Edit tour

Windows Analysis Report
44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Overview

General Information

Sample name:	44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe
Analysis ID:	1581280
MD5:	fff61bb50d1a423f5f92626a07c18221
SHA1:	3c6807f3da269f5a5dda12d063d02ab01e4aa5f6
SHA256:	44ba92cfe6426e6b641bda018ec4850696b32035a60e8d130086fdcb1604a2fc
Tags:	exeValleyRATuser-abuse_ch
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

AI detected suspicious sample

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Tries to detect sandboxes / dynamic malware analysis system (QueryWinSAT)

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain checking for process token information

Installs a global mouse hook

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe (PID: 3524 cmdline: "C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe" MD5: FFF61BB50D1A423F5F92626A07C18221)

cleanup

Suricata Signatures

ET MALWARE Anonymous RAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:11:55.591836+0100	2052875	1	A Network Trojan was detected	192.168.2.5	49704	156.224.26.128	6666	TCP
2024-12-27T10:13:06.388072+0100	2052875	1	A Network Trojan was detected	192.168.2.5	49705	156.224.26.128	6666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	ReversingLabs: Detection: 68%
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Virustotal: Detection: 69%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Unpacked PE file: 0.2.44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe.2860000.2.unpack

Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	File opened: [:	Jump to behavior

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_02869BC0 GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,lstrcpyW,lstrcpyW,lstrcatW,

0_2_02869BC0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.5:49704 -> 156.224.26.128:6666
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.5:49705 -> 156.224.26.128:6666

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 156.224.26.128:6666

Source: Joe Sandbox View

ASN Name: VPSQUANUS VPSQUANUS

Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128
Source: unknown	TCP traffic detected without corresponding DNS query: 156.224.26.128

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_02863670 select,recv,_errno,_errno,_errno,

0_2_02863670

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: [esc]

0_2_02872280

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_02872280 Sleep,SleepEx,GetTickCount,OpenClipboard,GetClipboardData,GlobalSize,GlobalLock,wsprintfW,GlobalUnlock,CloseClipboard,GetKeyState,lstrlenW,lstrlenW,lstrlenW,wsprintfW,wsprintfW,wsprintfW,lstrlenW,

0_2_02872280

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

0_2_02872280

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_0286EE40 GetDesktopWindow,GetDC,CreateCompatibleDC,GetDC,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateCompatibleBitmap,SelectObject,SetStretchBltMode,GetSystemMetrics,GetSystemMetrics,StretchBlt,GetDIBits,DeleteObject,DeleteObject,ReleaseDC,DeleteObject,DeleteObject,ReleaseDC,

0_2_0286EE40

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_02871E70 SHGetFolderPathW,lstrcatW,CreateMutexW,CreateMutexExW,WaitForSingleObject,CreateFileW,GetFileSize,CloseHandle,DeleteFileW,ReleaseMutex,DirectInput8Create,GetTickCount,GetKeyState,

0_2_02871E70

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Jump to behavior

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0286E2F7 ExitProcess,ExitWindowsEx,	0_2_0286E2F7
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0286E327 ExitWindowsEx,	0_2_0286E327
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0286E348 ExitWindowsEx,	0_2_0286E348

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_028802A4	0_2_028802A4
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02863370	0_2_02863370
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_028686F0	0_2_028686F0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02871E70	0_2_02871E70
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02871790	0_2_02871790
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_028677A0	0_2_028677A0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_028667A0	0_2_028667A0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0286B2B0	0_2_0286B2B0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0287CAF0	0_2_0287CAF0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02876210	0_2_02876210
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0288CA74	0_2_0288CA74
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02863BB0	0_2_02863BB0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0287B340	0_2_0287B340
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_028698B0	0_2_028698B0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_028838D0	0_2_028838D0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02862850	0_2_02862850
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_028811B0	0_2_028811B0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0286F9F0	0_2_0286F9F0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0287B104	0_2_0287B104
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02865930	0_2_02865930
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0287C15C	0_2_0287C15C
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02869170	0_2_02869170
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0287D638	0_2_0287D638
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0286EE40	0_2_0286EE40
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0286F780	0_2_0286F780
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02882F80	0_2_02882F80
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0288CFB0	0_2_0288CFB0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0288BFC0	0_2_0288BFC0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0287F7F8	0_2_0287F7F8
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02869710	0_2_02869710
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02889F10	0_2_02889F10
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02880724	0_2_02880724
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0288B75C	0_2_0288B75C
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0287ACE0	0_2_0287ACE0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0286C400	0_2_0286C400
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02880D10	0_2_02880D10
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF6609073D0	0_2_00007FF6609073D0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF660903390	0_2_00007FF660903390
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF660906F70	0_2_00007FF660906F70
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF660906860	0_2_00007FF660906860
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF66090E1C0	0_2_00007FF66090E1C0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF66090A30C	0_2_00007FF66090A30C
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF66090C28C	0_2_00007FF66090C28C
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF6609124BC	0_2_00007FF6609124BC
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF660916C50	0_2_00007FF660916C50
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF660906C80	0_2_00007FF660906C80
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF66090AD44	0_2_00007FF66090AD44
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF6609158CC	0_2_00007FF6609158CC
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF660916130	0_2_00007FF660916130
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF660914898	0_2_00007FF660914898
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF660902880	0_2_00007FF660902880
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0281F251	0_2_0281F251
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02832A51	0_2_02832A51
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02821261	0_2_02821261
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02817271	0_2_02817271
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02816271	0_2_02816271
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02819381	0_2_02819381
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02812321	0_2_02812321
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_028301F5	0_2_028301F5
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0281E911	0_2_0281E911
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02821941	0_2_02821941
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02813681	0_2_02813681
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0281BED1	0_2_0281BED1
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02812E41	0_2_02812E41
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0282A7B1	0_2_0282A7B1
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_028307E1	0_2_028307E1
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02825CE1	0_2_02825CE1
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02815401	0_2_02815401
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0282BC2D	0_2_0282BC2D
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02818C41	0_2_02818C41
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0282FD75	0_2_0282FD75

Source: classification engine

Classification label: mal84.spyw.evad.winEXE@1/1@0/1

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0286AB60 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,	0_2_0286AB60
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_028690B0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,	0_2_028690B0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02868F30 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,OpenProcess,	0_2_02868F30
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02869590 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	0_2_02869590

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_02868430 GetDriveTypeW,GetDiskFreeSpaceExW,GlobalMemoryStatusEx,

0_2_02868430

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_02867150 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

0_2_02867150

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_028677A0 lstrcatW,lstrcatW,CoCreateInstance,wsprintfW,RegOpenKeyExW,RegQueryValueExW,lstrcatW,lstrcatW,RegCloseKey,lstrlenW,lstrcatW,

0_2_028677A0

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Mutant created: \Sessions\1\BaseNamedObjects\2024.12.22

Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	ReversingLabs: Detection: 68%
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Virustotal: Detection: 69%

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

File read: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Jump to behavior

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: hid.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25E609E4-B259-11CF-BFC7-444553540000}\InProcServer32

Jump to behavior

Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Unpacked PE file: 0.2.44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe.2860000.2.unpack

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_02871790 GetVersionExW,LoadLibraryA,GetProcAddress,SetProcessMitigationPolicy,Sleep,SleepEx,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,EnumWindows,Sleep,EnumWindows,Sleep,CreateEventA,RegOpenKeyExW,Sleep,SleepEx,RegOpenKeyExW,RegQueryValueExW,Sleep,SleepEx,WaitForSingleObject,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,

0_2_02871790

Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Static PE information: real checksum: 0x2bb4f should be: 0x20d5c

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0288F94B push rbp; retf		0_2_0288F974
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02830755 pushfd ; ret		0_2_0283075A

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_0286E29A OpenEventLogW,ClearEventLogW,CloseEventLog,

0_2_0286E29A

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Key value created or modified: HKEY_CURRENT_USER\Console\1 d33f351a4aeea5e608853d1a56661059

Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (QueryWinSAT)

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{05DF8D13-C355-47F4-A11E-851B338CEFB8}

Jump to behavior

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Window / User API: threadDelayed 1501	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Window / User API: threadDelayed 752	Jump to behavior
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Window / User API: foregroundWindowGot 1704	Jump to behavior

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-37313

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-37955

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_02869BC0 GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,lstrcpyW,lstrcpyW,lstrcatW,

0_2_02869BC0

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_028667A0 gethostname,gethostbyname,inet_ntoa,inet_ntoa,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,GetLocalTime,wsprintfW,lstrlenW,RegSetValueExW,RegCloseKey,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,GetTickCount,_localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,

0_2_028667A0

Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe, 00000000.00000002.3242559682.0000000000C5B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllCC

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	API call chain: ExitProcess graph end node			graph_0-36939
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	API call chain: ExitProcess graph end node			graph_0-36936

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_02874F50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_02874F50

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

0_2_02871790

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_02867EA0 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,LookupAccountSidW,GetLastError,GetProcessHeap,HeapFree,

0_2_02867EA0

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02871790 GetVersionExW,LoadLibraryA,GetProcAddress,SetProcessMitigationPolicy,Sleep,SleepEx,CloseHandle,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,EnumWindows,Sleep,EnumWindows,Sleep,CreateEventA,RegOpenKeyExW,Sleep,SleepEx,RegOpenKeyExW,RegQueryValueExW,Sleep,SleepEx,WaitForSingleObject,CloseHandle,Sleep,WaitForSingleObject,CloseHandle,Sleep,CloseHandle,	0_2_02871790
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02874F50 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_02874F50
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0287C444 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0287C444
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF660908580 SetUnhandledExceptionFilter,GetConsoleWindow,ShowWindow,GetCurrentThreadId,PostThreadMessageA,GetInputState,CreateThread,WaitForSingleObject,CloseHandle,Sleep,	0_2_00007FF660908580
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF660908AD0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF660908AD0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF66090A5F4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF66090A5F4
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_00007FF66090CF6C SetUnhandledExceptionFilter,	0_2_00007FF66090CF6C

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_028698B0 GetSystemDirectoryA,CreateProcessA,VirtualAllocEx,WriteProcessMemory,GetThreadContext,SetThreadContext,ResumeThread,

0_2_028698B0

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_02869170 GetSystemDirectoryA,CreateProcessA,OpenProcess,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,GetModuleFileNameA,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,ResumeThread,		0_2_02869170
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: 0_2_0286A670 VirtualAllocEx,TerminateProcess,OpenProcess,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,VirtualFreeEx,		0_2_0286A670

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: GetSystemDirectoryA,CreateProcessA,OpenProcess,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,GetModuleFileNameA,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\System32\svchost.exe

0_2_02869170

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_0286FD50 lstrlenW,ShellExecuteW,

0_2_0286FD50

Source: DisplaySessionContainers.log.0.dr	Binary or memory string: :]Program Manager
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe, 00000000.00000003.2116639169.000000000450E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 54HDD:1WW 223 Gb Free 168 Gb Mem: 8 Gb Free3 Gb Microsoft Basic Render Driver 0 5140 Microsoft Basic Render Driver 0 5140 Program Manager
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe, 00000000.00000002.3243323978.0000000002FC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe, 00000000.00000003.2116547537.0000000004481000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .2.5 0 min562258Windows 10 Pro10.0.190454HDD:1WW 223 Gb Free 168 Gb Mem: 8 Gb Free3 Gb Microsoft Basic Render Driver 0 5140 Microsoft Basic Render Driver 0 5140 Program Manager

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: gethostname,gethostbyname,inet_ntoa,inet_ntoa,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,GetSystemInfo,wsprintfW,GetForegroundWindow,GetWindowTextW,lstrlenW,lstrlenW,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,GetLocalTime,wsprintfW,lstrlenW,RegSetValueExW,RegCloseKey,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,GetTickCount,_localtime64,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,	0_2_028667A0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoW,	0_2_0288629C
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: EnumSystemLocalesA,	0_2_028863CC
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: GetLastError,free,free,GetLocaleInfoW,GetLocaleInfoW,free,GetLocaleInfoW,	0_2_0287E8A0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: _getptd,GetLocaleInfoA,	0_2_02885E54
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: GetLocaleInfoW,malloc,GetLocaleInfoW,WideCharToMultiByte,free,	0_2_02887664
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: _getptd,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoW,	0_2_02885FCC
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: GetLocaleInfoW,	0_2_02885F3C
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: _getptd,EnumSystemLocalesA,GetUserDefaultLCID,GetLocaleInfoW,GetLocaleInfoW,GetACP,IsValidCodePage,IsValidLocale,GetLocaleInfoA,GetLocaleInfoA,_itow_s,	0_2_028864D0
Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Code function: EnumSystemLocalesA,	0_2_02886464

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_02872140 GetForegroundWindow,GetWindowTextW,lstrlenW,GetLocalTime,wsprintfW,

0_2_02872140

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_028802A4 _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,free,free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_028802A4

Source: C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Code function: 0_2_02868220 GetCurrentProcessId,wsprintfW,GetVersionExW,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,wsprintfW,

0_2_02868220

Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: acs.exe
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: vsserv.exe
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: avcenter.exe
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: kxetray.exe
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: avp.exe
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: cfp.exe
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: KSafeTray.exe
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: 360Safe.exe
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: rtvscan.exe
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: 360tray.exe
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: TMBMSRV.exe
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: ashDisp.exe
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: 360Tray.exe
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: avgwdsvc.exe
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: AYAgent.aye
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: QUHLPSVC.EXE
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: RavMonD.exe
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: Mcshield.exe
Source: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	Binary or memory string: K7TSecurity.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Modify Registry	121 Input Capture	2 System Time Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Access Token Manipulation	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	121 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	211 Process Injection	211 Process Injection	Security Account Manager	3 Process Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Indicator Removal	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	16 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	68%	ReversingLabs	Win64.Backdoor.Farfli
44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe	69%	Virustotal		Browse

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
156.224.26.128	unknown	Seychelles		62468	VPSQUANUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581280
Start date and time:	2024-12-27 10:11:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe
Detection:	MAL
Classification:	mal84.spyw.evad.winEXE@1/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 67 Number of non-executed functions: 291
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:12:50	API Interceptor	4113x Sleep call for process: 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VPSQUANUS	CnjMEmbChO.exe	Get hash	malicious	Unknown	Browse	198.44.170.193
	Fqae7BLq4m.exe	Get hash	malicious	Unknown	Browse	43.250.172.42
	236236236.elf	Get hash	malicious	Unknown	Browse	154.91.51.168
	x.bat	Get hash	malicious	Unknown	Browse	103.230.121.81
	product.bat	Get hash	malicious	Unknown	Browse	103.230.121.81
	test.exe	Get hash	malicious	Unknown	Browse	103.230.121.81
	Filezilla-stage2.exe	Get hash	malicious	Unknown	Browse	103.230.121.81
	rebirth.dbg.elf	Get hash	malicious	Mirai, Okiru	Browse	103.252.20.25
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	103.122.177.128
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	154.91.52.33

Process:	C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe
File Type:	data
Category:	dropped
Size (bytes):	28020
Entropy (8bit):	3.613497441764929
Encrypted:	false
SSDEEP:	192:+44444yAAAAAAFFFFFFFKKKKKKKnnnnnnnccccccccBBBBBBBGGGGGGGGzzzzzzs:+
MD5:	43AB57F3669000808EDD9711949B5532
SHA1:	95C587FD483E1219B28F7CDB4B91827419112695
SHA-256:	ED8FC85FE8AB9FAEE66082164559FE4033D627825A4ECBB93984D51BE046D431
SHA-512:	191E5CBB94CDF4B3D05DE676808A34302E576B9BF95047CABADE73AE46A1AB7EA92377C9F762E093CF1E39F2540E7CC24C1FC167E4610EF79A82CCD3C8F88F50
Malicious:	false
Reputation:	low
Preview:	....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.4.-.1.2.-.2.7. . .4.:.1.1.:.5.9.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.4.-.1.2.-.2.7. . .4.:.1.1.:.5.9.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.4.-.1.2.-.2.7. . .4.:.1.1.:.5.9.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.4.-.1.2.-.2.7. . .4.:.1.2.:.0.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.4.-.1.2.-.2.7. . .4.:.1.2.:.0.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.4.-.1.2.-.2.7. . .4.:.1.2.:.0.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.4.-.1.2.-.2.7. . .4.:.1.2.:.0.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.4.-.1.2.-.2.7. . .4.:.1.2.:.0.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.4.-.1.2.-.2.7. . .4.:.1.2.:.0.....[..Q.[:.].....[..h..:.].P.r.o.g.

