xrefs: 00007FF7EAF0DCDF
ceil, xrefs: 00007FF7EAF0DC8D
GetUserObjectInformationW, xrefs: 00007FF7EAF0DD41

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL$ceil$4 =X
API String ID: 2643518689-4018579367
Opcode ID: 3235768cab9551c74b9773b86dd77190edcad43fb14d3d9bf66f7ba374c6ba15
Instruction ID: a2a54d3d201849ee7d5a8461f8e625ce66593114b8641342f0bd3fd738e0cd6a
Opcode Fuzzy Hash: 3235768cab9551c74b9773b86dd77190edcad43fb14d3d9bf66f7ba374c6ba15
Instruction Fuzzy Hash: A0510B24A0AB0381FE55BB51A9943F4E3A56F69B94FC405B7DC0E03B61EE3CE845C276

Function 028F6B04 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 136libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 028F6B49
GetProcAddress.KERNEL32 ref: 028F6B65
EncodePointer.KERNEL32 ref: 028F6B77
GetProcAddress.KERNEL32 ref: 028F6B8E
EncodePointer.KERNEL32 ref: 028F6B97
GetProcAddress.KERNEL32 ref: 028F6BAE
EncodePointer.KERNEL32 ref: 028F6BB7
GetProcAddress.KERNEL32 ref: 028F6BCE
EncodePointer.KERNEL32 ref: 028F6BD7
GetProcAddress.KERNEL32 ref: 028F6BF6
EncodePointer.KERNEL32 ref: 028F6BFF
DecodePointer.KERNEL32 ref: 028F6C32
DecodePointer.KERNEL32 ref: 028F6C42
DecodePointer.KERNEL32 ref: 028F6C98
DecodePointer.KERNEL32 ref: 028F6CB9
DecodePointer.KERNEL32 ref: 028F6CD3

Strings

MessageBoxW, xrefs: 028F6B5B
GetProcessWindowStation, xrefs: 028F6BEC
GetActiveWindow, xrefs: 028F6B7D
GetLastActivePopup, xrefs: 028F6B9D
USER32.DLL, xrefs: 028F6B42
GetUserObjectInformationW, xrefs: 028F6BBD

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 2643518689-564504941
Opcode ID: dd5ed54e8927234f7e2481a09cd76468ffedfea20d48f418230764cb51715f96
Instruction ID: 1a708d5ff33697c7e490360e6d2dbbd4bffd2986ae0d9cc23131b376a2fa1b41
Opcode Fuzzy Hash: dd5ed54e8927234f7e2481a09cd76468ffedfea20d48f418230764cb51715f96
Instruction Fuzzy Hash: A2514B2C602B1681FEA5DB62B95832423A4FB89BD4F994525CE5E87BA0FF3CC195C304

Function 028F79C4 Relevance: 32.0, APIs: 21, Instructions: 482COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 028F79F5
_errno.LIBCMT ref: 028F79FE
__doserrno.LIBCMT ref: 028F7A58
_errno.LIBCMT ref: 028F7A5F
_invalid_parameter_noinfo.LIBCMT ref: 028F80CE

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfo
String ID:
API String ID: 2315031519-0
Opcode ID: b939670ddc4c985667765960a1396b9776873388c04f6c61acc916576a9ca98e
Instruction ID: 7a4a11b89a58797dc7042c73886f0bf6062d3a26aaeb24ea8677c51fc3a1e7d7
Opcode Fuzzy Hash: b939670ddc4c985667765960a1396b9776873388c04f6c61acc916576a9ca98e
Instruction Fuzzy Hash: 2B12362F2047C486FBA29F65C4803AC6B62F781B5CF989216CF6E87B95DB78C445C316

Function 00007FF7EAF13C88 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 334COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7EAF11988: RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7EAF119FC

__GetUnwindTryBlock.LIBCMT ref: 00007FF7EAF13CEC
__SetUnwindTryBlock.LIBCMT ref: 00007FF7EAF13D13

Part of subcall function 00007FF7EAF09A88: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF7EAF012E9), ref: 00007FF7EAF09B03

__GetUnwindTryBlock.LIBCMT ref: 00007FF7EAF13D1D
_getptd.LIBCMT ref: 00007FF7EAF13D73
_getptd.LIBCMT ref: 00007FF7EAF13D86
_getptd.LIBCMT ref: 00007FF7EAF13D92
_SetThrowImageBase.LIBCMT ref: 00007FF7EAF13DA6
_getptd.LIBCMT ref: 00007FF7EAF13DF6
_getptd.LIBCMT ref: 00007FF7EAF13E09
_getptd.LIBCMT ref: 00007FF7EAF13E15
type_info::operator==.LIBCMT ref: 00007FF7EAF13E7C
std::exception::exception.LIBCMT ref: 00007FF7EAF13EB5
_getptd.LIBCMT ref: 00007FF7EAF140E8
std::exception::exception.LIBCMT ref: 00007FF7EAF14161

Strings

csm, xrefs: 00007FF7EAF13DC1
csm, xrefs: 00007FF7EAF13EDA
bad exception, xrefs: 00007FF7EAF13EA2
csm, xrefs: 00007FF7EAF13D33

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseEntryExceptionFunctionImageLookupRaiseThrowtype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 1639654010-820278400
Opcode ID: fbe037284dd962ea214ae2f94636b38ee292e4416248e112e6b35bf23fd221be
Instruction ID: cb3a9f46625051f3bf3a313659f69dd0d56cfa341e54c11443f6ba227d35cb4e
Opcode Fuzzy Hash: fbe037284dd962ea214ae2f94636b38ee292e4416248e112e6b35bf23fd221be
Instruction Fuzzy Hash: FAE1B532A0864286FB64BB2590403FDB7A0FB64B89F844276DE4D17B87CF38E455C726

Function 028E9994 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 334COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 028E7708: RtlLookupFunctionEntry.KERNEL32 ref: 028E777C

__GetUnwindTryBlock.LIBCMT ref: 028E99F8
__SetUnwindTryBlock.LIBCMT ref: 028E9A1F

Part of subcall function 028E75BC: RaiseException.KERNEL32 ref: 028E7637

__GetUnwindTryBlock.LIBCMT ref: 028E9A29
_getptd.LIBCMT ref: 028E9A7F
_getptd.LIBCMT ref: 028E9A92
_getptd.LIBCMT ref: 028E9A9E
_SetThrowImageBase.LIBCMT ref: 028E9AB2
_getptd.LIBCMT ref: 028E9B02
_getptd.LIBCMT ref: 028E9B15
_getptd.LIBCMT ref: 028E9B21
type_info::operator==.LIBCMT ref: 028E9B88
std::exception::exception.LIBCMT ref: 028E9BC1
_getptd.LIBCMT ref: 028E9DF4
std::exception::exception.LIBCMT ref: 028E9E6D

Strings

csm, xrefs: 028E9ACD
csm, xrefs: 028E9A3F
csm, xrefs: 028E9BE6
bad exception, xrefs: 028E9BAE

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseEntryExceptionFunctionImageLookupRaiseThrowtype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 1639654010-820278400
Opcode ID: e1a46d9deac052332444679c0d04eb384c225fda7c92aae2bd98cd85c9c44a3e
Instruction ID: 5c6a8f0b28161a4fdf87cc19c82de281c1b640d7223642c9290c1448f7cd93e1
Opcode Fuzzy Hash: e1a46d9deac052332444679c0d04eb384c225fda7c92aae2bd98cd85c9c44a3e
Instruction Fuzzy Hash: B4D1CF3E704650CADF24EF6995843AE77A2FB4AB88F444125DE4F87B08CBB4D061CB42

Function 02899465 Relevance: 30.2, APIs: 14, Strings: 3, Instructions: 493COMMONLIBRARYCODE

Download Yara Rule

APIs

__GetUnwindTryBlock.LIBCMT ref: 028994C9
__SetUnwindTryBlock.LIBCMT ref: 028994F0
__GetUnwindTryBlock.LIBCMT ref: 028994FA
_getptd.LIBCMT ref: 02899550
_getptd.LIBCMT ref: 02899563
_getptd.LIBCMT ref: 0289956F
_SetThrowImageBase.LIBCMT ref: 02899583
_getptd.LIBCMT ref: 028995D3
_getptd.LIBCMT ref: 028995E6
_getptd.LIBCMT ref: 028995F2
type_info::operator==.LIBCMT ref: 02899659
std::exception::exception.LIBCMT ref: 02899692
_getptd.LIBCMT ref: 028998C5
std::exception::exception.LIBCMT ref: 0289993E

Strings

csm, xrefs: 02899510
csm, xrefs: 028996B7
csm, xrefs: 0289959E

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseImageThrowtype_info::operator==
String ID: csm$csm$csm
API String ID: 3798665358-393685449
Opcode ID: e703289ab1681031570886b67bdd3ad2315890cd872d463a38575eff1ac2c734
Instruction ID: 6ebdd5269e7d2f91807c67dd8ed0d750f91a18aaf7c4cafe5dbe85655e1e49bb
Opcode Fuzzy Hash: e703289ab1681031570886b67bdd3ad2315890cd872d463a38575eff1ac2c734
Instruction Fuzzy Hash: EDE1D47C618B088FDF28AF6CD8442A9B3E1FB58305F58466ED84AD3651EB35E441CB83

Function 00007FF7EAF08370 Relevance: 29.8, APIs: 12, Strings: 5, Instructions: 100libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF7EAF08396
GetProcAddress.KERNEL32 ref: 00007FF7EAF083BE
FreeLibrary.KERNEL32 ref: 00007FF7EAF083CF

Strings

!analyze -v, xrefs: 00007FF7EAF0844A
%s-%04d%02d%02d-%02d%02d%02d.dmp, xrefs: 00007FF7EAF08451
MiniDumpWriteDump, xrefs: 00007FF7EAF083AC
4 =X, xrefs: 00007FF7EAF0837A
DbgHelp.dll, xrefs: 00007FF7EAF0838F

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: !analyze -v$%s-%04d%02d%02d-%02d%02d%02d.dmp$DbgHelp.dll$MiniDumpWriteDump$4 =X
API String ID: 145871493-2810801375
Opcode ID: 480089490ec144e7b2b2c8ce8f4cc6496139fd37b894703ea7d60b2fbab28df8
Instruction ID: 7f57ee5f7fd9eaeb0738672765d01ec4fc83acbdacfd931ebdbf1e2910cea59b
Opcode Fuzzy Hash: 480089490ec144e7b2b2c8ce8f4cc6496139fd37b894703ea7d60b2fbab28df8
Instruction Fuzzy Hash: FB414F36608B8186F760AF11F4443AAF3A0FB99768F800276DA9D43B99DF7CD055CB51

Function 028DD780 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 224stringsleepregistryCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 028DD7C8
wsprintfW.USER32 ref: 028DD810

Part of subcall function 028D9A90: lstrlenW.KERNEL32 ref: 028D9AC2
Part of subcall function 028D9A90: lstrlenW.KERNEL32 ref: 028D9ADC
Part of subcall function 028D9A90: lstrlenW.KERNEL32 ref: 028D9AE8

lstrlenW.KERNEL32 ref: 028DD87B
lstrlenW.KERNEL32 ref: 028DD88E
CreateEventA.KERNEL32 ref: 028DD9FE
RegOpenKeyExW.ADVAPI32 ref: 028DDA68
CloseHandle.KERNEL32 ref: 028DDAB0
Sleep.KERNEL32 ref: 028DDACE
CloseHandle.KERNEL32 ref: 028DDAF7
CloseHandle.KERNEL32 ref: 028DDB16

Strings

p1:, xrefs: 028DD850
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 028DD802
t1:, xrefs: 028DD884
Console\1, xrefs: 028DDA5A
o1:, xrefs: 028DD869

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: lstrlen$CloseHandle$CreateEventLocalOpenSleepTimewsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$Console\1$o1:$p1:$t1:
API String ID: 441366266-1614091359
Opcode ID: e3bb5cf023bba0c0107a664c87a2776ec4c2090d32f508ec078842b5a6dc5444
Instruction ID: a7710fa4ea58140785efdde3a338ef752809249fa6bb656f68ca52c2c8fcec9a
Opcode Fuzzy Hash: e3bb5cf023bba0c0107a664c87a2776ec4c2090d32f508ec078842b5a6dc5444
Instruction Fuzzy Hash: B791E23F204A85D6DB209F26E9447AE73B6F785B89F405115DB8E47B58DF38C209CB40

Function 00007FF7EAF04220 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF7EAF0425B
WSAIoctl.WS2_32 ref: 00007FF7EAF042B0
setsockopt.WS2_32 ref: 00007FF7EAF042D2
setsockopt.WS2_32 ref: 00007FF7EAF042F4
WSACreateEvent.WS2_32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7EAF03FF5), ref: 00007FF7EAF042FA
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7EAF03FF5), ref: 00007FF7EAF04307
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7EAF03FF5), ref: 00007FF7EAF0432A
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7EAF03FF5), ref: 00007FF7EAF04344
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7EAF03FF5), ref: 00007FF7EAF04367
gethostbyname.WS2_32 ref: 00007FF7EAF04374

Strings

4 =X, xrefs: 00007FF7EAF04230

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ByteCharMultiWidelstrlensetsockopt$CreateEventIoctlgethostbynamesocket
String ID: 4 =X
API String ID: 2536029566-3147943113
Opcode ID: dd1851911fdd76a705326ba549579fe627525648a2b6dfceec2b157348278301
Instruction ID: be50937c1bc99eb6bc442b505e2229f85089f63278e035288830685fc22494cc
Opcode Fuzzy Hash: dd1851911fdd76a705326ba549579fe627525648a2b6dfceec2b157348278301
Instruction Fuzzy Hash: 97515436618B4186F710DF65F4403AAB7A5FB88BA8F500276EA9E43B94CF3CD4458B51

Function 028D72A0 Relevance: 24.6, APIs: 2, Strings: 12, Instructions: 146windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 028D72C2

Strings

TaskExplorer, xrefs: 028D7362
Malwarebytes, xrefs: 028D7332
Port, xrefs: 028D7392
TCPEye, xrefs: 028D734A
Process, xrefs: 028D748E
CurrPorts, xrefs: 028D737A
Sniff, xrefs: 028D7466
Fiddler, xrefs: 028D7422
Capsa, xrefs: 028D7452, 028D747A
Metascan, xrefs: 028D73AA
Wireshark, xrefs: 028D73C2
ApateDNS, xrefs: 028D731A

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: VisibleWindow
String ID: ApateDNS$Capsa$CurrPorts$Fiddler$Malwarebytes$Metascan$Port$Process$Sniff$TCPEye$TaskExplorer$Wireshark
API String ID: 1208467747-3439171801
Opcode ID: 6c83f4f935bc8fd318e5d8867c0384fad16a053bef60207c4fe23fe6007cb213
Instruction ID: a2e7275621d804eef6e730e981679bb60f0ac603a094321c8aefb39b7bd21119
Opcode Fuzzy Hash: 6c83f4f935bc8fd318e5d8867c0384fad16a053bef60207c4fe23fe6007cb213
Instruction Fuzzy Hash: EC51A21CB0270680EE5AEF29F9807649B966B6A794F88B030DD4F8730AFF7CD1498700

Function 028E1080 Relevance: 24.3, APIs: 16, Instructions: 279COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 028E10A2
SetLastError.KERNEL32 ref: 028E10C5

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 3bf04cb684953293119adb09c4abac423c49dbe06895ea3ccbae4e9aa986ae90
Instruction ID: c95be8702d4402e4b3a2e949bf2bc2d8227948b3c8fa5a0f9813b22338c27cd5
Opcode Fuzzy Hash: 3bf04cb684953293119adb09c4abac423c49dbe06895ea3ccbae4e9aa986ae90
Instruction Fuzzy Hash: B6B18B3E312A4086DF14CF26EA587A973A6FB4AB88F448525CE0F87B54EF38D955C700

Function 028D41C0 Relevance: 21.1, APIs: 14, Instructions: 127networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 028D41FB
WSAIoctl.WS2_32 ref: 028D4250
setsockopt.WS2_32 ref: 028D4272
setsockopt.WS2_32 ref: 028D4294
WSACreateEvent.WS2_32 ref: 028D429A
lstrlenW.KERNEL32 ref: 028D42A7
WideCharToMultiByte.KERNEL32 ref: 028D42CA
lstrlenW.KERNEL32 ref: 028D42E4
WideCharToMultiByte.KERNEL32 ref: 028D4307
gethostbyname.WS2_32 ref: 028D4314

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ByteCharMultiWidelstrlensetsockopt$CreateEventIoctlgethostbynamesocket
String ID:
API String ID: 2536029566-0
Opcode ID: 56f23a7e9dad3717f5929d4e235e4febecae6ecb8fe56b2f3ea6a90b2706ea7f
Instruction ID: 877797d036bcda7efbc22f842b241c8caf14fd5577d139ab842ef037dd5d7c2a
Opcode Fuzzy Hash: 56f23a7e9dad3717f5929d4e235e4febecae6ecb8fe56b2f3ea6a90b2706ea7f
Instruction Fuzzy Hash: F651543A215B8086D714CF65F84475AB7A5F798BA4F144226EF9A83FA8CF3CC149CB04

Function 00007FF7EAF0F668 Relevance: 19.6, APIs: 13, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 00007FF7EAF0F6C0

Part of subcall function 00007FF7EAF10EEC: free.LIBCMT ref: 00007FF7EAF10F0A
Part of subcall function 00007FF7EAF10EEC: free.LIBCMT ref: 00007FF7EAF10F1C
Part of subcall function 00007FF7EAF10EEC: free.LIBCMT ref: 00007FF7EAF10F2E
Part of subcall function 00007FF7EAF10EEC: free.LIBCMT ref: 00007FF7EAF10F40
Part of subcall function 00007FF7EAF10EEC: free.LIBCMT ref: 00007FF7EAF10F52
Part of subcall function 00007FF7EAF10EEC: free.LIBCMT ref: 00007FF7EAF10F64
Part of subcall function 00007FF7EAF10EEC: free.LIBCMT ref: 00007FF7EAF10F76
Part of subcall function 00007FF7EAF10EEC: free.LIBCMT ref: 00007FF7EAF10F88
Part of subcall function 00007FF7EAF10EEC: free.LIBCMT ref: 00007FF7EAF10F9A
Part of subcall function 00007FF7EAF10EEC: free.LIBCMT ref: 00007FF7EAF10FAC
Part of subcall function 00007FF7EAF10EEC: free.LIBCMT ref: 00007FF7EAF10FC1
Part of subcall function 00007FF7EAF10EEC: free.LIBCMT ref: 00007FF7EAF10FD6
Part of subcall function 00007FF7EAF10EEC: free.LIBCMT ref: 00007FF7EAF10FEB

free.LIBCMT ref: 00007FF7EAF0F6B4

Part of subcall function 00007FF7EAF09030: HeapFree.KERNEL32(?,?,00000000,00007FF7EAF0BA1C,?,?,?,00007FF7EAF0938D,?,?,?,?,00007FF7EAF14BEE), ref: 00007FF7EAF09046
Part of subcall function 00007FF7EAF09030: _errno.LIBCMT ref: 00007FF7EAF09050
Part of subcall function 00007FF7EAF09030: GetLastError.KERNEL32(?,?,00000000,00007FF7EAF0BA1C,?,?,?,00007FF7EAF0938D,?,?,?,?,00007FF7EAF14BEE), ref: 00007FF7EAF09058

free.LIBCMT ref: 00007FF7EAF0F6D6
__free_lconv_num.LIBCMT ref: 00007FF7EAF0F6E2
free.LIBCMT ref: 00007FF7EAF0F6EE
free.LIBCMT ref: 00007FF7EAF0F6FA
free.LIBCMT ref: 00007FF7EAF0F71E
free.LIBCMT ref: 00007FF7EAF0F732
free.LIBCMT ref: 00007FF7EAF0F741
free.LIBCMT ref: 00007FF7EAF0F74D
free.LIBCMT ref: 00007FF7EAF0F77A
free.LIBCMT ref: 00007FF7EAF0F7A2
free.LIBCMT ref: 00007FF7EAF0F7BC

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free$ErrorFreeHeapLast__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 518839503-0
Opcode ID: 578f8deb9b1b94d1822c3a308d3ccdd43089e4846e4b09c0fbd9a79327202c1b
Instruction ID: 603c43c4d3f8bae14edd4420ac14e5d74787ce89ea150cdea95f95bd98f93732
Opcode Fuzzy Hash: 578f8deb9b1b94d1822c3a308d3ccdd43089e4846e4b09c0fbd9a79327202c1b
Instruction Fuzzy Hash: F9412D32A1A54284FE55BF61C5D03F9A3A0AF84B98FD84477DA0D06296DF7DE881C363

Function 028EF438 Relevance: 19.6, APIs: 13, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 028EF490

Part of subcall function 028F572C: free.LIBCMT ref: 028F574A
Part of subcall function 028F572C: free.LIBCMT ref: 028F575C
Part of subcall function 028F572C: free.LIBCMT ref: 028F576E
Part of subcall function 028F572C: free.LIBCMT ref: 028F5780
Part of subcall function 028F572C: free.LIBCMT ref: 028F5792
Part of subcall function 028F572C: free.LIBCMT ref: 028F57A4
Part of subcall function 028F572C: free.LIBCMT ref: 028F57B6
Part of subcall function 028F572C: free.LIBCMT ref: 028F57C8
Part of subcall function 028F572C: free.LIBCMT ref: 028F57DA
Part of subcall function 028F572C: free.LIBCMT ref: 028F57EC
Part of subcall function 028F572C: free.LIBCMT ref: 028F5801
Part of subcall function 028F572C: free.LIBCMT ref: 028F5816
Part of subcall function 028F572C: free.LIBCMT ref: 028F582B

free.LIBCMT ref: 028EF484

Part of subcall function 028E5500: HeapFree.KERNEL32 ref: 028E5516
Part of subcall function 028E5500: _errno.LIBCMT ref: 028E5520
Part of subcall function 028E5500: GetLastError.KERNEL32 ref: 028E5528

free.LIBCMT ref: 028EF4A6
__free_lconv_num.LIBCMT ref: 028EF4B2
free.LIBCMT ref: 028EF4BE
free.LIBCMT ref: 028EF4CA
free.LIBCMT ref: 028EF4EE
free.LIBCMT ref: 028EF502
free.LIBCMT ref: 028EF511
free.LIBCMT ref: 028EF51D
free.LIBCMT ref: 028EF54A
free.LIBCMT ref: 028EF572
free.LIBCMT ref: 028EF58C

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free$ErrorFreeHeapLast__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 518839503-0
Opcode ID: edb782bafea0ee42e6b8fa078e6d3701924f9df5d875efc910698779a0fea97e
Instruction ID: ec417795c69d6100af3071a1d155a2860fca703d56a271720417800defdeefb3
Opcode Fuzzy Hash: edb782bafea0ee42e6b8fa078e6d3701924f9df5d875efc910698779a0fea97e
Instruction Fuzzy Hash: B831EA3E602A8485DF259F65D4503AD2362FBA6B98F885436CB4F8BA64DF28C491C721

Function 00007FF7EAF1054C Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7EAF10889), ref: 00007FF7EAF105E6
malloc.LIBCMT ref: 00007FF7EAF1064F
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7EAF10889), ref: 00007FF7EAF10683
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7EAF10889), ref: 00007FF7EAF106AA
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7EAF10889), ref: 00007FF7EAF106F2
malloc.LIBCMT ref: 00007FF7EAF1074F

Part of subcall function 00007FF7EAF09070: _FF_MSGBANNER.LIBCMT ref: 00007FF7EAF090A0
Part of subcall function 00007FF7EAF09070: HeapAlloc.KERNEL32(?,?,00B34BF300000000,00007FF7EAF0C050,?,?,ceil,00007FF7EAF0D951,?,?,?,00007FF7EAF0D9FB,?,?,00000000,00007FF7EAF0B951), ref: 00007FF7EAF090C5
Part of subcall function 00007FF7EAF09070: _callnewh.LIBCMT ref: 00007FF7EAF090DE
Part of subcall function 00007FF7EAF09070: _errno.LIBCMT ref: 00007FF7EAF090E9
Part of subcall function 00007FF7EAF09070: _errno.LIBCMT ref: 00007FF7EAF090F4

LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7EAF10889), ref: 00007FF7EAF10784
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7EAF10889), ref: 00007FF7EAF107C4
free.LIBCMT ref: 00007FF7EAF107D8
free.LIBCMT ref: 00007FF7EAF107E9

Strings

4 =X, xrefs: 00007FF7EAF1056B

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ByteCharMultiStringWide$_errnofreemalloc$AllocHeap_callnewh
String ID: 4 =X
API String ID: 1080698880-3147943113
Opcode ID: 8864ca2f36b3b28a6e37dacfbbe885c608440c4a788fc07bea0ef3c91e2c5cf3
Instruction ID: 61a4fcf39f93c310b81ea9478d81fc1aa4de49dfb8de679f8da355e1936ded03
Opcode Fuzzy Hash: 8864ca2f36b3b28a6e37dacfbbe885c608440c4a788fc07bea0ef3c91e2c5cf3
Instruction Fuzzy Hash: E981C532A0878286FB24AF2594403A9B7E5FB54BE8F850276EA5D53BD6DF3CD9008711

Function 028A6DB5 Relevance: 18.2, APIs: 12, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 028A6DE9

Part of subcall function 028A26D9: _errno.LIBCMT ref: 028A26E2
Part of subcall function 028A26D9: _invalid_parameter_noinfo.LIBCMT ref: 028A26ED

_fileno.LIBCMT ref: 028A6E04
_fileno.LIBCMT ref: 028A6E11
_fileno.LIBCMT ref: 028A6E20

Part of subcall function 0289C389: _fileno.LIBCMT ref: 0289C3A6
Part of subcall function 0289C389: _errno.LIBCMT ref: 0289C3B6

_fileno.LIBCMT ref: 028A6E4A
_fileno.LIBCMT ref: 028A6E57
_fileno.LIBCMT ref: 028A6E64
_fileno.LIBCMT ref: 028A6E73
_fileno.LIBCMT ref: 028A6E9D
_fileno.LIBCMT ref: 028A6EAA
_fileno.LIBCMT ref: 028A6EB7
_fileno.LIBCMT ref: 028A6EC6

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _fileno$_errno$_invalid_parameter_noinfo
String ID:
API String ID: 482796045-0
Opcode ID: 54bd916b88af1bd575d78faf126a4c9598831ddf2921f80b296b0a36c5fb6732
Instruction ID: b3598996f025d0dc57fe133fa0c879417d5b56311312538b76b4dc2b51f33696
Opcode Fuzzy Hash: 54bd916b88af1bd575d78faf126a4c9598831ddf2921f80b296b0a36c5fb6732
Instruction Fuzzy Hash: 19510A2C229F4D4BAB18AB2C84F117973D5FB85318758072DD56AC31D5FF2898528B82

Function 028F72E4 Relevance: 18.1, APIs: 12, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 028F7318

Part of subcall function 028F2C08: _errno.LIBCMT ref: 028F2C11
Part of subcall function 028F2C08: _invalid_parameter_noinfo.LIBCMT ref: 028F2C1C

_fileno.LIBCMT ref: 028F7333
_fileno.LIBCMT ref: 028F7340
_fileno.LIBCMT ref: 028F734F

Part of subcall function 028EC8B8: _fileno.LIBCMT ref: 028EC8D5
Part of subcall function 028EC8B8: _errno.LIBCMT ref: 028EC8E5

_fileno.LIBCMT ref: 028F7379
_fileno.LIBCMT ref: 028F7386
_fileno.LIBCMT ref: 028F7393
_fileno.LIBCMT ref: 028F73A2
_fileno.LIBCMT ref: 028F73CC
_fileno.LIBCMT ref: 028F73D9
_fileno.LIBCMT ref: 028F73E6
_fileno.LIBCMT ref: 028F73F5

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _fileno$_errno$_invalid_parameter_noinfo
String ID:
API String ID: 482796045-0
Opcode ID: 0a44dc10160c913522ca1b89bfe8ceb34a2fb27583fbc32893239fcdff2a64c1
Instruction ID: 2ef9fe0862e3b34fd377c574ff6c643fef75f4a117e0a1b4445fa5f7340a4257
Opcode Fuzzy Hash: 0a44dc10160c913522ca1b89bfe8ceb34a2fb27583fbc32893239fcdff2a64c1
Instruction Fuzzy Hash: 7751262E61468185EAA49F3D858027DBB11FB41BACF548301DF7EC77D4CF28C4128742