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.106287978128525
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe
File size:	133'632 bytes
MD5:	fff61bb50d1a423f5f92626a07c18221
SHA1:	3c6807f3da269f5a5dda12d063d02ab01e4aa5f6
SHA256:	44ba92cfe6426e6b641bda018ec4850696b32035a60e8d130086fdcb1604a2fc
SHA512:	f5cd46d6d53adc94896befb11647f27c794769a4391bbbfc78585b43e4c28cd8d80078554b4280a69f83d3744f9bcc059a56adfb241ccc8ebfc168f9ba9ae4d5
SSDEEP:	3072:lO55k/y5dAj+BMTYlgEQnB+Y+pek7+3OrFZeUqe6o/:lO5n5d56TYZQnB+Dpekyyqm
TLSH:	BAD36D4733A450F9D4A7C279C9A24A06E7B374660735A7CF17A086AA2F137D1BD3A331
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........VF.g.F.g.F.g.)...+.g.)...M.g.)...k.g.O...M.g.F.f...g.)...K.g.)...G.g.RichF.g.........................PE..d.....ld.........."

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140009a74
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x646C86AC [Tue May 23 09:26:04 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	fb51ede541a9ad63bf23d302e319d2a0

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007FC444DF9F88h
dec eax
add esp, 28h
jmp 00007FC444DF616Bh
int3
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], edi
push ebp
dec eax
mov ebp, esp
dec eax
sub esp, 60h
dec eax
mov edi, edx
dec eax
mov ebx, ecx
dec eax
lea ecx, dword ptr [ebp-40h]
dec eax
lea edx, dword ptr [0000EAE5h]
inc ecx
mov eax, 00000040h
call 00007FC444DF533Fh
dec eax
lea edx, dword ptr [ebp+10h]
dec eax
mov ecx, edi
dec eax
mov dword ptr [ebp-18h], ebx
dec eax
mov dword ptr [ebp-10h], edi
call 00007FC444DFDFF5h
dec esp
mov ebx, eax
dec eax
mov dword ptr [ebp+10h], eax
dec eax
mov dword ptr [ebp-08h], eax
dec eax
test edi, edi
je 00007FC444DF630Dh
test byte ptr [edi], 00000008h
mov ecx, 01994000h
je 00007FC444DF62F7h
mov dword ptr [ebp-20h], ecx
jmp 00007FC444DF62FEh
mov eax, dword ptr [ebp-20h]
dec ebp
test ebx, ebx
cmove eax, ecx
mov dword ptr [ebp-20h], eax
inc esp
mov eax, dword ptr [ebp-28h]
mov edx, dword ptr [ebp-3Ch]
mov ecx, dword ptr [ebp-40h]
dec esp
lea ecx, dword ptr [ebp-20h]
call dword ptr [0000E7AFh]
dec esp
lea ebx, dword ptr [esp+60h]
dec ecx
mov ebx, dword ptr [ebx+18h]
dec ecx
mov edi, dword ptr [ebx+20h]
dec ecx
mov esp, ebx
pop ebp
ret
int3
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 00000088h
dec eax
lea ecx, dword ptr [00016781h]
call dword ptr [0000E7B3h]
dec eax
mov eax, dword ptr [0001686Ch]

Rich Headers

Programming Language:

[ C ] VS2010 build 30319
[ASM] VS2010 build 30319
[C++] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1d028	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x27000	0x1b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x25000	0x1578	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x28000	0x2f8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x18000	0x438	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x16606	0x16800	9cde0d8ddbf108908aa730f375bc1766	False	0.5621636284722222	zlib compressed data	6.429037086317127	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x18000	0x5d3a	0x5e00	b44503f0aa67867070e1b6433af825a5	False	0.3683926196808511	data	4.8111582224132965	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1e000	0x6770	0x2200	c8548a34de37ef2b1c82d7743b8b22d2	False	0.22012867647058823	data	2.7002917262797337	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x25000	0x1578	0x1600	6b2fcd8de66b48f900df2c9c6b6db832	False	0.4728338068181818	data	5.019696142888745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x27000	0x1b4	0x200	5f882a758b6b0045acd02c3e0551be90	False	0.486328125	data	5.112623549532036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x28000	0x5be	0x600	3b9d434e2274fd734402fea8d43c6f67	False	0.3587239583333333	data	3.4572271853315204	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x27058	0x15a	ASCII text, with CRLF line terminators	English	United States	0.5491329479768786

Imports

DLL	Import
KERNEL32.dll	HeapCreate, EnterCriticalSection, DeleteCriticalSection, WaitForSingleObject, SetEvent, Sleep, CreateEventA, GetLastError, CloseHandle, GetCurrentThreadId, SwitchToThread, SetLastError, WideCharToMultiByte, lstrlenW, ResetEvent, CreateEventW, CancelIo, TryEnterCriticalSection, SetWaitableTimer, CreateWaitableTimerW, GetThreadContext, SetThreadContext, LeaveCriticalSection, GetExitCodeProcess, CreateProcessA, GetSystemDirectoryA, VirtualAllocEx, WriteProcessMemory, ResumeThread, FreeLibrary, SetUnhandledExceptionFilter, GetCurrentProcess, LoadLibraryW, GetConsoleWindow, CreateFileW, GetProcAddress, GetLocalTime, IsDebuggerPresent, GetCurrentProcessId, CreateThread, LCMapStringW, WriteConsoleW, SetStdHandle, GetStringTypeW, MultiByteToWideChar, HeapDestroy, InitializeCriticalSectionAndSpinCount, HeapFree, HeapAlloc, VirtualAlloc, OpenProcess, VirtualFree, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, GetConsoleMode, FlushFileBuffers, GetConsoleCP, SetFilePointer, GetSystemTimeAsFileTime, GetTickCount, QueryPerformanceCounter, GetStartupInfoW, GetFileType, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, RtlUnwindEx, FlsAlloc, FlsFree, FlsSetValue, FlsGetValue, HeapReAlloc, HeapSize, GetProcessHeap, ExitThread, DecodePointer, EncodePointer, GetCommandLineW, RaiseException, RtlPcToFileHeader, TerminateProcess, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, HeapSetInformation, GetVersion, GetModuleHandleW, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameW
USER32.dll	DispatchMessageW, PostThreadMessageA, PeekMessageW, TranslateMessage, MsgWaitForMultipleObjects, ShowWindow, GetInputState, wsprintfW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteValueW, RegQueryValueExW, RegCreateKeyW, RegSetValueExW
WS2_32.dll	WSAWaitForMultipleEvents, WSAIoctl, connect, WSAStartup, select, WSAResetEvent, setsockopt, recv, socket, closesocket, gethostbyname, send, WSASetLastError, WSACreateEvent, shutdown, WSAEventSelect, WSAEnumNetworkEvents, WSAGetLastError, WSACloseEvent, htons, WSACleanup
WINMM.dll	timeGetTime

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-27T10:11:55.591836+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.5	49704	156.224.26.128	6666	TCP
2024-12-27T10:13:06.388072+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.5	49705	156.224.26.128	6666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 27, 2024 10:11:55.470416069 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:55.589934111 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:55.590019941 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:55.591835976 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:55.711270094 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.088419914 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.088850021 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:57.208399057 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.208427906 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.208470106 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.612065077 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.612112999 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.612128973 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.612158060 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:57.612196922 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.612236977 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:57.612617970 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.612658024 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.612700939 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:57.820180893 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.820233107 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.820244074 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.820255041 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.820291042 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:57.820343971 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:57.828438997 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.828552008 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.828599930 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:57.836436987 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.836551905 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.836612940 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:57.844734907 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:57.888298035 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.028481960 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.028542995 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.028598070 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.032649040 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.032671928 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.032711983 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.040992975 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.041102886 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.041148901 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.049407959 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.049583912 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.049623013 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.057753086 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.057832956 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.057873011 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.066174984 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.066200018 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.066240072 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.074469090 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.074584961 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.074635029 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.082865000 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.082977057 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.083028078 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.238296986 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.238471031 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.238513947 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.242142916 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.242296934 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.242340088 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.249825001 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.249963999 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.250010014 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.255865097 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.255984068 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.256026030 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.263495922 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.263637066 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.263684988 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.271069050 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.271177053 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.271219969 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.278717041 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.278822899 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.278899908 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.288304090 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.288314104 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.288394928 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.294029951 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.294253111 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.294320107 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.301635027 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.301747084 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.301796913 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.309241056 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.309345961 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.309422970 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.318244934 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.318422079 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.318480968 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.324862957 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.372684956 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.428527117 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.444896936 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.444984913 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.444984913 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.447773933 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.447830915 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.447855949 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.452347040 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.452411890 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.452474117 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.458245993 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.458321095 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.458363056 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.464143038 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.464230061 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.464243889 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.470052958 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.470124006 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.470160007 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.476069927 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.476135015 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.476162910 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.481748104 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.481803894 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.481977940 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.487643003 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.487740993 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.487750053 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.493505955 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.493602037 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.493614912 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.499407053 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.499456882 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.499461889 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.505266905 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.505326986 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.505368948 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.511161089 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.511224031 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.511322021 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.517009020 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.517066002 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.517199993 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.522905111 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.523047924 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.523087025 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.528747082 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.528812885 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.528893948 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.534676075 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.534765005 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.534784079 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.540514946 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.540580034 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.540649891 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.546451092 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.546510935 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.546555042 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.552289963 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.552395105 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.552398920 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.558119059 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.558198929 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.653199911 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.653310061 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.653476954 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.655432940 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.655554056 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.655616999 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.659905910 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.659961939 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.660039902 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.664351940 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.664556980 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.664761066 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.668672085 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.668802977 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.668850899 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.672993898 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.673094988 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.673160076 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.677189112 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.677306890 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.677378893 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.681294918 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.681428909 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.681498051 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.685256004 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.685400009 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.685446024 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.689276934 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.689452887 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.689564943 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.693195105 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.693278074 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.693346977 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.697074890 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.697170973 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.697247982 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.700946093 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.701062918 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.701129913 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.704895020 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.705041885 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.705156088 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.708724976 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.708765030 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.708816051 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.712615013 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.712726116 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.712785959 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.716550112 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.716666937 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.716733932 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.720442057 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.720545053 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.720611095 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.724322081 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.724375010 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.724457026 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.728209972 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.728319883 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.728383064 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.732136011 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.732278109 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.732347965 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.736037970 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.736133099 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.736269951 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.739978075 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.740106106 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.740171909 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.743830919 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.743913889 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.743971109 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.747690916 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.747797012 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.747868061 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.751609087 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.751775026 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.751818895 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.755474091 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.755583048 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.755697966 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.759315968 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.810165882 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.861407995 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.861500025 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.861628056 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.862711906 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.862847090 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.862927914 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.865470886 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.865587950 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.865720034 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.868237972 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.868350029 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.868432999 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.871035099 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.871112108 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.871196985 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.873709917 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.873841047 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.873903990 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.876360893 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.876478910 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.876548052 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.879019976 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.879132986 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.879281998 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.881629944 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.881747961 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.881789923 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.884179115 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.884291887 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.884346008 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.886746883 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.886856079 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.886902094 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.889301062 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.889408112 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.889467955 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.891870975 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.892062902 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.892110109 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.894469976 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.894547939 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.894591093 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.897008896 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.897111893 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.897169113 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.899525881 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.899645090 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.899693966 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.902254105 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.902358055 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.902416945 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.904694080 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.904865026 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.904925108 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.907269001 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.907325983 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.907412052 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.909847021 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.910016060 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.910096884 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.912369967 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.912492037 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.912539005 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.914927006 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.915113926 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.915154934 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.917464018 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.917547941 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.917597055 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.920028925 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.920147896 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.920233011 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.922595978 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.922661066 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.922739029 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.925254107 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.925398111 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.925893068 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.927704096 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.927849054 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.927938938 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.930275917 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.930394888 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.930438995 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.932815075 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.932925940 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.932992935 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.935389042 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.935486078 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.935560942 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.937982082 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.938087940 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.939394951 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.940499067 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.940628052 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.943089008 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.943160057 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.943166018 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.943258047 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.945688963 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.945820093 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.945884943 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.948204994 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.948326111 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.948381901 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.950748920 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.950855970 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.950943947 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.953310013 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.953423023 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.953479052 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.955872059 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.956028938 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.956113100 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.958431959 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.958550930 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.959389925 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.961004972 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.961112976 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.963433027 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.963546991 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.963691950 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:58.963758945 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:58.966105938 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:59.028898954 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:59.069417953 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:59.069551945 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:59.069612980 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:59.070370913 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:59.070508003 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:59.070573092 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:11:59.072274923 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:59.072336912 CET	6666	49704	156.224.26.128	192.168.2.5
Dec 27, 2024 10:11:59.072453022 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:12:00.107960939 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:12:00.227399111 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:12:00.227490902 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:12:02.091470003 CET	49704	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:12:05.206557989 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:12:05.326219082 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:12:05.326232910 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:12:05.326288939 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:12:05.326323986 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:12:05.326333046 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:12:05.736526012 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:12:05.737570047 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:12:05.857146978 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:12:16.466522932 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:12:16.586009026 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:12:16.988492012 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:12:17.028795004 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:12:17.099509954 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:12:17.218978882 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:12:34.013309956 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:12:34.133210897 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:12:34.535883904 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:12:34.591209888 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:12:34.642389059 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:12:34.762130976 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:12:50.419555902 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:12:50.731777906 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:12:50.803126097 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:12:50.851356030 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:12:51.206087112 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:12:51.247399092 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:12:51.292450905 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:12:51.412086010 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:13:06.388072014 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:13:06.507668018 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:13:06.918102026 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:13:06.966056108 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:13:07.033906937 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:13:07.153587103 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:13:23.116394043 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:13:23.236033916 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:13:23.638612986 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:13:23.684747934 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:13:23.739614964 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:13:23.859256029 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:13:39.684936047 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:13:39.804477930 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:13:40.207101107 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:13:40.247167110 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:13:40.278968096 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:13:40.398677111 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:13:55.965930939 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:13:56.086666107 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:13:56.489274979 CET	6666	49705	156.224.26.128	192.168.2.5
Dec 27, 2024 10:13:56.543952942 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:13:56.695586920 CET	49705	6666	192.168.2.5	156.224.26.128
Dec 27, 2024 10:13:56.815198898 CET	6666	49705	156.224.26.128	192.168.2.5

Target ID:	0
Start time:	04:11:52
Start date:	27/12/2024
Path:	C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe"
Imagebase:	0x7ff660900000
File size:	133'632 bytes
MD5 hash:	FFF61BB50D1A423F5F92626A07C18221
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	68.8%
Signature Coverage:	32.4%
Total number of Nodes:	1335
Total number of Limit Nodes:	55

Executed Functions

Function 00007FF6609073D0 Relevance: 98.9, APIs: 31, Strings: 25, Instructions: 870stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6609072A0: lstrlenW.KERNEL32 ref: 00007FF6609072CF
Part of subcall function 00007FF6609072A0: lstrlenW.KERNEL32 ref: 00007FF6609072F0
Part of subcall function 00007FF6609072A0: lstrlenW.KERNEL32 ref: 00007FF6609072FC

lstrlenW.KERNEL32 ref: 00007FF660907459
lstrlenW.KERNEL32 ref: 00007FF66090746C
lstrlenW.KERNEL32 ref: 00007FF660907548
lstrlenW.KERNEL32 ref: 00007FF66090755B
lstrlenW.KERNEL32 ref: 00007FF660907628
lstrlenW.KERNEL32 ref: 00007FF66090763B
lstrlenW.KERNEL32 ref: 00007FF66090774E
lstrlenW.KERNEL32 ref: 00007FF660907761
lstrlenW.KERNEL32 ref: 00007FF660907810
lstrlenW.KERNEL32 ref: 00007FF660907823
lstrlenW.KERNEL32 ref: 00007FF6609078D0
lstrlenW.KERNEL32 ref: 00007FF6609078E3
lstrlenW.KERNEL32 ref: 00007FF660907990
lstrlenW.KERNEL32 ref: 00007FF6609079A3
lstrlenW.KERNEL32 ref: 00007FF660907A50
lstrlenW.KERNEL32 ref: 00007FF660907A63
lstrlenW.KERNEL32 ref: 00007FF660907B10
lstrlenW.KERNEL32 ref: 00007FF660907B23
lstrlenW.KERNEL32 ref: 00007FF660907BD0
lstrlenW.KERNEL32 ref: 00007FF660907BE3
lstrlenW.KERNEL32 ref: 00007FF660907C90
lstrlenW.KERNEL32 ref: 00007FF660907CA3
RegOpenKeyExW.KERNEL32 ref: 00007FF660907D81
RegQueryValueExW.KERNEL32 ref: 00007FF660907DB5
RegQueryValueExW.ADVAPI32 ref: 00007FF660907DFC
lstrlenW.KERNEL32 ref: 00007FF660907E31
lstrlenW.KERNEL32 ref: 00007FF660907E3D
lstrlenW.KERNEL32 ref: 00007FF660907EF7
lstrlenW.KERNEL32 ref: 00007FF660907F0A
lstrlenW.KERNEL32 ref: 00007FF660907FFC
lstrlenW.KERNEL32 ref: 00007FF660908008

Strings

bh:, xrefs: 00007FF6609078D6
bd:, xrefs: 00007FF660907C96
bb:, xrefs: 00007FF660907726
Console, xrefs: 00007FF660907D55
cl:, xrefs: 00007FF6609076FA
t3:, xrefs: 00007FF66090762E
kl:, xrefs: 00007FF660907BD6
o3:, xrefs: 00007FF660907616, 00007FF660907FEA
t2:, xrefs: 00007FF66090754E, 00007FF660907EFD
dd:, xrefs: 00007FF6609076E4
dl:, xrefs: 00007FF660907A56
sx:, xrefs: 00007FF660907816
o2:, xrefs: 00007FF660907536, 00007FF660907EE5
jp:, xrefs: 00007FF660907754
IpDate, xrefs: 00007FF660907DA2, 00007FF660907DED
p2:, xrefs: 00007FF660907520, 00007FF660907ECF
p3:, xrefs: 00007FF660907600, 00007FF660907FD4
ll:, xrefs: 00007FF660907996
t1:, xrefs: 00007FF66090745F
|p1:156.224.26.128|o1:6666|t1:1|p2:156.224.26.128|o2:8888|t2:1|p3:127.0.0.1|o3:80|t3:1|dd:1|cl:1|fz:, xrefs: 00007FF6609073FC
sh:, xrefs: 00007FF660907B16
fz:, xrefs: 00007FF660907710
p1:, xrefs: 00007FF660907431, 00007FF660907E09
o1:, xrefs: 00007FF660907447, 00007FF660907E1F
bz:, xrefs: 00007FF66090773C

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: lstrlen$QueryValue$Open
String ID: Console$IpDate$bb:$bd:$bh:$bz:$cl:$dd:$dl:$fz:$jp:$kl:$ll:$o1:$o2:$o3:$p1:$p2:$p3:$sh:$sx:$t1:$t2:$t3:$|p1:156.224.26.128|o1:6666|t1:1|p2:156.224.26.128|o2:8888|t2:1|p3:127.0.0.1|o3:80|t3:1|dd:1|cl:1|fz:
API String ID: 1772312705-3286395973
Opcode ID: e7c24950faba3f9ac85f5f069f5f95afb0107786a1c82c81ace9b637109b25c1
Instruction ID: 4611781327194c36e819747db63e7db66c9d3620679cb2f9ee178d696aaea46f
Opcode Fuzzy Hash: e7c24950faba3f9ac85f5f069f5f95afb0107786a1c82c81ace9b637109b25c1
Instruction Fuzzy Hash: AD72F261F1D51AF6EA158B1494446B9B373FF48754F80A239C90F8E793EE7CA989C380

Function 028667A0 Relevance: 93.1, APIs: 37, Strings: 16, Instructions: 394
registrystringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 028755F8: malloc.LIBCMT ref: 02875612

gethostname.WS2_32 ref: 02866851
gethostbyname.WS2_32 ref: 0286685E
inet_ntoa.WS2_32 ref: 0286687C

Part of subcall function 02876574: _errno.LIBCMT ref: 02876592
Part of subcall function 02876574: _invalid_parameter_noinfo.LIBCMT ref: 0287659E

Part of subcall function 02876574: _errno.LIBCMT ref: 028765E0

inet_ntoa.WS2_32 ref: 028668CD
MultiByteToWideChar.KERNEL32 ref: 0286692A
MultiByteToWideChar.KERNEL32 ref: 0286694C
GetLastInputInfo.USER32 ref: 0286695F
GetTickCount.KERNEL32 ref: 02866965
wsprintfW.USER32 ref: 02866999
MultiByteToWideChar.KERNEL32 ref: 028669B8
MultiByteToWideChar.KERNEL32 ref: 028669DD
GetSystemInfo.KERNEL32 ref: 02866A15
wsprintfW.USER32 ref: 02866A2D
GetForegroundWindow.USER32 ref: 02866A52
GetWindowTextW.USER32 ref: 02866A6D
lstrlenW.KERNEL32 ref: 02866A7A
lstrlenW.KERNEL32 ref: 02866AE9
RegOpenKeyExW.ADVAPI32 ref: 02866B51
RegQueryValueExW.ADVAPI32 ref: 02866B8F
RegCloseKey.ADVAPI32 ref: 02866BB4
GetLocalTime.KERNEL32 ref: 02866BCC
wsprintfW.USER32 ref: 02866C0E
lstrlenW.KERNEL32 ref: 02866C1B
RegSetValueExW.ADVAPI32 ref: 02866C48
RegCloseKey.ADVAPI32 ref: 02866C6D
GetModuleHandleW.KERNEL32 ref: 02866C94
GetProcAddress.KERNEL32 ref: 02866CA4
GetNativeSystemInfo.KERNEL32 ref: 02866CB3
GetSystemInfo.KERNEL32 ref: 02866CB7
wsprintfW.USER32 ref: 02866D00
GetCurrentProcessId.KERNEL32 ref: 02866D0E
GetTickCount.KERNEL32 ref: 02866D89
_localtime64.LIBCMT ref: 02866DB9
wsprintfW.USER32 ref: 02866E05
GetLocaleInfoW.KERNEL32 ref: 02866E20
GetSystemDirectoryW.KERNEL32 ref: 02866E32
GetCurrentHwProfileW.ADVAPI32 ref: 02866E3C

Strings

INSTALLTIME, xrefs: 02866B69, 02866C26
d, xrefs: 02866B82
%d min, xrefs: 02866992
GetNativeSystemInfo, xrefs: 02866C9A
X64, xrefs: 02866E77
2024.12.22, xrefs: 02866B0A
X64 %s, xrefs: 02866CF9
x86, xrefs: 02866CE7
kernel32.dll, xrefs: 02866C75
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 02866BFB
x64, xrefs: 02866CDE
Network, xrefs: 02866A8C
1.0, xrefs: 02866AD1
AppEvents, xrefs: 02866A85
REMARK, xrefs: 02866AF6
GROUP, xrefs: 02866A9A

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Infowsprintf$ByteCharMultiSystemWide$lstrlen$CloseCountCurrentTickValueWindow_errnoinet_ntoa$AddressDirectoryForegroundHandleInputLastLocalLocaleModuleNativeOpenProcProcessProfileQueryTextTime_invalid_parameter_noinfo_localtime64gethostbynamegethostnamemalloc
String ID: %4d.%2d.%2d-%2d:%2d:%2d$%d min$1.0$2024.12.22$AppEvents$GROUP$GetNativeSystemInfo$INSTALLTIME$Network$REMARK$X64$X64 %s$d$kernel32.dll$x64$x86
API String ID: 2649121426-1201274903
Opcode ID: ebf27855cbf1da67cac5b0d59773e5e39c8b06264da9a0268aece5b0ef446386
Instruction ID: b9f1ae5f5e5e15238f7455eda653e2ebd234e69d7676c60b21b9d4005b5fff3e
Opcode Fuzzy Hash: ebf27855cbf1da67cac5b0d59773e5e39c8b06264da9a0268aece5b0ef446386
Instruction Fuzzy Hash: 9C12803A301A8296EB24DF64E8483ED77B5F794748F808116DB4E97B68EF38C659C740

Function 02871790 Relevance: 70.3, APIs: 27, Strings: 13, Instructions: 325
sleepregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32 ref: 028717EF
LoadLibraryA.KERNEL32 ref: 0287181B
GetProcAddress.KERNEL32 ref: 0287182B
SetProcessMitigationPolicy.KERNELBASE ref: 02871840
Sleep.KERNEL32 ref: 02871856
CloseHandle.KERNEL32 ref: 02871891
GetLocalTime.KERNEL32 ref: 028718AC
wsprintfW.USER32 ref: 028718FE
SetUnhandledExceptionFilter.KERNEL32 ref: 0287190B
CloseHandle.KERNEL32 ref: 02871931
EnumWindows.USER32 ref: 02871AAD
Sleep.KERNEL32 ref: 02871AC5
EnumWindows.USER32 ref: 02871ADC
Sleep.KERNEL32 ref: 02871B1C
CreateEventA.KERNEL32 ref: 02871B77
RegOpenKeyExW.ADVAPI32 ref: 02871BF0

Part of subcall function 0286FE20: RegQueryInfoKeyW.ADVAPI32 ref: 0286FE96
Part of subcall function 0286FE20: RegEnumValueW.ADVAPI32 ref: 0286FF47

Sleep.KERNEL32 ref: 02871C25
RegOpenKeyExW.ADVAPI32 ref: 02871C5B
RegQueryValueExW.ADVAPI32 ref: 02871C8A
Sleep.KERNEL32 ref: 02871D0E
WaitForSingleObject.KERNEL32 ref: 02871D3F
CloseHandle.KERNEL32 ref: 02871D48
Sleep.KERNEL32 ref: 02871D53
WaitForSingleObject.KERNEL32 ref: 02871D78
CloseHandle.KERNEL32 ref: 02871D81
Sleep.KERNEL32 ref: 02871D9B
CloseHandle.KERNEL32 ref: 02871DB7

Strings

6666, xrefs: 028719B5, 028719E2, 02871A48, 02871AF3, 02871B33
127.0.0.1, xrefs: 02871A24
IpDatespecial, xrefs: 02871C7C
SetProcessMitigationPolicy, xrefs: 02871824
156.224.26.128, xrefs: 0287199D
kernel32.dll, xrefs: 02871814
8888, xrefs: 028719D6
Console, xrefs: 02871C4D
156.224.26.128, xrefs: 0287198D, 02871A30, 02871B02, 02871B9F
6666, xrefs: 028719A9
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 028718F0
Console\1, xrefs: 02871BE2
156.224.26.128, xrefs: 028719CA

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Sleep$CloseHandle$Enum$ObjectOpenQuerySingleValueWaitWindows$AddressCreateEventExceptionFilterInfoLibraryLoadLocalMitigationPolicyProcProcessTimeUnhandledVersionwsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$127.0.0.1$156.224.26.128$156.224.26.128$156.224.26.128$6666$6666$8888$Console$Console\1$IpDatespecial$SetProcessMitigationPolicy$kernel32.dll
API String ID: 1083268199-3636297361
Opcode ID: 0dd27b8a1ad55d9f117150914b3ddba7ddd8d4c5dfe5985ab6a0316a85d3c4e6
Instruction ID: 1bb7fdafe248ec5aefdf79cad3d34ff82bdb37b573c1f6987cfa788b61d11170
Opcode Fuzzy Hash: 0dd27b8a1ad55d9f117150914b3ddba7ddd8d4c5dfe5985ab6a0316a85d3c4e6
Instruction Fuzzy Hash: A9F13F3E612B80D6EB20DF25E84839977A5F784B49FC48116DA4E87BA4DF3CC649CB41

Function 02872280 Relevance: 51.0, APIs: 18, Strings: 11, Instructions: 223
stringclipboardsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 02872308
SleepEx.KERNEL32 ref: 0287230E
GetTickCount.KERNEL32 ref: 02872325
OpenClipboard.USER32 ref: 02872333
GetClipboardData.USER32 ref: 0287233E
GlobalSize.KERNEL32 ref: 02872353
GlobalLock.KERNEL32 ref: 02872360
wsprintfW.USER32 ref: 028723BE
GlobalUnlock.KERNEL32 ref: 028723E3
CloseClipboard.USER32 ref: 028723F0
GetKeyState.USER32 ref: 02872485
lstrlenW.KERNEL32 ref: 028724DF
lstrlenW.KERNEL32 ref: 028724FF
lstrlenW.KERNEL32 ref: 02872527
wsprintfW.USER32 ref: 0287254D
wsprintfW.USER32 ref: 0287256C
wsprintfW.USER32 ref: 0287259F
lstrlenW.KERNEL32 ref: 028725ED

Strings

5, xrefs: 02872583
%s%s, xrefs: 02872540
%s%s, xrefs: 02872558
[, xrefs: 028723AF
), xrefs: 028724AF
9, xrefs: 0287247D
5, xrefs: 028724B8
[esc], xrefs: 028722F5
), xrefs: 0287257E
%s%s, xrefs: 0287258B
f, xrefs: 028725B9

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: lstrlenwsprintf$ClipboardGlobal$Sleep$CloseCountDataLockOpenSizeStateTickUnlock
String ID: [$%s%s$%s%s$%s%s$)$)$5$5$9$[esc]$f
API String ID: 1110909968-2084089848
Opcode ID: f4c5d78ff3645bfeab57f0ca3db130f032e8f751affedc270cde83f38a5ffa6c
Instruction ID: 645a28769ea0d1921edf648c6bc91d772cec2f57c0f0cedc3d60decadc8660b9
Opcode Fuzzy Hash: f4c5d78ff3645bfeab57f0ca3db130f032e8f751affedc270cde83f38a5ffa6c
Instruction Fuzzy Hash: 6E91DE3D611B4186EB54CF25E8683A937A5F748B88F88C026DE4E97B6CEF38C145C741

Function 00007FF660906860 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 213
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32 ref: 00007FF6609068C7
RegQueryValueExW.ADVAPI32 ref: 00007FF6609068FC
RegQueryValueExW.ADVAPI32 ref: 00007FF660906961
VirtualAlloc.KERNEL32 ref: 00007FF660906993
RegCloseKey.ADVAPI32 ref: 00007FF6609069C4
VirtualFree.KERNEL32 ref: 00007FF660906A10
VirtualAlloc.KERNEL32 ref: 00007FF660906B4E
RegCreateKeyW.ADVAPI32 ref: 00007FF660906BD5
RegDeleteValueW.KERNEL32 ref: 00007FF660906BED
RegSetValueExW.KERNEL32 ref: 00007FF660906C13
RegCloseKey.KERNEL32 ref: 00007FF660906C20
SleepEx.KERNEL32 ref: 00007FF660906C55

Strings

c9cb53ecfed9c0deec10651b37c64103, xrefs: 00007FF6609069CE
Console\1, xrefs: 00007FF660906899, 00007FF660906BC7
., xrefs: 00007FF660906A60
d33f351a4aeea5e608853d1a56661059, xrefs: 00007FF6609068ED, 00007FF660906952, 00007FF660906BE6, 00007FF660906BFA
n, xrefs: 00007FF660906A84
l, xrefs: 00007FF660906A72

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Value$Virtual$AllocCloseQuery$CreateDeleteFreeOpenSleep
String ID: .$Console\1$c9cb53ecfed9c0deec10651b37c64103$d33f351a4aeea5e608853d1a56661059$l$n
API String ID: 544495302-326781106
Opcode ID: 4aba7daaff96ba61096fd5a04ae9774ed3b6344a7a79354cfc8832202cbca9d2
Instruction ID: ff942c6091819d6198a66f566b6e890825fb416ea836f9f62cd44a5567b5361e
Opcode Fuzzy Hash: 4aba7daaff96ba61096fd5a04ae9774ed3b6344a7a79354cfc8832202cbca9d2
Instruction Fuzzy Hash: 67B1D121B1DB82E5EB248F21E8407AA3372FB89744F406239DA4E8BB66DF7DD544C740

Function 02868220 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 117
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 02868255
wsprintfW.USER32 ref: 0286826C

Part of subcall function 02868040: GetCurrentProcessId.KERNEL32 ref: 0286805D
Part of subcall function 02868040: OpenProcess.KERNEL32 ref: 0286806D
Part of subcall function 02868040: OpenProcessToken.ADVAPI32 ref: 02868095
Part of subcall function 02868040: CloseHandle.KERNEL32 ref: 028680A2

GetVersionExW.KERNEL32 ref: 0286829B
GetCurrentProcess.KERNEL32 ref: 028682C4
OpenProcessToken.ADVAPI32 ref: 028682D5
GetTokenInformation.ADVAPI32 ref: 028682FF
GetLastError.KERNEL32 ref: 02868309
LocalAlloc.KERNEL32 ref: 02868323
GetTokenInformation.ADVAPI32 ref: 0286834B
GetSidSubAuthorityCount.ADVAPI32 ref: 02868359
GetSidSubAuthority.ADVAPI32 ref: 02868368
LocalFree.KERNEL32 ref: 02868373
CloseHandle.KERNEL32 ref: 02868386
wsprintfW.USER32 ref: 028683E5