Function 02898CA1 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 02898CD1
_getptd.LIBCMT ref: 02898CE5
_getptd.LIBCMT ref: 02898D1F
_getptd.LIBCMT ref: 02898D2B
_getptd.LIBCMT ref: 02898D37
_CreateFrameInfo.LIBCMT ref: 02898D4C

Part of subcall function 02897685: _getptd.LIBCMT ref: 02897691
Part of subcall function 02897685: _getptd.LIBCMT ref: 0289769F
Part of subcall function 02897685: _getptd.LIBCMT ref: 028976B3

_getptd.LIBCMT ref: 02898D6A
_getptd.LIBCMT ref: 02898E70
_getptd.LIBCMT ref: 02898E7C

Strings

csm, xrefs: 02898E30

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd$CreateFrameInfo
String ID: csm
API String ID: 4181383844-1018135373
Opcode ID: 2863c0b21ae9c87ee342759e37cf71052126b54f7717bdb50064378975811c3c
Instruction ID: 124c775f52cd2e4ba670421d7d7479cb882c1e4b6aab620a964ad0bbce3db88e
Opcode Fuzzy Hash: 2863c0b21ae9c87ee342759e37cf71052126b54f7717bdb50064378975811c3c
Instruction Fuzzy Hash: 64413CB8518F098FDBB4EF2C8455BB973E5FB5A311F58166ED08DC3611DB30A8428B86

Function 00007FF7EAF134C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF7EAF134F4

Part of subcall function 00007FF7EAF0BA34: _amsg_exit.LIBCMT ref: 00007FF7EAF0BA4A

_getptd.LIBCMT ref: 00007FF7EAF13508
_getptd.LIBCMT ref: 00007FF7EAF13542
_getptd.LIBCMT ref: 00007FF7EAF1354E
_getptd.LIBCMT ref: 00007FF7EAF1355A
_CreateFrameInfo.LIBCMT ref: 00007FF7EAF1356F

Part of subcall function 00007FF7EAF11E34: _getptd.LIBCMT ref: 00007FF7EAF11E40
Part of subcall function 00007FF7EAF11E34: _getptd.LIBCMT ref: 00007FF7EAF11E4E
Part of subcall function 00007FF7EAF11E34: _getptd.LIBCMT ref: 00007FF7EAF11E62

_getptd.LIBCMT ref: 00007FF7EAF1358D
_getptd.LIBCMT ref: 00007FF7EAF13693
_getptd.LIBCMT ref: 00007FF7EAF1369F

Strings

csm, xrefs: 00007FF7EAF13653

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd$CreateFrameInfo_amsg_exit
String ID: csm
API String ID: 2825728721-1018135373
Opcode ID: f7c0f49ba4beedef2b7976ee9fce1622404532abdfe6423b84f5cde918012730
Instruction ID: 83102c99c7da81c2d589eb42275632b9f6410d702c582e17929e5efa2353fbf2
Opcode Fuzzy Hash: f7c0f49ba4beedef2b7976ee9fce1622404532abdfe6423b84f5cde918012730
Instruction Fuzzy Hash: 5241B63650878282EA70AB11E4407FEB3A0F758B94F804276EF8D07B86CF38E055C711

Function 028E91D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 028E9200

Part of subcall function 028EE2A0: _amsg_exit.LIBCMT ref: 028EE2B6

_getptd.LIBCMT ref: 028E9214
_getptd.LIBCMT ref: 028E924E
_getptd.LIBCMT ref: 028E925A
_getptd.LIBCMT ref: 028E9266
_CreateFrameInfo.LIBCMT ref: 028E927B

Part of subcall function 028E7BB4: _getptd.LIBCMT ref: 028E7BC0
Part of subcall function 028E7BB4: _getptd.LIBCMT ref: 028E7BCE
Part of subcall function 028E7BB4: _getptd.LIBCMT ref: 028E7BE2

_getptd.LIBCMT ref: 028E9299
_getptd.LIBCMT ref: 028E939F
_getptd.LIBCMT ref: 028E93AB

Strings

csm, xrefs: 028E935F

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd$CreateFrameInfo_amsg_exit
String ID: csm
API String ID: 2825728721-1018135373
Opcode ID: a854c15857b26ecdbc1c546dd0a2f365401fac8809084246256c518ccd61d3aa
Instruction ID: bac43429814470d488082e77f6e47e28bdb57ae7638a6bcf002af472ba3a28af
Opcode Fuzzy Hash: a854c15857b26ecdbc1c546dd0a2f365401fac8809084246256c518ccd61d3aa
Instruction Fuzzy Hash: 6F412C3E114B8182CA309F56E44076E77A5F78ABA4F455225DF9E87B58DF38C095CB01

Function 028F92C4 Relevance: 16.8, APIs: 11, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 028F92EC
_invalid_parameter_noinfo.LIBCMT ref: 028F92F7
__wtomb_environ.LIBCMT ref: 028F93D9
_errno.LIBCMT ref: 028F93E2
free.LIBCMT ref: 028F94D3
SetEnvironmentVariableA.KERNEL32 ref: 028F9604
_errno.LIBCMT ref: 028F9611
free.LIBCMT ref: 028F961F
free.LIBCMT ref: 028F962C
free.LIBCMT ref: 028F9653

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free$_errno$EnvironmentVariable__wtomb_environ_invalid_parameter_noinfo
String ID:
API String ID: 101574016-0
Opcode ID: 23eb8e8c18a59001b054989e91b680996eabe19e047ad0e75173f6876b0bc54e
Instruction ID: b6d36bc5d3a9d308efb640181b892fdeb16d02be866cc9be91e80b8c6218fafa
Opcode Fuzzy Hash: 23eb8e8c18a59001b054989e91b680996eabe19e047ad0e75173f6876b0bc54e
Instruction Fuzzy Hash: 1B91F37D302B8081DE55AF2AA91032A7796FB85BD8F489625CF6EC7794EF38C055C710

Function 00007FF7EAF05F80 Relevance: 16.6, APIs: 11, Instructions: 114COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF7EAF05FA8
EnterCriticalSection.KERNEL32 ref: 00007FF7EAF05FCA
SetLastError.KERNEL32 ref: 00007FF7EAF05FDD
LeaveCriticalSection.KERNEL32 ref: 00007FF7EAF05FE7

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: 69df40eebe7a994a8abce202a6738ebc00c29fcc82c09fe2143204c8f9b5c241
Instruction ID: 233762868d57bfc3eda34c5bde33f2f8b2d246a5472a7b41e9cf2eb90d044d12
Opcode Fuzzy Hash: 69df40eebe7a994a8abce202a6738ebc00c29fcc82c09fe2143204c8f9b5c241
Instruction Fuzzy Hash: 64418032A0828586F754AF3598887BAB3A8FF58755F8051B6DA0E83291DF7CE444C762

Function 028D5F40 Relevance: 16.6, APIs: 11, Instructions: 114COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 028D5F68
EnterCriticalSection.KERNEL32 ref: 028D5F8A
SetLastError.KERNEL32 ref: 028D5F9D
LeaveCriticalSection.KERNEL32 ref: 028D5FA7

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: aa91ab01f644cac6639e0b83305ceff7e62f4cd5bcc9a19ba73228942fb7bed4
Instruction ID: 9c77f7ad5448a152d753b80d814e797a57309e601059a40d108e3e72d98b6f79
Opcode Fuzzy Hash: aa91ab01f644cac6639e0b83305ceff7e62f4cd5bcc9a19ba73228942fb7bed4
Instruction Fuzzy Hash: 90419F3E2006988BD794AF25E948B1E7369FB59795F819136DA1BC7390DF38C849CB40

Function 00007FF7EAF063D0 Relevance: 16.6, APIs: 11, Instructions: 98networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7EAF06414
WSASetLastError.WS2_32 ref: 00007FF7EAF06426
LeaveCriticalSection.KERNEL32 ref: 00007FF7EAF06430

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: ce80470fa4deb6d6172187dcf98ae3ac5c2e22c2398dc0b25eb93d0e69b03d15
Instruction ID: 07673bcf7f582cbca7b5546e8b805efbfe356b4a5e93c94dd2f124324e8084d1
Opcode Fuzzy Hash: ce80470fa4deb6d6172187dcf98ae3ac5c2e22c2398dc0b25eb93d0e69b03d15
Instruction Fuzzy Hash: 8331E420B0860282F6607B16A9843BAE310EF85FA4F8451F3DE1E837D6DF7CE4459322

Function 028D6390 Relevance: 16.6, APIs: 11, Instructions: 98networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 028D63D4
WSASetLastError.WS2_32 ref: 028D63E6
LeaveCriticalSection.KERNEL32 ref: 028D63F0

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: d38135fb4df71e6c80e8ec1e62eecfd2964b8a9f5f980a5a01061e436e37bc9f
Instruction ID: 19ae9ad9d2e7f4982a32459bf65bd1777e4dce848daafaaf88691129b45dcc52
Opcode Fuzzy Hash: d38135fb4df71e6c80e8ec1e62eecfd2964b8a9f5f980a5a01061e436e37bc9f
Instruction Fuzzy Hash: AB31843C31465882E7549F2AF90832A7356F796B95F04D135DE2AC7BD8EF28E449C701

Function 028DFC70 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 52registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 028DFCC1
RegDeleteValueW.ADVAPI32 ref: 028DFCCF
RegCloseKey.ADVAPI32 ref: 028DFCDA
RegCreateKeyW.ADVAPI32 ref: 028DFCFA
lstrlenW.KERNEL32 ref: 028DFD07
RegSetValueExW.ADVAPI32 ref: 028DFD29
RegCloseKey.ADVAPI32 ref: 028DFD34

Strings

AppEvents, xrefs: 028DFC9E
Network, xrefs: 028DFC97

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CloseValue$CreateDeleteOpenlstrlen
String ID: AppEvents$Network
API String ID: 3197061591-3733486940
Opcode ID: 8a321232281fbf681079ab08f7dcd2ccb76e80488ff50b598181f6d6f6baf471
Instruction ID: 9d70eaa2fe358a575e2ff3f3087d7501e212341c127a931afe891d55f0e9e143
Opcode Fuzzy Hash: 8a321232281fbf681079ab08f7dcd2ccb76e80488ff50b598181f6d6f6baf471
Instruction Fuzzy Hash: D6116D7A314A8086EB509F12F948B4AB361F7A4BE5F448121EF5947FA8CF7CC149CB08

Function 028EA0B0 Relevance: 15.2, APIs: 10, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 028EA14A
malloc.LIBCMT ref: 028EA1B3
MultiByteToWideChar.KERNEL32 ref: 028EA1E7
LCMapStringW.KERNEL32 ref: 028EA20E
LCMapStringW.KERNEL32 ref: 028EA256
malloc.LIBCMT ref: 028EA2B3

Part of subcall function 028E5540: _FF_MSGBANNER.LIBCMT ref: 028E5570
Part of subcall function 028E5540: HeapAlloc.KERNEL32 ref: 028E5595
Part of subcall function 028E5540: _callnewh.LIBCMT ref: 028E55AE
Part of subcall function 028E5540: _errno.LIBCMT ref: 028E55B9
Part of subcall function 028E5540: _errno.LIBCMT ref: 028E55C4

LCMapStringW.KERNEL32 ref: 028EA2E8
WideCharToMultiByte.KERNEL32 ref: 028EA328
free.LIBCMT ref: 028EA33C
free.LIBCMT ref: 028EA34D

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ByteCharMultiStringWide$_errnofreemalloc$AllocHeap_callnewh
String ID:
API String ID: 1080698880-0
Opcode ID: 033118b0e005be7a82588d032ac2f7b1eb71ec2fd9006a8a0668d71b221458d4
Instruction ID: 1c4408fc8696715c1b766a7c7f997bc0836340f3a37bfd2815d89eed5ee6a12d
Opcode Fuzzy Hash: 033118b0e005be7a82588d032ac2f7b1eb71ec2fd9006a8a0668d71b221458d4
Instruction Fuzzy Hash: 0071833E304B8086DF298F2AD84035977A6F74AFA8F584625EB5F97B94DB38C541C700

Function 00007FF7EAF0F95C Relevance: 15.1, APIs: 10, Instructions: 123COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7EAF0F9A3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF0F9AF
_errno.LIBCMT ref: 00007FF7EAF0F9F9
_errno.LIBCMT ref: 00007FF7EAF0FA04
_errno.LIBCMT ref: 00007FF7EAF0FA36
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF0FA40
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000001FE,?,00007FF7EAF0FB2F), ref: 00007FF7EAF0FAB2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000001FE,?,00007FF7EAF0FB2F), ref: 00007FF7EAF0FACF
_errno.LIBCMT ref: 00007FF7EAF0FAF5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF0FB01

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 2295021086-0
Opcode ID: bd3480430a4880f8b9bfe9aab1841d67a6c611096bbe8aa784dae63e06954dd0
Instruction ID: a3799b98ffae329fd587adb5a9f9e012854eabbd5fe7cb2ba1db352c34068bc4
Opcode Fuzzy Hash: bd3480430a4880f8b9bfe9aab1841d67a6c611096bbe8aa784dae63e06954dd0
Instruction Fuzzy Hash: 7A51B722E0864299FB61BB6488C43FDB7E0AF44BACF9441B2DA5D46AC5DF3CD4418722

Function 028F6E70 Relevance: 15.1, APIs: 10, Instructions: 123COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 028F6EB7
_invalid_parameter_noinfo.LIBCMT ref: 028F6EC3
_errno.LIBCMT ref: 028F6F0D
_errno.LIBCMT ref: 028F6F18
_errno.LIBCMT ref: 028F6F4A
_invalid_parameter_noinfo.LIBCMT ref: 028F6F54
WideCharToMultiByte.KERNEL32 ref: 028F6FC6
GetLastError.KERNEL32 ref: 028F6FE3
_errno.LIBCMT ref: 028F7009
_invalid_parameter_noinfo.LIBCMT ref: 028F7015

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 2295021086-0
Opcode ID: 0ab8b6024eb8a54b2c3b44afa5e405960a18b4b6e26be879e09c9547ab337a78
Instruction ID: 49f432b4534afd426f8574857034cebd1b4f3549c88cae55fc29a63ab40e3b0e
Opcode Fuzzy Hash: 0ab8b6024eb8a54b2c3b44afa5e405960a18b4b6e26be879e09c9547ab337a78
Instruction Fuzzy Hash: 5C41D33F6016609AEF619F64C5403AD7765EB41BACF658325DB6D8BE98FB38C042CB01

Function 028F1EF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 028F1F11

Part of subcall function 028EAAE0: Sleep.KERNEL32 ref: 028EAB25

GetFileType.KERNEL32 ref: 028F207C
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 028F20BA

Strings

@, xrefs: 028F2175

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CountCriticalFileInfoInitializeSectionSleepSpinStartupType
String ID: @
API String ID: 3473179607-2766056989
Opcode ID: b4bc3a53cfc02e0c56905f5ebed1485824023a63904237965023175fdc3cfb9b
Instruction ID: 9d2b4ced91bee991f508dc41fc6fd55ae1104a98a8a07a9babe3d2c8f8276d39
Opcode Fuzzy Hash: b4bc3a53cfc02e0c56905f5ebed1485824023a63904237965023175fdc3cfb9b
Instruction Fuzzy Hash: 5981B06A301B8686DB548F25D5483597761F744B78F448725CF7E837E8EB38C0A6C305

Function 00007FF7EAF04430 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 154threadnetworktimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7EAF04460
SetWaitableTimer.KERNEL32 ref: 00007FF7EAF044A2
WSAWaitForMultipleEvents.WS2_32 ref: 00007FF7EAF0454C
SetLastError.KERNEL32 ref: 00007FF7EAF045F7
GetLastError.KERNEL32 ref: 00007FF7EAF045FD
WSAGetLastError.WS2_32 ref: 00007FF7EAF0462A
GetCurrentThreadId.KERNEL32 ref: 00007FF7EAF0465F

Strings

4 =X, xrefs: 00007FF7EAF0444F

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ErrorLast$CurrentThread$EventsMultipleTimerWaitWaitable
String ID: 4 =X
API String ID: 3058130114-3147943113
Opcode ID: 7b60ca50b3758f1c58badd931637b434e66ff62f720dd5cba929699bab1da5df
Instruction ID: 1faaf8a5edb7e76a49f17204fd9a797dccabc907258c627551491264a4d90657
Opcode Fuzzy Hash: 7b60ca50b3758f1c58badd931637b434e66ff62f720dd5cba929699bab1da5df
Instruction Fuzzy Hash: EE616131A04A4285FF60AF2598943F9A3A4FB44B5DF944676DE1E877D5EF38E8408322

Function 00007FF7EAF0A0F0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 00007FF7EAF0A119

Part of subcall function 00007FF7EAF0D9D8: _amsg_exit.LIBCMT ref: 00007FF7EAF0DA02

DecodePointer.KERNEL32(?,?,00000000,?,?,ceil,00000000,00007FF7EAF0A2DD,?,?,00000000,00007FF7EAF0DA07,?,?,00000000,00007FF7EAF0B951), ref: 00007FF7EAF0A14C
DecodePointer.KERNEL32(?,?,00000000,?,?,ceil,00000000,00007FF7EAF0A2DD,?,?,00000000,00007FF7EAF0DA07,?,?,00000000,00007FF7EAF0B951), ref: 00007FF7EAF0A16A
DecodePointer.KERNEL32(?,?,00000000,?,?,ceil,00000000,00007FF7EAF0A2DD,?,?,00000000,00007FF7EAF0DA07,?,?,00000000,00007FF7EAF0B951), ref: 00007FF7EAF0A1AA
DecodePointer.KERNEL32(?,?,00000000,?,?,ceil,00000000,00007FF7EAF0A2DD,?,?,00000000,00007FF7EAF0DA07,?,?,00000000,00007FF7EAF0B951), ref: 00007FF7EAF0A1C4
DecodePointer.KERNEL32(?,?,00000000,?,?,ceil,00000000,00007FF7EAF0A2DD,?,?,00000000,00007FF7EAF0DA07,?,?,00000000,00007FF7EAF0B951), ref: 00007FF7EAF0A1D4
ExitProcess.KERNEL32 ref: 00007FF7EAF0A260

Strings

ceil, xrefs: 00007FF7EAF0A100

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: DecodePointer$ExitProcess_amsg_exit_lock
String ID: ceil
API String ID: 3411037476-3069211559
Opcode ID: 9a183ae1f03644b8a62f51de8d9c4146bcd30d60da9bb7abc91cae87c8d0ceca
Instruction ID: 6ed968367603b0c71f560c9a3de216e821483dccb80b54ac97ccc42363735ab0
Opcode Fuzzy Hash: 9a183ae1f03644b8a62f51de8d9c4146bcd30d60da9bb7abc91cae87c8d0ceca
Instruction Fuzzy Hash: 72412D21A1AA4285F650BB11ED803B9F3A4FF98788F8400B7D94D437A6EF7CE4558722

Function 028DA7B0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 028DA7BD
GetProcAddress.KERNEL32 ref: 028DA7D5
GetProcAddress.KERNEL32 ref: 028DA7EC
GetProcAddress.KERNEL32 ref: 028DA803

Strings

ZwQueryInformationProcess, xrefs: 028DA7CB
ZwQueryObject, xrefs: 028DA7DB
ZwQuerySystemInformation, xrefs: 028DA7F2
ntdll.dll, xrefs: 028DA7B6

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ZwQueryInformationProcess$ZwQueryObject$ZwQuerySystemInformation$ntdll.dll
API String ID: 667068680-3590752221
Opcode ID: 8a0be3c6d33e8e2dd6bfebc5c516e81d155b332878859c9dd15496a47ec7d989
Instruction ID: 4df332184e137bbfcde5bcf49a91b7562b3e4282df5be9c4333cf9ef45fbf0b5
Opcode Fuzzy Hash: 8a0be3c6d33e8e2dd6bfebc5c516e81d155b332878859c9dd15496a47ec7d989
Instruction Fuzzy Hash: 6E1112A8612B4AC0FF098B42F89C31423F0F798704FEA106AC94D463A0EF7D81AAC740

Function 028A7BB9 Relevance: 13.6, APIs: 9, Instructions: 111COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 028A7BE2
_errno.LIBCMT ref: 028A7BEB
__doserrno.LIBCMT ref: 028A7C49
_errno.LIBCMT ref: 028A7C50
_invalid_parameter_noinfo.LIBCMT ref: 028A7CB4

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfo
String ID:
API String ID: 2315031519-0
Opcode ID: 4862a53a2d00355b2cdfb6728f68fce1447d9864874779d523ba4aac90f1cc33
Instruction ID: 8a58967905cdc8fd430832c2a234df4c5cf26332a77f1b15e54cc3e1e8b34ea2
Opcode Fuzzy Hash: 4862a53a2d00355b2cdfb6728f68fce1447d9864874779d523ba4aac90f1cc33
Instruction Fuzzy Hash: D7310A7C10C7054EF70A6F6C989613DB7D2EB86320F49026DD546C72A1EEB49C019BD3

Function 00007FF7EAF06240 Relevance: 13.6, APIs: 9, Instructions: 101timenetworkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7EAF062AA
timeGetTime.WINMM ref: 00007FF7EAF062D8
WSASetLastError.WS2_32 ref: 00007FF7EAF062F9
LeaveCriticalSection.KERNEL32 ref: 00007FF7EAF06303
timeGetTime.WINMM ref: 00007FF7EAF0631A
SetEvent.KERNEL32 ref: 00007FF7EAF06354
LeaveCriticalSection.KERNEL32 ref: 00007FF7EAF06366
LeaveCriticalSection.KERNEL32 ref: 00007FF7EAF06395
WSASetLastError.WS2_32 ref: 00007FF7EAF063BE

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalSection$Leave$ErrorLastTimetime$EnterEvent
String ID:
API String ID: 3019579578-0
Opcode ID: 1cc5bff3dd2912bbf840fa48739d8834fcdebc8cdae61fe5ead118e36bb8da40
Instruction ID: 8d56228dbd0b2e91dc81251db120336e6bd225b1d25e563d6044b9db93bb7b17
Opcode Fuzzy Hash: 1cc5bff3dd2912bbf840fa48739d8834fcdebc8cdae61fe5ead118e36bb8da40
Instruction Fuzzy Hash: 7C411C229086818BF7B0AB11E5803BAF3A0FB94754F8441B6DB8E43B95CF7CF5859752

Function 028D6200 Relevance: 13.6, APIs: 9, Instructions: 101timenetworkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 028D626A
timeGetTime.WINMM ref: 028D6298
WSASetLastError.WS2_32 ref: 028D62B9
LeaveCriticalSection.KERNEL32 ref: 028D62C3
timeGetTime.WINMM ref: 028D62DA
SetEvent.KERNEL32 ref: 028D6314
LeaveCriticalSection.KERNEL32 ref: 028D6326
LeaveCriticalSection.KERNEL32 ref: 028D6355
WSASetLastError.WS2_32 ref: 028D637E

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalSection$Leave$ErrorLastTimetime$EnterEvent
String ID:
API String ID: 3019579578-0
Opcode ID: dd50ce443d7a7c7a2503f875a105e6cc88d9067b5d064de374ba49bafdefeff6
Instruction ID: c3bb5b9b267e718582b243117b3aa6a0007ecce15e45aed9f602a1fd1794dec9
Opcode Fuzzy Hash: dd50ce443d7a7c7a2503f875a105e6cc88d9067b5d064de374ba49bafdefeff6
Instruction Fuzzy Hash: 08414A3E2046948BD7749B26F54432EB775F798754F084125DB9A83BA8EF3CE489CB40

Function 028F80E8 Relevance: 13.6, APIs: 9, Instructions: 81COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 028F8111
_errno.LIBCMT ref: 028F811A
__doserrno.LIBCMT ref: 028F8178
_errno.LIBCMT ref: 028F817F
_invalid_parameter_noinfo.LIBCMT ref: 028F81E3

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfo
String ID:
API String ID: 2315031519-0
Opcode ID: 4862a53a2d00355b2cdfb6728f68fce1447d9864874779d523ba4aac90f1cc33
Instruction ID: 6ccd4f693b912d7fff37da2e95b18b6fd6d8ef4c00431adbe3cfcf59b969f159
Opcode Fuzzy Hash: 4862a53a2d00355b2cdfb6728f68fce1447d9864874779d523ba4aac90f1cc33
Instruction Fuzzy Hash: 0C213D3E70029585DB46AF699C8032F7B56B781768F455619DF25CB3A0DB7CC481CB11

Function 00007FF7EAF06120 Relevance: 13.6, APIs: 9, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF7EAF0613A
TryEnterCriticalSection.KERNEL32 ref: 00007FF7EAF0615B
TryEnterCriticalSection.KERNEL32 ref: 00007FF7EAF0616D
SetLastError.KERNEL32 ref: 00007FF7EAF06186
LeaveCriticalSection.KERNEL32 ref: 00007FF7EAF06190
LeaveCriticalSection.KERNEL32 ref: 00007FF7EAF0619A

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 3a839ef8a6bf8d7d73b88de66420fd037dbe664b26c5089cd47badf1e2dfdb2a
Instruction ID: d5ab6988c5b7437f6488a6b7dafe54ccdfa7d43db0e2a5098182d87b6dc937f0
Opcode Fuzzy Hash: 3a839ef8a6bf8d7d73b88de66420fd037dbe664b26c5089cd47badf1e2dfdb2a
Instruction Fuzzy Hash: 54315231A18546C6FB90AF24D5843ADB3A0FF54B4CF9000F2DA0E86165DF7DE946D761

Function 028D60E0 Relevance: 13.6, APIs: 9, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 028D60FA
TryEnterCriticalSection.KERNEL32 ref: 028D611B
TryEnterCriticalSection.KERNEL32 ref: 028D612D
SetLastError.KERNEL32 ref: 028D6146
LeaveCriticalSection.KERNEL32 ref: 028D6150
LeaveCriticalSection.KERNEL32 ref: 028D615A

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 7e876657705aafb2821538dd1f535f86e1477a843cf3583b913b0a5c36b37387
Instruction ID: 64ae50f4a7dd772fe3e86a5c60e4821d368d6bece041d6849dc729800969d7dc
Opcode Fuzzy Hash: 7e876657705aafb2821538dd1f535f86e1477a843cf3583b913b0a5c36b37387
Instruction Fuzzy Hash: 3B31493EA11A54C7DB50DF29E94836D37A9FB54B4CF548025DB0AC66A5EF39C88ECB00

Function 028DF630 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 028DF6AD
WriteFile.KERNEL32 ref: 028DF6DE
CloseHandle.KERNEL32 ref: 028DF6EB
lstrlenW.KERNEL32 ref: 028DF6F6
wsprintfW.USER32 ref: 028DF71C

Strings

%s %s, xrefs: 028DF715

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: File$CloseCreateHandleWritelstrlenwsprintf
String ID: %s %s
API String ID: 2369136734-2939940506
Opcode ID: 7ef7a53ba985828fa4f99ddb91af49db77e1c784a27905632a79e32e9e8331c5
Instruction ID: 52ae75dcf78fefc9c53750a66d7756ab50839e0f000ff0524a4132e7a5da5c9b
Opcode Fuzzy Hash: 7ef7a53ba985828fa4f99ddb91af49db77e1c784a27905632a79e32e9e8331c5
Instruction Fuzzy Hash: F1318E3A21498595EB209F25F8447DBB361FB94798F844121DB5E87E98DF3CC649DB00

Function 028A6941 Relevance: 12.2, APIs: 8, Instructions: 165COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 028A6988
_invalid_parameter_noinfo.LIBCMT ref: 028A6994
_errno.LIBCMT ref: 028A69DE
_errno.LIBCMT ref: 028A69E9
_errno.LIBCMT ref: 028A6A1B
_invalid_parameter_noinfo.LIBCMT ref: 028A6A25
_errno.LIBCMT ref: 028A6ADA
_invalid_parameter_noinfo.LIBCMT ref: 028A6AE6

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: f3f04de84822cc1239a4827cb0b81b2f4a7de66a547fef9b1cca50d5853ff6da
Instruction ID: 59546e37b1e0658490a7b1d283765d447642d49ffe8a4f4c3a06f01eb2e9a1c1
Opcode Fuzzy Hash: f3f04de84822cc1239a4827cb0b81b2f4a7de66a547fef9b1cca50d5853ff6da
Instruction Fuzzy Hash: 4751D33C514A2A8FEF2ADF18C8A436977A5FB48329F5C4229D45EC7199EF34D4818B42

Function 028A2585 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 028A259C
_invalid_parameter_noinfo.LIBCMT ref: 028A25A7