Strings

-N/, xrefs: 028683C2
None/%s, xrefs: 028683D4
NO/, xrefs: 028683CB

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Process$Token$CurrentOpen$AuthorityCloseHandleInformationLocalwsprintf$AllocCountErrorFreeLastVersion
String ID: -N/$NO/$None/%s
API String ID: 4155081256-3095023699
Opcode ID: aa1dc0a71ee852b7543f200892738a0fbeb9d10303c75d0b1296d44c0924ed1f
Instruction ID: 2ae48936995d2f3331c3ee716386604fd97c7bf1e5172935c9a2a7cb6c09059d
Opcode Fuzzy Hash: aa1dc0a71ee852b7543f200892738a0fbeb9d10303c75d0b1296d44c0924ed1f
Instruction Fuzzy Hash: 1B51623D215B81C6DB60CF21F5987AA7360F799B88F8C5015EA4E87A54DF38C149CB00

Function 02863370 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 168
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32 ref: 028633A1
timeGetTime.WINMM ref: 028633B0
socket.WS2_32 ref: 028633E5
lstrlenW.KERNEL32 ref: 02863412
WideCharToMultiByte.KERNEL32 ref: 02863436
lstrlenW.KERNEL32 ref: 02863450
WideCharToMultiByte.KERNEL32 ref: 02863473
gethostbyname.WS2_32 ref: 02863480
htons.WS2_32 ref: 028634A8
connect.WS2_32 ref: 028634D2

Strings

0u, xrefs: 02863555

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$EventResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 950253168-3203441087
Opcode ID: 2ae06a9d799ad217e1939a4cc30cfbc6fb037babddfd49fabee5cbe1934be173
Instruction ID: 34636157df6768b354ea023cadbcc63a407f1fa914175586d6f0b33b534a8881
Opcode Fuzzy Hash: 2ae06a9d799ad217e1939a4cc30cfbc6fb037babddfd49fabee5cbe1934be173
Instruction Fuzzy Hash: 7D715B7A204B8186D720CF65F44435AB7A5FB88B98F908229EB8E47F68DF3CC145CB04

Function 00007FF660903390 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 168
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32 ref: 00007FF6609033C1
timeGetTime.WINMM ref: 00007FF6609033D0
socket.WS2_32 ref: 00007FF660903405
lstrlenW.KERNEL32 ref: 00007FF660903432
WideCharToMultiByte.KERNEL32 ref: 00007FF660903456
lstrlenW.KERNEL32 ref: 00007FF660903470
WideCharToMultiByte.KERNEL32 ref: 00007FF660903493
gethostbyname.WS2_32 ref: 00007FF6609034A0
htons.WS2_32 ref: 00007FF6609034C8
connect.WS2_32 ref: 00007FF6609034F2

Strings

0u, xrefs: 00007FF660903575

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$EventResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 950253168-3203441087
Opcode ID: 7d394e5f66ba6b850d9984085327fb0713afef9c6993ef69a4f9733b52998f24
Instruction ID: 59d08befe585a3221a519983c18d7ce4da6c1aeea92686c01f3c1d8a02c40320
Opcode Fuzzy Hash: 7d394e5f66ba6b850d9984085327fb0713afef9c6993ef69a4f9733b52998f24
Instruction Fuzzy Hash: 89815C72608B81D6D724CF61F44026BB7A5FB88B94F005239EB9E87B69CF7CD1459B04

Function 02871E70 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 121
synchronizationfilekeyboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathW.SHELL32 ref: 02871EAD
lstrcatW.KERNEL32 ref: 02871EBD
CreateMutexW.KERNEL32 ref: 02871ECA
WaitForSingleObject.KERNEL32 ref: 02871EDD
CreateFileW.KERNEL32 ref: 02871F0B
GetFileSize.KERNEL32 ref: 02871F19
CloseHandle.KERNEL32 ref: 02871F24
DeleteFileW.KERNEL32 ref: 02871F35
ReleaseMutex.KERNEL32 ref: 02871F42
DirectInput8Create.DINPUT8 ref: 02871F63
GetTickCount.KERNEL32 ref: 0287201B
GetKeyState.USER32 ref: 0287202C

Strings

\DisplaySessionContainers.log, xrefs: 02871EB3
C:\ProgramData\DisplaySessionContainers.log, xrefs: 02871E98
<, xrefs: 02871FE6

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CreateFile$Mutex$CloseCountDeleteDirectFolderHandleInput8ObjectPathReleaseSingleSizeStateTickWaitlstrcat
String ID: <$C:\ProgramData\DisplaySessionContainers.log$\DisplaySessionContainers.log
API String ID: 1095970075-2401377312
Opcode ID: bb6a7608012b94c4c6d922e8e9e914e6b01070625297e575aa239041ff6539ab
Instruction ID: 386884721d72c806e2b964c3708545bbe05f615962a2237f4f3ab0e40235fb0e
Opcode Fuzzy Hash: bb6a7608012b94c4c6d922e8e9e914e6b01070625297e575aa239041ff6539ab
Instruction Fuzzy Hash: 6951593D701A4186FB10CF26E85875A37A4F799B98F848116DE5E87B28DF3DC589C700

Function 028802A4 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 292
timeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_lock.LIBCMT ref: 028802CF

Part of subcall function 02882F3C: _amsg_exit.LIBCMT ref: 02882F66

_get_daylight.LIBCMT ref: 028802E5

Part of subcall function 02881040: _errno.LIBCMT ref: 02881049
Part of subcall function 02881040: _invalid_parameter_noinfo.LIBCMT ref: 02881054

_get_daylight.LIBCMT ref: 028802FA

Part of subcall function 02880FE0: _errno.LIBCMT ref: 02880FE9
Part of subcall function 02880FE0: _invalid_parameter_noinfo.LIBCMT ref: 02880FF4

_get_daylight.LIBCMT ref: 0288030F

Part of subcall function 02881010: _errno.LIBCMT ref: 02881019
Part of subcall function 02881010: _invalid_parameter_noinfo.LIBCMT ref: 02881024

___lc_codepage_func.LIBCMT ref: 0288031C

Part of subcall function 0287A9F0: _getptd.LIBCMT ref: 0287A9F4

Part of subcall function 02887890: __wtomb_environ.LIBCMT ref: 028878C0

free.LIBCMT ref: 0288038D

Part of subcall function 02875500: HeapFree.KERNEL32 ref: 02875516
Part of subcall function 02875500: _errno.LIBCMT ref: 02875520
Part of subcall function 02875500: GetLastError.KERNEL32 ref: 02875528

free.LIBCMT ref: 028803F6
GetTimeZoneInformation.KERNEL32 ref: 02880409
WideCharToMultiByte.KERNEL32 ref: 028804BF
WideCharToMultiByte.KERNEL32 ref: 02880512

Strings

Eastern Summer Time, xrefs: 02880507
Eastern Standard Time, xrefs: 028804B4

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$ByteCharMultiWidefree$ErrorFreeHeapInformationLastTimeZone___lc_codepage_func__wtomb_environ_amsg_exit_getptd_lock
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 2532449802-239921721
Opcode ID: 7be99dbbe7bd35314df4901e9ab7b07cb3c0379838c0e6ee7fd2d91ba5def4a4
Instruction ID: c30e306c5d4b51908f3a9047e46f08f46e34630c999a67afb02366f16e3c1d18
Opcode Fuzzy Hash: 7be99dbbe7bd35314df4901e9ab7b07cb3c0379838c0e6ee7fd2d91ba5def4a4
Instruction Fuzzy Hash: C5B1E47E2057C08AE734EF29E85471A7BA6F785784F848126DA8DE3B25DF38C456CB01

Function 028677A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 199
stringregistrycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32 ref: 0286785B
lstrcatW.KERNEL32 ref: 0286786B

Part of subcall function 0286AB60: GetCurrentProcess.KERNEL32 ref: 0286AB77
Part of subcall function 0286AB60: OpenProcessToken.ADVAPI32 ref: 0286AB88
Part of subcall function 0286AB60: LookupPrivilegeValueW.ADVAPI32 ref: 0286ABA8
Part of subcall function 0286AB60: AdjustTokenPrivileges.ADVAPI32 ref: 0286ABD0
Part of subcall function 0286AB60: GetLastError.KERNEL32 ref: 0286ABD6
Part of subcall function 0286AB60: CloseHandle.KERNEL32 ref: 0286ABE6

Part of subcall function 0286A860: CreateToolhelp32Snapshot.KERNEL32 ref: 0286A897

CoCreateInstance.OLE32 ref: 028678B6
wsprintfW.USER32 ref: 028679B3
RegOpenKeyExW.ADVAPI32 ref: 028679DA
RegQueryValueExW.ADVAPI32 ref: 02867A28
lstrcatW.KERNEL32 ref: 02867A3C
lstrcatW.KERNEL32 ref: 02867A4C
RegCloseKey.ADVAPI32 ref: 02867A56

Part of subcall function 028676B0: CreateToolhelp32Snapshot.KERNEL32 ref: 028676F1
Part of subcall function 028676B0: Process32FirstW.KERNEL32 ref: 02867710
Part of subcall function 028676B0: Process32NextW.KERNEL32 ref: 02867750
Part of subcall function 028676B0: CloseHandle.KERNEL32 ref: 0286775D

lstrlenW.KERNEL32 ref: 02867A8D
lstrcatW.KERNEL32 ref: 02867AA1

Part of subcall function 0286A7B0: GetModuleHandleA.KERNEL32 ref: 0286A7BD
Part of subcall function 0286A7B0: GetProcAddress.KERNEL32 ref: 0286A7D5
Part of subcall function 0286A7B0: GetProcAddress.KERNEL32 ref: 0286A7EC
Part of subcall function 0286A7B0: GetProcAddress.KERNEL32 ref: 0286A803

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 028679A8

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: lstrcat$AddressCloseCreateHandleProc$OpenProcessProcess32SnapshotTokenToolhelp32Value$AdjustCurrentErrorFirstInstanceLastLookupModuleNextPrivilegePrivilegesQuerylstrlenwsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}
API String ID: 1729154408-4035668053
Opcode ID: 87d92d43499c7525a60042b981ac11658ec4cafe16c756d136ae682597cb2c07
Instruction ID: 49d575e516a307c6e5963a205cf9c84ce4ca8a5c7f0cc68aae052e31817d7436
Opcode Fuzzy Hash: 87d92d43499c7525a60042b981ac11658ec4cafe16c756d136ae682597cb2c07
Instruction Fuzzy Hash: 1D917D7A700B808AEB10CF65E8447AD7BB2F788B98F944116DE4D97B28DF38C555CB40

Function 02867EA0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 102
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 028666B0: SysFreeString.OLEAUT32 ref: 0286670D
Part of subcall function 028666B0: SysAllocString.OLEAUT32 ref: 02866759

GetTokenInformation.ADVAPI32 ref: 02867F16
GetLastError.KERNEL32 ref: 02867F20
GetProcessHeap.KERNEL32 ref: 02867F33
HeapAlloc.KERNEL32 ref: 02867F42
GetTokenInformation.ADVAPI32 ref: 02867F6E
LookupAccountSidW.ADVAPI32 ref: 02867FAC
GetLastError.KERNEL32 ref: 02867FB6
GetProcessHeap.KERNEL32 ref: 02868006
HeapFree.KERNEL32 ref: 02868014

Strings

NONE_MAPPED, xrefs: 02867FC3
Network, xrefs: 02867EA0

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Heap$AllocErrorFreeInformationLastProcessStringToken$AccountLookup
String ID: NONE_MAPPED$Network
API String ID: 1972796461-3150097737
Opcode ID: 8113f941a4de608807758112df11e72a60d86c4884b026946c1f4e66eb8542e5
Instruction ID: 1975085d689a9c1d69c0998f41fbab6972064ebf189f74531db21a2448b47223
Opcode Fuzzy Hash: 8113f941a4de608807758112df11e72a60d86c4884b026946c1f4e66eb8542e5
Instruction Fuzzy Hash: 08419F2E305A8186EB109F55F8487AAB3A5FB89B89F948521DB4D87B14EF3DC449CB00

Function 00007FF660906F70 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 169timeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FF660906FB0
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF660907077
CreateEventW.KERNEL32 ref: 00007FF6609070B8
CreateEventW.KERNEL32 ref: 00007FF6609070E6
CreateEventW.KERNEL32 ref: 00007FF660907114
timeGetTime.WINMM ref: 00007FF66090722A
CreateEventW.KERNEL32 ref: 00007FF66090723F
CreateEventW.KERNEL32 ref: 00007FF660907253

Strings

<, xrefs: 00007FF660906FFE
<, xrefs: 00007FF660906FF7

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CreateEvent$CountCriticalInitializeSectionSpinTimetime
String ID: <$<
API String ID: 4111701721-213342407
Opcode ID: 71aba28c82a38994b348574f9f59d4c9b61d547acce44c6443545729c696c839
Instruction ID: 4498978ab4d058ed65b842b0282d27372764391c367ce77cdbdf4bf7d91bdbbe
Opcode Fuzzy Hash: 71aba28c82a38994b348574f9f59d4c9b61d547acce44c6443545729c696c839
Instruction Fuzzy Hash: 61817932615B92D6E7488F34E8447AD32BAFB44F48F08523DEE498E799CF788155CB50

Function 02869BC0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 85stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32 ref: 02869C1C
lstrcmpiW.KERNEL32 ref: 02869C5B
lstrcmpiW.KERNEL32 ref: 02869C6F
QueryDosDeviceW.KERNEL32 ref: 02869CA0
lstrlenW.KERNEL32 ref: 02869CAF
lstrcpyW.KERNEL32 ref: 02869CE3
lstrcpyW.KERNEL32 ref: 02869D2E
lstrcatW.KERNEL32 ref: 02869D3B

Strings

B:\, xrefs: 02869C65
A:\, xrefs: 02869C49

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: lstrcmpilstrcpy$DeviceDriveLogicalQueryStringslstrcatlstrlen
String ID: A:\$B:\
API String ID: 1889997506-1009255891
Opcode ID: 195c15b6208fbb33efc9ae23a30a98022802357f617ac369b918550c39e8a5e0
Instruction ID: 6441adcd8c2c5a26db9991909316c6a49c3c71768022a82c3cb3d821f1ce48ac
Opcode Fuzzy Hash: 195c15b6208fbb33efc9ae23a30a98022802357f617ac369b918550c39e8a5e0
Instruction Fuzzy Hash: C8316E6E704A81C5EB709B15F8483AB63A5F798B89F849111DE8E87B98EF7CC145CB40

Function 00007FF660908580 Relevance: 15.0, APIs: 10, Instructions: 34threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF66090858B
GetConsoleWindow.KERNEL32 ref: 00007FF660908591
ShowWindow.USER32 ref: 00007FF66090859C
GetCurrentThreadId.KERNEL32 ref: 00007FF6609085A2
PostThreadMessageA.USER32 ref: 00007FF6609085B2
GetInputState.USER32 ref: 00007FF6609085B8

Part of subcall function 00007FF6609073D0: lstrlenW.KERNEL32 ref: 00007FF660907459
Part of subcall function 00007FF6609073D0: lstrlenW.KERNEL32 ref: 00007FF66090746C
Part of subcall function 00007FF6609073D0: lstrlenW.KERNEL32 ref: 00007FF660907548
Part of subcall function 00007FF6609073D0: lstrlenW.KERNEL32 ref: 00007FF66090755B

CreateThread.KERNEL32 ref: 00007FF6609085DE
WaitForSingleObject.KERNEL32 ref: 00007FF6609085F1
CloseHandle.KERNEL32 ref: 00007FF6609085FE
Sleep.KERNEL32 ref: 00007FF660908609

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: lstrlen$Thread$Window$CloseConsoleCreateCurrentExceptionFilterHandleInputMessageObjectPostShowSingleSleepStateUnhandledWait
String ID:
API String ID: 3551332608-0
Opcode ID: 152ae417eb4b62f33c842a60702934fe7b1e65802cfc5c2bd98c8d5dbe26bc31
Instruction ID: 625eb9fb99ca038de03077731bc382c68d16cebd485ed85c37edc4ef0751dff1
Opcode Fuzzy Hash: 152ae417eb4b62f33c842a60702934fe7b1e65802cfc5c2bd98c8d5dbe26bc31
Instruction Fuzzy Hash: 47014020F18942E2F708EB71BC1956A33B7BF88B15B446274D44EC9372DE7C640A9200

Function 02868430 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32 ref: 0286849A
GetDiskFreeSpaceExW.KERNEL32 ref: 028684BE
GlobalMemoryStatusEx.KERNEL32 ref: 02868525

Strings

HDD:%d, xrefs: 02868539
:, xrefs: 0286847E
%sFree%d Gb , xrefs: 02868567
@, xrefs: 028684EE

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: DiskDriveFreeGlobalMemorySpaceStatusType
String ID: %sFree%d Gb $:$@$HDD:%d
API String ID: 3475944273-3501811827
Opcode ID: 1e499d2353234789bc0f3bbbd974805f3cb9744872628ca8bd1c944a6ef7e3b2
Instruction ID: f5cd74b01277286fed59a5f5d44795f735485d7911731f0eb9b6760125a07a83
Opcode Fuzzy Hash: 1e499d2353234789bc0f3bbbd974805f3cb9744872628ca8bd1c944a6ef7e3b2
Instruction Fuzzy Hash: 0E31173A209B8486D760DB15B84479BB3A4F389798F945116EACD83B18DF38C45ACB40

Function 02872140 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringtimeCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0287216F
GetWindowTextW.USER32 ref: 0287218C
lstrlenW.KERNEL32 ref: 028721C6
GetLocalTime.KERNEL32 ref: 028721D5
wsprintfW.USER32 ref: 02872225

Part of subcall function 02872080: WaitForSingleObject.KERNEL32 ref: 02872097
Part of subcall function 02872080: CreateFileW.KERNEL32 ref: 028720C9
Part of subcall function 02872080: SetFilePointer.KERNEL32 ref: 028720EE
Part of subcall function 02872080: lstrlenW.KERNEL32 ref: 028720F7
Part of subcall function 02872080: WriteFile.KERNEL32 ref: 02872115
Part of subcall function 02872080: CloseHandle.KERNEL32 ref: 0287211E
Part of subcall function 02872080: ReleaseMutex.KERNEL32 ref: 0287212B

Strings

[, xrefs: 0287221E

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: File$Windowlstrlen$CloseCreateForegroundHandleLocalMutexObjectPointerReleaseSingleTextTimeWaitWritewsprintf
String ID: [
API String ID: 3163932117-4056885943
Opcode ID: 4a0902b76c87c20fdb2e3105c81e170fc1e3dc222144a48b5715cacb2e30ad74
Instruction ID: 1c902aacf525c8bc1d40069f2497ddbdd740a5804f6f7f994c69911d2666289b
Opcode Fuzzy Hash: 4a0902b76c87c20fdb2e3105c81e170fc1e3dc222144a48b5715cacb2e30ad74
Instruction Fuzzy Hash: 34318E29229A5085EB10CF56F85837AB3A6FB94744F84C116E98E82A68EF3CC448CF41

Function 02867150 Relevance: 7.6, APIs: 5, Instructions: 89processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 028671B9
Process32FirstW.KERNEL32 ref: 028671D8
Process32NextW.KERNEL32 ref: 0286720F
CloseHandle.KERNEL32 ref: 0286721C
CloseHandle.KERNEL32 ref: 02867258

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 478adfaa53224f4c646a90ac3974a5860d44690c717c694f81840881146ffb29
Instruction ID: 4fbe7f7e372e46f84a6fdecaa5270dc0ee0c663a0f4f5e280384a9a9461cbc66
Opcode Fuzzy Hash: 478adfaa53224f4c646a90ac3974a5860d44690c717c694f81840881146ffb29
Instruction Fuzzy Hash: 5531766D315A8185DB20CB29E81977AB361FB48BB8F848316EE7A437D8EF38C555C740

Function 02863670 Relevance: 7.6, APIs: 5, Instructions: 74networkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 02863705
recv.WS2_32 ref: 0286372B
_errno.LIBCMT ref: 02863737
_errno.LIBCMT ref: 02863741
_errno.LIBCMT ref: 0286374E

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$recvselect
String ID:
API String ID: 4102763267-0
Opcode ID: 0209d1afcfec4bbf66b436d0a2968ceaa8cc84d20af26958721757647a73e531
Instruction ID: 5f1408e4048b0de4e9fd3f98930e5bd5ea95fd3793d215b2e79b995c95e5a221
Opcode Fuzzy Hash: 0209d1afcfec4bbf66b436d0a2968ceaa8cc84d20af26958721757647a73e531
Instruction Fuzzy Hash: C1316DBE214A8082DB309B69E95876E73A2F789F89F844275CB5D87B58DF38C0448B05

Function 028686F0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 377COMMON

Download Yara Rule

APIs

CreateDXGIFactory.DXGI ref: 02868760

Strings

vector<T> too long, xrefs: 028688DF, 028688EC, 02868C33, 02868C40
%s%s %d*%d , xrefs: 02868BAD
%s%s %d %d , xrefs: 02868960

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CreateFactory
String ID: %s%s %d %d $%s%s %d*%d $vector<T> too long
API String ID: 1145517477-257307503
Opcode ID: fa8402bfd6ce440d6ff4b8cf1932907d5849ae49a8771a0e948cbd0e09370c9a
Instruction ID: 379db8999fcea133f550d0ead7c934de4036c75e16a9c9b7968ea98d788c31b7
Opcode Fuzzy Hash: fa8402bfd6ce440d6ff4b8cf1932907d5849ae49a8771a0e948cbd0e09370c9a
Instruction Fuzzy Hash: B4D1C37E715A8486DF10CF66E4482AE7362F784BE8F544611DE6EA7B98CF38C449C700

Function 0286F2E0 Relevance: 34.7, APIs: 23, Instructions: 201
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32 ref: 0286F32A
GlobalLock.KERNEL32 ref: 0286F336
GlobalUnlock.KERNEL32 ref: 0286F34D
CreateStreamOnHGlobal.OLE32 ref: 0286F362
EnterCriticalSection.KERNEL32 ref: 0286F3AB
LeaveCriticalSection.KERNEL32 ref: 0286F3BE
GdipCreateBitmapFromStream.GDIPLUS ref: 0286F3EE
GdipDisposeImage.GDIPLUS ref: 0286F405
GdipDisposeImage.GDIPLUS ref: 0286F423
CreateStreamOnHGlobal.OLE32 ref: 0286F442
GetHGlobalFromStream.OLE32 ref: 0286F46D
GlobalLock.KERNEL32 ref: 0286F478
GlobalFree.KERNEL32 ref: 0286F493
DeleteObject.GDI32 ref: 0286F598
EnterCriticalSection.KERNEL32 ref: 0286F5A5
EnterCriticalSection.KERNEL32 ref: 0286F5BA
GdiplusShutdown.GDIPLUS ref: 0286F5CC
LeaveCriticalSection.KERNEL32 ref: 0286F5E0
LeaveCriticalSection.KERNEL32 ref: 0286F5ED
GlobalFree.KERNEL32 ref: 0286F5F6

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Global$CriticalSection$Stream$CreateEnterGdipLeave$DisposeFreeFromImageLock$AllocBitmapDeleteGdiplusObjectShutdownUnlock
String ID:
API String ID: 562715702-0
Opcode ID: 6b4c91a67da076fc5ed7ed7d3bbb601d668363ccad180db4f24a8162a4e7ad9d
Instruction ID: ea1b0a1126f8da68a6564e692726fd3d0cb770698b0915d4004322e30ec941b4
Opcode Fuzzy Hash: 6b4c91a67da076fc5ed7ed7d3bbb601d668363ccad180db4f24a8162a4e7ad9d
Instruction Fuzzy Hash: 48910A3A705B408AEB20EB65E8583AD33B5F754BA8F808615CE5E57EA8DF38C519C740

Function 0286CEB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 225
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GdipGetImageEncodersSize.GDIPLUS ref: 0286CEEE
malloc.LIBCMT ref: 0286CF5A
free.LIBCMT ref: 0286CF86
GdipGetImageEncoders.GDIPLUS ref: 0286CF9F
free.LIBCMT ref: 0286CFB6
free.LIBCMT ref: 0286D08B
GdipCreateBitmapFromScan0.GDIPLUS ref: 0286D0D2
GdipSaveImageToStream.GDIPLUS ref: 0286D0E9
GdipDisposeImage.GDIPLUS ref: 0286D0F6
free.LIBCMT ref: 0286D10B
GdipCreateBitmapFromHBITMAP.GDIPLUS ref: 0286D125
GdipSaveImageToStream.GDIPLUS ref: 0286D13C
GdipDisposeImage.GDIPLUS ref: 0286D149
free.LIBCMT ref: 0286D166
GdipDisposeImage.GDIPLUS ref: 0286D175
free.LIBCMT ref: 0286D186

Strings

&, xrefs: 0286D0BD

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Gdip$Image$free$Dispose$BitmapCreateEncodersFromSaveStream$Scan0Sizemalloc
String ID: &
API String ID: 1890951399-3042966939
Opcode ID: cae27d6bd8201d0dc58153021ad5c4c411b490ebb8ed088c6c7b76cf93af3724
Instruction ID: 6f9250bc32a0cf990ce523ce32283a0ed16c4339e93c85f527424bf6f4491161
Opcode Fuzzy Hash: cae27d6bd8201d0dc58153021ad5c4c411b490ebb8ed088c6c7b76cf93af3724
Instruction Fuzzy Hash: DF71A46E3016819AEF149F35D80C7B96365F758B9CF888622DF5D8BB98EF68C145C340

Function 0286CA90 Relevance: 27.3, APIs: 18, Instructions: 283
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GdipGetImagePixelFormat.GDIPLUS ref: 0286CACF
GdipGetImageHeight.GDIPLUS ref: 0286CB38
GdipGetImageWidth.GDIPLUS ref: 0286CB56
GdipGetImagePaletteSize.GDIPLUS ref: 0286CB9C
malloc.LIBCMT ref: 0286CC02

Part of subcall function 02875540: _FF_MSGBANNER.LIBCMT ref: 02875570
Part of subcall function 02875540: HeapAlloc.KERNEL32 ref: 02875595
Part of subcall function 02875540: _callnewh.LIBCMT ref: 028755AE
Part of subcall function 02875540: _errno.LIBCMT ref: 028755B9
Part of subcall function 02875540: _errno.LIBCMT ref: 028755C4

free.LIBCMT ref: 0286CC2B
GdipGetImagePalette.GDIPLUS ref: 0286CC4A
GdipBitmapLockBits.GDIPLUS ref: 0286CD07
free.LIBCMT ref: 0286CD26
GdipCreateBitmapFromScan0.GDIPLUS ref: 0286CE1F
GdipGetImageGraphicsContext.GDIPLUS ref: 0286CE34
GdipDrawImageI.GDIPLUS ref: 0286CE4C
GdipDeleteGraphics.GDIPLUS ref: 0286CE55
GdipDisposeImage.GDIPLUS ref: 0286CE5E
free.LIBCMT ref: 0286CD46

Part of subcall function 02875500: HeapFree.KERNEL32 ref: 02875516
Part of subcall function 02875500: _errno.LIBCMT ref: 02875520
Part of subcall function 02875500: GetLastError.KERNEL32 ref: 02875528

memcpy_s.LIBCMT ref: 0286CD8C
GdipBitmapUnlockBits.GDIPLUS ref: 0286CDC8
free.LIBCMT ref: 0286CE76

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Gdip$Image$free$Bitmap_errno$BitsGraphicsHeapPalette$AllocContextCreateDeleteDisposeDrawErrorFormatFreeFromHeightLastLockPixelScan0SizeUnlockWidth_callnewhmallocmemcpy_s
String ID:
API String ID: 1886978121-0
Opcode ID: 65f0a3a14f119414638e25c4c10bd3a856a8312b62936d53a4a41eaeb62985e8
Instruction ID: aac2562407ffc9b6dd38f3be6c4fcff0d3b889a3e20039f25e410e78d760881f
Opcode Fuzzy Hash: 65f0a3a14f119414638e25c4c10bd3a856a8312b62936d53a4a41eaeb62985e8
Instruction Fuzzy Hash: 49B1797E3006808AEB20DF25D44CBA93BA5F748BD8F858526DE9E8BB54DF38D145C744

Function 02867580 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 67
synchronizationsleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNEL32 ref: 028675A4
CreateMutexExW.KERNEL32 ref: 028675AA
Sleep.KERNEL32 ref: 028675C5
CreateMutexW.KERNEL32 ref: 028675D6
GetLastError.KERNEL32 ref: 028675DC
lstrlenW.KERNEL32 ref: 02867615
lstrcmpW.KERNEL32 ref: 02867643
Sleep.KERNEL32 ref: 02867652
GetModuleHandleW.KERNEL32 ref: 02867663
GetConsoleWindow.KERNEL32 ref: 0286766E

Strings

2024.12.22, xrefs: 02867599, 028675CB
key, xrefs: 02867627
open, xrefs: 02867620

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CreateMutex$Sleep$ConsoleErrorHandleLastModuleWindowlstrcmplstrlen
String ID: 2024.12.22$key$open
API String ID: 4141083079-4017660554
Opcode ID: f911b2afd73dc9504530b06ff46ad50bcc204ae388924bb075476682b1ac500a
Instruction ID: 41db5e5d8561bcd9e1bba20d14efa2088a1ffeec4a5414398b66dcb44886f728
Opcode Fuzzy Hash: f911b2afd73dc9504530b06ff46ad50bcc204ae388924bb075476682b1ac500a
Instruction Fuzzy Hash: 9B31317D611A42D2FB54AB24F85C7BA7361FB94709FC4C026D64E82964DF3CC149CB41

Function 02868D20 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 82registrylibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 02868D35
GetProcAddress.KERNEL32 ref: 02868D51
FreeLibrary.KERNEL32 ref: 02868E7D

Part of subcall function 028757BC: _vswprintf_s_l.LIBCMT ref: 028757D6

Part of subcall function 02868CA0: GetModuleHandleW.KERNEL32 ref: 02868CCB
Part of subcall function 02868CA0: GetProcAddress.KERNEL32 ref: 02868CDB
Part of subcall function 02868CA0: GetNativeSystemInfo.KERNEL32 ref: 02868CEB

RegOpenKeyExW.ADVAPI32 ref: 02868E17
RegQueryValueExW.ADVAPI32 ref: 02868E42
RegCloseKey.ADVAPI32 ref: 02868E67

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 02868DF6
%d.%d.%d, xrefs: 02868D96
ntdll.dll, xrefs: 02868D2B
ProductName, xrefs: 02868E2E
RtlGetNtVersionNumbers, xrefs: 02868D47

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: AddressLibraryProc$CloseFreeHandleInfoLoadModuleNativeOpenQuerySystemValue_vswprintf_s_l
String ID: %d.%d.%d$ProductName$RtlGetNtVersionNumbers$SOFTWARE\Microsoft\Windows NT\CurrentVersion$ntdll.dll
API String ID: 1477497710-3190923360
Opcode ID: 9a6095186e03b76efae6a3eae714c10ad3fa5ee1170803ccf761aa8016e5e9c0
Instruction ID: f430e0186ae0cc2a3bfda231f70723f6262d409611caf17b45941d6ba73c08c2
Opcode Fuzzy Hash: 9a6095186e03b76efae6a3eae714c10ad3fa5ee1170803ccf761aa8016e5e9c0
Instruction Fuzzy Hash: 3F31A53E21678186DB60CB15F44476A7361F789BE8F848211EE9E47B58EF3CC549CB00

Function 00007FF6609080E0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 140synchronizationCOMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 00007FF660908114

Part of subcall function 00007FF660909128: malloc.LIBCMT ref: 00007FF660909142

SleepEx.KERNEL32 ref: 00007FF66090828D
CreateEventA.KERNEL32 ref: 00007FF6609082E4
SleepEx.KERNEL32 ref: 00007FF660908333
WaitForSingleObject.KERNEL32 ref: 00007FF66090833F

Part of subcall function 00007FF660903230: WSAStartup.WS2_32 ref: 00007FF6609032AF
Part of subcall function 00007FF660903230: CreateEventW.KERNEL32 ref: 00007FF6609032C0

Part of subcall function 00007FF6609092D0: _errno.LIBCMT ref: 00007FF6609092EF
Part of subcall function 00007FF6609092D0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6609092FB

Part of subcall function 00007FF6609092D0: _errno.LIBCMT ref: 00007FF66090932B

CloseHandle.KERNEL32 ref: 00007FF660908350
CloseHandle.KERNEL32 ref: 00007FF660908360

Strings

6666, xrefs: 00007FF6609081A6, 00007FF6609081D3, 00007FF660908239, 00007FF660908296
156.224.26.128, xrefs: 00007FF66090817E, 00007FF660908221, 00007FF6609082A5

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Sleep$CloseCreateEventHandle_errno$ObjectSingleStartupWait_invalid_parameter_noinfomalloc
String ID: 156.224.26.128$6666
API String ID: 407272786-1480230661
Opcode ID: 13c9adc974c42543c4138414809006d942cbbcd1fe96e939a7d0cf87f8cfa7a0
Instruction ID: 4a690725ad1da380f0d6ba215481166fe19d483d2aa96c77f8049645f6f69872
Opcode Fuzzy Hash: 13c9adc974c42543c4138414809006d942cbbcd1fe96e939a7d0cf87f8cfa7a0
Instruction Fuzzy Hash: 37614A31A2C642F5E6149B20E8402BA6376FF89790F406339E95ECB7A6DF3CE955C340