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: ba147bacc2b5e060ee5a802c7efa88b2d7141a420072347e719a083b69a0ed4b
Instruction ID: 1ba639e78b013b456722f6006644cb7447c8be77870afb14506f1116c52fc35f
Opcode Fuzzy Hash: ba147bacc2b5e060ee5a802c7efa88b2d7141a420072347e719a083b69a0ed4b
Instruction Fuzzy Hash: 1241B23C615A0A5BEB68EF2DC4A436477E1FB55318B240719DC5AC319ADF24D892CBC2

Function 00007FF7EAF04AD0 Relevance: 12.1, APIs: 8, Instructions: 120memorynetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7EAF04CD0: EnterCriticalSection.KERNEL32 ref: 00007FF7EAF04CFE
Part of subcall function 00007FF7EAF04CD0: LeaveCriticalSection.KERNEL32 ref: 00007FF7EAF04D52

send.WS2_32 ref: 00007FF7EAF04B23
EnterCriticalSection.KERNEL32 ref: 00007FF7EAF04B37
LeaveCriticalSection.KERNEL32 ref: 00007FF7EAF04B4B
HeapFree.KERNEL32 ref: 00007FF7EAF04BC7
WSAGetLastError.WS2_32 ref: 00007FF7EAF04C14
EnterCriticalSection.KERNEL32 ref: 00007FF7EAF04C28
LeaveCriticalSection.KERNEL32 ref: 00007FF7EAF04C76
HeapFree.KERNEL32 ref: 00007FF7EAF04CB4

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalSection$EnterLeave$FreeHeap$ErrorLastsend
String ID:
API String ID: 1701177279-0
Opcode ID: c1be7f863ec74c84b7929cd5dfa0ec5487756cd30b1768cbd88e9af37da90106
Instruction ID: ce87d3362b5a646ea6823113c2903eac1dc49196cf9545055058cd4f1342a83c
Opcode Fuzzy Hash: c1be7f863ec74c84b7929cd5dfa0ec5487756cd30b1768cbd88e9af37da90106
Instruction Fuzzy Hash: 49518032608A8186FB64EF26D5803EDB3A0FB44B89F804076DB4E47B94DF38E995C751

Function 028D4A70 Relevance: 12.1, APIs: 8, Instructions: 120memorynetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 028D4C70: EnterCriticalSection.KERNEL32 ref: 028D4C9E
Part of subcall function 028D4C70: LeaveCriticalSection.KERNEL32 ref: 028D4CF2

send.WS2_32 ref: 028D4AC3
EnterCriticalSection.KERNEL32 ref: 028D4AD7
LeaveCriticalSection.KERNEL32 ref: 028D4AEB
HeapFree.KERNEL32 ref: 028D4B67
WSAGetLastError.WS2_32 ref: 028D4BB4
EnterCriticalSection.KERNEL32 ref: 028D4BC8
LeaveCriticalSection.KERNEL32 ref: 028D4C16
HeapFree.KERNEL32 ref: 028D4C54

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalSection$EnterLeave$FreeHeap$ErrorLastsend
String ID:
API String ID: 1701177279-0
Opcode ID: 0f41ccaa659a3fbdd162dac1c10e9f0415eaaa72adcae5368495915b1afd0a29
Instruction ID: 2bb0750e3bd1da12180b6a20df24cbc091cd276fdaa4803dbda637cdd090fd43
Opcode Fuzzy Hash: 0f41ccaa659a3fbdd162dac1c10e9f0415eaaa72adcae5368495915b1afd0a29
Instruction Fuzzy Hash: 42517C3E201B808AE764CF6AE5443AD73A1F758B98F448125DB4E87F54DF38D5AAC740

Function 028D3F10 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32 ref: 028D3F72

Part of subcall function 028D1370: free.LIBCMT ref: 028D1390
Part of subcall function 028D1370: malloc.LIBCMT ref: 028D13BC

setsockopt.WS2_32 ref: 028D400D
setsockopt.WS2_32 ref: 028D4037
ResetEvent.KERNEL32 ref: 028D4085
SetLastError.KERNEL32 ref: 028D40B0
GetLastError.KERNEL32 ref: 028D40C8

Part of subcall function 028D4D20: GetCurrentThreadId.KERNEL32 ref: 028D4D2D

SetLastError.KERNEL32 ref: 028D40DA

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ErrorLast$setsockopt$CreateCurrentEventResetThreadTimerWaitablefreemalloc
String ID:
API String ID: 3356772049-0
Opcode ID: b62db397012c45f7f6159a48d9087b38499f2d1e65472d174db3c1d68d875640
Instruction ID: 11341abfc4c339a86bdaa2a36296527480d36330c00c7d3f56708d09c5af998f
Opcode Fuzzy Hash: b62db397012c45f7f6159a48d9087b38499f2d1e65472d174db3c1d68d875640
Instruction Fuzzy Hash: 5941587A601B809BE7548F25E64835EB7A0F748748F148139EB8987B90CF7ED069CF44

Function 028F2AB4 Relevance: 12.1, APIs: 8, Instructions: 95COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 028F2ACB
_invalid_parameter_noinfo.LIBCMT ref: 028F2AD6

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: ba147bacc2b5e060ee5a802c7efa88b2d7141a420072347e719a083b69a0ed4b
Instruction ID: 32c2d3175cb5829355a7aca0605e24d2f1db97dd34bf2d031c19f452d42cfcea
Opcode Fuzzy Hash: ba147bacc2b5e060ee5a802c7efa88b2d7141a420072347e719a083b69a0ed4b
Instruction Fuzzy Hash: 8B31F43E614645C6DBA48F7DC68032C37A0F7457ACF244615DF6AC7A98CB38C4A2CB01

Function 00007FF7EAF05460 Relevance: 12.1, APIs: 8, Instructions: 82networksleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FF7EAF05490
timeGetTime.WINMM ref: 00007FF7EAF054B6
GetCurrentThreadId.KERNEL32 ref: 00007FF7EAF054D9
send.WS2_32 ref: 00007FF7EAF0551C
SetEvent.KERNEL32 ref: 00007FF7EAF0553A
WSACloseEvent.WS2_32 ref: 00007FF7EAF05550
shutdown.WS2_32 ref: 00007FF7EAF05569
closesocket.WS2_32 ref: 00007FF7EAF05573

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Event$CloseCurrentSleepThreadTimeclosesocketsendshutdowntime
String ID:
API String ID: 929257074-0
Opcode ID: e6689e71db0ff1669b26d14558efafb386105a6056d856fa6fa8066e84783edc
Instruction ID: e33347b0cc48dd7d558bdbfa722c77f25a665198b8af4048373139b255aed456
Opcode Fuzzy Hash: e6689e71db0ff1669b26d14558efafb386105a6056d856fa6fa8066e84783edc
Instruction Fuzzy Hash: 70315F3290464286FB20AF25D4902BCB361FB44F6EF9442B2DA5D876D9CF7CD841C7A2

Function 028D5400 Relevance: 12.1, APIs: 8, Instructions: 82networksleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 028D5430
timeGetTime.WINMM ref: 028D5456
GetCurrentThreadId.KERNEL32 ref: 028D5479
send.WS2_32 ref: 028D54BC
SetEvent.KERNEL32 ref: 028D54DA
WSACloseEvent.WS2_32 ref: 028D54F0
shutdown.WS2_32 ref: 028D5509
closesocket.WS2_32 ref: 028D5513

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Event$CloseCurrentSleepThreadTimeclosesocketsendshutdowntime
String ID:
API String ID: 929257074-0
Opcode ID: d80bd20e404b5833ff99a516d4d3aea9d62cab81a5f619cabeebe738e59a6503
Instruction ID: c3bdb2b1d17a121f59967b51234a13aa067f8e2b841d0e0ea7afe9ad8e9cac91
Opcode Fuzzy Hash: d80bd20e404b5833ff99a516d4d3aea9d62cab81a5f619cabeebe738e59a6503
Instruction Fuzzy Hash: CE315E7E61169187DB219F39E84431C7372F784F69F589222DA6A87AD8CF38C889C741

Function 00007FF7EAF04FA0 Relevance: 12.1, APIs: 8, Instructions: 64windowCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 00007FF7EAF04FC7
MsgWaitForMultipleObjects.USER32 ref: 00007FF7EAF04FF8
PeekMessageW.USER32 ref: 00007FF7EAF05014
TranslateMessage.USER32 ref: 00007FF7EAF05025
DispatchMessageW.USER32 ref: 00007FF7EAF05030
PeekMessageW.USER32 ref: 00007FF7EAF0504B
SetLastError.KERNEL32 ref: 00007FF7EAF05077
CloseHandle.KERNEL32 ref: 00007FF7EAF0508C

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Message$Peek$CloseDispatchErrorEventHandleLastMultipleObjectsTranslateWait
String ID:
API String ID: 1713936993-0
Opcode ID: 446e21ef8d1e23cb48fe62aa3044cfdae947c01fbde446d7c73040613798d1b3
Instruction ID: c9deb741fd1fe531b746019222becf28eae65091819c0954f48616c30d4c1da9
Opcode Fuzzy Hash: 446e21ef8d1e23cb48fe62aa3044cfdae947c01fbde446d7c73040613798d1b3
Instruction Fuzzy Hash: 4121D232A1854282F760AF34D4947BDB390FF94709FD441B6DA4D825A4DF3CD849CB62

Function 00007FF7EAF04E60 Relevance: 12.1, APIs: 8, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,00007FF7EAF04E44), ref: 00007FF7EAF04E85
ResetEvent.KERNEL32(?,?,00000000,00007FF7EAF04E44), ref: 00007FF7EAF04E92
ResetEvent.KERNEL32(?,?,00000000,00007FF7EAF04E44), ref: 00007FF7EAF04E9F
ResetEvent.KERNEL32(?,?,00000000,00007FF7EAF04E44), ref: 00007FF7EAF04EAC
HeapFree.KERNEL32 ref: 00007FF7EAF04F0F
HeapDestroy.KERNEL32(?,?,00000000,00007FF7EAF04E44), ref: 00007FF7EAF04F2F
HeapCreate.KERNEL32(?,?,00000000,00007FF7EAF04E44), ref: 00007FF7EAF04F49
SetEvent.KERNEL32 ref: 00007FF7EAF04F7D

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Event$HeapReset$CreateCriticalDestroyEnterFreeSection
String ID:
API String ID: 1658878062-0
Opcode ID: b8e90da5e81a1c5bd4b7ea335600b5e9df7185687b6b9f4d8d1a246453650ad8
Instruction ID: 7a88990e8b2e0ec4500e6ed1c0c8c0ac93afd5a1af21220599c605d6bf61b440
Opcode Fuzzy Hash: b8e90da5e81a1c5bd4b7ea335600b5e9df7185687b6b9f4d8d1a246453650ad8
Instruction Fuzzy Hash: 1731E932604A81E2FA48EB21D6843ECF364FB54B85F8041B6DB6D43651CF38E5B9C752

Function 028D4F40 Relevance: 12.1, APIs: 8, Instructions: 64windowCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 028D4F67
MsgWaitForMultipleObjects.USER32 ref: 028D4F98
PeekMessageW.USER32 ref: 028D4FB4
TranslateMessage.USER32 ref: 028D4FC5
DispatchMessageW.USER32 ref: 028D4FD0
PeekMessageW.USER32 ref: 028D4FEB
SetLastError.KERNEL32 ref: 028D5017
CloseHandle.KERNEL32 ref: 028D502C

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Message$Peek$CloseDispatchErrorEventHandleLastMultipleObjectsTranslateWait
String ID:
API String ID: 1713936993-0
Opcode ID: 4271cb4c7969a4cce060b49edca004edc8465e505ab8869e0f42c4e3588366c3
Instruction ID: adcff25602df26baace3d4ae9bad28433670d70216465382eed8c23dd4dffc53
Opcode Fuzzy Hash: 4271cb4c7969a4cce060b49edca004edc8465e505ab8869e0f42c4e3588366c3
Instruction Fuzzy Hash: 3621A17E611A4083E7609F34E558B1933A1FF94708FA49225DB5AC6AB4DF3CC84DCB04

Function 00007FF7EAF0D8F0 Relevance: 12.1, APIs: 8, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 00007FF7EAF0D917

Part of subcall function 00007FF7EAF0A56C: _set_error_mode.LIBCMT ref: 00007FF7EAF0A575
Part of subcall function 00007FF7EAF0A56C: _set_error_mode.LIBCMT ref: 00007FF7EAF0A584

Part of subcall function 00007FF7EAF0A30C: _set_error_mode.LIBCMT ref: 00007FF7EAF0A351
Part of subcall function 00007FF7EAF0A30C: _set_error_mode.LIBCMT ref: 00007FF7EAF0A362
Part of subcall function 00007FF7EAF0A30C: GetModuleFileNameW.KERNEL32 ref: 00007FF7EAF0A3C4

Part of subcall function 00007FF7EAF09F5C: ExitProcess.KERNEL32 ref: 00007FF7EAF09F6B

Part of subcall function 00007FF7EAF0C020: malloc.LIBCMT ref: 00007FF7EAF0C04B
Part of subcall function 00007FF7EAF0C020: Sleep.KERNEL32(?,?,ceil,00007FF7EAF0D951,?,?,?,00007FF7EAF0D9FB,?,?,00000000,00007FF7EAF0B951,?,?,00000000,00007FF7EAF0BA08), ref: 00007FF7EAF0C05E

_errno.LIBCMT ref: 00007FF7EAF0D959
_lock.LIBCMT ref: 00007FF7EAF0D96D
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,00007FF7EAF0D9FB,?,?,00000000,00007FF7EAF0B951,?,?,00000000,00007FF7EAF0BA08,?,?,?,00007FF7EAF0938D), ref: 00007FF7EAF0D983
free.LIBCMT ref: 00007FF7EAF0D990
_errno.LIBCMT ref: 00007FF7EAF0D995
LeaveCriticalSection.KERNEL32(?,?,?,00007FF7EAF0D9FB,?,?,00000000,00007FF7EAF0B951,?,?,00000000,00007FF7EAF0BA08,?,?,?,00007FF7EAF0938D), ref: 00007FF7EAF0D9B8

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_lockfreemalloc
String ID:
API String ID: 113790786-0
Opcode ID: 1cf7f058a8983c64bfdf0fb23590526f2e0664be90d8ed4957796866281ab8dc
Instruction ID: ba0be9acc8f412c2e8c996dd1355668a8dd4246a6f1ad5fb932af317596bd6a4
Opcode Fuzzy Hash: 1cf7f058a8983c64bfdf0fb23590526f2e0664be90d8ed4957796866281ab8dc
Instruction Fuzzy Hash: E3217C21E1D64281F754BB20A5947FAE364AF80788F8452B7E58E466C2EF3CE44087A3

Function 028F2E54 Relevance: 12.1, APIs: 8, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 028F2E7B

Part of subcall function 028EC3BC: _set_error_mode.LIBCMT ref: 028EC3C5
Part of subcall function 028EC3BC: _set_error_mode.LIBCMT ref: 028EC3D4

Part of subcall function 028EC15C: _set_error_mode.LIBCMT ref: 028EC1A1
Part of subcall function 028EC15C: _set_error_mode.LIBCMT ref: 028EC1B2
Part of subcall function 028EC15C: GetModuleFileNameW.KERNEL32 ref: 028EC214

Part of subcall function 028EBDC8: ExitProcess.KERNEL32 ref: 028EBDD7
Part of subcall function 028EBDC8: _amsg_exit.LIBCMT ref: 028F2F66

Part of subcall function 028EAA60: malloc.LIBCMT ref: 028EAA8B
Part of subcall function 028EAA60: Sleep.KERNEL32 ref: 028EAA9E

_errno.LIBCMT ref: 028F2EBD
_lock.LIBCMT ref: 028F2ED1
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 028F2EE7
free.LIBCMT ref: 028F2EF4
_errno.LIBCMT ref: 028F2EF9
LeaveCriticalSection.KERNEL32 ref: 028F2F1C

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_amsg_exit_lockfreemalloc
String ID:
API String ID: 2779410436-0
Opcode ID: 37d972f6b1d76df9f826d02c284df8605912df9770a7338b09434c8fb6f2a1a1
Instruction ID: dd65eab2284c4092dc9598254ee83bc867d6857629385451f4faf669dbd927df
Opcode Fuzzy Hash: 37d972f6b1d76df9f826d02c284df8605912df9770a7338b09434c8fb6f2a1a1
Instruction Fuzzy Hash: D321B12D62168482EBA4EB55E40472A3366FB86798F859035DB4BC7B98DF3CC440CB12

Function 0289A0A1 Relevance: 11.6, APIs: 9, Instructions: 379COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0289A390
free.LIBCMT ref: 0289A3A0
free.LIBCMT ref: 0289A3B0
free.LIBCMT ref: 0289A3BC
free.LIBCMT ref: 0289A411
free.LIBCMT ref: 0289A419
free.LIBCMT ref: 0289A421
free.LIBCMT ref: 0289A429
free.LIBCMT ref: 0289A433

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 79754162f90728ee6296ef0ddc862aca26a0c0dc80cbfdd284a51caaacb4e720
Instruction ID: 7d1404c4a877f5dd9546c740a17968b62b4957fd46a0d22298759454a22a5a3e
Opcode Fuzzy Hash: 79754162f90728ee6296ef0ddc862aca26a0c0dc80cbfdd284a51caaacb4e720
Instruction Fuzzy Hash: 86C1B238618B488BCB5DDF6CD4947A9B7E1FB59304F58412EE88EC7251DB35D842CB82

Function 00007FF7EAF02390 Relevance: 10.8, APIs: 2, Strings: 5, Instructions: 339COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF7EAF025A6
malloc.LIBCMT ref: 00007FF7EAF0268D

Part of subcall function 00007FF7EAF09070: _FF_MSGBANNER.LIBCMT ref: 00007FF7EAF090A0
Part of subcall function 00007FF7EAF09070: HeapAlloc.KERNEL32(?,?,00B34BF300000000,00007FF7EAF0C050,?,?,ceil,00007FF7EAF0D951,?,?,?,00007FF7EAF0D9FB,?,?,00000000,00007FF7EAF0B951), ref: 00007FF7EAF090C5
Part of subcall function 00007FF7EAF09070: _callnewh.LIBCMT ref: 00007FF7EAF090DE
Part of subcall function 00007FF7EAF09070: _errno.LIBCMT ref: 00007FF7EAF090E9
Part of subcall function 00007FF7EAF09070: _errno.LIBCMT ref: 00007FF7EAF090F4

Strings

[RI] %d bytes, xrefs: 00007FF7EAF023CA
input wins: %lu, xrefs: 00007FF7EAF0272E
input probe, xrefs: 00007FF7EAF02705
input ack: sn=%lu rtt=%ld rto=%ld, xrefs: 00007FF7EAF02601
input psh: sn=%lu ts=%lu, xrefs: 00007FF7EAF0263E

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$AllocHeap_callnewhfreemalloc
String ID: [RI] %d bytes$input ack: sn=%lu rtt=%ld rto=%ld$input probe$input psh: sn=%lu ts=%lu$input wins: %lu
API String ID: 3198430600-868042568
Opcode ID: dda5b54ef822ff448da02969afc54e1d0890a7d0193f906d4744a84604512da3
Instruction ID: e47505bb60a5bb7204d64456a3a709b14c4eccfb9d1390599cfe45a9dbd37caf
Opcode Fuzzy Hash: dda5b54ef822ff448da02969afc54e1d0890a7d0193f906d4744a84604512da3
Instruction Fuzzy Hash: 1CE1A672A086824AF7749B25A4907BABBE1FB54788F944073DB9A43785DF3CE441CB31

Function 028D2360 Relevance: 10.8, APIs: 2, Strings: 5, Instructions: 339COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 028D2576
malloc.LIBCMT ref: 028D265D

Part of subcall function 028E5540: _FF_MSGBANNER.LIBCMT ref: 028E5570
Part of subcall function 028E5540: HeapAlloc.KERNEL32 ref: 028E5595
Part of subcall function 028E5540: _callnewh.LIBCMT ref: 028E55AE
Part of subcall function 028E5540: _errno.LIBCMT ref: 028E55B9
Part of subcall function 028E5540: _errno.LIBCMT ref: 028E55C4

Strings

input probe, xrefs: 028D26D5
[RI] %d bytes, xrefs: 028D239A
input ack: sn=%lu rtt=%ld rto=%ld, xrefs: 028D25D1
input psh: sn=%lu ts=%lu, xrefs: 028D260E
input wins: %lu, xrefs: 028D26FE

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$AllocHeap_callnewhfreemalloc
String ID: [RI] %d bytes$input ack: sn=%lu rtt=%ld rto=%ld$input probe$input psh: sn=%lu ts=%lu$input wins: %lu
API String ID: 3198430600-868042568
Opcode ID: 998f631f10f0674a01e626946bbc140b1c142096ffe25ddbd44dd6e6184c5e58
Instruction ID: 8ceadc83816512a52d9da0939ee1330b5a64601f57c5692a71ca2c9875631ff4
Opcode Fuzzy Hash: 998f631f10f0674a01e626946bbc140b1c142096ffe25ddbd44dd6e6184c5e58
Instruction Fuzzy Hash: 50D1BF7E6046808BD7748F29E450B2EBBB1F784B99F144021DF9AC3B5ADB38D858CB51

Function 028F5838 Relevance: 10.8, APIs: 7, Instructions: 305COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 028F58BC
free.LIBCMT ref: 028F58E1
free.LIBCMT ref: 028F5CA6
free.LIBCMT ref: 028F5CB2

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f79610ff68ecb84ad7a242d7dc4ba12df8ee8fd71acbd90681a3878a8731f65c
Instruction ID: 5e7a1d92a8aa056e1da1ff83666cfefb18d4a346d66c31bccde5cb7b24a5548c
Opcode Fuzzy Hash: f79610ff68ecb84ad7a242d7dc4ba12df8ee8fd71acbd90681a3878a8731f65c
Instruction Fuzzy Hash: DCC1943E700B5589DF20DB66E484A9E77A5F789788F804926CF9E87B14EF78C205CB40

Function 00007FF7EAF0D3CC Relevance: 10.7, APIs: 7, Instructions: 184COMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 00007FF7EAF0D3ED

Part of subcall function 00007FF7EAF0C0A0: Sleep.KERNEL32(?,?,ceil,00007FF7EAF0B9E3,?,?,?,00007FF7EAF0938D,?,?,?,?,00007FF7EAF14BEE), ref: 00007FF7EAF0C0E5

GetFileType.KERNEL32 ref: 00007FF7EAF0D558
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF7EAF0D596

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CountCriticalFileInfoInitializeSectionSleepSpinStartupType
String ID:
API String ID: 3473179607-0
Opcode ID: eff7a9d518b47b5a0bc449bc8e70df270870fd33741806fcd9b591f6a57ce8e5
Instruction ID: 2f75ddb6596d06fc939ea8d826903e50099ac351faafe6fb744f5566719060eb
Opcode Fuzzy Hash: eff7a9d518b47b5a0bc449bc8e70df270870fd33741806fcd9b591f6a57ce8e5
Instruction Fuzzy Hash: 76815E62A08B8286FB14AF14D5843B9A7A0EF44B78F944376CA6E432D5DF3CE455C322

Function 028A8341 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 028A835C

Part of subcall function 028A26D9: _errno.LIBCMT ref: 028A26E2
Part of subcall function 028A26D9: _invalid_parameter_noinfo.LIBCMT ref: 028A26ED

_errno.LIBCMT ref: 028A836C
_errno.LIBCMT ref: 028A838A
_isatty.LIBCMT ref: 028A83EB
_getbuf.LIBCMT ref: 028A83F7

Strings

, xrefs: 028A8377

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-3916222277
Opcode ID: 3f5d46b04a604bc5b79a1a1652a8fb6aba7d8c85590462c3b1725dfb1c4ad4a1
Instruction ID: e8e569d4cdbcdf8a06e49f9cc2811dd07ff6125ce9767fa8ba2667a834893a5b
Opcode Fuzzy Hash: 3f5d46b04a604bc5b79a1a1652a8fb6aba7d8c85590462c3b1725dfb1c4ad4a1
Instruction Fuzzy Hash: 0F41C37C114A098FEB18EF2CC4E636A77D1FB44314B188269D85ACB299DF74C851CBD2

Function 028D43D0 Relevance: 10.7, APIs: 7, Instructions: 154threadnetworktimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 028D4400
SetWaitableTimer.KERNEL32 ref: 028D4442
WSAWaitForMultipleEvents.WS2_32 ref: 028D44EC
SetLastError.KERNEL32 ref: 028D4597
GetLastError.KERNEL32 ref: 028D459D
WSAGetLastError.WS2_32 ref: 028D45CA
GetCurrentThreadId.KERNEL32 ref: 028D45FF

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ErrorLast$CurrentThread$EventsMultipleTimerWaitWaitable
String ID:
API String ID: 3058130114-0
Opcode ID: 233744dc1db25240e62441a4cfda316594facda456fb24716390902636e45cb6
Instruction ID: a9ce267e5a4feeac900e68008606c901d8cf0346be45282b1f1194426aa316e8
Opcode Fuzzy Hash: 233744dc1db25240e62441a4cfda316594facda456fb24716390902636e45cb6
Instruction Fuzzy Hash: 07515B3E201B8186DB609F39A85435933A5F748B98F588636DF6ECBB98DF35C488C711

Function 028DDE7E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119registryCOMMON

Download Yara Rule

APIs

Part of subcall function 028E55F8: malloc.LIBCMT ref: 028E5612

Part of subcall function 028E55F8: _callnewh.LIBCMT ref: 028E5606
Part of subcall function 028E55F8: std::exception::exception.LIBCMT ref: 028E567F

RegCreateKeyW.ADVAPI32 ref: 028DDFC4
RegDeleteValueW.ADVAPI32 ref: 028DE008
RegSetValueExW.ADVAPI32 ref: 028DE028
RegCloseKey.ADVAPI32 ref: 028DE03F
CloseHandle.KERNEL32 ref: 028DE8D3

Strings

Console\1, xrefs: 028DDFB6

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CloseValue$CreateDeleteHandle_callnewhmallocstd::exception::exception
String ID: Console\1
API String ID: 2917754286-1035756066
Opcode ID: 197f3776fcfdbae7181363bff554ce8eb13514d1fa7c0f2a772ffbaf27157f94
Instruction ID: 9636764637abc0f4cbc798c6397cdfaebbbed1ffee9a47903f50bac5d9b93cc2
Opcode Fuzzy Hash: 197f3776fcfdbae7181363bff554ce8eb13514d1fa7c0f2a772ffbaf27157f94
Instruction Fuzzy Hash: F6519D3E305B8086DB58DB26E958BAE73A9F789B88F414125DF8E87B44CF38C154CB45

Function 028F8870 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 028F888B

Part of subcall function 028F2C08: _errno.LIBCMT ref: 028F2C11
Part of subcall function 028F2C08: _invalid_parameter_noinfo.LIBCMT ref: 028F2C1C

_errno.LIBCMT ref: 028F889B
_errno.LIBCMT ref: 028F88B9
_isatty.LIBCMT ref: 028F891A
_getbuf.LIBCMT ref: 028F8926

Strings

, xrefs: 028F88A6

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-3916222277
Opcode ID: 3400bb7e1b23dcffe992471eb001d2fbbed010b591358fa3dccb17419f35d11d
Instruction ID: 493ec6cb87ca605dfbb761d86d0e3b737b4bccc0956d90e777ff0a5be3aa877d
Opcode Fuzzy Hash: 3400bb7e1b23dcffe992471eb001d2fbbed010b591358fa3dccb17419f35d11d
Instruction Fuzzy Hash: 3941C37E710B0486DB689F2DD48532D7761EB84BA8F144215CF69C73D8EB38C491C792

Function 02897AF1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 02897B18
_invalid_parameter_noinfo.LIBCMT ref: 02897B23
_fileno.LIBCMT ref: 02897B46
_errno.LIBCMT ref: 02897BB6
_invalid_parameter_noinfo.LIBCMT ref: 02897BC1

Strings

@, xrefs: 02897B39

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno
String ID: @
API String ID: 3947385824-2766056989
Opcode ID: c59bcbb70bdc2dd793f40e48e33bab8fac7fcf3cd1580ce031325b872c95e3c5
Instruction ID: 60141b148518bc933a18506573d9ff77e269d03237f3647a948840e9c0615ab3
Opcode Fuzzy Hash: c59bcbb70bdc2dd793f40e48e33bab8fac7fcf3cd1580ce031325b872c95e3c5
Instruction Fuzzy Hash: AA31097C224D094F9F68EB2C8895339B2A2FB89334B9C476ED42EC71E5DB3488418742