Function 00007FF660906690 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 67registrysleepCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32 ref: 00007FF6609066EC
RegDeleteValueW.KERNEL32 ref: 00007FF6609066FE
RegSetValueExW.KERNEL32 ref: 00007FF660906726
RegCloseKey.KERNEL32 ref: 00007FF660906731
OpenProcess.KERNEL32 ref: 00007FF660906770
GetExitCodeProcess.KERNEL32 ref: 00007FF660906783
Sleep.KERNEL32 ref: 00007FF66090679C

Strings

IpDates_info, xrefs: 00007FF6609066F7, 00007FF660906709
SOFTWARE, xrefs: 00007FF6609066D0

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: OpenProcessValue$CloseCodeDeleteExitSleep
String ID: IpDates_info$SOFTWARE
API String ID: 864241144-2243437601
Opcode ID: 7273320449914747eef314da4b35d0b3e2dae11081ca32cb48a94620bb4d36a9
Instruction ID: 9798693b298f1ad9a88031f2290c8cb4fcb6a82360eb373ba8f3188d46248237
Opcode Fuzzy Hash: 7273320449914747eef314da4b35d0b3e2dae11081ca32cb48a94620bb4d36a9
Instruction Fuzzy Hash: AD313231B2CA02E2E7548B11E84466A33B7EF88794F402234E55ECA7A6DF7CE589C740

Function 02868040 Relevance: 15.1, APIs: 10, Instructions: 126COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 0286805D
OpenProcess.KERNEL32 ref: 0286806D
OpenProcessToken.ADVAPI32 ref: 02868095
CloseHandle.KERNEL32 ref: 028680A2
SysStringLen.OLEAUT32 ref: 028680F0
SysStringLen.OLEAUT32 ref: 02868103
CloseHandle.KERNEL32 ref: 0286816D
CloseHandle.KERNEL32 ref: 02868176
SysFreeString.OLEAUT32 ref: 028681AC
SysFreeString.OLEAUT32 ref: 028681E9

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: String$CloseHandleProcess$FreeOpen$CurrentToken
String ID:
API String ID: 3697972778-0
Opcode ID: d65573670d91d4a2319d9bf601b7591871b764b4696a34e88597c2945c6666e4
Instruction ID: 91d1fc67ab332e77c1a3bc676f190d942634110b2f5cc0dd830e1b199d7122b2
Opcode Fuzzy Hash: d65573670d91d4a2319d9bf601b7591871b764b4696a34e88597c2945c6666e4
Instruction Fuzzy Hash: FD41632E206B8082EF25DF55E85837A7361FB84B99F888625CE9E87B54DF3CC449C741

Function 00007FF6609098FC Relevance: 15.1, APIs: 10, Instructions: 87COMMON

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 00007FF660909966
_FF_MSGBANNER.LIBCMT ref: 00007FF660909991
_RTC_Initialize.LIBCMT ref: 00007FF6609099AA
_amsg_exit.LIBCMT ref: 00007FF6609099BE
GetCommandLineW.KERNEL32 ref: 00007FF6609099C3
__wsetargv.LIBCMT ref: 00007FF6609099DC
_amsg_exit.LIBCMT ref: 00007FF6609099EA
_amsg_exit.LIBCMT ref: 00007FF6609099FD
_cinit.LIBCMT ref: 00007FF660909A07
_amsg_exit.LIBCMT ref: 00007FF660909A12

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _amsg_exit$CommandInitializeLine__wsetargv_cinit
String ID:
API String ID: 2949660345-0
Opcode ID: bc546b9b31afb54ae0084185d84276419e05a16c241d08c8ffe122babf2c2063
Instruction ID: 3eb9d5b54a46f594e811938b236e3ce806246cbd3c3c2d58b33657f53c2f2244
Opcode Fuzzy Hash: bc546b9b31afb54ae0084185d84276419e05a16c241d08c8ffe122babf2c2063
Instruction Fuzzy Hash: 0731C421E1D603E6FB506B6495512B922B7EF91744F00733DD66ECE3D3EE2CA84086D1

Function 02867B10 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 117registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 02867B79
RegQueryInfoKeyW.ADVAPI32 ref: 02867BD4
RegEnumKeyExW.ADVAPI32 ref: 02867C69
lstrlenW.KERNEL32 ref: 02867C73
lstrlenW.KERNEL32 ref: 02867C82

Part of subcall function 02876188: _errno.LIBCMT ref: 028761A7
Part of subcall function 02876188: _invalid_parameter_noinfo.LIBCMT ref: 028761B3

Part of subcall function 02876188: _errno.LIBCMT ref: 028761FD

RegCloseKey.ADVAPI32 ref: 02867CCB
lstrlenW.KERNEL32 ref: 02867CE8

Strings

Software\Tencent\Plugin\VAS, xrefs: 02867B5D

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: lstrlen$_errno$CloseEnumInfoOpenQuery_invalid_parameter_noinfo
String ID: Software\Tencent\Plugin\VAS
API String ID: 47975445-3343197220
Opcode ID: 83177f2e4f272b9abf8fd471bf99554f254f381e64807105df55b77755f485f0
Instruction ID: 5803119369623710f9349123bfef6b21d9b37dfa1081a65b05cd48a8b4094580
Opcode Fuzzy Hash: 83177f2e4f272b9abf8fd471bf99554f254f381e64807105df55b77755f485f0
Instruction Fuzzy Hash: A351523A614B819AE760CF25F8947AEB3A6F78874CF904126DB8D97E58DF38C145CB40

Function 02872080 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 40filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 02872097
CreateFileW.KERNEL32 ref: 028720C9
SetFilePointer.KERNEL32 ref: 028720EE
lstrlenW.KERNEL32 ref: 028720F7
WriteFile.KERNEL32 ref: 02872115
CloseHandle.KERNEL32 ref: 0287211E
ReleaseMutex.KERNEL32 ref: 0287212B

Strings

C:\ProgramData\DisplaySessionContainers.log, xrefs: 028720A9

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID: C:\ProgramData\DisplaySessionContainers.log
API String ID: 4202892810-820907713
Opcode ID: e66edca27f0b4b472a47d301f0d453ed1a843aabc931c6e442c329c9c8bb1688
Instruction ID: d40ac78a1433ec359e721419d28961f1d3c620cb58b6c02791f92aae3966711b
Opcode Fuzzy Hash: e66edca27f0b4b472a47d301f0d453ed1a843aabc931c6e442c329c9c8bb1688
Instruction Fuzzy Hash: 8D115E79215A4082FB508F55F80C7697360F798BB8FD48311DA6A03BA9CF7CC049CB01

Function 0286EC90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 028755F8: malloc.LIBCMT ref: 02875612

GetLastInputInfo.USER32 ref: 0286ECDA
GetTickCount.KERNEL32 ref: 0286ECE0
wsprintfW.USER32 ref: 0286ED14
GetForegroundWindow.USER32 ref: 0286ED1A
GetWindowTextW.USER32 ref: 0286ED32

Strings

%d min, xrefs: 0286ED0D

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Window$CountForegroundInfoInputLastTextTickmallocwsprintf
String ID: %d min
API String ID: 4179731349-1947832151
Opcode ID: 5ee87d7f40671d848751d3e95bac82712995824589b493fa2cb3551ae09538af
Instruction ID: 982fcd554040f4675011dc880df93639837ca7a0ed332afa5fae5886a4ce6d8f
Opcode Fuzzy Hash: 5ee87d7f40671d848751d3e95bac82712995824589b493fa2cb3551ae09538af
Instruction Fuzzy Hash: 2141C57E31468096DB24DF2AE4987AEB761FB85B88F844125DF4E87B58DF38C515CB00

Function 02867D40 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 82comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 02867D4A
CoCreateInstance.OLE32 ref: 02867D6E
SysFreeString.OLEAUT32 ref: 02867E38
CoUninitialize.OLE32 ref: 02867E85

Strings

FriendlyName, xrefs: 02867E20
Network, xrefs: 02867D40

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CreateFreeInitializeInstanceStringUninitialize
String ID: FriendlyName$Network
API String ID: 841178590-1437807293
Opcode ID: 85724eb1235deb858d208dd5baec3e034e629cdd9d5c200151cad6a771ccc146
Instruction ID: 7a47f3f41696a2d798c1ee190cc9d6a39649715353027a251f96ec4574bcd42f
Opcode Fuzzy Hash: 85724eb1235deb858d208dd5baec3e034e629cdd9d5c200151cad6a771ccc146
Instruction Fuzzy Hash: 6731FD3A304A8692DB20CF75E44479A7760F7D8F98F958012DB8E87B28DF38C589CB40

Function 02868CA0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 02868CCB
GetProcAddress.KERNEL32 ref: 02868CDB
GetNativeSystemInfo.KERNEL32 ref: 02868CEB
GetSystemInfo.KERNEL32 ref: 02868CEF

Strings

kernel32.dll, xrefs: 02868CA6
GetNativeSystemInfo, xrefs: 02868CD1

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 3433367815-192647395
Opcode ID: 13fcd9e8e1cc8ddc9bbf0ad522e0ae51a73a5c5d350313a27b70b9d8622c7569
Instruction ID: 6ab3bf27d8315a94a099998b6bf5952996ad791f7cf460f931eff0ee7f9df30a
Opcode Fuzzy Hash: 13fcd9e8e1cc8ddc9bbf0ad522e0ae51a73a5c5d350313a27b70b9d8622c7569
Instruction Fuzzy Hash: F9F03C3D616F8586DB619B10F85836A73A1F798704FD44129D6CF83B54EF3CC2998B10

Function 00007FF660903860 Relevance: 9.2, APIs: 6, Instructions: 154memorythreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF660903883
VirtualAlloc.KERNEL32 ref: 00007FF660903910
VirtualFree.KERNEL32 ref: 00007FF660903952
VirtualAlloc.KERNEL32 ref: 00007FF6609039DF
VirtualFree.KERNEL32 ref: 00007FF660903A21
GetCurrentThreadId.KERNEL32 ref: 00007FF660903AE3

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Virtual$AllocCurrentFreeThread
String ID:
API String ID: 1155560630-0
Opcode ID: 4b852a1b5dd8efe1026821f14150178db2e8c6b99ec0c6da190b714437e6e122
Instruction ID: 2da2e8c2ca25592d44eb9bd89994024a44ed67bc081fb622f29eff00437531b7
Opcode Fuzzy Hash: 4b852a1b5dd8efe1026821f14150178db2e8c6b99ec0c6da190b714437e6e122
Instruction Fuzzy Hash: 29717932718A81EBE65C8B35A140769B3B6FB44784F509238DB9EC7746DF38E4A5CB40

Function 028685C0 Relevance: 9.1, APIs: 6, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 02868625
RegQueryValueExW.ADVAPI32 ref: 0286866D
lstrcmpW.KERNEL32 ref: 02868683
RegCloseKey.ADVAPI32 ref: 028686AC
RegCloseKey.ADVAPI32 ref: 028686B7

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Close$OpenQueryValuelstrcmp
String ID:
API String ID: 4288439342-0
Opcode ID: 8270887b47fe0bbc6353c8e6efe7337fff00ec0666d6931bc69347773c267aa0
Instruction ID: b16fbfc00ffd34104400706e2ca88fc0a243ec977659c15f73734689acbc4f53
Opcode Fuzzy Hash: 8270887b47fe0bbc6353c8e6efe7337fff00ec0666d6931bc69347773c267aa0
Instruction Fuzzy Hash: DA214439315A4085EB60CB15FC8C76BB360FB98B98F905225EA5D83B99DF3CC449CB00

Function 028759EC Relevance: 9.1, APIs: 6, Instructions: 63threadCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 02875A17
_invalid_parameter_noinfo.LIBCMT ref: 02875A22
_getptd.LIBCMT ref: 02875A48
CreateThread.KERNEL32 ref: 02875A9D
GetLastError.KERNEL32 ref: 02875AA8
free.LIBCMT ref: 02875AB3

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CreateErrorLastThread_errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 3283625137-0
Opcode ID: 6f9f1b3579f94cfaebc6fbf0fcd5291c4895944225407b78114679f626bf50e4
Instruction ID: 1559a4e5a0e97397cc405aea552aaee7d08a60d5562a7ca53b465867d56baca7
Opcode Fuzzy Hash: 6f9f1b3579f94cfaebc6fbf0fcd5291c4895944225407b78114679f626bf50e4
Instruction Fuzzy Hash: 5C21A13D60578086DB14EBAAA94075EF291FB84BE4F888235AF6983B94DF3CC054CB01

Function 00007FF6609094DC Relevance: 9.1, APIs: 6, Instructions: 63threadCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF660909507
_invalid_parameter_noinfo.LIBCMT ref: 00007FF660909512
_getptd.LIBCMT ref: 00007FF660909538
CreateThread.KERNEL32 ref: 00007FF66090958D
GetLastError.KERNEL32 ref: 00007FF660909598
free.LIBCMT ref: 00007FF6609095A3

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CreateErrorLastThread_errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 3283625137-0
Opcode ID: 3cde405814183ac50174b4c7b06ee0a655b453fe3172371e7738c2e9b2a32393
Instruction ID: dceb2789fbbf88cfb4fe330d47c6b549f31ca67de383ab1ffd07ad22e4d0ab10
Opcode Fuzzy Hash: 3cde405814183ac50174b4c7b06ee0a655b453fe3172371e7738c2e9b2a32393
Instruction Fuzzy Hash: 9C218621B0C781D5EA15DB66A9402AAB2B6FF44B90F445339EE5E8B7D7DF3CE0118740

Function 00007FF660903690 Relevance: 7.6, APIs: 5, Instructions: 74networkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 00007FF660903725
recv.WS2_32 ref: 00007FF66090374B
_errno.LIBCMT ref: 00007FF660903757
_errno.LIBCMT ref: 00007FF660903761
_errno.LIBCMT ref: 00007FF66090376E

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$recvselect
String ID:
API String ID: 4102763267-0
Opcode ID: a9cf800f0c082130cbe65a746388d6a607d03ee4f2f85c36c10afcc355ff1771
Instruction ID: 451a0c89dffb2a9a4396a1e13adab7e6557c708bfdd6b2c789fae7dec6c7f462
Opcode Fuzzy Hash: a9cf800f0c082130cbe65a746388d6a607d03ee4f2f85c36c10afcc355ff1771
Instruction Fuzzy Hash: 9B31A7B271C681E1E7745B35E40477A72B6EB44B84F446339DA4E8BB86DF3CD0008B41

Function 028676B0 Relevance: 7.6, APIs: 5, Instructions: 56processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 028676F1
Process32FirstW.KERNEL32 ref: 02867710
Process32NextW.KERNEL32 ref: 02867750
CloseHandle.KERNEL32 ref: 0286775D
CloseHandle.KERNEL32 ref: 02867786

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1789362936-0
Opcode ID: 6d084133aede52ac398ad07cdf42d3340ba2a72bb8a60b58af00913f837ec5e4
Instruction ID: 0fe79e25173c19485a5cd800e283923c4363723608a287967b09e0f95cde0f33
Opcode Fuzzy Hash: 6d084133aede52ac398ad07cdf42d3340ba2a72bb8a60b58af00913f837ec5e4
Instruction Fuzzy Hash: 0A21933D21568185DB64CB25E44C37AB7A1FB88B9CF848325DA5E86B58EF3CC105CB40

Function 0286DB90 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0286DBE9
RegQueryValueExW.ADVAPI32 ref: 0286DC13

Strings

Console, xrefs: 0286DBC3
IpDatespecial, xrefs: 0286DC04

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: OpenQueryValue
String ID: Console$IpDatespecial
API String ID: 4153817207-1840232981
Opcode ID: 9808f5570271f1bcc43127ee74aea5a2611a74c26f443a315a67f81ca2b01fbe
Instruction ID: 0dc3818f7cd4b6c4e7a8d08530fdd6460a299f964ab096eac0750d2b1c48a829
Opcode Fuzzy Hash: 9808f5570271f1bcc43127ee74aea5a2611a74c26f443a315a67f81ca2b01fbe
Instruction Fuzzy Hash: D621C23B719AA099E3208B61F8447AD77A5F74879CF848126EE8813A48CF38C19AC700

Function 00007FF660909128 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 00007FF660909136
malloc.LIBCMT ref: 00007FF660909142

Part of subcall function 00007FF660909070: _FF_MSGBANNER.LIBCMT ref: 00007FF6609090A0
Part of subcall function 00007FF660909070: HeapAlloc.KERNEL32(?,?,4E00000000000000,00007FF66090C050,?,?,ceil,00007FF66090D951,?,?,?,00007FF66090D9FB,?,?,00000000,00007FF66090B951), ref: 00007FF6609090C5
Part of subcall function 00007FF660909070: _callnewh.LIBCMT ref: 00007FF6609090DE
Part of subcall function 00007FF660909070: _errno.LIBCMT ref: 00007FF6609090E9
Part of subcall function 00007FF660909070: _errno.LIBCMT ref: 00007FF6609090F4

std::exception::exception.LIBCMT ref: 00007FF6609091AF

Strings

bad allocation, xrefs: 00007FF66090917F

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _callnewh_errno$AllocHeapmallocstd::exception::exception
String ID: bad allocation
API String ID: 2837191506-2104205924
Opcode ID: 4f08dc12cc9b3052129dc1c476ad1ada57a0f8fd3b1b96a9833c9c367f9ae114
Instruction ID: 30a9019c45a02aa4396789dba68a50cff9a5c998750958fe9b60bd68d8f2f8bc
Opcode Fuzzy Hash: 4f08dc12cc9b3052129dc1c476ad1ada57a0f8fd3b1b96a9833c9c367f9ae114
Instruction Fuzzy Hash: 7E01F761B1C607E0EA54AB10E8501B563B7EF94340F842639E95ECA7A3EE7CE155C780

Function 02869D50 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 02869D8A
GetProcessImageFileNameW.PSAPI ref: 02869DA6
CloseHandle.KERNEL32 ref: 02869DB3
CloseHandle.KERNEL32 ref: 02869DD1

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CloseHandleProcess$FileImageNameOpen
String ID:
API String ID: 93767460-0
Opcode ID: f9ca6d39da2e8c6a3f8d5f910570484524346d4c253cc5b6543d40e07020b5bd
Instruction ID: ffad153d02d010558dd5ca80cb2f385257bafbd8961d4eaa5de5ea027dcb9d25
Opcode Fuzzy Hash: f9ca6d39da2e8c6a3f8d5f910570484524346d4c253cc5b6543d40e07020b5bd
Instruction Fuzzy Hash: 660112AD31578182EF24DB25F45C36662A1BB59BC8F848135CE4D87B48EF3DD045C700

Function 00007FF66090945C Relevance: 6.0, APIs: 4, Instructions: 32threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF660909491
ExitThread.KERNEL32 ref: 00007FF660909499
GetCurrentThreadId.KERNEL32 ref: 00007FF6609094A0
_freefls.LIBCMT ref: 00007FF6609094D1

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Thread$CurrentErrorExitLast_freefls
String ID:
API String ID: 217443660-0
Opcode ID: c1032e5ba32211df7021af190faab52d392a270f38cd16aa57ea7f747e353cbe
Instruction ID: 9b40b17ae35c10df3fb41bb5365db6ca894e5f8bd80b488298d70fb8c3b02df1
Opcode Fuzzy Hash: c1032e5ba32211df7021af190faab52d392a270f38cd16aa57ea7f747e353cbe
Instruction Fuzzy Hash: A4011D24E0DB56E5EA046B71D4452BD23BAEF09B84F146638CD0ECF363EE7DA4458390

Function 00007FF660903310 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF66090334D
CancelIo.KERNEL32 ref: 00007FF66090335A
closesocket.WS2_32 ref: 00007FF66090336A
SetEvent.KERNEL32 ref: 00007FF660903374

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CancelEventclosesocketsetsockopt
String ID:
API String ID: 852421847-0
Opcode ID: 77c2693313518921cd1b9c8efffd3d9e865a5c66b2e60eb56a87be25d9ebaed2
Instruction ID: fb92add6df132b9c446cf6421dea208e5182d820b0e7c70cfd64aa0a9a25dfb2
Opcode Fuzzy Hash: 77c2693313518921cd1b9c8efffd3d9e865a5c66b2e60eb56a87be25d9ebaed2
Instruction Fuzzy Hash: F5F06D36604B81D7D7148F25E45436AB336FB88BA0F540335DBAD4B7A4CF79D0698700

Function 00007FF660903C10 Relevance: 6.0, APIs: 4, Instructions: 22synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF660903C20
SleepEx.KERNEL32 ref: 00007FF660903C2B
WaitForSingleObject.KERNEL32 ref: 00007FF660903C40
WaitForSingleObject.KERNEL32 ref: 00007FF660903C50

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ObjectSingleWait$Sleep
String ID:
API String ID: 2961732021-0
Opcode ID: bc31317e1241cbe88b87a2fddbfd8f69b2015d3f2dce8f37f5b894eda6bc4ee3
Instruction ID: 71a35b6224632fd37fe5f7deb727bb04432697bfa682b607b8bac291f78800ba
Opcode Fuzzy Hash: bc31317e1241cbe88b87a2fddbfd8f69b2015d3f2dce8f37f5b894eda6bc4ee3
Instruction Fuzzy Hash: 7AF03472B04A48D6E744CF76D8042A93376FB8DB24F641730CA3D8A3E4CF7884898320

Function 0286FE20 Relevance: 4.7, APIs: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0286FE96
RegEnumValueW.ADVAPI32 ref: 0286FF47

Part of subcall function 028755F8: malloc.LIBCMT ref: 02875612

Part of subcall function 028755F8: _callnewh.LIBCMT ref: 02875606
Part of subcall function 028755F8: std::exception::exception.LIBCMT ref: 0287567F

RegCloseKey.ADVAPI32 ref: 02870110

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CloseEnumInfoQueryValue_callnewhmallocstd::exception::exception
String ID:
API String ID: 1242514309-0
Opcode ID: 21b6ffa531e1fb87080f36f12b0947fb1935bc3c292b2138ac1d3d5bf68f2f64
Instruction ID: e63b8c96bfd204421a5ba7baab3c4a17bc1d7b02a8292c92a8cbeb8f23034914
Opcode Fuzzy Hash: 21b6ffa531e1fb87080f36f12b0947fb1935bc3c292b2138ac1d3d5bf68f2f64
Instruction Fuzzy Hash: 3C817E3A301B408ADB00DF69E88479D73A9F788B98F458226EF6D87B64EF34C555C701

Function 00007FF660903C80 Relevance: 4.7, APIs: 3, Instructions: 152memorytimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF660901080: VirtualAlloc.KERNEL32 ref: 00007FF6609010F8
Part of subcall function 00007FF660901080: VirtualFree.KERNELBASE ref: 00007FF660901133

timeGetTime.WINMM(?,?,?,?,?,00007FF6609037C7), ref: 00007FF660903D24
VirtualAlloc.KERNEL32(?,?,?,?,?,00007FF6609037C7), ref: 00007FF660903E3F
VirtualFree.KERNEL32(?,?,?,?,?,00007FF6609037C7), ref: 00007FF660903E77

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Virtual$AllocFree$Timetime
String ID:
API String ID: 3637049079-0
Opcode ID: 772ceebf875e37336e87943166f2de9f2810a96974fdecb1bd8079b0e36f7ae3
Instruction ID: 852a20171916048d16edd348fbc7244a387bd6c83b5ba33be5f8f0473ec1986d
Opcode Fuzzy Hash: 772ceebf875e37336e87943166f2de9f2810a96974fdecb1bd8079b0e36f7ae3
Instruction Fuzzy Hash: 48617232A18A52D6DB149B29D04CA6F73BAFB48B84F015239DA4E8B795DF38E445C780

Function 0286C7D0 Relevance: 4.5, APIs: 3, Instructions: 31COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0286C7F0
GdiplusStartup.GDIPLUS ref: 0286C82C
LeaveCriticalSection.KERNEL32 ref: 0286C846

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalSection$EnterGdiplusLeaveStartup
String ID:
API String ID: 389129658-0
Opcode ID: da60f929d78d2f63b72fb7356355eb002dbfafbd2e5e2885638b90ebbc7f88c4
Instruction ID: cfa74c1f74a51750b774949265f4389f5ee32d805930394590c6d721d966857d
Opcode Fuzzy Hash: da60f929d78d2f63b72fb7356355eb002dbfafbd2e5e2885638b90ebbc7f88c4
Instruction Fuzzy Hash: 4A01313A615B81D2EB109F15F848795B3F5F7A5744FC85107E68943964DFBCC159CB00

Function 0287BD14 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 0287BD2A
GetVersion.KERNEL32 ref: 0287BD3C
HeapSetInformation.KERNEL32 ref: 0287BD5A

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 7cfbc3600ba10913be0d99bf369f62085571deb7fe8177c71bd152516bdef674
Instruction ID: eed4d6f22158ba834efa06aee8fb9b654b1a6202fa45a570ca78bb4a8c4214ad
Opcode Fuzzy Hash: 7cfbc3600ba10913be0d99bf369f62085571deb7fe8177c71bd152516bdef674
Instruction Fuzzy Hash: F6E0DF3C612A84C2FB945B65F84D7552222F798788FD0D01BEA4E43B54DF3CC0868B10

Function 00007FF660909EC8 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 00007FF660909EDE
GetVersion.KERNEL32 ref: 00007FF660909EF0
HeapSetInformation.KERNEL32 ref: 00007FF660909F0E

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: 548033a4c8ebb5abcb3e3bdf629b7b62b8a0c9b1179596de6b3cb96c9a1ceea0
Instruction ID: aea53cb257df5f67807302197e4a85b4195b82f2bb51540dff08e2c67a905fcd
Opcode Fuzzy Hash: 548033a4c8ebb5abcb3e3bdf629b7b62b8a0c9b1179596de6b3cb96c9a1ceea0
Instruction Fuzzy Hash: 63E09234B29A43D2FB895710A81577A227AFF98384F802638E90EC6756DF7CE445CB84

Function 028100DC Relevance: 3.4, APIs: 2, Instructions: 391memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 02810157
LoadLibraryA.KERNEL32 ref: 028102BD

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 22a59f860d870a6bcf201ec3191bb530606b5caa03c236b8628a20c22f198a64
Instruction ID: 24d84e8ac275bd997bf27c43daa18495dda9ede40f3c276e1b525ba48bca8d8f
Opcode Fuzzy Hash: 22a59f860d870a6bcf201ec3191bb530606b5caa03c236b8628a20c22f198a64
Instruction Fuzzy Hash: 87B1B539614E0A8BCB2C9E69C8856B5B3E4FB54319B15413DEC8EC7291EB74E8D2C7C1

Function 028666B0 Relevance: 3.1, APIs: 2, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 0286670D
SysAllocString.OLEAUT32 ref: 02866759

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 37c7eda1fc14ccb20b40b4972395f454460bfd1e1c29be7e040f8245d3cdd862
Instruction ID: 8d3ace924d0ef5217a006104939b296bdac78484a378f2e905e6874f0e4f69bd
Opcode Fuzzy Hash: 37c7eda1fc14ccb20b40b4972395f454460bfd1e1c29be7e040f8245d3cdd862
Instruction Fuzzy Hash: F321563D202B9181EF199F55E1583386268AF50BA8F1C47398F6D8BB94FF7DC4118740

Function 02863A40 Relevance: 3.1, APIs: 2, Instructions: 66networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 02863AA3
send.WS2_32 ref: 02863AF0

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: d0ae4d2fbc79c699570b411c092e8fac233cba77cf9ac9c238a55a0d91b9a40b
Instruction ID: a5eb0760b933473dccb9b3d30625467cc90667d16b110776f5081429cb048644
Opcode Fuzzy Hash: d0ae4d2fbc79c699570b411c092e8fac233cba77cf9ac9c238a55a0d91b9a40b
Instruction Fuzzy Hash: 5211262E704BD141E3209B26F88873A7A54F788FD8F542161EF5AD3B54EBB9C0928701

Function 00007FF660903B10 Relevance: 3.1, APIs: 2, Instructions: 66networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF660903B73
send.WS2_32 ref: 00007FF660903BC0

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 993fe9fb8bd5cda1ffd7d49de116850fd78509aad300088003f3a940471f662b
Instruction ID: 0c15599e246cb9ef836b232113abeb97a6fc8dc367b00561e92427016f38b72d
Opcode Fuzzy Hash: 993fe9fb8bd5cda1ffd7d49de116850fd78509aad300088003f3a940471f662b
Instruction Fuzzy Hash: 8A210B22B0CA9290E3605B26B84577A7669FB84BD8F046235DF5ED7B53EEBCD4428340

Function 02870170 Relevance: 3.0, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 028701A1
free.LIBCMT ref: 028701E4

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CreateHeapfree
String ID:
API String ID: 2345683253-0
Opcode ID: 5355ca0c2c7f68d72ca0deb5608f946a487617abf1cba7d6c45117941fe628d7
Instruction ID: 0f6e99e47257aaeb4530e41128888a1ad90a3f87a10ffa5b24fec424fc3ab6ba
Opcode Fuzzy Hash: 5355ca0c2c7f68d72ca0deb5608f946a487617abf1cba7d6c45117941fe628d7
Instruction Fuzzy Hash: D0115BBA521760CAE754CF28E48031977B8F748F48F64911AEB4997B18CB78C492CB84

Function 00007FF660908650 Relevance: 3.0, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32 ref: 00007FF660908681
free.LIBCMT ref: 00007FF6609086C4

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CreateHeapfree
String ID:
API String ID: 2345683253-0
Opcode ID: d06350443261b5c44dc0382cd6166cd32f98e0a7bcc8923f0c5a309339592e20
Instruction ID: 97edbeff3d5c72eb7e646a2e042c8a7aeb056bed934f25fc68b61a090aa12035
Opcode Fuzzy Hash: d06350443261b5c44dc0382cd6166cd32f98e0a7bcc8923f0c5a309339592e20
Instruction Fuzzy Hash: 74115172A15760C6E744CF24E48021936FDFB48F48F25513AEB499B759CF78D482CB80

Function 028637C0 Relevance: 3.0, APIs: 2, Instructions: 37sleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 028637EB
timeGetTime.WINMM ref: 0286380F

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: 8ba189807d10781ce9f7bbddadc3a74c6f7bd83e01ef95e7953e346e1cdbb878
Instruction ID: 777df05bb9c1c0be199ed794b9f1b4cabfbaa6542df38b6a0809c20ff0f84f8d
Opcode Fuzzy Hash: 8ba189807d10781ce9f7bbddadc3a74c6f7bd83e01ef95e7953e346e1cdbb878
Instruction Fuzzy Hash: 81018B3AB14680C7E7288B69E68C37C2771F748F89F845265DB5A83B90CFB8C4A5C701

Function 00007FF6609037E0 Relevance: 3.0, APIs: 2, Instructions: 37timeCOMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 00007FF66090380B
timeGetTime.WINMM ref: 00007FF66090382F

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: 88df6c9814dd7951e769eaa4fec861968935f3fc4ebb5d812e480bd371ef65fc
Instruction ID: 9628f92da19bc8e75538870529063452b89af69eb2aeab54389d27eeb7bb5b4c
Opcode Fuzzy Hash: 88df6c9814dd7951e769eaa4fec861968935f3fc4ebb5d812e480bd371ef65fc
Instruction Fuzzy Hash: DA018022A0C645E7E7648B34D18473D2672FB44B84F04A378DB5F8AB91CF78D4A5C741

Function 02871DD0 Relevance: 3.0, APIs: 2, Instructions: 20synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 02871DFB
WaitForSingleObject.KERNEL32 ref: 02871E0E

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: fe1e6dd7a0d7d9773822c04724471c00a9c4c89ee4f5eb478abf33e2b4483c6e
Instruction ID: 5684edeb92a5664e044e88a0e1e57799cae13f1f1a3b221194b6102cae30138c
Opcode Fuzzy Hash: fe1e6dd7a0d7d9773822c04724471c00a9c4c89ee4f5eb478abf33e2b4483c6e
Instruction Fuzzy Hash: B2E0483DD11A4081FBA0DB64BC4D3553695F7A4354F90C226D54D82B64FF3CC0558704

Function 00007FF660901080 Relevance: 2.6, APIs: 2, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF6609010F8
VirtualFree.KERNELBASE ref: 00007FF660901133

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 26e2137525513526dd013d54ad7f142b8e6e46a3c1df15383bd1b51481be757a
Instruction ID: fe3775e0aa619ac003ebf98b0996a487b04c0ae17f97ad527a9e779c7ccfb0ee
Opcode Fuzzy Hash: 26e2137525513526dd013d54ad7f142b8e6e46a3c1df15383bd1b51481be757a
Instruction Fuzzy Hash: CF41153270CA8597D74DCA2AE45056AB3A6FB85BC8F049238EA4A8B759DF38D541C780

Function 02861140 Relevance: 2.6, APIs: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 028611B1
VirtualFree.KERNEL32 ref: 028611E5