Function 028979ED Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 02897A0D
_invalid_parameter_noinfo.LIBCMT ref: 02897A18
_fileno.LIBCMT ref: 02897A38
_errno.LIBCMT ref: 02897AA8
_invalid_parameter_noinfo.LIBCMT ref: 02897AB3

Strings

@, xrefs: 02897A2B

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno
String ID: @
API String ID: 3947385824-2766056989
Opcode ID: 2a3b2a4cd214041c74d131aa7b21a7eccb1e02e7ccffb0f930f8d01a64b21150
Instruction ID: acd10e3d9bdb0d44a8d020be652b6f07066ac23d8779794dcfe6f005553193da
Opcode Fuzzy Hash: 2a3b2a4cd214041c74d131aa7b21a7eccb1e02e7ccffb0f930f8d01a64b21150
Instruction Fuzzy Hash: 0321057C224E494E9F18AF3C8C94378B6D2EB85334B9C036DD42AC61E1DB3885528742

Function 00007FF7EAF108B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,00007FF7EAF10A6B), ref: 00007FF7EAF1090A
malloc.LIBCMT ref: 00007FF7EAF1096E
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,00007FF7EAF10A6B), ref: 00007FF7EAF109B6
GetStringTypeW.KERNEL32(?,?,?,?,?,?,?,00007FF7EAF10A6B), ref: 00007FF7EAF109CD
free.LIBCMT ref: 00007FF7EAF109E1

Strings

4 =X, xrefs: 00007FF7EAF108CF

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ByteCharMultiWide$StringTypefreemalloc
String ID: 4 =X
API String ID: 307345228-3147943113
Opcode ID: e70f9f49b4bf10f7c9a397bbad2514da52a9a5bda9101d0c48d23cf0e55f0220
Instruction ID: 24dd06b7fb80f277b021ba784d5574b54bce8fd024ce9dc77e5442aaab2a0694
Opcode Fuzzy Hash: e70f9f49b4bf10f7c9a397bbad2514da52a9a5bda9101d0c48d23cf0e55f0220
Instruction Fuzzy Hash: FA41B422A0478185FB10AF2688506E9A395FF54BB8F994277EE2D477C6EE3CD8018361

Function 028EBF5C Relevance: 10.6, APIs: 7, Instructions: 99COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 028EBF85

Part of subcall function 028F2F3C: _amsg_exit.LIBCMT ref: 028F2F66

DecodePointer.KERNEL32 ref: 028EBFB8
DecodePointer.KERNEL32 ref: 028EBFD6
DecodePointer.KERNEL32 ref: 028EC016
DecodePointer.KERNEL32 ref: 028EC030
DecodePointer.KERNEL32 ref: 028EC040
ExitProcess.KERNEL32 ref: 028EC0CC

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: DecodePointer$ExitProcess_amsg_exit_lock
String ID:
API String ID: 3411037476-0
Opcode ID: 5baf0d66a436a85a947ee67fa1ec11c69a1ec0394f995791ac727bd547e250b3
Instruction ID: bf1fe0465b50b4e9490d1d4b926480aeb7237c5adabcfd39f17db68358a2547f
Opcode Fuzzy Hash: 5baf0d66a436a85a947ee67fa1ec11c69a1ec0394f995791ac727bd547e250b3
Instruction Fuzzy Hash: 3E31BD3E616B4181EA90DF16F948319B7A5F789BD8F144036DE8E87BA4EF78C0A1C701

Function 00007FF7EAF03EF0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7EAF040A0: CreateWaitableTimerW.KERNEL32(?,?,?,00007FF7EAF03F50), ref: 00007FF7EAF040B9
Part of subcall function 00007FF7EAF040A0: free.LIBCMT ref: 00007FF7EAF040F6
Part of subcall function 00007FF7EAF040A0: malloc.LIBCMT ref: 00007FF7EAF04131

setsockopt.WS2_32 ref: 00007FF7EAF03FB6
setsockopt.WS2_32 ref: 00007FF7EAF03FE0
ResetEvent.KERNEL32 ref: 00007FF7EAF0402E
SetLastError.KERNEL32 ref: 00007FF7EAF04059
GetLastError.KERNEL32 ref: 00007FF7EAF04071

Part of subcall function 00007FF7EAF04D80: GetCurrentThreadId.KERNEL32 ref: 00007FF7EAF04D8D

SetLastError.KERNEL32 ref: 00007FF7EAF04083

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ErrorLast$setsockopt$CreateCurrentEventResetThreadTimerWaitablefreemalloc
String ID:
API String ID: 3356772049-0
Opcode ID: 73a169a4cf32f37848a49fcc32154ae59d27d63d7761706b7a505c6040b8b509
Instruction ID: 3dd0eb5e6f7333eaaf6ffc8f6dbe1af0333e6fe001475a3746b0ca3d6d9da0de
Opcode Fuzzy Hash: 73a169a4cf32f37848a49fcc32154ae59d27d63d7761706b7a505c6040b8b509
Instruction Fuzzy Hash: C141E272A08B428BF710AF25E6443ADB7A0FB48749F500176EB8C47B91CF7EE4658B51

Function 028A3785 Relevance: 10.6, APIs: 7, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 028A37A8
_errno.LIBCMT ref: 028A37B0

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: e39b6d2089daf4d4073d4d58c1da8825e9c538b0487b3bad0c323805675e4389
Instruction ID: 7a91c1e78d50b1bb5ea781cecb3a3c9b11b1ae2dbaaee38477ec78f60be2dba5
Opcode Fuzzy Hash: e39b6d2089daf4d4073d4d58c1da8825e9c538b0487b3bad0c323805675e4389
Instruction Fuzzy Hash: 4A21283C618B084EE71A6F5CD8A637873D1FB46321F49029DD546C72A1DBA86C018AA3

Function 028E730C Relevance: 10.6, APIs: 7, Instructions: 93threadCOMMON

Download Yara Rule

APIs

Part of subcall function 028EBD14: HeapCreate.KERNEL32 ref: 028EBD2A
Part of subcall function 028EBD14: GetVersion.KERNEL32 ref: 028EBD3C
Part of subcall function 028EBD14: HeapSetInformation.KERNEL32 ref: 028EBD5A

_RTC_Initialize.LIBCMT ref: 028E733E
GetCommandLineA.KERNEL32 ref: 028E7343

Part of subcall function 028F2630: GetEnvironmentStringsW.KERNEL32 ref: 028F2649
Part of subcall function 028F2630: WideCharToMultiByte.KERNEL32 ref: 028F26A0
Part of subcall function 028F2630: WideCharToMultiByte.KERNEL32 ref: 028F26DB
Part of subcall function 028F2630: free.LIBCMT ref: 028F26E8
Part of subcall function 028F2630: FreeEnvironmentStringsW.KERNEL32 ref: 028F26F3

Part of subcall function 028F1EF0: GetStartupInfoW.KERNEL32 ref: 028F1F11

__setargv.LIBCMT ref: 028E736C
_cinit.LIBCMT ref: 028E7380

Part of subcall function 028EE13C: FlsFree.KERNEL32 ref: 028EE14B
Part of subcall function 028EE13C: DeleteCriticalSection.KERNEL32 ref: 028F2DE7
Part of subcall function 028EE13C: free.LIBCMT ref: 028F2DF0
Part of subcall function 028EE13C: DeleteCriticalSection.KERNEL32 ref: 028F2E17

Part of subcall function 028F21C4: free.LIBCMT ref: 028F2215

Part of subcall function 028EAAE0: Sleep.KERNEL32 ref: 028EAB25

FlsSetValue.KERNEL32 ref: 028E741A
GetCurrentThreadId.KERNEL32 ref: 028E742E
free.LIBCMT ref: 028E743D

Part of subcall function 028E5500: HeapFree.KERNEL32 ref: 028E5516
Part of subcall function 028E5500: _errno.LIBCMT ref: 028E5520
Part of subcall function 028E5500: GetLastError.KERNEL32 ref: 028E5528

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free$FreeHeap$ByteCharCriticalDeleteEnvironmentMultiSectionStringsWide$CommandCreateCurrentErrorInfoInformationInitializeLastLineSleepStartupThreadValueVersion__setargv_cinit_errno
String ID:
API String ID: 125979975-0
Opcode ID: 90631a1543a1d8c7db3f4f35e3e1f4328e7249212d1559b88ca2253deb0b4b6c
Instruction ID: 96d66ef72b2eeffade2c905377fbf197492487586ccc9436bedf46f02f56158c
Opcode Fuzzy Hash: 90631a1543a1d8c7db3f4f35e3e1f4328e7249212d1559b88ca2253deb0b4b6c
Instruction Fuzzy Hash: 3931A23CA4178285EFA8B7B9594432D9297AF0736DF988139CE27C5294EF38C0518A33

Function 028A31B1 Relevance: 10.6, APIs: 7, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 028A31D4
_errno.LIBCMT ref: 028A31DC

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 2439d78e238f4b406dbb2099e9f50d018f4921c7879633d4acecbc07e4d2803a
Instruction ID: f32310c8f197f762c29018f5e0455c76ce50038c2f967b6713823637636b38c4
Opcode Fuzzy Hash: 2439d78e238f4b406dbb2099e9f50d018f4921c7879633d4acecbc07e4d2803a
Instruction Fuzzy Hash: 1D21F53C6087844EF7196F5CD89633877D1EB46322F49029DE546C71A1DBA86C028AA3

Function 00007FF7EAF12DB8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 00007FF7EAF12DF9
_exception_enabled.LIBCMT ref: 00007FF7EAF12E1C

Part of subcall function 00007FF7EAF12CFC: _set_statfp.LIBCMT ref: 00007FF7EAF12D23
Part of subcall function 00007FF7EAF12CFC: _set_statfp.LIBCMT ref: 00007FF7EAF12D96

_raise_exc.LIBCMT ref: 00007FF7EAF12E68
_ctrlfp.LIBCMT ref: 00007FF7EAF12EA8
_ctrlfp.LIBCMT ref: 00007FF7EAF12ED9

Strings

4 =X, xrefs: 00007FF7EAF12DD2

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _ctrlfp$_set_statfp$_exception_enabled_raise_exc
String ID: 4 =X
API String ID: 3456427917-3147943113
Opcode ID: ec85eac3057d4a959c5fd9faad8141c4a2bc6fb97e23b1e6474f11119bd41e60
Instruction ID: c0bd6b72f248f6d078da9a1ae827ea528943e4352e3238f9fdc191a925b49c92
Opcode Fuzzy Hash: ec85eac3057d4a959c5fd9faad8141c4a2bc6fb97e23b1e6474f11119bd41e60
Instruction Fuzzy Hash: 39319432A18A8586EB10EF65E4417ABF775FB95398F401236FE8D06A5ADF3CD441CB00

Function 028E8020 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 028E8047
_invalid_parameter_noinfo.LIBCMT ref: 028E8052
_fileno.LIBCMT ref: 028E8075
_errno.LIBCMT ref: 028E80E5
_invalid_parameter_noinfo.LIBCMT ref: 028E80F0

Strings

@, xrefs: 028E8068

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno
String ID: @
API String ID: 3947385824-2766056989
Opcode ID: 6f26d6a21ce5f7e9606268b60968b5792fb72b6de065461b25dd9013e7e9b1b0
Instruction ID: 967c6ea33358c9b9a7c7c2224f045c1d4d440cf7203f9404d73ea97d19b2eeab
Opcode Fuzzy Hash: 6f26d6a21ce5f7e9606268b60968b5792fb72b6de065461b25dd9013e7e9b1b0
Instruction Fuzzy Hash: 5E21F87E604A8541DF198B2D9C4433D6262AB86BA8F549726DA3FC72F5DF3CC441C711

Function 0289C519 Relevance: 10.6, APIs: 7, Instructions: 75COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0289C53D
_errno.LIBCMT ref: 0289C556
write_char.LIBCMT ref: 0289C56B
_errno.LIBCMT ref: 0289C578
write_char.LIBCMT ref: 0289C58A
_errno.LIBCMT ref: 0289C593
_errno.LIBCMT ref: 0289C59D

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$write_char
String ID:
API String ID: 1772936973-0
Opcode ID: befc4e31688ca027fc467a0091b09bfe04993e8a5ec8ed331c858a993eb204c6
Instruction ID: bfe68440f80f73017468ba625593da227a6e4a9435b5b7cd2cea0fc72bef89a5
Opcode Fuzzy Hash: befc4e31688ca027fc467a0091b09bfe04993e8a5ec8ed331c858a993eb204c6
Instruction Fuzzy Hash: 6711797C518B488FCF65AB6C904632573E1FB5E310F9D01AAE56CC7261D77598818BC3

Function 028E7F1C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 028E7F3C
_invalid_parameter_noinfo.LIBCMT ref: 028E7F47
_fileno.LIBCMT ref: 028E7F67
_errno.LIBCMT ref: 028E7FD7
_invalid_parameter_noinfo.LIBCMT ref: 028E7FE2

Strings

@, xrefs: 028E7F5A

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno
String ID: @
API String ID: 3947385824-2766056989
Opcode ID: 2a3b2a4cd214041c74d131aa7b21a7eccb1e02e7ccffb0f930f8d01a64b21150
Instruction ID: bf0cf2effe2a4bb26ff10d908972d8f7e568a7318227c429b60e9d1d28928f3e
Opcode Fuzzy Hash: 2a3b2a4cd214041c74d131aa7b21a7eccb1e02e7ccffb0f930f8d01a64b21150
Instruction Fuzzy Hash: 0421D66E600A4545DF199B7D98A433DA251AB82B78F595721DE2FC62E4DB3CC052C213

Function 028A3925 Relevance: 10.6, APIs: 7, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 028A393E
_errno.LIBCMT ref: 028A3946
_close_nolock.LIBCMT ref: 028A399D

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: __doserrno_close_nolock_errno
String ID:
API String ID: 186997739-0
Opcode ID: 6f2b7d36461e4a0d181c2c2b0b56c0f7b2e919e7de38a3e7e4e2102f7147be67
Instruction ID: 75f59634201f5aa158a039951afc3cd5ea3901ee43aabc3df8e332e51ab4af9f
Opcode Fuzzy Hash: 6f2b7d36461e4a0d181c2c2b0b56c0f7b2e919e7de38a3e7e4e2102f7147be67
Instruction Fuzzy Hash: 1B11063D5096445FE705AF6C98A53287791FB86322F5D05ADD41AC71D1DEB888408B53

Function 028DA440 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 028DA494
std::exception::exception.LIBCMT ref: 028DA4E0
std::exception::exception.LIBCMT ref: 028DA528

Part of subcall function 028E75BC: RaiseException.KERNEL32 ref: 028E7637

Strings

ios_base::badbit set, xrefs: 028DA489
ios_base::eofbit set, xrefs: 028DA51D
ios_base::failbit set, xrefs: 028DA4D5

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: std::exception::exception$ExceptionRaise
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 127205192-1866435925
Opcode ID: 03de42b1d57c69098daac0204ad33a72ce76f433452482d42a03222e607276e7
Instruction ID: 7b1a4d8cc899c02f871114ba720f40141229b6876dd793b326d3eaff7e3e6d1b
Opcode Fuzzy Hash: 03de42b1d57c69098daac0204ad33a72ce76f433452482d42a03222e607276e7
Instruction Fuzzy Hash: 2231073AA01B2599EF00EBA4E8847DC33B5B74574CF944926DE1E57A18EF74C116C740

Function 00007FF7EAF0E0DC Relevance: 10.6, APIs: 7, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF7EAF0E0FF
_errno.LIBCMT ref: 00007FF7EAF0E107

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: f4454937c5e5bbaa0e9d0a0c22758e5a6eeff2523f96aab8d469512271315ee2
Instruction ID: 236d8ff7d899541f1969f85ddf217c8ea04bdf1129b627e1cc3b650b4a32582b
Opcode Fuzzy Hash: f4454937c5e5bbaa0e9d0a0c22758e5a6eeff2523f96aab8d469512271315ee2
Instruction Fuzzy Hash: 62218C32B1864241FA157B15D8953FDE7116F90BB9F8942B6EE2C073D2DE7CE4808A32

Function 00007FF7EAF0E920 Relevance: 10.6, APIs: 7, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF7EAF0E943
_errno.LIBCMT ref: 00007FF7EAF0E94B

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 5a090e99aeee2951a657be0a8c4efb463e857be8daee4d60eaed3aa4b73c4070
Instruction ID: 9a7ed84f99584369d59fa519dac73e9eeb2a63b166eccc39e4e87ab0d7ecba6f
Opcode Fuzzy Hash: 5a090e99aeee2951a657be0a8c4efb463e857be8daee4d60eaed3aa4b73c4070
Instruction Fuzzy Hash: EA21B022A1864245F7457B25D8D53FDE7116F80769F8941B7EA5C073E2DEBCE4408B32

Function 028F36E0 Relevance: 10.6, APIs: 7, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 028F3703
_errno.LIBCMT ref: 028F370B

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: e4f8f13b11732ad43df6e553a8cae38b40c6eadb2424a5e75519e9bbb8820977
Instruction ID: c1f496d9d7e84d466fcde2055cc8e8756b7b26a4c898760bbdb5191f13abe08a
Opcode Fuzzy Hash: e4f8f13b11732ad43df6e553a8cae38b40c6eadb2424a5e75519e9bbb8820977
Instruction Fuzzy Hash: C811567E3102C445EB466F2DDC4032E7712A7817A9F895664DF2A8B3E1CB7C8441CB22

Function 028F3CB4 Relevance: 10.6, APIs: 7, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 028F3CD7
_errno.LIBCMT ref: 028F3CDF

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 43cc440da8af3915d8bd74f6a889a99aea8c3c9b156225ad2d0e54cda31f56a7
Instruction ID: 519f78560e9c2b03e572ae22d24c9fa03a6287159e6404f1da1fa437cbe86975
Opcode Fuzzy Hash: 43cc440da8af3915d8bd74f6a889a99aea8c3c9b156225ad2d0e54cda31f56a7
Instruction Fuzzy Hash: FD11F32F31028481DB467B19984032E7712A781BB9F495745EF398B3E1D73C94818B22

Function 00007FF7EAF113CC Relevance: 10.6, APIs: 7, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7EAF113E5
FlushFileBuffers.KERNEL32(?,00000000,00000000,00007FF7EAF10446,?,?,00000001,00007FF7EAF104EF,?,?,?,?,?,00007FF7EAF0EBA5), ref: 00007FF7EAF11448
GetLastError.KERNEL32(?,00000000,00000000,00007FF7EAF10446,?,?,00000001,00007FF7EAF104EF,?,?,?,?,?,00007FF7EAF0EBA5), ref: 00007FF7EAF11452
__doserrno.LIBCMT ref: 00007FF7EAF11462
_errno.LIBCMT ref: 00007FF7EAF11469

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$BuffersErrorFileFlushLast__doserrno
String ID:
API String ID: 1845094721-0
Opcode ID: 17d30c8fc9599290ce3f70905f1a86dc7465141df05744b8eccb52f7b4e97e35
Instruction ID: 55113ca647a10da7571acdb777f7e54034b4c5866ee732e733a66a65b01305a9
Opcode Fuzzy Hash: 17d30c8fc9599290ce3f70905f1a86dc7465141df05744b8eccb52f7b4e97e35
Instruction Fuzzy Hash: 9821CF21B0868285FB217BA598843FDA710AF91B54F8501BAE61D0A2D3CE7CE840C73A

Function 028F37C0 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 028F37D9
FlushFileBuffers.KERNEL32 ref: 028F383C
GetLastError.KERNEL32 ref: 028F3846
__doserrno.LIBCMT ref: 028F3856
_errno.LIBCMT ref: 028F385D

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$BuffersErrorFileFlushLast__doserrno
String ID:
API String ID: 1845094721-0
Opcode ID: 58f0368fb1738dca0da4bf07de5baca974cc5020b4aa8846053832f6b6a845e5
Instruction ID: 9484ae5c63e026a02fd5440576d10501a74d52240a8e10ca7b172519448493be
Opcode Fuzzy Hash: 58f0368fb1738dca0da4bf07de5baca974cc5020b4aa8846053832f6b6a845e5
Instruction Fuzzy Hash: EA11262EB106C086DF856FA9998432E7712AB817A4F494568DB2A8B3E0DB3CC840C711

Function 00007FF7EAF11560 Relevance: 10.6, APIs: 7, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF7EAF11579
_errno.LIBCMT ref: 00007FF7EAF11581
_close_nolock.LIBCMT ref: 00007FF7EAF115D8

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: __doserrno_close_nolock_errno
String ID:
API String ID: 186997739-0
Opcode ID: bda87b43c9d570eecaee3d7bd9474c424701c106e53aae398468428abc392862
Instruction ID: 66e7ea1101813dd4402c3c439abae478f9b14b498499adef02bd72f34750018e
Opcode Fuzzy Hash: bda87b43c9d570eecaee3d7bd9474c424701c106e53aae398468428abc392862
Instruction Fuzzy Hash: 2C11AE22E0828241F7157B2599853FDE710AF90765F9942BAE61E073D3CF7CE8408636

Function 028F3E54 Relevance: 10.6, APIs: 7, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 028F3E6D
_errno.LIBCMT ref: 028F3E75
_close_nolock.LIBCMT ref: 028F3ECC

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: __doserrno_close_nolock_errno
String ID:
API String ID: 186997739-0
Opcode ID: baf9c1151bc9c8a6f5abce6b24066df88c5bae785345918343bb9b08cd44c72b
Instruction ID: 0b36c65b27ca33eef6805b3fa1e06ede587c908580bb77a10aadb96390a3bd3b
Opcode Fuzzy Hash: baf9c1151bc9c8a6f5abce6b24066df88c5bae785345918343bb9b08cd44c72b
Instruction Fuzzy Hash: 7D11503E7002C445DB556F2DD84431D7712AB81765F5A1568DB2ACB7E1DB7CC440CB21

Function 00007FF7EAF0AC9C Relevance: 10.6, APIs: 7, Instructions: 51COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7EAF0ACC0
_errno.LIBCMT ref: 00007FF7EAF0ACD9
write_char.LIBCMT ref: 00007FF7EAF0ACEE
_errno.LIBCMT ref: 00007FF7EAF0ACFB
write_char.LIBCMT ref: 00007FF7EAF0AD0D
_errno.LIBCMT ref: 00007FF7EAF0AD16
_errno.LIBCMT ref: 00007FF7EAF0AD20

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$write_char
String ID:
API String ID: 1772936973-0
Opcode ID: c1d3ccc9aad43bc67af73f482cb02ec735a242584822cbb9a96a93b359dba97b
Instruction ID: 876444fcd596335267e39fac2826be18f378882c35762c76b71ada7bde41e8ff
Opcode Fuzzy Hash: c1d3ccc9aad43bc67af73f482cb02ec735a242584822cbb9a96a93b359dba97b
Instruction Fuzzy Hash: 4611513290878286F7217B5194803E9B7A4BF94B98F9580B2DB58077D6DE3DE8418762

Function 028ECA48 Relevance: 10.6, APIs: 7, Instructions: 51COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 028ECA6C
_errno.LIBCMT ref: 028ECA85
write_char.LIBCMT ref: 028ECA9A
_errno.LIBCMT ref: 028ECAA7
write_char.LIBCMT ref: 028ECAB9
_errno.LIBCMT ref: 028ECAC2
_errno.LIBCMT ref: 028ECACC

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$write_char
String ID:
API String ID: 1772936973-0
Opcode ID: befc4e31688ca027fc467a0091b09bfe04993e8a5ec8ed331c858a993eb204c6
Instruction ID: 7755c2a9e6b5a825cf023e111f4f6216b0222920fd762861cc8e87cc8416f540
Opcode Fuzzy Hash: befc4e31688ca027fc467a0091b09bfe04993e8a5ec8ed331c858a993eb204c6
Instruction Fuzzy Hash: 0011517E9007D08ADF21AB6694003597661F78AF98F585012CF6A8B755CB38C491CB42

Function 028D8E90 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 028D8EBB
GetCommandLineW.KERNEL32 ref: 028D8EC1
GetStartupInfoW.KERNEL32 ref: 028D8ECF
CreateProcessW.KERNEL32 ref: 028D8F12
ExitProcess.KERNEL32 ref: 028D8F1B

Strings

, xrefs: 028D8F06

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Process$CommandCreateExitFileInfoLineModuleNameStartup
String ID:
API String ID: 3421218197-3916222277
Opcode ID: d4be7e06b31d663aed38c78f28249248fafd060fd5c9b0da482a79e76a279693
Instruction ID: 6e68921fb81455700c121df743536b1c1bfacf9ea4477928de7a26c15fa568f1
Opcode Fuzzy Hash: d4be7e06b31d663aed38c78f28249248fafd060fd5c9b0da482a79e76a279693
Instruction Fuzzy Hash: 3501FF36215B8582DBA08B64F89974BB7A4F794794F505626E78A43FA8DF3CC145CB00

Function 00007FF7EAF0D710 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7EAF0D747
GetCurrentProcessId.KERNEL32 ref: 00007FF7EAF0D752
GetCurrentThreadId.KERNEL32 ref: 00007FF7EAF0D75E
GetTickCount.KERNEL32 ref: 00007FF7EAF0D76A
QueryPerformanceCounter.KERNEL32 ref: 00007FF7EAF0D77B

Strings

4 =X, xrefs: 00007FF7EAF0D71A

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID: 4 =X
API String ID: 1445889803-3147943113
Opcode ID: 98e16b1ec0ad293c89ca25142769c411a4e3d743e8d3f271fefc4cf6040d5f50
Instruction ID: 41f699e3545245eae991e97c34416b52450b81cb2f7fa32d0bc59ab31749e397
Opcode Fuzzy Hash: 98e16b1ec0ad293c89ca25142769c411a4e3d743e8d3f271fefc4cf6040d5f50
Instruction Fuzzy Hash: 9901C431A18A4181F741EF21F9543B5B360FB69B90F8426B2EE9E477A1CF3CD9848361

Function 028DE8DF Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 028DE906
RegDeleteValueW.ADVAPI32 ref: 028DE917
RegSetValueExW.ADVAPI32 ref: 028DE93E
RegCloseKey.ADVAPI32 ref: 028DE948

Strings

Console, xrefs: 028DE8EA
IpDatespecial, xrefs: 028DE910, 028DE921

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Value$CloseDeleteOpen
String ID: Console$IpDatespecial
API String ID: 3183427449-1840232981
Opcode ID: 46a845e2221ca44cf1185620c2cc3f604d55b02dd79e17f295db38f463142a96
Instruction ID: 49804de12ecaa9e4ed0c6e602342a56d14d7b43f52eaef69cbb092c74425adf8
Opcode Fuzzy Hash: 46a845e2221ca44cf1185620c2cc3f604d55b02dd79e17f295db38f463142a96
Instruction Fuzzy Hash: 10015A7A316A8486EB61DB24F958B883774F394BA8F409122CF8D03F94CF38C189C708

Function 02898969 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 02898988

Part of subcall function 028A2449: _getptd.LIBCMT ref: 028A244D

_getptd.LIBCMT ref: 0289899A
_getptd.LIBCMT ref: 028989A8

Strings

RCC, xrefs: 02898970
csm, xrefs: 02898980
MOC, xrefs: 02898978

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: 4492ebc9ca6bdbeee3c9e48b8907104a9bea354ad505bcfbe4c374627ff8bcb6
Instruction ID: aa0ad21453a63ee4f285a7f1c8aa4d5a1224c59538aa02b25973498cc01c27a0
Opcode Fuzzy Hash: 4492ebc9ca6bdbeee3c9e48b8907104a9bea354ad505bcfbe4c374627ff8bcb6
Instruction Fuzzy Hash: BEE01A7C410506CFDF25BB6C814C7A832E1FF9A30AF4EA2E5844CCA220D7BD54809E57

Function 00007FF7EAF131A8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF7EAF131C7

Part of subcall function 00007FF7EAF0BA34: _amsg_exit.LIBCMT ref: 00007FF7EAF0BA4A

Part of subcall function 00007FF7EAF0DA94: _getptd.LIBCMT ref: 00007FF7EAF0DA98

_getptd.LIBCMT ref: 00007FF7EAF131D9
_getptd.LIBCMT ref: 00007FF7EAF131E7

Strings

MOC, xrefs: 00007FF7EAF131B7
csm, xrefs: 00007FF7EAF131BF
RCC, xrefs: 00007FF7EAF131AF

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd$_amsg_exit
String ID: MOC$RCC$csm
API String ID: 2610988583-2671469338
Opcode ID: d0c629851adb83669a1057044e1c73a61abea7eb16c4708499e842e3cc9a1464
Instruction ID: a05f7e03ae82ca6ed8ecd363d0826677bda081c46b7c28fccc4fe6f03daa0fa7
Opcode Fuzzy Hash: d0c629851adb83669a1057044e1c73a61abea7eb16c4708499e842e3cc9a1464
Instruction Fuzzy Hash: 9BF03035D0910285F7953B1481563F8B391EFA8B09FC596F6DA4842383CFBCA8818B23

Function 028E8E98 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 028E8EB7

Part of subcall function 028EE2A0: _amsg_exit.LIBCMT ref: 028EE2B6

Part of subcall function 028F2978: _getptd.LIBCMT ref: 028F297C

_getptd.LIBCMT ref: 028E8EC9
_getptd.LIBCMT ref: 028E8ED7

Strings

MOC, xrefs: 028E8EA7
csm, xrefs: 028E8EAF
RCC, xrefs: 028E8E9F

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd$_amsg_exit
String ID: MOC$RCC$csm
API String ID: 2610988583-2671469338
Opcode ID: 1b2680ee4a659874caf0a1eaf985222dd724bdd207817a8be6d1b1b3bd18d7af
Instruction ID: 119168d3d3fb85a8703c6e7fca931ad4026895d88d79497832334e258baa814f
Opcode Fuzzy Hash: 1b2680ee4a659874caf0a1eaf985222dd724bdd207817a8be6d1b1b3bd18d7af
Instruction Fuzzy Hash: B2E0123E900145CACF257F6984443AC3661F79AB1AFD6D9659649C6314C7BC84808E13

Function 0289EBD1 Relevance: 9.2, APIs: 6, Instructions: 164COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0289EBF0

Part of subcall function 0289E80D: _getptd.LIBCMT ref: 0289E817

Part of subcall function 0289A531: malloc.LIBCMT ref: 0289A55C

free.LIBCMT ref: 0289EC7B

Part of subcall function 02894FD1: _errno.LIBCMT ref: 02894FF1

_lock.LIBCMT ref: 0289ECAB
free.LIBCMT ref: 0289ED4E
free.LIBCMT ref: 0289ED7A
_errno.LIBCMT ref: 0289ED7F

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free$_errno_getptd$_lockmalloc
String ID:
API String ID: 1369581901-0
Opcode ID: 6627a91fce6e6f9bd605d3e47a486a9597166daa8d056ce2c6ca4d44098f1495
Instruction ID: 23ee6b77673a27f2d96c8189c377dcd44029ffca3c9fb44453dd81ac097a5aef
Opcode Fuzzy Hash: 6627a91fce6e6f9bd605d3e47a486a9597166daa8d056ce2c6ca4d44098f1495
Instruction Fuzzy Hash: 9551B93C614A088FEF65EF6C98817657BE2FB49314F18455EC89EC7256DB34E442CB82

Function 00007FF7EAF055B0 Relevance: 9.2, APIs: 6, Instructions: 155memorythreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7EAF055D3
VirtualAlloc.KERNEL32 ref: 00007FF7EAF05660
VirtualFree.KERNEL32 ref: 00007FF7EAF056A2
VirtualAlloc.KERNEL32 ref: 00007FF7EAF0572F
VirtualFree.KERNEL32 ref: 00007FF7EAF05771
GetCurrentThreadId.KERNEL32 ref: 00007FF7EAF05833

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Virtual$AllocCurrentFreeThread
String ID:
API String ID: 1155560630-0
Opcode ID: 830d78c65f3cc68ec1669a78847bbb4da38a08bd86f6038b668fa4aa0f3d6164
Instruction ID: ed6bd814e57de4562e97aa43cc4e2bdd168ce6ab2803db8f5a1d8c67d92c405d
Opcode Fuzzy Hash: 830d78c65f3cc68ec1669a78847bbb4da38a08bd86f6038b668fa4aa0f3d6164
Instruction Fuzzy Hash: B671AC32718A8197E75DAB25E2803ADF3A4FB44B84F80813AEB5D87640DF38F161CB51

Function 02881261 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 02881296
malloc.LIBCMT ref: 02881302

Part of subcall function 02895011: _FF_MSGBANNER.LIBCMT ref: 02895041
Part of subcall function 02895011: _callnewh.LIBCMT ref: 0289507F
Part of subcall function 02895011: _errno.LIBCMT ref: 0289508A
Part of subcall function 02895011: _errno.LIBCMT ref: 02895095

free.LIBCMT ref: 0288132B

Part of subcall function 02894FD1: _errno.LIBCMT ref: 02894FF1

Strings

d, xrefs: 028813D6
d, xrefs: 028813AC
d, xrefs: 028813A2

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$malloc$_callnewhfree
String ID: d$d$d
API String ID: 1789327305-1898527202
Opcode ID: e4bca791a3ca6fc00bfabf83367b606d4990b6dba4dc514ecbcba51caafa37f7
Instruction ID: b288a9603d7b7a89e30238e1480e99ebd8bddfd6c6989d7454326dade78692b9
Opcode Fuzzy Hash: e4bca791a3ca6fc00bfabf83367b606d4990b6dba4dc514ecbcba51caafa37f7
Instruction Fuzzy Hash: 7E51D3B4414A598FDB91EF5DD088B957BE4FB18704F5981EB980CCB22ADB74C884CFA1

Function 00007FF7EAF0F330 Relevance: 9.1, APIs: 6, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF7EAF0F34F

Part of subcall function 00007FF7EAF0BA34: _amsg_exit.LIBCMT ref: 00007FF7EAF0BA4A

Part of subcall function 00007FF7EAF0EF6C: _getptd.LIBCMT ref: 00007FF7EAF0EF76
Part of subcall function 00007FF7EAF0EF6C: _amsg_exit.LIBCMT ref: 00007FF7EAF0F013

Part of subcall function 00007FF7EAF0F028: GetOEMCP.KERNEL32 ref: 00007FF7EAF0F052

Part of subcall function 00007FF7EAF0C020: malloc.LIBCMT ref: 00007FF7EAF0C04B
Part of subcall function 00007FF7EAF0C020: Sleep.KERNEL32(?,?,ceil,00007FF7EAF0D951,?,?,?,00007FF7EAF0D9FB,?,?,00000000,00007FF7EAF0B951,?,?,00000000,00007FF7EAF0BA08), ref: 00007FF7EAF0C05E

free.LIBCMT ref: 00007FF7EAF0F3DA

Part of subcall function 00007FF7EAF09030: HeapFree.KERNEL32(?,?,00000000,00007FF7EAF0BA1C,?,?,?,00007FF7EAF0938D,?,?,?,?,00007FF7EAF14BEE), ref: 00007FF7EAF09046
Part of subcall function 00007FF7EAF09030: _errno.LIBCMT ref: 00007FF7EAF09050
Part of subcall function 00007FF7EAF09030: GetLastError.KERNEL32(?,?,00000000,00007FF7EAF0BA1C,?,?,?,00007FF7EAF0938D,?,?,?,?,00007FF7EAF14BEE), ref: 00007FF7EAF09058

_lock.LIBCMT ref: 00007FF7EAF0F40A
free.LIBCMT ref: 00007FF7EAF0F4AD
free.LIBCMT ref: 00007FF7EAF0F4D9
_errno.LIBCMT ref: 00007FF7EAF0F4DE

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free$_amsg_exit_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 3894533514-0
Opcode ID: de94af9eb20aff71365a2e79f7747a0a6ec5dd64a421ced7859fa65583d8f430
Instruction ID: 66a39d77ed887c4179d176a358054014211069dd2e2626c39c1e6bbe06d41f7d
Opcode Fuzzy Hash: de94af9eb20aff71365a2e79f7747a0a6ec5dd64a421ced7859fa65583d8f430
Instruction Fuzzy Hash: E3519025A0868281F764AB25D4903FAF7E1BB84B58F9481B7DD5E47396CE3CE442C722

Function 028EF100 Relevance: 9.1, APIs: 6, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 028EF11F

Part of subcall function 028EE2A0: _amsg_exit.LIBCMT ref: 028EE2B6

Part of subcall function 028EED3C: _getptd.LIBCMT ref: 028EED46
Part of subcall function 028EED3C: _amsg_exit.LIBCMT ref: 028EEDE3

Part of subcall function 028EEDF8: GetOEMCP.KERNEL32 ref: 028EEE22

Part of subcall function 028EAA60: malloc.LIBCMT ref: 028EAA8B
Part of subcall function 028EAA60: Sleep.KERNEL32 ref: 028EAA9E

free.LIBCMT ref: 028EF1AA

Part of subcall function 028E5500: HeapFree.KERNEL32 ref: 028E5516
Part of subcall function 028E5500: _errno.LIBCMT ref: 028E5520
Part of subcall function 028E5500: GetLastError.KERNEL32 ref: 028E5528

_lock.LIBCMT ref: 028EF1DA
free.LIBCMT ref: 028EF27D
free.LIBCMT ref: 028EF2A9
_errno.LIBCMT ref: 028EF2AE

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free$_amsg_exit_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 3894533514-0
Opcode ID: d4a90aba13fa6df1b62632328913ca3c99ebc68f7272fa7b5f98928cecdce023
Instruction ID: 06befd8108e5b617ac8d3c45644c9008a87dbab7cc2237e958483521eef53d27
Opcode Fuzzy Hash: d4a90aba13fa6df1b62632328913ca3c99ebc68f7272fa7b5f98928cecdce023
Instruction Fuzzy Hash: 2C41B23E600A8086EB14DB69E44032EB7A2F796B58F548116CF5FC7B64DF78C442C791

Function 00007FF7EAF017C0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FF7EAF017F5
malloc.LIBCMT ref: 00007FF7EAF01861

Part of subcall function 00007FF7EAF09070: _FF_MSGBANNER.LIBCMT ref: 00007FF7EAF090A0
Part of subcall function 00007FF7EAF09070: HeapAlloc.KERNEL32(?,?,00B34BF300000000,00007FF7EAF0C050,?,?,ceil,00007FF7EAF0D951,?,?,?,00007FF7EAF0D9FB,?,?,00000000,00007FF7EAF0B951), ref: 00007FF7EAF090C5
Part of subcall function 00007FF7EAF09070: _callnewh.LIBCMT ref: 00007FF7EAF090DE
Part of subcall function 00007FF7EAF09070: _errno.LIBCMT ref: 00007FF7EAF090E9
Part of subcall function 00007FF7EAF09070: _errno.LIBCMT ref: 00007FF7EAF090F4

free.LIBCMT ref: 00007FF7EAF0188A

Part of subcall function 00007FF7EAF09030: HeapFree.KERNEL32(?,?,00000000,00007FF7EAF0BA1C,?,?,?,00007FF7EAF0938D,?,?,?,?,00007FF7EAF14BEE), ref: 00007FF7EAF09046
Part of subcall function 00007FF7EAF09030: _errno.LIBCMT ref: 00007FF7EAF09050
Part of subcall function 00007FF7EAF09030: GetLastError.KERNEL32(?,?,00000000,00007FF7EAF0BA1C,?,?,?,00007FF7EAF0938D,?,?,?,?,00007FF7EAF14BEE), ref: 00007FF7EAF09058

Strings

d, xrefs: 00007FF7EAF01934
d, xrefs: 00007FF7EAF0190B
d, xrefs: 00007FF7EAF01901

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$Heapmalloc$AllocErrorFreeLast_callnewhfree
String ID: d$d$d
API String ID: 161857241-1898527202
Opcode ID: e9053c7a343c0b83d9d295b64127538e78e5f548f8b7e2bc9a1aaa569d59c23e
Instruction ID: d60f46dc47c6ea838b016ce66fdf5017b0fe5f80bb1dfbe2e5ed36031e451371
Opcode Fuzzy Hash: e9053c7a343c0b83d9d295b64127538e78e5f548f8b7e2bc9a1aaa569d59c23e
Instruction Fuzzy Hash: FD413532515B91C5E7809F20E48039ABBE8FB48F88F59817ADB8C07788EF78D454CB61

Function 028D1790 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 028D17C5
malloc.LIBCMT ref: 028D1831

Part of subcall function 028E5540: _FF_MSGBANNER.LIBCMT ref: 028E5570
Part of subcall function 028E5540: HeapAlloc.KERNEL32 ref: 028E5595
Part of subcall function 028E5540: _callnewh.LIBCMT ref: 028E55AE
Part of subcall function 028E5540: _errno.LIBCMT ref: 028E55B9
Part of subcall function 028E5540: _errno.LIBCMT ref: 028E55C4

free.LIBCMT ref: 028D185A

Part of subcall function 028E5500: HeapFree.KERNEL32 ref: 028E5516
Part of subcall function 028E5500: _errno.LIBCMT ref: 028E5520
Part of subcall function 028E5500: GetLastError.KERNEL32 ref: 028E5528

Strings

d, xrefs: 028D18D1
d, xrefs: 028D1904
d, xrefs: 028D18DB

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$Heapmalloc$AllocErrorFreeLast_callnewhfree
String ID: d$d$d
API String ID: 161857241-1898527202
Opcode ID: aaf7e2ceca1702e10ce0a85846b1fc0fd677ce5ae422e8ca0e75b2e2ccd431ce
Instruction ID: 2cb1d1fcbbbcc37e9dd073db462ae752d6a45935e8d8ab05f43b23ee2f023d2d
Opcode Fuzzy Hash: aaf7e2ceca1702e10ce0a85846b1fc0fd677ce5ae422e8ca0e75b2e2ccd431ce
Instruction Fuzzy Hash: DF41F376511B90C9E780CF25E4443893BA9F748F88F59813ADB8D8B798EF79C458CB60

Function 028A2925 Relevance: 9.1, APIs: 6, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 028A294C

Part of subcall function 0289BE8D: _set_error_mode.LIBCMT ref: 0289BE96
Part of subcall function 0289BE8D: _set_error_mode.LIBCMT ref: 0289BEA5

Part of subcall function 0289BC2D: _set_error_mode.LIBCMT ref: 0289BC72
Part of subcall function 0289BC2D: _set_error_mode.LIBCMT ref: 0289BC83

Part of subcall function 0289A531: malloc.LIBCMT ref: 0289A55C

_errno.LIBCMT ref: 028A298E
_lock.LIBCMT ref: 028A29A2
free.LIBCMT ref: 028A29C5
_errno.LIBCMT ref: 028A29CA

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _set_error_mode$_errno$_lockfreemalloc
String ID:
API String ID: 360200360-0
Opcode ID: 94b0533748bce51f3f0ee7a44595441a65b1f51acf6d8cfd0de9afd4f5187e95
Instruction ID: 4af2727c712d4a377fdfde92ffdb09c6049c883ff57814ab4d34d49c92d55524
Opcode Fuzzy Hash: 94b0533748bce51f3f0ee7a44595441a65b1f51acf6d8cfd0de9afd4f5187e95
Instruction Fuzzy Hash: 68218E3C608A198FFB64BFA8D86576972D1FB89715F48052C980AC3694DF789881CB42

Function 028F2630 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 028F2649
WideCharToMultiByte.KERNEL32 ref: 028F26A0
WideCharToMultiByte.KERNEL32 ref: 028F26DB
free.LIBCMT ref: 028F26E8
FreeEnvironmentStringsW.KERNEL32 ref: 028F26F3
FreeEnvironmentStringsW.KERNEL32 ref: 028F2701

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$free
String ID:
API String ID: 517548149-0
Opcode ID: 38e05a7487bcb73507117e121c7675c6e230bfbb54ccb13ecc2fcb477b3f4506
Instruction ID: 7e317dbaef0d90ce52dc1e6804cf85e3e34b70dc5a7b7ac57f197bd1e4654256
Opcode Fuzzy Hash: 38e05a7487bcb73507117e121c7675c6e230bfbb54ccb13ecc2fcb477b3f4506
Instruction Fuzzy Hash: 95217C3A605B8086DB649F26B51471AB7A5FB89FC4F488028EF8A47B58EF3CD450C705

Function 00007FF7EAF05350 Relevance: 9.1, APIs: 6, Instructions: 66synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32 ref: 00007FF7EAF0536C
ResetEvent.KERNEL32 ref: 00007FF7EAF05379
timeGetTime.WINMM ref: 00007FF7EAF0537F
WaitForSingleObject.KERNEL32 ref: 00007FF7EAF053D3
ResetEvent.KERNEL32 ref: 00007FF7EAF053F0

Part of subcall function 00007FF7EAF04D80: GetCurrentThreadId.KERNEL32 ref: 00007FF7EAF04D8D

ResetEvent.KERNEL32 ref: 00007FF7EAF05417

Part of subcall function 00007FF7EAF094DC: _errno.LIBCMT ref: 00007FF7EAF09507
Part of subcall function 00007FF7EAF094DC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF09512

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: EventReset$CurrentObjectSingleThreadTimeWait_errno_invalid_parameter_noinfotime
String ID:
API String ID: 2543248268-0
Opcode ID: c78a28b176580af9311e331f57aa8b083a8a6ec56fce78c484d13ed2a8b23dc4
Instruction ID: e1448c7477eec45735d51c1ebc3ef33f540e0fa38e3894499efac4f07bdfb764
Opcode Fuzzy Hash: c78a28b176580af9311e331f57aa8b083a8a6ec56fce78c484d13ed2a8b23dc4
Instruction Fuzzy Hash: 0E219136608B8186EB40DF31E8802ADB3A4FB44F99F984172DE4D87769DF78C585C761

Function 028D52F0 Relevance: 9.1, APIs: 6, Instructions: 66synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32 ref: 028D530C
ResetEvent.KERNEL32 ref: 028D5319
timeGetTime.WINMM ref: 028D531F
WaitForSingleObject.KERNEL32 ref: 028D5373
ResetEvent.KERNEL32 ref: 028D5390

Part of subcall function 028D4D20: GetCurrentThreadId.KERNEL32 ref: 028D4D2D

ResetEvent.KERNEL32 ref: 028D53B7

Part of subcall function 028E59EC: _errno.LIBCMT ref: 028E5A17
Part of subcall function 028E59EC: _invalid_parameter_noinfo.LIBCMT ref: 028E5A22

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: EventReset$CurrentObjectSingleThreadTimeWait_errno_invalid_parameter_noinfotime
String ID:
API String ID: 2543248268-0
Opcode ID: d50bf74d6e22cde16153601e1c4afc7f6e0cc1e21fea4f5b3574960e88087405
Instruction ID: 4c1351374f002a09ba60b7247ca8032e8acb0798984fe224d7acdbea80f91b0e
Opcode Fuzzy Hash: d50bf74d6e22cde16153601e1c4afc7f6e0cc1e21fea4f5b3574960e88087405
Instruction Fuzzy Hash: E421463A204B8086DB85CF25E844359B3A4F788F98F588132DE5DD7BA8DF38C5868B00

Function 00007FF7EAF04D80 Relevance: 9.1, APIs: 6, Instructions: 57networkthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7EAF04D8D

Part of subcall function 00007FF7EAF04160: SwitchToThread.KERNEL32(?,?,00000000,00007FF7EAF04D9D), ref: 00007FF7EAF0419E
Part of subcall function 00007FF7EAF04160: SetLastError.KERNEL32(?,?,00000000,00007FF7EAF04D9D), ref: 00007FF7EAF041E5

send.WS2_32 ref: 00007FF7EAF04DD9
SetEvent.KERNEL32 ref: 00007FF7EAF04DF7
WSACloseEvent.WS2_32 ref: 00007FF7EAF04E0B
shutdown.WS2_32 ref: 00007FF7EAF04E24
closesocket.WS2_32 ref: 00007FF7EAF04E2E

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: EventThread$CloseCurrentErrorLastSwitchclosesocketsendshutdown
String ID:
API String ID: 779811758-0
Opcode ID: 2fa192ee69b06f1eeb25edd6ab0f4da1fe6a6614d325027052db3e123256aa8b
Instruction ID: 589e37ded033c2e79058dc3bc261b325162f8c5d43b7beaec12eeb088147dc9e
Opcode Fuzzy Hash: 2fa192ee69b06f1eeb25edd6ab0f4da1fe6a6614d325027052db3e123256aa8b
Instruction Fuzzy Hash: 2D217431A0464282FB10BF35E5902B9B361FF94FA9F8402B2DA2D476D5DE38DC85C761

Function 00007FF7EAF0B9B0 Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7EAF0938D,?,?,?,?,00007FF7EAF14BEE,?,?,?,?,00007FF7EAF12ED1), ref: 00007FF7EAF0B9BA
FlsGetValue.KERNEL32(?,?,?,00007FF7EAF0938D,?,?,?,?,00007FF7EAF14BEE,?,?,?,?,00007FF7EAF12ED1), ref: 00007FF7EAF0B9C8
SetLastError.KERNEL32(?,?,?,00007FF7EAF0938D,?,?,?,?,00007FF7EAF14BEE,?,?,?,?,00007FF7EAF12ED1), ref: 00007FF7EAF0BA20

Part of subcall function 00007FF7EAF0C0A0: Sleep.KERNEL32(?,?,ceil,00007FF7EAF0B9E3,?,?,?,00007FF7EAF0938D,?,?,?,?,00007FF7EAF14BEE), ref: 00007FF7EAF0C0E5

FlsSetValue.KERNEL32(?,?,?,00007FF7EAF0938D,?,?,?,?,00007FF7EAF14BEE,?,?,?,?,00007FF7EAF12ED1), ref: 00007FF7EAF0B9F4
free.LIBCMT ref: 00007FF7EAF0BA17

Part of subcall function 00007FF7EAF0B8F8: _lock.LIBCMT ref: 00007FF7EAF0B94C
Part of subcall function 00007FF7EAF0B8F8: _lock.LIBCMT ref: 00007FF7EAF0B96B

GetCurrentThreadId.KERNEL32 ref: 00007FF7EAF0BA08

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: 4213d91c3c88d15f51b7cb7809fe6c775b8414f6b8c9181202556ccbea47a494
Instruction ID: ba274ca7df2297d208d8a5c7a0a8fcd3c0714040ba19c4d1f9b9966a7943cd67
Opcode Fuzzy Hash: 4213d91c3c88d15f51b7cb7809fe6c775b8414f6b8c9181202556ccbea47a494
Instruction Fuzzy Hash: BF017134E0874282FB45BB75A4A53B8E391AF98754F8846B6CD2D023D2EE3CE4458222

Function 028EE21C Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 028EE226
FlsGetValue.KERNEL32 ref: 028EE234
SetLastError.KERNEL32 ref: 028EE28C

Part of subcall function 028EAAE0: Sleep.KERNEL32 ref: 028EAB25

FlsSetValue.KERNEL32 ref: 028EE260
free.LIBCMT ref: 028EE283

Part of subcall function 028EE164: _lock.LIBCMT ref: 028EE1B8
Part of subcall function 028EE164: _lock.LIBCMT ref: 028EE1D7

GetCurrentThreadId.KERNEL32 ref: 028EE274

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: 83a1dd9ac0b1f27b870cf3968c3c9bf503e541a76a665be7e0d39451eed9be99
Instruction ID: 076701e33aa39eaeb9c12a97024c0db7ba91a65e4b17b109cd1f3c1dc2c86309
Opcode Fuzzy Hash: 83a1dd9ac0b1f27b870cf3968c3c9bf503e541a76a665be7e0d39451eed9be99
Instruction Fuzzy Hash: F101A22D60170186EF85AF65E5583293352BB5DBB4F48C234DA2B437D0EF3CC4458715

Function 02881411 Relevance: 9.0, APIs: 7, Instructions: 259COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 02881480
free.LIBCMT ref: 028814D0
free.LIBCMT ref: 02881520
free.LIBCMT ref: 02881570
free.LIBCMT ref: 0288159B
free.LIBCMT ref: 028815BC

Part of subcall function 02894FD1: _errno.LIBCMT ref: 02894FF1

free.LIBCMT ref: 028815FA

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: fb9f54a9f244550df940d026c32715cce55ac9c12273f06423ac3a9ba640441a
Instruction ID: d9e3611feac2e11edb4609eb2765188929d0c2e9e7ed6452e397d11aaf0c771c
Opcode Fuzzy Hash: fb9f54a9f244550df940d026c32715cce55ac9c12273f06423ac3a9ba640441a
Instruction Fuzzy Hash: D1918FB9105A4D8FCB95FFACC198B29B7E1FF19308B18449DC04EDB621CB71A882CB51

Function 0289922D Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0289925E
_getptd.LIBCMT ref: 0289927C
_CallSETranslator.LIBCMT ref: 028992C4

Part of subcall function 02897505: _getptd.LIBCMT ref: 0289752C

Strings

RCC, xrefs: 0289929A
MOC, xrefs: 02899292

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd$CallTranslator
String ID: MOC$RCC
API String ID: 3569367362-2084237596
Opcode ID: cb34173580a42dfacebeea2d5b2fd6fdecd6c43d53704b8f6108025bf97ea43f
Instruction ID: d94cad2deb23d06acb7af03cb1b9e60b0620425f532a86932f616c3c3d23bfcc
Opcode Fuzzy Hash: cb34173580a42dfacebeea2d5b2fd6fdecd6c43d53704b8f6108025bf97ea43f
Instruction Fuzzy Hash: 2461EB38118B0D8FDB24FF58C4457EAB3E1FB81318F584A6ED44AC7515EBB4A591CB82

Function 00007FF7EAF01970 Relevance: 8.9, APIs: 7, Instructions: 157COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF7EAF019DF
free.LIBCMT ref: 00007FF7EAF01A2F
free.LIBCMT ref: 00007FF7EAF01A7F
free.LIBCMT ref: 00007FF7EAF01ACF
free.LIBCMT ref: 00007FF7EAF01AFA
free.LIBCMT ref: 00007FF7EAF01B1B
free.LIBCMT ref: 00007FF7EAF01B59

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 39caf3c37a47655031c94e0de5774d4aa99865a29994b72ed535d303bf2608d5
Instruction ID: 364430ba3ab7a70d92f96474c022312044180bc0ec9a0b4be8ea12808dcc975e
Opcode Fuzzy Hash: 39caf3c37a47655031c94e0de5774d4aa99865a29994b72ed535d303bf2608d5
Instruction Fuzzy Hash: 32715E7360AB8185EB51EF69E1903EDB7A4EB54B84F989076C78E03301DF38E451C325

Function 00007FF7EAF13A50 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF7EAF13A81

Part of subcall function 00007FF7EAF0BA34: _amsg_exit.LIBCMT ref: 00007FF7EAF0BA4A

_getptd.LIBCMT ref: 00007FF7EAF13A9F
_CallSETranslator.LIBCMT ref: 00007FF7EAF13AE7

Part of subcall function 00007FF7EAF11CB4: _getptd.LIBCMT ref: 00007FF7EAF11CDB

Strings

RCC, xrefs: 00007FF7EAF13ABD
MOC, xrefs: 00007FF7EAF13AB5

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd$CallTranslator_amsg_exit
String ID: MOC$RCC
API String ID: 1374396951-2084237596
Opcode ID: 71d4d7f3723b5425788edb4ff7159e0c2d35ca9445fe2397f069a4d9efb0fa2f
Instruction ID: a928ea9ac9d03ad3bf89f3cf70c18aa00332e171e45b4320e2689c36db78ab5f
Opcode Fuzzy Hash: 71d4d7f3723b5425788edb4ff7159e0c2d35ca9445fe2397f069a4d9efb0fa2f
Instruction Fuzzy Hash: 66619072A08A8285EE60EB05D0803FDF7A0FB91B88F84467ADB4D43696DF7CE555C711

Function 028E975C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 028E978D

Part of subcall function 028EE2A0: _amsg_exit.LIBCMT ref: 028EE2B6

_getptd.LIBCMT ref: 028E97AB
_CallSETranslator.LIBCMT ref: 028E97F3

Part of subcall function 028E7A34: _getptd.LIBCMT ref: 028E7A5B

Strings

RCC, xrefs: 028E97C9
MOC, xrefs: 028E97C1

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd$CallTranslator_amsg_exit
String ID: MOC$RCC
API String ID: 1374396951-2084237596
Opcode ID: fcebf428d0a4319ca5fd6b4e6bc6cad07f907aa1324cb64ab3f40b343a735524
Instruction ID: 053123ef50d5b18b1b72cbfe10e09f29e3950e87925667610c7545bf1cfd8358
Opcode Fuzzy Hash: fcebf428d0a4319ca5fd6b4e6bc6cad07f907aa1324cb64ab3f40b343a735524
Instruction Fuzzy Hash: 9551D07A208AD496CF24DF19E4807ADB361FB82B89F444526DB9F87618DFB8C152CB01

Function 028D1940 Relevance: 8.9, APIs: 7, Instructions: 135COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 028D19AF
free.LIBCMT ref: 028D19FF
free.LIBCMT ref: 028D1A4F
free.LIBCMT ref: 028D1A9F
free.LIBCMT ref: 028D1ACA
free.LIBCMT ref: 028D1AEB
free.LIBCMT ref: 028D1B29

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 67efea22a5e106fd7ec821f50b4422697c1b4e56067bce418c694cd677954da4
Instruction ID: 1b839f9ece8ec54255b82e873ee66d63f8512a8446bc3c69192bf1b484f98212
Opcode Fuzzy Hash: 67efea22a5e106fd7ec821f50b4422697c1b4e56067bce418c694cd677954da4
Instruction Fuzzy Hash: 7451D23E202B84C5CB549F5AE5843ADB366FB48B88F9C9012CB9E87714DF39D4A9C315

Function 02897C09 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 02897C25

Part of subcall function 028A26D9: _errno.LIBCMT ref: 028A26E2
Part of subcall function 028A26D9: _invalid_parameter_noinfo.LIBCMT ref: 028A26ED

_errno.LIBCMT ref: 02897C8E
_invalid_parameter_noinfo.LIBCMT ref: 02897C99
_getbuf.LIBCMT ref: 02897CCD

Strings

@, xrefs: 02897CEA

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno_getbuf
String ID: @
API String ID: 3036866907-2766056989
Opcode ID: 6e7c207d42a18353b67d0f256d14af4aa84329ee3b20535ed05c0923c9c5ad37
Instruction ID: 2299aa8ff8091dc409f7f3f4d66874ebf93981c7743d0268b21780c4a01fc186
Opcode Fuzzy Hash: 6e7c207d42a18353b67d0f256d14af4aa84329ee3b20535ed05c0923c9c5ad37
Instruction Fuzzy Hash: 9E31B47C134A488EFF6D9F2C84C9334B691FB5572DF7C1298D86ACA1E6D7388482C681

Function 00007FF7EAF046A0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115networkCOMMON

Download Yara Rule

APIs

WSAEnumNetworkEvents.WS2_32 ref: 00007FF7EAF046D8
WSAGetLastError.WS2_32(?,?,?,00007FF7EAF0455E), ref: 00007FF7EAF046E6
WSAResetEvent.WS2_32(?,?,?,00007FF7EAF0455E), ref: 00007FF7EAF04723

Strings

, xrefs: 00007FF7EAF047EC
4 =X, xrefs: 00007FF7EAF046B4

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: EnumErrorEventEventsLastNetworkReset
String ID: $4 =X
API String ID: 1050048411-2907286441
Opcode ID: 828e8a55efaf8f4e93ed5acb76a083e09fbb0b5487182bc448ae793a037f2d46
Instruction ID: fd84db22cf7b51df5532fb69ba7ce388e33d6180ba02d3f53c87b7925adc03a3
Opcode Fuzzy Hash: 828e8a55efaf8f4e93ed5acb76a083e09fbb0b5487182bc448ae793a037f2d46
Instruction Fuzzy Hash: A851C03290864286FB20AF25D0843AAB7E1FB84B8DF950176DE5D43299DF7DEC408B12

Function 00007FF7EAF12B0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

_fltout2.LIBCMT ref: 00007FF7EAF12B47
_errno.LIBCMT ref: 00007FF7EAF12B51
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF12B58

Strings

4 =X, xrefs: 00007FF7EAF12B1A
-, xrefs: 00007FF7EAF12B73

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_fltout2_invalid_parameter_noinfo
String ID: -$4 =X
API String ID: 485257318-1488396313
Opcode ID: 618538ce884b31deba6e1646cd0d9800068b1e888b6e4428242c9665014ee262
Instruction ID: 1fc16d12897754cf007b6e2358202315228053860cb4eacd7b55ab27bf99dc8c
Opcode Fuzzy Hash: 618538ce884b31deba6e1646cd0d9800068b1e888b6e4428242c9665014ee262
Instruction Fuzzy Hash: EA31F62260868141FA21EF65A4403EAF7A0AB657E4F944173EE8D07BC6DF3CD4058721

Function 028E8138 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 028E8154

Part of subcall function 028F2C08: _errno.LIBCMT ref: 028F2C11
Part of subcall function 028F2C08: _invalid_parameter_noinfo.LIBCMT ref: 028F2C1C

_errno.LIBCMT ref: 028E81BD
_invalid_parameter_noinfo.LIBCMT ref: 028E81C8
_getbuf.LIBCMT ref: 028E81FC

Strings

@, xrefs: 028E8219

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno_getbuf
String ID: @
API String ID: 3036866907-2766056989
Opcode ID: 6e7c207d42a18353b67d0f256d14af4aa84329ee3b20535ed05c0923c9c5ad37
Instruction ID: c44659b29e090456de2b393968abed80e9837c838c5d86eb02fa44e88bab0b54
Opcode Fuzzy Hash: 6e7c207d42a18353b67d0f256d14af4aa84329ee3b20535ed05c0923c9c5ad37
Instruction Fuzzy Hash: 2031936E610F8885DF2A8F38D84432C2751E752BADF595605CE2F862F9CB78C891C791

Function 00007FF7EAF135C9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF7EAF1361C
_getptd.LIBCMT ref: 00007FF7EAF135D1

Part of subcall function 00007FF7EAF0BA34: _amsg_exit.LIBCMT ref: 00007FF7EAF0BA4A

_getptd.LIBCMT ref: 00007FF7EAF13693
_getptd.LIBCMT ref: 00007FF7EAF1369F

Strings

csm, xrefs: 00007FF7EAF13653

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd$ExceptionRaise_amsg_exit
String ID: csm
API String ID: 4155239085-1018135373
Opcode ID: 9353493ea25706b6dc90e2ff27a29bc00a94e76970d53f38476d2ffead27e1f6
Instruction ID: 5f04fd945c057fae2748338dd303039270cf1ea06da0e79ea51867ceb168b977
Opcode Fuzzy Hash: 9353493ea25706b6dc90e2ff27a29bc00a94e76970d53f38476d2ffead27e1f6
Instruction Fuzzy Hash: 4B316D3650864286E6B0AF11E0447AEB360FBA8765F804376DE9E07786CF3DE846CB11

Function 028E92D5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 028E9328
_getptd.LIBCMT ref: 028E92DD

Part of subcall function 028EE2A0: _amsg_exit.LIBCMT ref: 028EE2B6

_getptd.LIBCMT ref: 028E939F
_getptd.LIBCMT ref: 028E93AB

Strings

csm, xrefs: 028E935F

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd$ExceptionRaise_amsg_exit
String ID: csm
API String ID: 4155239085-1018135373
Opcode ID: 348f7d04e5162bdd1961caa65b0e66369303be3bed8a20078405ec2eaa0bb5e4
Instruction ID: e4339e0d8343dbbb73ca188e6d3ba238b0b4e6924902276027e40ff2c13c8fd6
Opcode Fuzzy Hash: 348f7d04e5162bdd1961caa65b0e66369303be3bed8a20078405ec2eaa0bb5e4
Instruction Fuzzy Hash: F021273E204641C6DB30DF16E04079EB365F38ABA5F454226DFAE47B98CB79D886CB01

Function 028DE951 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 028DE974
RegDeleteValueW.ADVAPI32 ref: 028DE985
RegCloseKey.ADVAPI32 ref: 028DE98F

Strings

Console, xrefs: 028DE958
IpDatespecial, xrefs: 028DE97E

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Console$IpDatespecial
API String ID: 849931509-1840232981
Opcode ID: b025ef4eb51c44f48957f4b35409c7e843425d9afe9ad078bec9dd5431dc71bf
Instruction ID: 335a373cdc93c88c51d6b47d1e79825c25a9acfd44e9f0a48748e7b00a418b7f
Opcode Fuzzy Hash: b025ef4eb51c44f48957f4b35409c7e843425d9afe9ad078bec9dd5431dc71bf
Instruction Fuzzy Hash: 68F05E3A711985C6EB60DB65F948B897364F794BADF0041228F5D03E98DF38C1C9C744

Function 028F54C4 Relevance: 7.7, APIs: 5, Instructions: 168COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 028F5557
__free_lconv_num.LIBCMT ref: 028F562B
free.LIBCMT ref: 028F5637
free.LIBCMT ref: 028F56E6
free.LIBCMT ref: 028F56F2

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free$__free_lconv_num
String ID:
API String ID: 1547021563-0
Opcode ID: 08be15b8f50a777d4269c658e8ade808a532f6322247756bdc8886a22102f9c6
Instruction ID: 2a47bb1a2323bcd028bb70116a2eebdd0a2a7ee70b7807055a96287c08e1e865
Opcode Fuzzy Hash: 08be15b8f50a777d4269c658e8ade808a532f6322247756bdc8886a22102f9c6
Instruction Fuzzy Hash: FB51B23E301B848ACBA49F26E44079A77A6F789B88F844526DFAE87714DF3CC152C740

Function 0289B345 Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0289B36B
_invalid_parameter_noinfo.LIBCMT ref: 0289B376
_getptd.LIBCMT ref: 0289B382
_lock.LIBCMT ref: 0289B3BB
_lock.LIBCMT ref: 0289B44E

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _lock$_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808128820-0
Opcode ID: 9441f5ab7ec443429837251121a8f35dc82b3e26f8158eac5b6752c49b38b939
Instruction ID: 8b593efb78ef60764a94ef10206a8f2b2fb408a36fbd7bfe7e2748ad5a9f0f1a
Opcode Fuzzy Hash: 9441f5ab7ec443429837251121a8f35dc82b3e26f8158eac5b6752c49b38b939
Instruction Fuzzy Hash: DE41A33C61CA084FEF58EB6CA8557B933D2FBA9314F18416ED84EC7255DF6498028B92

Function 0289C389 Relevance: 7.6, APIs: 5, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 0289C3A6

Part of subcall function 028A26D9: _errno.LIBCMT ref: 028A26E2
Part of subcall function 028A26D9: _invalid_parameter_noinfo.LIBCMT ref: 028A26ED

_errno.LIBCMT ref: 0289C3B6
_errno.LIBCMT ref: 0289C3D2
_isatty.LIBCMT ref: 0289C433
_getbuf.LIBCMT ref: 0289C43F

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-0
Opcode ID: 3a1171754d4b4170047c6cc9e54148eef069f994d9e669cb0a89bd27f0e9310b
Instruction ID: c8715898735ac9c1936cedd69a57fc4988f7103b7ad762eb83151c538e2d41a9
Opcode Fuzzy Hash: 3a1171754d4b4170047c6cc9e54148eef069f994d9e669cb0a89bd27f0e9310b
Instruction Fuzzy Hash: 9841B07C214A084FDF58EF2CC49172A77E1FB4D314B5C429AD85ACB29ADB75C881CB82

Function 00007FF7EAF0AA68 Relevance: 7.6, APIs: 5, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 00007FF7EAF0AA85

Part of subcall function 00007FF7EAF0ECC8: _errno.LIBCMT ref: 00007FF7EAF0ECD1
Part of subcall function 00007FF7EAF0ECC8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF0ECDC

_errno.LIBCMT ref: 00007FF7EAF0AA95
_errno.LIBCMT ref: 00007FF7EAF0AAB1
_isatty.LIBCMT ref: 00007FF7EAF0AB12
_getbuf.LIBCMT ref: 00007FF7EAF0AB1E

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-0
Opcode ID: 4f60cfe29fde747d4f6edf3b98704d3458481cfd96a237e93bfce69436bb82ae
Instruction ID: d4388cb6a81738f82b2aaaf23b0cb458e1055f13aa997036aa0d5ce28fea6567
Opcode Fuzzy Hash: 4f60cfe29fde747d4f6edf3b98704d3458481cfd96a237e93bfce69436bb82ae
Instruction Fuzzy Hash: 6941E772A0860586FB14BF28C4913B8B390EF44B58F940276DAAD473D5DE3CE441C762

Function 028EC8B8 Relevance: 7.6, APIs: 5, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 028EC8D5

Part of subcall function 028F2C08: _errno.LIBCMT ref: 028F2C11
Part of subcall function 028F2C08: _invalid_parameter_noinfo.LIBCMT ref: 028F2C1C

_errno.LIBCMT ref: 028EC8E5
_errno.LIBCMT ref: 028EC901
_isatty.LIBCMT ref: 028EC962
_getbuf.LIBCMT ref: 028EC96E

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-0
Opcode ID: 3a1171754d4b4170047c6cc9e54148eef069f994d9e669cb0a89bd27f0e9310b
Instruction ID: b797327b01c629020682cdaffd45202adbba891db94ef4b9b4b521b10684be9c
Opcode Fuzzy Hash: 3a1171754d4b4170047c6cc9e54148eef069f994d9e669cb0a89bd27f0e9310b
Instruction Fuzzy Hash: 4441B27EA14B848ADF18AF2DD45136D3760E796B98F144216CBBAC73D4EB38C451CB81

Function 028DC890 Relevance: 7.6, APIs: 5, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 028DC8CA
EnterCriticalSection.KERNEL32 ref: 028DC8D7
EnterCriticalSection.KERNEL32 ref: 028DC8EC
GdiplusShutdown.GDIPLUS ref: 028DC8FE
LeaveCriticalSection.KERNEL32 ref: 028DC912

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalSection$Enter$DeleteGdiplusLeaveObjectShutdown
String ID:
API String ID: 1513102227-0
Opcode ID: e9b95e999a4ec25c2c412e6d9664678c8c55cf3ebce0bb2f99f3fe396375c299
Instruction ID: 951801c4d7c12ed0667f7001a961614d68aeb75bf6686df527c942dc5dea26e2
Opcode Fuzzy Hash: e9b95e999a4ec25c2c412e6d9664678c8c55cf3ebce0bb2f99f3fe396375c299
Instruction Fuzzy Hash: C841DB6F60AAC146EB718F28AC9835C3B60F779B28F1DA14AC79CC7AD1DB154017CB01

Function 028E14C0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 028E14EF
SetLastError.KERNEL32 ref: 028E1582

Strings

Main, xrefs: 028E14D2

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ErrorLast
String ID: Main
API String ID: 1452528299-521822810
Opcode ID: 84099bf8a725d166ee20315b1c9746f156bee2e17b322136615ebfaf6b4ec049
Instruction ID: 7a6da4ceabf7fd519337ba276e63a8bff904484bcb9a6eae25863db37bbcfea8
Opcode Fuzzy Hash: 84099bf8a725d166ee20315b1c9746f156bee2e17b322136615ebfaf6b4ec049
Instruction Fuzzy Hash: 74419C7AB11B40CADB14CF15E04832D73A1F749B88F488029DB8E87758DF38D951CB80

Function 028E0E90 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32 ref: 028E0ECC
realloc.LIBCMT ref: 028E0F33

Part of subcall function 028E7238: malloc.LIBCMT ref: 028E7255

IsBadReadPtr.KERNEL32 ref: 028E0FB9
SetLastError.KERNEL32 ref: 028E0FDA
SetLastError.KERNEL32 ref: 028E0FF8

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ErrorLastRead$mallocrealloc
String ID:
API String ID: 3638135368-0
Opcode ID: 29ff069d9a5630de77bab8c1bef4471da58ecb6172fdba01688657c43c45e91a
Instruction ID: e888f34ca0c11e73050f82e6c90ad767c9a9b177de661b87f5d4800ad2204234
Opcode Fuzzy Hash: 29ff069d9a5630de77bab8c1bef4471da58ecb6172fdba01688657c43c45e91a
Instruction Fuzzy Hash: 1F41673A201B8487DF208F16E4447AAB3A0FB49B98F088825DF8F97B64DF78E455C710

Function 028EB874 Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 028EB89A
_invalid_parameter_noinfo.LIBCMT ref: 028EB8A5
_getptd.LIBCMT ref: 028EB8B1
_lock.LIBCMT ref: 028EB8EA
_lock.LIBCMT ref: 028EB97D

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _lock$_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808128820-0
Opcode ID: d66af5cbfe8efa56d161d7e007c8763a06224c05c261f365567e5369a69fda6a
Instruction ID: aca54dfca3a3de114217ad0c4a6e8a019f7e15c1b7c5671a73dd59bc17d2c62d
Opcode Fuzzy Hash: d66af5cbfe8efa56d161d7e007c8763a06224c05c261f365567e5369a69fda6a
Instruction Fuzzy Hash: 40417E3D21278485EF14EB66D98476A73A2FB5ABD8F044125CE4F8BB58EF78C411CB12

Function 028F4158 Relevance: 7.6, APIs: 5, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 028F41B2
malloc.LIBCMT ref: 028F4216
MultiByteToWideChar.KERNEL32 ref: 028F425E
GetStringTypeW.KERNEL32 ref: 028F4275
free.LIBCMT ref: 028F4289

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ByteCharMultiWide$StringTypefreemalloc
String ID:
API String ID: 307345228-0
Opcode ID: 058ed6d3f7844282ed6552244507be00efca70214b3540c14490742d002049fd
Instruction ID: edadc0e619dcf86a9bfe3b56a2cbdfd08cde5ee1a9adc8526d09efbfb30c2942
Opcode Fuzzy Hash: 058ed6d3f7844282ed6552244507be00efca70214b3540c14490742d002049fd
Instruction Fuzzy Hash: 44319E7A300B808ADB509F26D80079A63A6FB59BF8F594222EF2D87BD4DF38C4418700

Function 028DC930 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 028DC963

Part of subcall function 028E5540: _FF_MSGBANNER.LIBCMT ref: 028E5570
Part of subcall function 028E5540: HeapAlloc.KERNEL32 ref: 028E5595
Part of subcall function 028E5540: _callnewh.LIBCMT ref: 028E55AE
Part of subcall function 028E5540: _errno.LIBCMT ref: 028E55B9
Part of subcall function 028E5540: _errno.LIBCMT ref: 028E55C4

free.LIBCMT ref: 028DC98B
CreateDIBSection.GDI32 ref: 028DC9F7
free.LIBCMT ref: 028DCA16

Part of subcall function 028DD280: GetObjectW.GDI32 ref: 028DD2B2

free.LIBCMT ref: 028DCA56

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free$_errno$AllocCreateHeapObjectSection_callnewhmalloc
String ID:
API String ID: 2034203143-0
Opcode ID: c1f85406e9bf532789bfbc2e7cc18b022143bcb7c94ab42e68c1e33a11dffac0
Instruction ID: 731a6730f38ba3f1e99fd9004cf8c7e3f7628c54ba98c791426d11b0d8e62903
Opcode Fuzzy Hash: c1f85406e9bf532789bfbc2e7cc18b022143bcb7c94ab42e68c1e33a11dffac0
Instruction Fuzzy Hash: A031853E20578092DB15DF16D40036AF796FB89B98F489426DF8A97B24EF38D016CB00

Function 00007FF7EAF04950 Relevance: 7.6, APIs: 5, Instructions: 91networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF7EAF04984
SetLastError.KERNEL32 ref: 00007FF7EAF049BE
WSAGetLastError.WS2_32 ref: 00007FF7EAF04A12
WSASetLastError.WS2_32 ref: 00007FF7EAF04A68
GetLastError.KERNEL32 ref: 00007FF7EAF04A77

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: e4f8957da8d65f30d38b13d09da8badb50e03e5984e11ac3259b2f877bd45eac
Instruction ID: 42fbab10cefc5bd8564473f97ea758d0cdcd114d897bb5c6b1a11ea24ed2d1ed
Opcode Fuzzy Hash: e4f8957da8d65f30d38b13d09da8badb50e03e5984e11ac3259b2f877bd45eac
Instruction Fuzzy Hash: AC41A332A0864185FB60AF38E5843ADB3A0FB45B8DF944573DA0C83699DF3DD8808762

Function 028D48F0 Relevance: 7.6, APIs: 5, Instructions: 91networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 028D4924
SetLastError.KERNEL32 ref: 028D495E
WSAGetLastError.WS2_32 ref: 028D49B2
WSASetLastError.WS2_32 ref: 028D4A08
GetLastError.KERNEL32 ref: 028D4A17

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: 36fda355891a9b6a2a41bb1c4455046136ab9c6b80eef1ec788c7483a912b158
Instruction ID: 8a183792653f578d8fd5fe4dad966dfa49eebfa5a2bf8d048f0bfed960574412
Opcode Fuzzy Hash: 36fda355891a9b6a2a41bb1c4455046136ab9c6b80eef1ec788c7483a912b158
Instruction Fuzzy Hash: A531BC3E204A808AEB609F3AE44435D3361F749B99F544922CF1DC3BA8DF39C488CB01

Function 028FCE60 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 028FCEA1
_exception_enabled.LIBCMT ref: 028FCEC4

Part of subcall function 028FCDA4: _set_statfp.LIBCMT ref: 028FCDCB
Part of subcall function 028FCDA4: _set_statfp.LIBCMT ref: 028FCE3E

_raise_exc.LIBCMT ref: 028FCF10
_ctrlfp.LIBCMT ref: 028FCF50
_ctrlfp.LIBCMT ref: 028FCF81

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _ctrlfp$_set_statfp$_exception_enabled_raise_exc
String ID:
API String ID: 3456427917-0
Opcode ID: 1881c9f60fed99a1fcd6eed20471586da49208d22f40064342bfaebc292350a2
Instruction ID: 9ff942e62faaa550a1bb084779ca6a190498e7a36138e52e2a5131c4e3fd701e
Opcode Fuzzy Hash: 1881c9f60fed99a1fcd6eed20471586da49208d22f40064342bfaebc292350a2
Instruction Fuzzy Hash: EB315E3A614E848ADB51DF29E84066FB775FB8A798F041216FF8D97A18DF38C541CB40

Function 028E6724 Relevance: 7.6, APIs: 5, Instructions: 80memorythreadCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 028E6776
GetSystemInfo.KERNEL32 ref: 028E678D
SetThreadStackGuarantee.KERNEL32 ref: 028E679F
VirtualAlloc.KERNEL32 ref: 028E67F2
VirtualProtect.KERNEL32 ref: 028E680C

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Virtual$AllocGuaranteeInfoProtectQueryStackSystemThread
String ID:
API String ID: 513674450-0
Opcode ID: 075c36b3ca135fdc652563b5ac2541178ceec77664d81c65090f73d39e80c9e7
Instruction ID: 9d70313311de6d008e0072630a964d35b682d6fa20d7a9f2db30444908bd4384
Opcode Fuzzy Hash: 075c36b3ca135fdc652563b5ac2541178ceec77664d81c65090f73d39e80c9e7
Instruction Fuzzy Hash: 5C31713A311A919EDF24CF31E8547D933A4F759B8CF4881269A5E8BB48EF38D645C740

Function 028A3291 Relevance: 7.6, APIs: 5, Instructions: 78COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 028A32AA
__doserrno.LIBCMT ref: 028A3327
_errno.LIBCMT ref: 028A332E

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$__doserrno
String ID:
API String ID: 2614100947-0
Opcode ID: 800d099e4cba60736708ed37c98d79b550133b1203d55932b7dfc71724dd1719
Instruction ID: 137bbb6965448e9b8a640c7f15304db4f0bd0edf3db321fa799153bf1d088635
Opcode Fuzzy Hash: 800d099e4cba60736708ed37c98d79b550133b1203d55932b7dfc71724dd1719
Instruction Fuzzy Hash: D1213A3C60C7458FE715AFACE8A523DB791EB85314F4D06ADE41AC7291DFB888408B53

Function 0289D05D Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0289D081
_errno.LIBCMT ref: 0289D09A
_errno.LIBCMT ref: 0289D0BE
_errno.LIBCMT ref: 0289D0DC
_errno.LIBCMT ref: 0289D0E6

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: 56325473ece89c43913ab42bac2eec84427b1d3a9a27b51c81ea3f767b85194f
Instruction ID: e657de539acefbc45bd7ae34b24c0100029afad222ca6fbe5a8c7e1f2b36b94f
Opcode Fuzzy Hash: 56325473ece89c43913ab42bac2eec84427b1d3a9a27b51c81ea3f767b85194f
Instruction Fuzzy Hash: F1117C3C504B088FCF65BB6C844672473E1FB59310F5D41AAE55CC7261D7B89882CB9B

Function 00007FF7EAF0961C Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,00000000,00007FF7EAF09731,?,?,?,?,00007FF7EAF091A3), ref: 00007FF7EAF09645
DecodePointer.KERNEL32(?,?,00000000,00007FF7EAF09731,?,?,?,?,00007FF7EAF091A3), ref: 00007FF7EAF09655

Part of subcall function 00007FF7EAF0C1B4: _errno.LIBCMT ref: 00007FF7EAF0C1BD
Part of subcall function 00007FF7EAF0C1B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF0C1C8

EncodePointer.KERNEL32(?,?,00000000,00007FF7EAF09731,?,?,?,?,00007FF7EAF091A3), ref: 00007FF7EAF096D3

Part of subcall function 00007FF7EAF0C124: realloc.LIBCMT ref: 00007FF7EAF0C14F
Part of subcall function 00007FF7EAF0C124: Sleep.KERNEL32(?,?,00000000,00007FF7EAF096C3,?,?,00000000,00007FF7EAF09731,?,?,?,?,00007FF7EAF091A3), ref: 00007FF7EAF0C16B

EncodePointer.KERNEL32(?,?,00000000,00007FF7EAF09731,?,?,?,?,00007FF7EAF091A3), ref: 00007FF7EAF096E3
EncodePointer.KERNEL32(?,?,00000000,00007FF7EAF09731,?,?,?,?,00007FF7EAF091A3), ref: 00007FF7EAF096F0

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Pointer$Encode$Decode$Sleep_errno_invalid_parameter_noinforealloc
String ID:
API String ID: 1909145217-0
Opcode ID: ecada074d5a0a7123039d1954c0b31d342863ec9009fb92d5d2dea83d0352a09
Instruction ID: 8255790eb83c667c2c2698201523599a4b116c6b3b06bde0d8f5bb6abb6f6699
Opcode Fuzzy Hash: ecada074d5a0a7123039d1954c0b31d342863ec9009fb92d5d2dea83d0352a09
Instruction Fuzzy Hash: F5218021B09A8281FA01BB11E9C82F9E3A1BF54BC5BC444B6D91D47765EF7CE485C362

Function 028E5B64 Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 028EBDC8: _amsg_exit.LIBCMT ref: 028F2F66

DecodePointer.KERNEL32 ref: 028E5B8D
DecodePointer.KERNEL32 ref: 028E5B9D
EncodePointer.KERNEL32 ref: 028E5C1B

Part of subcall function 028EAB64: realloc.LIBCMT ref: 028EAB8F
Part of subcall function 028EAB64: Sleep.KERNEL32 ref: 028EABAB

EncodePointer.KERNEL32 ref: 028E5C2B
EncodePointer.KERNEL32 ref: 028E5C38

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Pointer$Encode$Decode$Sleep_amsg_exitrealloc
String ID:
API String ID: 1162480733-0
Opcode ID: 1c272021f84b2579e31e02946320267b97f2c365d49e819e98475682d178a89d
Instruction ID: e89ec7a117185dc7849f54006fa4eef450d6cd7fd9a5b918d385c27656d510a9
Opcode Fuzzy Hash: 1c272021f84b2579e31e02946320267b97f2c365d49e819e98475682d178a89d
Instruction Fuzzy Hash: 8221922D702B4581EE149B62FA58359B366B78ABC8F849835CA4F8B764EF7CD095C304

Function 028DD1B0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32 ref: 028DD1F8
SelectObject.GDI32 ref: 028DD209
SetDIBColorTable.GDI32 ref: 028DD21F
SelectObject.GDI32 ref: 028DD232
DeleteDC.GDI32 ref: 028DD254

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ObjectSelect$ColorCompatibleCreateDeleteTable
String ID:
API String ID: 3899591553-0
Opcode ID: aea2d29c66071ab4bceb5e6f64975c6cb6b9eb1a8a263ab540639364755b0d74
Instruction ID: 0cfd8dbc853d15e2664dc659e52a1ccaa650a1ae0769f1562bb046007007f52b
Opcode Fuzzy Hash: aea2d29c66071ab4bceb5e6f64975c6cb6b9eb1a8a263ab540639364755b0d74
Instruction Fuzzy Hash: 17117C3A201B10C9EB55DF66E594B197374FB98F98F24A025DE4A93B18CF39C485C380

Function 028DA9A0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 028DA9C2
malloc.LIBCMT ref: 028DA9D0

Part of subcall function 028E5540: _FF_MSGBANNER.LIBCMT ref: 028E5570
Part of subcall function 028E5540: HeapAlloc.KERNEL32 ref: 028E5595
Part of subcall function 028E5540: _callnewh.LIBCMT ref: 028E55AE
Part of subcall function 028E5540: _errno.LIBCMT ref: 028E55B9
Part of subcall function 028E5540: _errno.LIBCMT ref: 028E55C4

GetCurrentProcessId.KERNEL32 ref: 028DAA07
free.LIBCMT ref: 028DAA23
CloseHandle.KERNEL32 ref: 028DAA2B

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Process_errno$AllocCloseCurrentHandleHeapOpen_callnewhfreemalloc
String ID:
API String ID: 1715275611-0
Opcode ID: bc000fb6def70590699c8e641fdd0ae050c0fdc48ef69748c87e3439370336a6
Instruction ID: f671b3a0302f4c6cfa1060ba61ef59b74fef4702896a74495661b325cecaae38
Opcode Fuzzy Hash: bc000fb6def70590699c8e641fdd0ae050c0fdc48ef69748c87e3439370336a6
Instruction Fuzzy Hash: 8A11CE3A710A40C2DB689F16F90435D73A1F789B88F988224DB8E47B98DF38C495CB00

Function 02898715 Relevance: 7.5, APIs: 5, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0289872A
_invalid_parameter_noinfo.LIBCMT ref: 02898735
_freebuf.LIBCMT ref: 0289874E
_fileno.LIBCMT ref: 02898756

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_fileno_freebuf_invalid_parameter_noinfo
String ID:
API String ID: 228234209-0
Opcode ID: 9b8945a01a406cd1ac831ca273cda5d643df3cbecfdeb2c523a6de6a35bb6735
Instruction ID: 762e7f945ec2076a3e97be414a21f9db1c829a876a5a2334afca7c2a24cebae9
Opcode Fuzzy Hash: 9b8945a01a406cd1ac831ca273cda5d643df3cbecfdeb2c523a6de6a35bb6735
Instruction Fuzzy Hash: A601D13D215E0B1AEF18ABBC94943296182BB8A378F5C036C981AC71C5DB79C841CB82

Function 00007FF7EAF05E10 Relevance: 7.5, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,00007FF7EAF04E7E,?,?,00000000,00007FF7EAF04E44), ref: 00007FF7EAF05E35
EnterCriticalSection.KERNEL32(?,?,00000000,00007FF7EAF04E7E,?,?,00000000,00007FF7EAF04E44), ref: 00007FF7EAF05E3F
LeaveCriticalSection.KERNEL32(?,?,00000000,00007FF7EAF04E7E,?,?,00000000,00007FF7EAF04E44), ref: 00007FF7EAF05E4F
LeaveCriticalSection.KERNEL32(?,?,00000000,00007FF7EAF04E7E,?,?,00000000,00007FF7EAF04E44), ref: 00007FF7EAF05E59

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: d0535108d2faffde62c4ad6e510cb9d391b63625fe126b8c96127d7e5368dc19
Instruction ID: 31d07e40f3da96ff6d41b66dbed3ee5f19b60de6366056465ad24d937dc1216f
Opcode Fuzzy Hash: d0535108d2faffde62c4ad6e510cb9d391b63625fe126b8c96127d7e5368dc19
Instruction Fuzzy Hash: 42113036A2894583FBA0AB21F4843EAB360FB54755F845072DB8F43A50DF7CE98AC751

Function 028A7DDD Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 028A7DE6
_errno.LIBCMT ref: 028A7DEE

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: fa741961b582ee7b67e6576bbdc250400e5bcedb0d675f31e0db02a7ef4224cf
Instruction ID: ec41d6b7cd84ec445b3e7f8a7f7afba1801b41774544829924e4e72856515f23
Opcode Fuzzy Hash: fa741961b582ee7b67e6576bbdc250400e5bcedb0d675f31e0db02a7ef4224cf
Instruction Fuzzy Hash: BBF0C83C1259484EE709AB68C8A536CB7E2FF0272AF9D4298D415CB1E4CBBD58509A52

Function 028F2794 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 028F27CB
GetCurrentProcessId.KERNEL32 ref: 028F27D6
GetCurrentThreadId.KERNEL32 ref: 028F27E2
GetTickCount.KERNEL32 ref: 028F27EE
QueryPerformanceCounter.KERNEL32 ref: 028F27FF

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: be49b71be2468d602ce2b86d554d21e0fe8525651c21df714ca60d01e100c69a
Instruction ID: 297c7fa36765dcc8f1de7e17d455a056bb87f27562c55b363d418fc23ca56f6e
Opcode Fuzzy Hash: be49b71be2468d602ce2b86d554d21e0fe8525651c21df714ca60d01e100c69a
Instruction Fuzzy Hash: DA019229225B0486EB80CF22F98935573A0F759B90F446621EF5E47BA4DF3CC8958300

Function 00007FF7EAF100DC Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF7EAF100E5
_errno.LIBCMT ref: 00007FF7EAF100ED

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: b2568e6a52513f616cc9bf7babecad4815ad7cdb92447009d9c431ea0fd75076
Instruction ID: dbbb59c35951f68b25be762f4f9a69180f033afda6f86316dbe317abf2ebdc2a
Opcode Fuzzy Hash: b2568e6a52513f616cc9bf7babecad4815ad7cdb92447009d9c431ea0fd75076
Instruction Fuzzy Hash: B3014B61A1864685FE057B1488D53F8A7519FA0B26FE243B7D52D063E2DE7DE4408632

Function 028F830C Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 028F8315
_errno.LIBCMT ref: 028F831D

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: fa741961b582ee7b67e6576bbdc250400e5bcedb0d675f31e0db02a7ef4224cf
Instruction ID: fbd0fbb755fde48c3ecc3f366c6a21aa4ee678ed8c38972d05b7ba5b4ecec88a
Opcode Fuzzy Hash: fa741961b582ee7b67e6576bbdc250400e5bcedb0d675f31e0db02a7ef4224cf
Instruction Fuzzy Hash: F2F0F67E60168985DF496B59C88032C77539B91B39F895701CB3E8A3F1CB7C8000CA12

Function 00007FF7EAF059B0 Relevance: 7.5, APIs: 5, Instructions: 26synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF7EAF059C0
WaitForSingleObject.KERNEL32 ref: 00007FF7EAF059D0
Sleep.KERNEL32 ref: 00007FF7EAF059DB
CloseHandle.KERNEL32 ref: 00007FF7EAF059FA
CloseHandle.KERNEL32 ref: 00007FF7EAF05A07

Part of subcall function 00007FF7EAF04D80: GetCurrentThreadId.KERNEL32 ref: 00007FF7EAF04D8D

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CloseHandleObjectSingleWait$CurrentSleepThread
String ID:
API String ID: 570250148-0
Opcode ID: 892c36502c9aa2b1c275c7a3c19491e1c66a3c365f8122baa1cd80770b25c1c6
Instruction ID: e3526d573b093bab36c8e39e0f5eb7de582fdba1149ff28045cbbabd75f09034
Opcode Fuzzy Hash: 892c36502c9aa2b1c275c7a3c19491e1c66a3c365f8122baa1cd80770b25c1c6
Instruction Fuzzy Hash: CAF04F32604989C2F701EF31E8543B87320FB94F65F5842B2CE2E463A5CF38D88583A1

Function 028D4640 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115networkCOMMON

Download Yara Rule

APIs

WSAEnumNetworkEvents.WS2_32 ref: 028D4678
WSAGetLastError.WS2_32 ref: 028D4686
WSAResetEvent.WS2_32 ref: 028D46C3

Strings

, xrefs: 028D478C

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: EnumErrorEventEventsLastNetworkReset
String ID:
API String ID: 1050048411-3916222277
Opcode ID: bae50107dfc8bbf13130f036befb9453e5ae5370985c1f6d570d448442856cd2
Instruction ID: 15f4e5a266a1170e785975a47ad7bac3a0f1a542a4ff6a04a1dd6195f24279c6
Opcode Fuzzy Hash: bae50107dfc8bbf13130f036befb9453e5ae5370985c1f6d570d448442856cd2
Instruction Fuzzy Hash: 5141497E2047888BE724CF29E40835A77E2F785B8CF150115DE9DC7759EBBAC9498B40

Function 02898DA6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 02898DAE
_getptd.LIBCMT ref: 02898E70
_getptd.LIBCMT ref: 02898E7C

Strings

csm, xrefs: 02898E30

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 745c27bf58ce9136a60d1a91a6c4d13b24bddf59c14694e7ed41f0101153d043
Instruction ID: 29d0b39500aaafa5039b99ccaa6fa1ef5ca793fac8b9d80405be9e582dc94354
Opcode Fuzzy Hash: 745c27bf58ce9136a60d1a91a6c4d13b24bddf59c14694e7ed41f0101153d043
Instruction Fuzzy Hash: C3313878218B058FDE28EF1CD491B69B3E2FB99310F48066DD48EC7651DB31B846CB86

Function 00007FF7EAF1464C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7EAF14665
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF14671
_errno.LIBCMT ref: 00007FF7EAF14698

Strings

1, xrefs: 00007FF7EAF146E7

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: 1
API String ID: 2819658684-2212294583
Opcode ID: c24aa144a5a2c35a8fdb484c0746f0b94e6cfc09c221b34de806f61d68da000b
Instruction ID: 4700f1dacd8a8fab77d0ee743756dde97cf2d5f2f22ce06e17012b43953ddfa6
Opcode Fuzzy Hash: c24aa144a5a2c35a8fdb484c0746f0b94e6cfc09c221b34de806f61d68da000b
Instruction Fuzzy Hash: E521B29291D6C245FF16AB2484503BCDB949FA574EFD580B2D649062D3DB3EE801C732

Function 028FA978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 028FA991
_invalid_parameter_noinfo.LIBCMT ref: 028FA99D
_errno.LIBCMT ref: 028FA9C4

Strings

1, xrefs: 028FAA13

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: 1
API String ID: 2819658684-2212294583
Opcode ID: 8b5cdfa21005997d6bb634ea344ebc4c1ac8b752d5149d2aec92532df31fceaa
Instruction ID: a3db9e3320343e62953972cecd2dbb4d42623e2d9d506edfaa1b0b66cc212a12
Opcode Fuzzy Hash: 8b5cdfa21005997d6bb634ea344ebc4c1ac8b752d5149d2aec92532df31fceaa
Instruction Fuzzy Hash: 79113A6E3197C495DB9F8F3C81503286B55E745B58F8AD061CB9FC7312D72E8950CB22

Function 00007FF7EAF09F20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,000000FF,00007FF7EAF09F69,?,?,00000028,00007FF7EAF090B9,?,?,00B34BF300000000,00007FF7EAF0C050,?,?,ceil,00007FF7EAF0D951), ref: 00007FF7EAF09F2F
GetProcAddress.KERNEL32(?,?,000000FF,00007FF7EAF09F69,?,?,00000028,00007FF7EAF090B9,?,?,00B34BF300000000,00007FF7EAF0C050,?,?,ceil,00007FF7EAF0D951), ref: 00007FF7EAF09F44

Strings

CorExitProcess, xrefs: 00007FF7EAF09F3A
mscoree.dll, xrefs: 00007FF7EAF09F28

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 8532fc609fad59ffe6e62cafeae73a037ed505a12b62afac9e0faec1dfd416e1
Instruction ID: b381fbacece2947a914d103611003869594f11d3917b7b64da3381b83742bf4e
Opcode Fuzzy Hash: 8532fc609fad59ffe6e62cafeae73a037ed505a12b62afac9e0faec1dfd416e1
Instruction Fuzzy Hash: 74E01210F1960281FE197BA0ADD43B4A390AF68755FC854FBC51E47392FE7CE54883A1

Function 028EBD8C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 028EBD9B
GetProcAddress.KERNEL32 ref: 028EBDB0

Strings

CorExitProcess, xrefs: 028EBDA6
mscoree.dll, xrefs: 028EBD94

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 6f0d2907b1ebdc80269f3466a428568ae1999691cd8246c2ae25d5ed097e1493
Instruction ID: 3d7de99da7eaa6c47c93756cb39b9f921c55c50bb393a20c88fb7a2faa1ccd09
Opcode Fuzzy Hash: 6f0d2907b1ebdc80269f3466a428568ae1999691cd8246c2ae25d5ed097e1493
Instruction Fuzzy Hash: F8D05E18702704C2EF5A9FA0E8C83AC13506B99718F4C103D891F46390FF2CD6D9C300

Function 028EAF28 Relevance: 6.4, APIs: 5, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 028EAA60: malloc.LIBCMT ref: 028EAA8B
Part of subcall function 028EAA60: Sleep.KERNEL32 ref: 028EAA9E

free.LIBCMT ref: 028EB054
free.LIBCMT ref: 028EB070

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free$Sleepmalloc
String ID:
API String ID: 1995388493-0
Opcode ID: 4209ad955ca58475186a0720f4ce9e83326167eefa8bbc20b1d91e3d4340953c
Instruction ID: 53e7ac7753c5308b3fb2ff05e59297632ad08be371c5bdcd48cc74f34b1b60ce
Opcode Fuzzy Hash: 4209ad955ca58475186a0720f4ce9e83326167eefa8bbc20b1d91e3d4340953c
Instruction Fuzzy Hash: 9141763A301B4897DF14DF2AE99035A73A5F786B98F8445299F5E83B20EF38E5618740

Function 028E1670 Relevance: 6.3, APIs: 5, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

free.LIBCMT ref: 028E16B5
free.LIBCMT ref: 028E16F5
free.LIBCMT ref: 028E1748
GetProcessHeap.KERNEL32 ref: 028E1755
HeapFree.KERNEL32 ref: 028E1763

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free$Heap$FreeProcess
String ID:
API String ID: 3493288988-0
Opcode ID: 8a39af4dcfd79384b3d3462def16139b905ea2fa1f72942a706cb804d5276759
Instruction ID: f30bda4c4d5b21b375bdc1b38627aa6149129b8f08c5757eb729be51eb6c80fc
Opcode Fuzzy Hash: 8a39af4dcfd79384b3d3462def16139b905ea2fa1f72942a706cb804d5276759
Instruction Fuzzy Hash: 4331562A711A5083DB28DF6AE54475D6361FB8AF84F488021DF4E93F24CF38D8A1CB00

Function 02896A29 Relevance: 6.2, APIs: 4, Instructions: 220COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 02896A58
_invalid_parameter_noinfo.LIBCMT ref: 02896A63
iswctype.LIBCMT ref: 02896A9C
_errno.LIBCMT ref: 02896BC6

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfoiswctype
String ID:
API String ID: 248606491-0
Opcode ID: 97ec92455e3c7918d41b8261675ed43ac07a1cfb8a1a9c8953e80a2ad2af7bba
Instruction ID: 2ad4dc439ff106382e58938c1a9bf0e5a57544eca595cb4d285f7763b86f8269
Opcode Fuzzy Hash: 97ec92455e3c7918d41b8261675ed43ac07a1cfb8a1a9c8953e80a2ad2af7bba
Instruction Fuzzy Hash: 76514D7D90863D49EF38292DD85537A32CDFB41764F6D522ADD9FC7180FB60C4864282

Function 00007FF7EAF0CD38 Relevance: 6.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7EAF0CD67
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF0CD72
iswctype.LIBCMT ref: 00007FF7EAF0CDAB
_errno.LIBCMT ref: 00007FF7EAF0CED5

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfoiswctype
String ID:
API String ID: 248606491-0
Opcode ID: 94b972fa06678f78d860e6f5b723ba573def77772fbd1e0a4943df1ed3bb4a81
Instruction ID: 81bda052a208730e0efa8a485498da130968470be042b282e8d1fd628a7b19c9
Opcode Fuzzy Hash: 94b972fa06678f78d860e6f5b723ba573def77772fbd1e0a4943df1ed3bb4a81
Instruction Fuzzy Hash: 11518E22E0815345FBB4772998853FAEBC1AF40B5CF9541B3DE69425C1EE7CE8939223

Function 028E6F58 Relevance: 6.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 028E6F87
_invalid_parameter_noinfo.LIBCMT ref: 028E6F92
iswctype.LIBCMT ref: 028E6FCB
_errno.LIBCMT ref: 028E70F5

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfoiswctype
String ID:
API String ID: 248606491-0
Opcode ID: 67f8f42e0385bfde8af5f096faebcf698eb41e3d725d8295d792653990f622a7
Instruction ID: 298621a81a4dfbfdfa39bc519e829db2ef746e104172b9f83482faa5b6cbacdf
Opcode Fuzzy Hash: 67f8f42e0385bfde8af5f096faebcf698eb41e3d725d8295d792653990f622a7
Instruction Fuzzy Hash: 0A41126FA0026184EF345A2ED80177EB286BB43BACF558522DEABC7584F779C481D353

Function 00007FF7EAF0A834 Relevance: 6.2, APIs: 4, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7EAF0A882
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF0A88D
DecodePointer.KERNEL32(?,?,?,?,?,00007FF7EAF091E4,?,?,?,?,00007FF7EAF0219E), ref: 00007FF7EAF0A93C
_lock.LIBCMT ref: 00007FF7EAF0A967

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: DecodePointer_errno_invalid_parameter_noinfo_lock
String ID:
API String ID: 27599310-0
Opcode ID: 2e1f47d07c568a67316eefeacd6411d58cf0c130c40cf9c6aca4e33faf3add32
Instruction ID: f8cb4c522f82b3aa154e62090eee3c179ddbcfe54bb5a241e86e0b4c6ac6c85a
Opcode Fuzzy Hash: 2e1f47d07c568a67316eefeacd6411d58cf0c130c40cf9c6aca4e33faf3add32
Instruction Fuzzy Hash: 9551A332F0C64286FA69BB15A5C03FAE391EF85748F9541B7D99E066D4DF3CE841C222

Function 028EC684 Relevance: 6.2, APIs: 4, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 028EC6D2
_invalid_parameter_noinfo.LIBCMT ref: 028EC6DD
DecodePointer.KERNEL32 ref: 028EC78C
_lock.LIBCMT ref: 028EC7B7

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: DecodePointer_errno_invalid_parameter_noinfo_lock
String ID:
API String ID: 27599310-0
Opcode ID: e0472d1584fb1bcfed8cf7d1971529828c62e46184f1eed563550706c70d7fd3
Instruction ID: 9b6270bff682fbbb6c7f505b41adcd691d374cd7c5fdad85ad8d890e46f6360e
Opcode Fuzzy Hash: e0472d1584fb1bcfed8cf7d1971529828c62e46184f1eed563550706c70d7fd3
Instruction Fuzzy Hash: 2451DB3EA0474486DE298B2DA98633A6B62F787788F55812BDE6FC7714DB38C442C201

Function 028989BD Relevance: 6.2, APIs: 4, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 028972C5: _getptd.LIBCMT ref: 028972C9

_getptd.LIBCMT ref: 028989FC
_SetImageBase.LIBCMT ref: 02898ACF
_getptd.LIBCMT ref: 02898AFD
_getptd.LIBCMT ref: 02898B0B

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd$BaseImage
String ID:
API String ID: 2482573191-0
Opcode ID: 04e4ddb59326ee2f6fd00dd5a9e934302c90db7294c98b3c1bfd7684be65c82c
Instruction ID: 50bf3c9c4826fe04314ca6d9bb79d71512e434e0b4e77c43b6a3651060f2c43f
Opcode Fuzzy Hash: 04e4ddb59326ee2f6fd00dd5a9e934302c90db7294c98b3c1bfd7684be65c82c
Instruction Fuzzy Hash: 3A41FD7D134A054EDB187B7CC8055B972D2FB86324F6C86AED05AC7175DB74E8428A43

Function 028A8219 Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 028A8238
_invalid_parameter_noinfo.LIBCMT ref: 028A8244
_errno.LIBCMT ref: 028A826E
_errno.LIBCMT ref: 028A82D0

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 7be2ae340f5959406522c893d974e7f2dc4a3aef0f5b2582e14843318c479f82
Instruction ID: 4544216c1fb0deb77e20a533c1290763fc2a2a27b5abe7ee4f939c021878e598
Opcode Fuzzy Hash: 7be2ae340f5959406522c893d974e7f2dc4a3aef0f5b2582e14843318c479f82
Instruction Fuzzy Hash: FD312B2C618E894BE70D5A2C94A83397BC1EB6A305F5C12BED08BC7653DEA58C458725

Function 00007FF7EAF1289C Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7EAF0ABF8: _getptd.LIBCMT ref: 00007FF7EAF0AC0A

_errno.LIBCMT ref: 00007FF7EAF128DA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF128E4
_errno.LIBCMT ref: 00007FF7EAF12908
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF12912

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd
String ID:
API String ID: 1297830140-0
Opcode ID: 9ca92d5bb05e79156cbab85d98cd5049689c098bd46746ebc4bd1871a1c2f17d
Instruction ID: 99ede3a6522753571ebe9fd22695beac72761af84f60a6ce2268dcf3ea8387b6
Opcode Fuzzy Hash: 9ca92d5bb05e79156cbab85d98cd5049689c098bd46746ebc4bd1871a1c2f17d
Instruction Fuzzy Hash: E641CF62A0878286F760AB59C1843ADB7A0EB54BD0F8441B3DB8D03B92DF3CE445C722

Function 028FA2F0 Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 028E5D58: _getptd.LIBCMT ref: 028E5D6A

_errno.LIBCMT ref: 028FA32E
_invalid_parameter_noinfo.LIBCMT ref: 028FA338
_errno.LIBCMT ref: 028FA35C
_invalid_parameter_noinfo.LIBCMT ref: 028FA366

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd
String ID:
API String ID: 1297830140-0
Opcode ID: b97e4681cad7102bf8eb11c838a13d165c45bbaf35c379efe426b3f239e3ab6d
Instruction ID: 342a867992d9a64bb165567f0f45c5027cc4bff39dc180886d773f60a93c0eec
Opcode Fuzzy Hash: b97e4681cad7102bf8eb11c838a13d165c45bbaf35c379efe426b3f239e3ab6d
Instruction Fuzzy Hash: BC41127E2047848ADB55DF29D58436EBB61F785FE4F488121DB9E87B25CB38C045CB02

Function 00007FF7EAF131FC Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7EAF11A74: _getptd.LIBCMT ref: 00007FF7EAF11A78

_getptd.LIBCMT ref: 00007FF7EAF1323B

Part of subcall function 00007FF7EAF0BA34: _amsg_exit.LIBCMT ref: 00007FF7EAF0BA4A

_SetImageBase.LIBCMT ref: 00007FF7EAF1330E
_getptd.LIBCMT ref: 00007FF7EAF1333C
_getptd.LIBCMT ref: 00007FF7EAF1334A

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd$BaseImage_amsg_exit
String ID:
API String ID: 2306399499-0
Opcode ID: b5c06598e24a17d2af3d260348e39d1b732e80aecbaef9a16b5b1eba258a06ea
Instruction ID: aee0bbf2a3f49c2136ecaf640a99eaed86b3c79202fa453715cf30f3ec9e9460
Opcode Fuzzy Hash: b5c06598e24a17d2af3d260348e39d1b732e80aecbaef9a16b5b1eba258a06ea
Instruction Fuzzy Hash: 11418622A0854281FA60BB15D4813FDFB50AF65B98F958277DE5D437E3CE3CE5468322

Function 028E8EEC Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 028E77F4: _getptd.LIBCMT ref: 028E77F8

_getptd.LIBCMT ref: 028E8F2B

Part of subcall function 028EE2A0: _amsg_exit.LIBCMT ref: 028EE2B6

_SetImageBase.LIBCMT ref: 028E8FFE
_getptd.LIBCMT ref: 028E902C
_getptd.LIBCMT ref: 028E903A

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd$BaseImage_amsg_exit
String ID:
API String ID: 2306399499-0
Opcode ID: 9f529da7157698e50d5f34f7b3e4ea87a707267c000e75ac816959d67dde5636
Instruction ID: 002478e388cf027ac71832cf14936b7282d3bb9d2f77eaa0ed20d939250392ad
Opcode Fuzzy Hash: 9f529da7157698e50d5f34f7b3e4ea87a707267c000e75ac816959d67dde5636
Instruction Fuzzy Hash: B231A63E60058986CE34EB1DD98066DB7A2B786BA9F458561CF1FC7760CB74C087CB02

Function 028954BD Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 028954E8
_invalid_parameter_noinfo.LIBCMT ref: 028954F3
_getptd.LIBCMT ref: 02895519
free.LIBCMT ref: 02895584

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 4053972703-0
Opcode ID: 7481bf8148e7d156cf8c311b37150eb594a00842ee05393b003d335b8423385e
Instruction ID: 7e0c7e869f15d01b6fb3c2ff64c2197fe8f910117397ec68813ccb3f9e04b965
Opcode Fuzzy Hash: 7481bf8148e7d156cf8c311b37150eb594a00842ee05393b003d335b8423385e
Instruction Fuzzy Hash: 5221B538208F094FDF58FFAC985962AB7D2FB98311F48062E984DC3261DB64D8418B83

Function 00007FF7EAF072A0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 90stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF7EAF072CF
lstrlenW.KERNEL32 ref: 00007FF7EAF072F0
lstrlenW.KERNEL32 ref: 00007FF7EAF072FC

Strings

|p1:18.167.52.240|o1:6666|t1:1|p2:18.167.52.240|o2:8888|t2:1|p3:127.0.0.1|o3:80|t3:1|dd:1|cl:1|fz:, xrefs: 00007FF7EAF072E6

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: lstrlen
String ID: |p1:18.167.52.240|o1:6666|t1:1|p2:18.167.52.240|o2:8888|t2:1|p3:127.0.0.1|o3:80|t3:1|dd:1|cl:1|fz:
API String ID: 1659193697-511104048
Opcode ID: 32b2e33b096677a599e1476ba1b417f22cd16269792abd837077c77c15f759a6
Instruction ID: bb97d6a076229dcae55a51e2cbd2f778e348478261c64a8a49e5add29094323f
Opcode Fuzzy Hash: 32b2e33b096677a599e1476ba1b417f22cd16269792abd837077c77c15f759a6
Instruction Fuzzy Hash: 43310922E08A5685FA28EB11A9843F9F3A0FF94B88B8480F6DD4D56755DE7CE541C321

Function 028DA860 Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 028DA897
Process32FirstW.KERNEL32 ref: 028DA90F
Process32NextW.KERNEL32 ref: 028DA950
CloseHandle.KERNEL32 ref: 028DA96C

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 02b47b998f259fe205a3e2606ef92517168e540379220ccbf34bb92ef0d7b66a
Instruction ID: eb9c915c3274d16acb475452842d0ac6a5c9d6f9d00178b5d5588818c92c06df
Opcode Fuzzy Hash: 02b47b998f259fe205a3e2606ef92517168e540379220ccbf34bb92ef0d7b66a
Instruction Fuzzy Hash: 2F31A63E60474582DF28CB2AE45436A77A1F7C4FA9F558225DE6E83794DF39C00AC740

Function 028F8748 Relevance: 6.1, APIs: 4, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 028F8767
_invalid_parameter_noinfo.LIBCMT ref: 028F8773
_errno.LIBCMT ref: 028F879D
_errno.LIBCMT ref: 028F87FF

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 7be2ae340f5959406522c893d974e7f2dc4a3aef0f5b2582e14843318c479f82
Instruction ID: 8338791333e556d294b58a9ed66ec300d34be35e867055a04609daa5642f4dda
Opcode Fuzzy Hash: 7be2ae340f5959406522c893d974e7f2dc4a3aef0f5b2582e14843318c479f82
Instruction Fuzzy Hash: B8216A7E7187C08AEB848A79D95035E7B41E366788F588433CB4AC7743E779C446CB11

Function 00007FF7EAF04850 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32 ref: 00007FF7EAF0488E
WSAGetLastError.WS2_32 ref: 00007FF7EAF04899

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ErrorEventLastSelect
String ID:
API String ID: 1135597009-0
Opcode ID: 0be878fb768bf08b0c5fb6e885e8fe2ab6ec24c45cef932c45ab1ad02d861857
Instruction ID: 1faa383b6a73d31ea5c6f4807f86223a3470b7eea96a559db3f044719e1964bc
Opcode Fuzzy Hash: 0be878fb768bf08b0c5fb6e885e8fe2ab6ec24c45cef932c45ab1ad02d861857
Instruction Fuzzy Hash: D6212FB2A0014086FB10EF3AC4883AD73A1FB44B4CF944076DA1C876D0DF7AD886CB61

Function 028D47F0 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32 ref: 028D482E
WSAGetLastError.WS2_32 ref: 028D4839

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: ErrorEventLastSelect
String ID:
API String ID: 1135597009-0
Opcode ID: cb030ebd4eb2ee841ca7b97a548f52db33a60d32a92dd19741f3f7cea45038d6
Instruction ID: 0350c5d26f261a1777dd995c82f53994922b1e70214cc3a8eb25a4bffedd55b0
Opcode Fuzzy Hash: cb030ebd4eb2ee841ca7b97a548f52db33a60d32a92dd19741f3f7cea45038d6
Instruction Fuzzy Hash: 22218EBA60068087E750CF7AD48835D77A2EB94B98F544125CB1CCBA94DF7AC4CACB11

Function 00007FF7EAF050B0 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7EAF050CC
LeaveCriticalSection.KERNEL32 ref: 00007FF7EAF050E5
LeaveCriticalSection.KERNEL32 ref: 00007FF7EAF05165
SetEvent.KERNEL32 ref: 00007FF7EAF05185

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: 03f9e94784ee446fcc446a6b9a97075121abf68d5be1871662565671ac975166
Instruction ID: d3b4735b51aa167b998c127a20b0c961d15bdb5ce0a1cb3c93902ff9dbea9bc2
Opcode Fuzzy Hash: 03f9e94784ee446fcc446a6b9a97075121abf68d5be1871662565671ac975166
Instruction Fuzzy Hash: 34214B32604B8593E658DF16E5803A9B3A4FB58B84F548076DB6E43321CF38E9A1C740

Function 028D5050 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 028D506C
LeaveCriticalSection.KERNEL32 ref: 028D5085
LeaveCriticalSection.KERNEL32 ref: 028D5105
SetEvent.KERNEL32 ref: 028D5125

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: b017e7a6f2334ba3780cffc380c5b460edc1420cb3fde9e064e142419b43089a
Instruction ID: dba8e5a66bf4b395f1f50d81e179ba51b57f4cdb44ec3edde5bac08e3dea23f3
Opcode Fuzzy Hash: b017e7a6f2334ba3780cffc380c5b460edc1420cb3fde9e064e142419b43089a
Instruction Fuzzy Hash: A221193A314B8493DB48CF26E58439DB364F758B94F948125DBAE83764DF38E8A1C740

Function 00007FF7EAF0B8D0 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32(?,?,?,?,00007FF7EAF0BC45,?,?,00000000,00007FF7EAF09984), ref: 00007FF7EAF0B8DF
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7EAF0BC45), ref: 00007FF7EAF0D883
free.LIBCMT ref: 00007FF7EAF0D88C
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7EAF0BC45), ref: 00007FF7EAF0D8B3

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalDeleteSection$Freefree
String ID:
API String ID: 1250194111-0
Opcode ID: c67542cc3d2d698b88e45379a5442c15c18af80ec950ad7c34deb963a0871383
Instruction ID: a1343ca55e4e1ebcd84f99376681816011443e07d5f691886a51068008c732bd
Opcode Fuzzy Hash: c67542cc3d2d698b88e45379a5442c15c18af80ec950ad7c34deb963a0871383
Instruction Fuzzy Hash: 9F116331E09541C6FA15AF11E4903B9E3A0EF64B68F9806B2DA5D062A5CF3CD491C712

Function 00007FF7EAF0EF6C Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF7EAF0EF76

Part of subcall function 00007FF7EAF0BA34: _amsg_exit.LIBCMT ref: 00007FF7EAF0BA4A

_lock.LIBCMT ref: 00007FF7EAF0EFA4
free.LIBCMT ref: 00007FF7EAF0EFDA
_amsg_exit.LIBCMT ref: 00007FF7EAF0F013

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _amsg_exit$_getptd_lockfree
String ID:
API String ID: 2148533958-0
Opcode ID: 7d7c657d20a7dd2b4e75e9e7dc412b9cbf1c6d67fe2fb29e532279fb9e9c9193
Instruction ID: 1cd43d15b2e5052ee62143cd28962ffe201bfcb28f4513e2f42f17436f81ec10
Opcode Fuzzy Hash: 7d7c657d20a7dd2b4e75e9e7dc412b9cbf1c6d67fe2fb29e532279fb9e9c9193
Instruction Fuzzy Hash: 83114222A1964286FB94BB10D4907F9B3A1FF44B44F884477DA4E03396DF3CE451C762

Function 00007FF7EAF102E0 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 00007FF7EAF102F4

Part of subcall function 00007FF7EAF0D9D8: _amsg_exit.LIBCMT ref: 00007FF7EAF0DA02

fclose.LIBCMT ref: 00007FF7EAF10324
DeleteCriticalSection.KERNEL32(?,?,?,?,?,00007FF7EAF0EBB3), ref: 00007FF7EAF10348
free.LIBCMT ref: 00007FF7EAF10359

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalDeleteSection_amsg_exit_lockfclosefree
String ID:
API String ID: 594724896-0
Opcode ID: 78db43efc7c8f8b6f2111a7d5b2742e6ce96985b6946986547e2f26360c46e23
Instruction ID: 4c8d1f10881e1d3d3ffbd18318f90c3e2c007a09387a3dfdbd5b098ee10c7455
Opcode Fuzzy Hash: 78db43efc7c8f8b6f2111a7d5b2742e6ce96985b6946986547e2f26360c46e23
Instruction Fuzzy Hash: 7011632590864282F610AB15E4853FCF360FF94B44F9142B7DA9E472A6CF3DE642C725

Function 028EE13C Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32 ref: 028EE14B
DeleteCriticalSection.KERNEL32 ref: 028F2DE7
free.LIBCMT ref: 028F2DF0
DeleteCriticalSection.KERNEL32 ref: 028F2E17

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalDeleteSection$Freefree
String ID:
API String ID: 1250194111-0
Opcode ID: 75cf5cf2a91dc546f02e38a9e3dbec3fe3da6b61775a161062c4c9708d13ad3c
Instruction ID: 597c0996c939da764e2a450d53f28ca8fc8334a185bd39cc19247bade12ed6c4
Opcode Fuzzy Hash: 75cf5cf2a91dc546f02e38a9e3dbec3fe3da6b61775a161062c4c9708d13ad3c
Instruction Fuzzy Hash: 5811C23EA01A84CAEF58DF55F4843587360F751BA8F984222DB5A43769DF38C091C750

Function 028F2C84 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 028F2C98

Part of subcall function 028F2F3C: _amsg_exit.LIBCMT ref: 028F2F66

fclose.LIBCMT ref: 028F2CC8
DeleteCriticalSection.KERNEL32 ref: 028F2CEC
free.LIBCMT ref: 028F2CFD

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CriticalDeleteSection_amsg_exit_lockfclosefree
String ID:
API String ID: 594724896-0
Opcode ID: 587678b0e22b6f1ed6e9727d4f25aa771bb7f2d66daf027d874ec5787a5967df
Instruction ID: 4aaa6b915bc0514b18d276a11fbe3eddd8c34cec0af1fd9cdc7a725015d03ea2
Opcode Fuzzy Hash: 587678b0e22b6f1ed6e9727d4f25aa771bb7f2d66daf027d874ec5787a5967df
Instruction Fuzzy Hash: 95115E3E51064182E750DB5AE88435CB762F7C5B58F554216DF5E837B8CF35C8A2CB14

Function 028E596C Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 028E59A1
ExitThread.KERNEL32 ref: 028E59A9
GetCurrentThreadId.KERNEL32 ref: 028E59B0
_freefls.LIBCMT ref: 028E59E1

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Thread$CurrentErrorExitLast_freefls
String ID:
API String ID: 217443660-0
Opcode ID: 588db04c18f29c9be1d5c9446df95e04195eaa9b6e35d7d8b5d50f2190a618f9
Instruction ID: 6507a1e92a9169300f885af5baf601cb7cf260500cf63efec2bcc48263c66932
Opcode Fuzzy Hash: 588db04c18f29c9be1d5c9446df95e04195eaa9b6e35d7d8b5d50f2190a618f9
Instruction Fuzzy Hash: 64F0F92D602B4585DF58BF75E84835D3296AB1ABAAF5484348A5ECB344EE3884848726

Function 00007FF7EAF086F0 Relevance: 6.0, APIs: 4, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7EAF01540: HeapFree.KERNEL32 ref: 00007FF7EAF01586
Part of subcall function 00007FF7EAF01540: free.LIBCMT ref: 00007FF7EAF015B2

HeapDestroy.KERNEL32 ref: 00007FF7EAF0870E
HeapCreate.KERNEL32 ref: 00007FF7EAF0871F
free.LIBCMT ref: 00007FF7EAF08731
HeapDestroy.KERNEL32 ref: 00007FF7EAF08754

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Heap$Destroyfree$CreateFree
String ID:
API String ID: 3907340440-0
Opcode ID: fcaa257793e5fadcfc70eac2341b6a548630f635855dc52f12f0612825e35ef9
Instruction ID: f4410ee0a833a76fe1a7bb199f8f531d079077e000fef9c7dfece8205727fff9
Opcode Fuzzy Hash: fcaa257793e5fadcfc70eac2341b6a548630f635855dc52f12f0612825e35ef9
Instruction Fuzzy Hash: 4D014B3661668197FB48AF62D6902B8B760FF44BC0B409476DF1E03A11CF38E8B08361

Function 028E0210 Relevance: 6.0, APIs: 4, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 028D1510: HeapFree.KERNEL32 ref: 028D1556
Part of subcall function 028D1510: free.LIBCMT ref: 028D1582

HeapDestroy.KERNEL32 ref: 028E022E
HeapCreate.KERNEL32 ref: 028E023F
free.LIBCMT ref: 028E0251
HeapDestroy.KERNEL32 ref: 028E0274

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Heap$Destroyfree$CreateFree
String ID:
API String ID: 3907340440-0
Opcode ID: c2a02e2d25dcdc3eb15845cf098bfdc20e2b18508da8d5513ac710b9526543a6
Instruction ID: c36a96a184fb4c5c438d50ca8386151b0f18978acd08340d720963a9adfdd2d5
Opcode Fuzzy Hash: c2a02e2d25dcdc3eb15845cf098bfdc20e2b18508da8d5513ac710b9526543a6
Instruction Fuzzy Hash: 9AF0147E612A8097EF899FA2E6943283361FB59B90F149425DF5A53A20DF38D4B0C710

Function 00007FF7EAF0F83C Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF7EAF0F842

Part of subcall function 00007FF7EAF0BA34: _amsg_exit.LIBCMT ref: 00007FF7EAF0BA4A

_getptd.LIBCMT ref: 00007FF7EAF0F862
_lock.LIBCMT ref: 00007FF7EAF0F875
_amsg_exit.LIBCMT ref: 00007FF7EAF0F8A3

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: 41071648471df9d3322a353edf5a3ab4de664c8de62a61506e4f03b2c3d18dde
Instruction ID: 63f86b7e8de1919b3b8911303c4860800ed71143adcf416f9b84d89a3a8810a4
Opcode Fuzzy Hash: 41071648471df9d3322a353edf5a3ab4de664c8de62a61506e4f03b2c3d18dde
Instruction Fuzzy Hash: F3F0EC21A4A14281FA54BB5188917F9A3E1EF58B48F8802B7D90D073D2DE3CE441C722

Function 028EF60C Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 028EF612

Part of subcall function 028EE2A0: _amsg_exit.LIBCMT ref: 028EE2B6

_getptd.LIBCMT ref: 028EF632
_lock.LIBCMT ref: 028EF645
_amsg_exit.LIBCMT ref: 028EF673

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: fd85481e6f1651f5d76b00fa4aeef51f91457a022d7dafcf2304a8bda7794c52
Instruction ID: c3befff70bd03871af7a0fd9a1baa8057917e52829f135abd541cdcaa8ce1fbf
Opcode Fuzzy Hash: fd85481e6f1651f5d76b00fa4aeef51f91457a022d7dafcf2304a8bda7794c52
Instruction Fuzzy Hash: 2CF0FE6D612544C7EE68AFA5C880FA82762FBA6B44F494139CF0F8B7A5DF14C851CB12

Function 028D32F0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 028D332D
CancelIo.KERNEL32 ref: 028D333A
closesocket.WS2_32 ref: 028D334A
SetEvent.KERNEL32 ref: 028D3354

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CancelEventclosesocketsetsockopt
String ID:
API String ID: 852421847-0
Opcode ID: 5fed5ac1a6c0e25038b08101fba0c49ff6199068559f4a30632e6729f0e15d68
Instruction ID: 50e1a0112eac3c3abd94e9a4470f0ce8d417eb8873f9351af2e53c6197e22fb9
Opcode Fuzzy Hash: 5fed5ac1a6c0e25038b08101fba0c49ff6199068559f4a30632e6729f0e15d68
Instruction Fuzzy Hash: 1CF04F3A201B8087D7548F25E65835AB371FB84B64F144335CBA947BE4CF39C069CB04

Function 02899959 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 209COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0289997D

Strings

csm, xrefs: 028999AA
csm, xrefs: 02899AB4

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 917fc8f16f91c9c1e7d02b967013efe3ed59a3bfb2a6870d806dcbebc9267545
Instruction ID: a13eb0efc198411a823cf120c35f3216ee48437f2ed81b2a2cd6c67ae726e402
Opcode Fuzzy Hash: 917fc8f16f91c9c1e7d02b967013efe3ed59a3bfb2a6870d806dcbebc9267545
Instruction Fuzzy Hash: 86518B3C618B198FDF689E6D8485329B3D1FB98315F58426DE88EC7251CB34D891CB87

Function 00007FF7EAF0F0B8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF7EAF0F028: GetOEMCP.KERNEL32 ref: 00007FF7EAF0F052

IsValidCodePage.KERNEL32 ref: 00007FF7EAF0F13B
GetCPInfo.KERNEL32 ref: 00007FF7EAF0F150

Strings

4 =X, xrefs: 00007FF7EAF0F0C8

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: 4 =X
API String ID: 546120528-3147943113
Opcode ID: 2d66e40806a7885bca04df63df21ba3203eb18842c8fe416ed4071b8c72ebfbf
Instruction ID: 2e975659a06d7d177395e76740d16e2138ab4eb873a27aa0a509ec053e6a4b25
Opcode Fuzzy Hash: 2d66e40806a7885bca04df63df21ba3203eb18842c8fe416ed4071b8c72ebfbf
Instruction Fuzzy Hash: D171D366F0C2824AF774AB24D4903FAE7D1EB50748FC480B7DA4E46685DE3CE905C322

Function 00007FF7EAF1417C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF7EAF141A0

Part of subcall function 00007FF7EAF0BA34: _amsg_exit.LIBCMT ref: 00007FF7EAF0BA4A

Strings

csm, xrefs: 00007FF7EAF142D7
csm, xrefs: 00007FF7EAF141CD

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _amsg_exit_getptd
String ID: csm$csm
API String ID: 4217099735-3733052814
Opcode ID: 101f134f4e12a7d59dd54e5d86992c5274962396a685041d1e783f31e629751d
Instruction ID: e51aebc7c065e9cd95a0c0cf083e32e48395d8c6a496ea6a4a33bb242a30d534
Opcode Fuzzy Hash: 101f134f4e12a7d59dd54e5d86992c5274962396a685041d1e783f31e629751d
Instruction Fuzzy Hash: C151926691828285FF60AF2290403FDF794BBA5B86F844176DA5C57B86CF3CE491C712

Function 028E9E88 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 028E9EAC

Part of subcall function 028EE2A0: _amsg_exit.LIBCMT ref: 028EE2B6

Strings

csm, xrefs: 028E9FE3
csm, xrefs: 028E9ED9

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _amsg_exit_getptd
String ID: csm$csm
API String ID: 4217099735-3733052814
Opcode ID: 7bd6ec597707a8130d98902d7c5797d217323703ccc9fee464bfcdaa9f334678
Instruction ID: c2d68f6cceebdcbedb59a018da21be921d408fa29338730ee8a98e5eec67f60b
Opcode Fuzzy Hash: 7bd6ec597707a8130d98902d7c5797d217323703ccc9fee464bfcdaa9f334678
Instruction Fuzzy Hash: 03518A3E204680CACF248E2AD44076DB765F38AB99F048125DE9E97B54CB78D491CB02

Function 00007FF7EAF0ED7C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF7EAF0EDB6

Strings

4 =X, xrefs: 00007FF7EAF0ED9A
, xrefs: 00007FF7EAF0EDDF

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: Info
String ID: $4 =X
API String ID: 1807457897-2907286441
Opcode ID: f47733b1d9d4e4c31e341bf347b99f3e606d04bb89b8deb29d44699b80daf317
Instruction ID: 7700f2ba9c58f117059aa5184faa682191fd3fed7e6fc109626cb6299bb72dca
Opcode Fuzzy Hash: f47733b1d9d4e4c31e341bf347b99f3e606d04bb89b8deb29d44699b80daf317
Instruction Fuzzy Hash: 4751BE326186C58AE721DF24E0943EEBBA0F744748F944176EB8E47A85CB7CE506CB61

Function 028DDCA4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

Part of subcall function 028E55F8: malloc.LIBCMT ref: 028E5612

wsprintfW.USER32 ref: 028DDCF8
CloseHandle.KERNEL32 ref: 028DDE6B

Strings

%s_bin, xrefs: 028DDCEE

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CloseHandlemallocwsprintf
String ID: %s_bin
API String ID: 2399101171-2665034546
Opcode ID: 7ee2cb6e65462bd43dae09ae97409f9e65dedb4d2c49679d403bce761502c7fe
Instruction ID: 052445d6e301edf4ce8e68567fcbd71fba18eaa55909c9d2da4891e64b720a40
Opcode Fuzzy Hash: 7ee2cb6e65462bd43dae09ae97409f9e65dedb4d2c49679d403bce761502c7fe
Instruction Fuzzy Hash: 4F41CB2F701A9582EF50DF66E408BAD2369FB86F88F448126DE5E87784DF39C149C702

Function 02895281 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 02895202
_invalid_parameter_noinfo.LIBCMT ref: 0289520D

Strings

B, xrefs: 02895232

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: b2b1431cd55b683814269cea7d1a1a7e7268a5820bfd4734ba4b4440490ac067
Instruction ID: b449b299b524f92154108b75b8fabfad8f7efe7f8eec78f182f843c1ac5972f8
Opcode Fuzzy Hash: b2b1431cd55b683814269cea7d1a1a7e7268a5820bfd4734ba4b4440490ac067
Instruction Fuzzy Hash: 79219338218B4C8FCB45EF6DC44461AB7D1FB9C324F98066EA45EC7251CB78C940CB82

Function 028961D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0289617A
_invalid_parameter_noinfo.LIBCMT ref: 02896185

Strings

B, xrefs: 028961B1

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: e7192767c34a9623a5d1a89167f59ebb02eb77dc64806a58f83736d32f6d4f2d
Instruction ID: 8bfa09019b4a50351e4a2a23c4d99bb458c2390d12eee161d12e1fddd0d20017
Opcode Fuzzy Hash: e7192767c34a9623a5d1a89167f59ebb02eb77dc64806a58f83736d32f6d4f2d
Instruction Fuzzy Hash: 3A118F34628A0C8FCB44EF5C9485765B7E2FB98325F54476EA419C32A1DF78C984CB82

Function 00007FF7EAF17323 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF7EAF173E7

Strings

csm, xrefs: 00007FF7EAF1734A
csm, xrefs: 00007FF7EAF173A3

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 2390259f5c7b96c66dbe66369981e250b2529a0f82c8583acd2dcf66a4ceee86
Instruction ID: e1a6bb7ffff4d377cfebc557c419318f0deddd055834db130299dcf96305d0d8
Opcode Fuzzy Hash: 2390259f5c7b96c66dbe66369981e250b2529a0f82c8583acd2dcf66a4ceee86
Instruction Fuzzy Hash: E2312B73904605CAEB209F26C0803EC7B71F768B9CF861276EA4D0BB55CB75D880CB95

Function 028FD797 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 028FD85B

Strings

csm, xrefs: 028FD7BE
csm, xrefs: 028FD817

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 25678bfddff69f2c8b5c90b0b7b9e7d65aa6f3eafa1e5e7c8d0546c620d86463
Instruction ID: 2d0b685b7449edd915e375253271ec5e3d67c12d63006d88718accef4d026d0f
Opcode Fuzzy Hash: 25678bfddff69f2c8b5c90b0b7b9e7d65aa6f3eafa1e5e7c8d0546c620d86463
Instruction Fuzzy Hash: 1C21927B910644CADB708F6AC4843983B75F358BADF8A6619EB4D4BB28CB75C484C784

Function 00007FF7EAF092C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF7EAF09245
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7EAF09250

Strings

B, xrefs: 00007FF7EAF09275

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: 9b4439fc7c8faf101ecdfea0264f82894208d5a38c9186357c889f9d5f545f4f
Instruction ID: 06aab3626fecc4afef7d2d00e843a2651960b286dad7fb34a7accb517bce524e
Opcode Fuzzy Hash: 9b4439fc7c8faf101ecdfea0264f82894208d5a38c9186357c889f9d5f545f4f
Instruction Fuzzy Hash: F111607261874186FB20AB1594C03A9F7A1FB88B98F944276EB9C07BDADE3CD5408A11

Function 028E57B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 028E5731
_invalid_parameter_noinfo.LIBCMT ref: 028E573C

Strings

B, xrefs: 028E5761

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: a7d384a4a382772bfc790132e8eab40cdf77b8e882ca1c314d63da2ead943826
Instruction ID: 2e9b518168d44f89babe428ecda1c048037bcbea6b64e4f9a1ebb30387a1d7eb
Opcode Fuzzy Hash: a7d384a4a382772bfc790132e8eab40cdf77b8e882ca1c314d63da2ead943826
Instruction Fuzzy Hash: 6911607E614780C6DF209F16E84025AB7A1F78ABE8F984225AF9E87B55CB3CC551CF00

Function 00007FF7EAF03230 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF7EAF032AF
CreateEventW.KERNEL32 ref: 00007FF7EAF032C0

Strings

4 =X, xrefs: 00007FF7EAF0323D

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: CreateEventStartup
String ID: 4 =X
API String ID: 1546077022-3147943113
Opcode ID: 843f07e2daff2403fab57a8c23db658a33a530a6203255328299021b0e95f094
Instruction ID: 8e7d274e698e84cb1d3a2e9ebd55e3c8bf9912be6531a68d16b4cf42ffe17d2a
Opcode Fuzzy Hash: 843f07e2daff2403fab57a8c23db658a33a530a6203255328299021b0e95f094
Instruction Fuzzy Hash: AE211A32505B8086E7109F28E950399B3E9FB68B58F64423ACA9C4BBB5DF39C057C740

Function 028E6700 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 028E66A9
_invalid_parameter_noinfo.LIBCMT ref: 028E66B4

Strings

B, xrefs: 028E66E0

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: e7192767c34a9623a5d1a89167f59ebb02eb77dc64806a58f83736d32f6d4f2d
Instruction ID: 70be47fa1491b5590bc10b4ae0283de66141da7d765b41f8a186da6ef9182b90
Opcode Fuzzy Hash: e7192767c34a9623a5d1a89167f59ebb02eb77dc64806a58f83736d32f6d4f2d
Instruction Fuzzy Hash: A10104BA620A5082DF10DF16E44035AB765F799FE4F584320AF5D47BA5DF38C144CB00

Function 00007FF7EAF17423 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7EAF11EAC: _getptd.LIBCMT ref: 00007FF7EAF11EB9
Part of subcall function 00007FF7EAF11EAC: _getptd.LIBCMT ref: 00007FF7EAF11ECC

_getptd.LIBCMT ref: 00007FF7EAF17484
_getptd.LIBCMT ref: 00007FF7EAF17497

Strings

csm, xrefs: 00007FF7EAF17443

Memory Dump Source

Source File: 00000000.00000002.3385403146.00007FF7EAF01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7EAF00000, based on PE: true

Associated: 00000000.00000002.3385387283.00007FF7EAF00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385423515.00007FF7EAF18000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385439155.00007FF7EAF1E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3385454304.00007FF7EAF25000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7eaf00000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 4682075a758e49528a487afa047c3333b91a60c7711f6bd7727fe6ef45998704
Instruction ID: 9e9a2f039d30ddcbaec40f032adb1e1fb94ffa722c3d7a33ed84c02bdd1484f4
Opcode Fuzzy Hash: 4682075a758e49528a487afa047c3333b91a60c7711f6bd7727fe6ef45998704
Instruction Fuzzy Hash: 93014022E05246C5FB74BF6698403F8A764EB64B19F8401BADD0D0B647CF38E881CB66

Function 028FD897 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 028E7C2C: _getptd.LIBCMT ref: 028E7C39
Part of subcall function 028E7C2C: _getptd.LIBCMT ref: 028E7C4C

_getptd.LIBCMT ref: 028FD8F8
_getptd.LIBCMT ref: 028FD90B

Strings

csm, xrefs: 028FD8B7

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: ae5fc649bd731ad5fcb06f6cb01dd5fd5110b3d79c0197b37bd5c776304181fd
Instruction ID: ff21e7b40fc7d75b42b32e3aebfcb3432c172cb2a51de55cd449a83600a9db3c
Opcode Fuzzy Hash: ae5fc649bd731ad5fcb06f6cb01dd5fd5110b3d79c0197b37bd5c776304181fd
Instruction Fuzzy Hash: A201786E6107818ACF70AF7588403BC2374E78AF99F880A26CF0E8B604CB30C080DB02

Function 0288C401 Relevance: 5.2, APIs: 4, Instructions: 156COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0288C434

Part of subcall function 02895011: _FF_MSGBANNER.LIBCMT ref: 02895041
Part of subcall function 02895011: _callnewh.LIBCMT ref: 0289507F
Part of subcall function 02895011: _errno.LIBCMT ref: 0289508A
Part of subcall function 02895011: _errno.LIBCMT ref: 02895095

free.LIBCMT ref: 0288C45C
free.LIBCMT ref: 0288C4E7
free.LIBCMT ref: 0288C527

Memory Dump Source

Source File: 00000000.00000002.3384810256.0000000002880000.00000040.00001000.00020000.00000000.sdmp, Offset: 02880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2880000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 41aa70f8018d2aebca106d91cb34d39965c9ad2e17f13fc8d01bbcb11a335b68
Instruction ID: f8fa3f58ac8db099b055cdb06c58f2c190f809ef2c56048cb80b9512d2b97be3
Opcode Fuzzy Hash: 41aa70f8018d2aebca106d91cb34d39965c9ad2e17f13fc8d01bbcb11a335b68
Instruction Fuzzy Hash: C541D07861CB0E4F9B69FF5DD481736B7D1FB89314B04852E998EC3215EB70E8428B92

Function 028E314C Relevance: 5.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 028E3171

Part of subcall function 028E5500: HeapFree.KERNEL32 ref: 028E5516
Part of subcall function 028E5500: _errno.LIBCMT ref: 028E5520
Part of subcall function 028E5500: GetLastError.KERNEL32 ref: 028E5528

free.LIBCMT ref: 028E3184
free.LIBCMT ref: 028E3197
free.LIBCMT ref: 028E31AA

Memory Dump Source

Source File: 00000000.00000002.3384839055.00000000028D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 028D0000, based on PE: true

Associated: 00000000.00000002.3384839055.0000000002919000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28d0000_5935c1f1a7da8e42028da77013b80635afdd605866569.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: e7cc336616b3ae51eb487ff96c7c0b168c67d33a26c84f7fd8b447fa1097f8f7
Instruction ID: 9751a5beecb4892950ebf757214cc111949011d1936a21e745ba6cc68b83e86e
Opcode Fuzzy Hash: e7cc336616b3ae51eb487ff96c7c0b168c67d33a26c84f7fd8b447fa1097f8f7
Instruction Fuzzy Hash: 21F0681E202B4484DF24EF64C0A43391322DB57F7CF9807189E6B8A594CF2CC480C681

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\DisplaySessionContainers.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Windows Analysis Report
5935c1f1a7da8e42028da77013b80635afdd605866569.exe

Function 028D67A0 Relevance: 93.1, APIs: 37, Strings: 16, Instructions: 394
registrystringnetworkCOMMON

Function 028E1790 Relevance: 70.3, APIs: 27, Strings: 13, Instructions: 325
sleepregistrylibraryCOMMON

Function 028E2280 Relevance: 51.0, APIs: 18, Strings: 11, Instructions: 223
stringclipboardsleepCOMMON

Function 00007FF7EAF06860 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 213
registrymemoryCOMMON

Function 00007FF7EAF03390 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 168
networkstringtimeCOMMON

Function 028D8220 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 117
memoryCOMMON

Function 028D3370 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 168
networkstringtimeCOMMON

Function 028F02A4 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 292
timeCOMMONLIBRARYCODE

Function 028D77A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 199
stringregistrycomCOMMON

Function 028D7EA0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 102
memoryCOMMON

Function 00007FF7EAF06F70 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 169
timeCOMMON

Function 028DF2E0 Relevance: 34.7, APIs: 23, Instructions: 201
memorywindowCOMMON

Function 028DCEB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 225
windowCOMMON

Function 028DCA90 Relevance: 27.3, APIs: 18, Instructions: 283
windowCOMMON

Function 028D8D20 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 82
registrylibraryloaderCOMMON