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: a7907fc47371d8ea5bd45931dab553867b38b76e3d69a2c4af86bce9e67ffd8b
Instruction ID: c187a0cab08aed18895beb186fe09a85776d8aa2227c4c9c274cea291e8dfbdb
Opcode Fuzzy Hash: a7907fc47371d8ea5bd45931dab553867b38b76e3d69a2c4af86bce9e67ffd8b
Instruction Fuzzy Hash: 7F21A13A715A408BD744CB2AE544719B3A1F788B84F549521EB5AD3B08EF38D8E28B40

Function 00007FF6609011F0 Relevance: 2.6, APIs: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF660901261
VirtualFree.KERNELBASE ref: 00007FF660901295

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 95b57b51fc333e6316162f6326f5110e0a83f6deb2dcaf3171337f97a5765aa6
Instruction ID: db5705a5e9aa23ef14b0f34b65255b926e6de1a09c70dfef67482a4b6cf1fbe2
Opcode Fuzzy Hash: 95b57b51fc333e6316162f6326f5110e0a83f6deb2dcaf3171337f97a5765aa6
Instruction Fuzzy Hash: 8721B632B18941D7DB48CB2EE14021973B6FB49B84F549235EA5AD7749DF38E8D28B40

Function 02861080 Relevance: 2.6, APIs: 2, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 028610D3
VirtualFree.KERNEL32 ref: 0286110C

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f1a96c915ccf0ad4eed1430c910f3da438602d1a86d24f0baeb0599d625581a0
Instruction ID: ce1a4240d6c3450c8e38b92b6cac439b181cebce41baaa77ee740db3f9c14078
Opcode Fuzzy Hash: f1a96c915ccf0ad4eed1430c910f3da438602d1a86d24f0baeb0599d625581a0
Instruction Fuzzy Hash: 6F11C439721B848ADB58CF3AB544719F3A5E788BC4F58D125DA4AD3718EF38C892CB40

Function 00007FF6609174F0 Relevance: 1.5, APIs: 1, Instructions: 22networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF660917520

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 69ce0e59409c3ed63e01fee79cb91035653ccaefa39d6bbe4741f0a49fc59aaf
Instruction ID: 1e9b3ded4e6473acbfafc760840e8fc4b8f0b2379be032bc68d2af76b1995000
Opcode Fuzzy Hash: 69ce0e59409c3ed63e01fee79cb91035653ccaefa39d6bbe4741f0a49fc59aaf
Instruction Fuzzy Hash: E4F05E35B18A86EEE700DF20D8150A973BAFB48304F849636E99DCB756DE3CE114CB00

Function 00007FF660909430 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF660909434

Part of subcall function 00007FF66090BA34: _amsg_exit.LIBCMT ref: 00007FF66090BA4A

Part of subcall function 00007FF66090940C: ExitThread.KERNEL32 ref: 00007FF660909428

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ExitThread_amsg_exit_getptd
String ID:
API String ID: 449628364-0
Opcode ID: 556d5509b120e02cdcca8f06fb680f1e7bbffed6d54eb6d90fa9cde67232f795
Instruction ID: 16fdf7879a33fa640da4a2e406cdad392736c1857f3667a42fd6da941108be80
Opcode Fuzzy Hash: 556d5509b120e02cdcca8f06fb680f1e7bbffed6d54eb6d90fa9cde67232f795
Instruction Fuzzy Hash: 24C01212F4B241D2DE08737184AA6BC12B2EFCAB00F40A278E10F87383CD2C945A8280

Function 00007FF66090940C Relevance: 1.5, APIs: 1, Instructions: 10threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF66090B9B0: GetLastError.KERNEL32(?,?,?,00007FF66090938D,?,?,?,?,00007FF660914BEE,?,?,?,?,00007FF660912ED1), ref: 00007FF66090B9BA
Part of subcall function 00007FF66090B9B0: FlsGetValue.KERNEL32(?,?,?,00007FF66090938D,?,?,?,?,00007FF660914BEE,?,?,?,?,00007FF660912ED1), ref: 00007FF66090B9C8
Part of subcall function 00007FF66090B9B0: FlsSetValue.KERNEL32(?,?,?,00007FF66090938D,?,?,?,?,00007FF660914BEE,?,?,?,?,00007FF660912ED1), ref: 00007FF66090B9F4
Part of subcall function 00007FF66090B9B0: GetCurrentThreadId.KERNEL32 ref: 00007FF66090BA08
Part of subcall function 00007FF66090B9B0: SetLastError.KERNEL32(?,?,?,00007FF66090938D,?,?,?,?,00007FF660914BEE,?,?,?,?,00007FF660912ED1), ref: 00007FF66090BA20

ExitThread.KERNEL32 ref: 00007FF660909428

Part of subcall function 00007FF66090BB8C: FlsGetValue.KERNEL32(?,?,?,00007FF660909426), ref: 00007FF66090BBA5
Part of subcall function 00007FF66090BB8C: FlsSetValue.KERNEL32(?,?,?,00007FF660909426), ref: 00007FF66090BBB6
Part of subcall function 00007FF66090BB8C: _freefls.LIBCMT ref: 00007FF66090BBBF

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Value$ErrorLastThread$CurrentExit_freefls
String ID:
API String ID: 1216290073-0
Opcode ID: c93bf5a72a887f659e3f866e1ba6ff3216b61a395110430233b074b26d48111d
Instruction ID: 72c641242e5ddc0bb407fe7cac5cf2924874119faaa592e12c672d31db8b0d9a
Opcode Fuzzy Hash: c93bf5a72a887f659e3f866e1ba6ff3216b61a395110430233b074b26d48111d
Instruction Fuzzy Hash: 77C00260F1D616E2EE196771255547922765F58740E083A3CDA1F8E393ED7CA4458290

Non-executed Functions

Function 02869170 Relevance: 59.7, APIs: 25, Strings: 9, Instructions: 202libraryloaderprocessCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 028691FB
CreateProcessA.KERNEL32 ref: 0286925E
OpenProcess.KERNEL32 ref: 02869283
LoadLibraryA.KERNEL32 ref: 028692B1
GetProcAddress.KERNEL32 ref: 028692C1
LoadLibraryA.KERNEL32 ref: 028692D2
GetProcAddress.KERNEL32 ref: 028692E2
LoadLibraryA.KERNEL32 ref: 028692F3
GetProcAddress.KERNEL32 ref: 02869303
LoadLibraryA.KERNEL32 ref: 02869314
GetProcAddress.KERNEL32 ref: 02869324
GetCurrentProcess.KERNEL32 ref: 0286932E
GetProcessId.KERNEL32 ref: 02869337
GetModuleFileNameA.KERNEL32 ref: 0286936B
VirtualAllocEx.KERNEL32 ref: 028693A1
WriteProcessMemory.KERNEL32 ref: 028693C4

Strings

WinExec, xrefs: 028692F9
Kernel32.dll, xrefs: 028692AA, 028692C7, 028692E8, 02869309
Windows\System32\svchost.exe, xrefs: 02869201
%s%s, xrefs: 0286920F
WaitForSingleObject, xrefs: 0286931A
@, xrefs: 02869415
h, xrefs: 028691DB
OpenProcess, xrefs: 028692B7
ExitProcess, xrefs: 028692D8

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Process$AddressLibraryLoadProc$AllocCreateCurrentDirectoryFileMemoryModuleNameOpenSystemVirtualWrite
String ID: %s%s$@$ExitProcess$Kernel32.dll$OpenProcess$WaitForSingleObject$WinExec$Windows\System32\svchost.exe$h
API String ID: 675209239-4110464286
Opcode ID: 52ee398f02bbc98b8c9999d93ed425826fb6b28bff95aa8a10a5d848b399f8ca
Instruction ID: c0fcbf5bcfbfe69dd7ffa15777847ab4fbbd796d8f76d75803a7dac2a3db866b
Opcode Fuzzy Hash: 52ee398f02bbc98b8c9999d93ed425826fb6b28bff95aa8a10a5d848b399f8ca
Instruction Fuzzy Hash: 57913A39315B8186EB21CF61F8187AA73A5FB99B88FC48025DA4D57B58EF3DC249C740

Function 0286EE40 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 302windowCOMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0286EE81
GetDC.USER32 ref: 0286EE8A
CreateCompatibleDC.GDI32 ref: 0286EE96
GetDC.USER32 ref: 0286EEA2
GetDeviceCaps.GDI32 ref: 0286EEB3
GetDeviceCaps.GDI32 ref: 0286EEC3
ReleaseDC.USER32 ref: 0286EEE0
GetSystemMetrics.USER32 ref: 0286EEFE
GetSystemMetrics.USER32 ref: 0286EF34
GetSystemMetrics.USER32 ref: 0286EF87
GetSystemMetrics.USER32 ref: 0286EFA1
CreateCompatibleBitmap.GDI32 ref: 0286EFBF
SelectObject.GDI32 ref: 0286EFD3
SetStretchBltMode.GDI32 ref: 0286EFE1
GetSystemMetrics.USER32 ref: 0286EFEC
GetSystemMetrics.USER32 ref: 0286F006
StretchBlt.GDI32 ref: 0286F04C
GetDIBits.GDI32 ref: 0286F0F1

Part of subcall function 028755F8: malloc.LIBCMT ref: 02875612

DeleteObject.GDI32 ref: 0286F1A4
DeleteObject.GDI32 ref: 0286F1AE
ReleaseDC.USER32 ref: 0286F1B9
DeleteObject.GDI32 ref: 0286F247
DeleteObject.GDI32 ref: 0286F251
ReleaseDC.USER32 ref: 0286F25C

Strings

gfff, xrefs: 0286EF3E
, xrefs: 0286F00C
gfff, xrefs: 0286EF18

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: MetricsSystem$Object$Delete$Release$CapsCompatibleCreateDeviceStretch$BitmapBitsDesktopModeSelectWindowmalloc
String ID: $gfff$gfff
API String ID: 1524144516-4202476792
Opcode ID: 8066b90c8a4dc953b84e640f8476b70301ba565c68af8a82491631fbe9cac30a
Instruction ID: 13e5ea65c434561d29b974adc7afa1576a703f1e2b29b61fda6cbfdad377aca4
Opcode Fuzzy Hash: 8066b90c8a4dc953b84e640f8476b70301ba565c68af8a82491631fbe9cac30a
Instruction Fuzzy Hash: 2EC1B03A715B408AE705DF76E44836D73B2BB59B88F418225DE0AABB58EF38C455C740

Function 02882F80 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 465COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 02882FD6
_errno.LIBCMT ref: 02882FDD
_invalid_parameter_noinfo.LIBCMT ref: 02882FE8

Strings

U, xrefs: 02883564

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 67f0b5eaeb3921740e190712f335f91ecce0bd6accc88dea46569f73dd5c7a4a
Instruction ID: b6c2ce812d424c4b14db8b60671dad5bf82610915810c35b545979590574a2a9
Opcode Fuzzy Hash: 67f0b5eaeb3921740e190712f335f91ecce0bd6accc88dea46569f73dd5c7a4a
Instruction Fuzzy Hash: AA02E03E205A8586DB21EF29E44436EB761F784B48F984116EB8EC7B68DF3DC445CB11

Function 00007FF66090E1C0 Relevance: 40.7, APIs: 22, Strings: 1, Instructions: 465COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF66090E216
_errno.LIBCMT ref: 00007FF66090E21D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66090E228

Strings

U, xrefs: 00007FF66090E7A4

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 059fcb8d0d384e491ef6770d9f73524f45f969136b4973030bd1143b1e84cbf4
Instruction ID: 0a139ae1aef6ed05d4284d072eadaa0a1c8a0d395d91ac79e72bf12a69ac7249
Opcode Fuzzy Hash: 059fcb8d0d384e491ef6770d9f73524f45f969136b4973030bd1143b1e84cbf4
Instruction Fuzzy Hash: FA12C422A1C642E6EB208F25D44437A6776FB84B44F146239EA4ECB796EF3DE445CB40

Function 00007FF66090C28C Relevance: 32.2, APIs: 16, Strings: 2, Instructions: 722COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF66090ABF8: _getptd.LIBCMT ref: 00007FF66090AC0A

_errno.LIBCMT ref: 00007FF66090C2FF
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66090C30A
_fileno.LIBCMT ref: 00007FF66090C343
_errno.LIBCMT ref: 00007FF66090C3B6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66090C3C1
write_multi_char.LIBCMT ref: 00007FF66090C9AB
write_multi_char.LIBCMT ref: 00007FF66090C9DD
write_multi_char.LIBCMT ref: 00007FF66090CA7E
free.LIBCMT ref: 00007FF66090CA96
write_char.LIBCMT ref: 00007FF66090CBE9
write_char.LIBCMT ref: 00007FF66090CC14

Strings

@, xrefs: 00007FF66090C32F
, xrefs: 00007FF66090C97B

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: write_multi_char$_errno_invalid_parameter_noinfowrite_char$_fileno_getptdfree
String ID: $@
API String ID: 1084558760-1077428164
Opcode ID: d243f7bfa6fd055a53a23daff3e65f4d6fa7b73664807df99c45da9877ccf527
Instruction ID: 4d4512041e3992fe8511d0fc565a733b6613ffa6297f4e654d29bf449b8eb8d2
Opcode Fuzzy Hash: d243f7bfa6fd055a53a23daff3e65f4d6fa7b73664807df99c45da9877ccf527
Instruction Fuzzy Hash: 8F52C3A2E0C656E5FB248B14944427E66B3BF45744F146A3ADA4FCE7D6CF3CE8408B90

Function 0287F7F8 Relevance: 32.2, APIs: 16, Strings: 2, Instructions: 721COMMON

Download Yara Rule

APIs

Part of subcall function 02875D58: _getptd.LIBCMT ref: 02875D6A

_errno.LIBCMT ref: 0287F86B
_invalid_parameter_noinfo.LIBCMT ref: 0287F876
_fileno.LIBCMT ref: 0287F8AF
_errno.LIBCMT ref: 0287F922
_invalid_parameter_noinfo.LIBCMT ref: 0287F92D
write_multi_char.LIBCMT ref: 0287FF17
write_multi_char.LIBCMT ref: 0287FF49
write_multi_char.LIBCMT ref: 0287FFEA
free.LIBCMT ref: 02880002
write_char.LIBCMT ref: 02880155
write_char.LIBCMT ref: 02880180

Strings

@, xrefs: 0287F89B
, xrefs: 0287FEE7

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: write_multi_char$_errno_invalid_parameter_noinfowrite_char$_fileno_getptdfree
String ID: $@
API String ID: 1084558760-1077428164
Opcode ID: 03ac5d1bdc9301c8ca3c9df34c87bf5f3fb9feeef272702db5c9e1564eaafe61
Instruction ID: 0947d6551c6532def4a837db9ad10d9ff0e27ae5b783a62c02ece42c9cee6c67
Opcode Fuzzy Hash: 03ac5d1bdc9301c8ca3c9df34c87bf5f3fb9feeef272702db5c9e1564eaafe61
Instruction Fuzzy Hash: CF42247F60869486EB258B6AD54437EBBA1F79579CF285006DF8ECBE64CB38C440CB01

Function 0287CAF0 Relevance: 32.2, APIs: 16, Strings: 2, Instructions: 705COMMON

Download Yara Rule

APIs

Part of subcall function 02875D58: _getptd.LIBCMT ref: 02875D6A

_errno.LIBCMT ref: 0287CB5E
_invalid_parameter_noinfo.LIBCMT ref: 0287CB69
_fileno.LIBCMT ref: 0287CBA1
_errno.LIBCMT ref: 0287CC12
_invalid_parameter_noinfo.LIBCMT ref: 0287CC1D
write_multi_char.LIBCMT ref: 0287D1EA
write_multi_char.LIBCMT ref: 0287D21C
write_multi_char.LIBCMT ref: 0287D2C8
free.LIBCMT ref: 0287D2E1
write_char.LIBCMT ref: 0287D420
write_char.LIBCMT ref: 0287D441

Strings

@, xrefs: 0287CB8D
, xrefs: 0287D1BA

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: write_multi_char$_errno_invalid_parameter_noinfowrite_char$_fileno_getptdfree
String ID: $@
API String ID: 1084558760-1077428164
Opcode ID: c7796815577772ce18d3e5aab90d9a5c4550496c256c24ff41890e78ec68314e
Instruction ID: b0d5bf4755d3f236cdd199938e6fbaf77b51d256b775776191da7993da486335
Opcode Fuzzy Hash: c7796815577772ce18d3e5aab90d9a5c4550496c256c24ff41890e78ec68314e
Instruction Fuzzy Hash: 874267BE61868486EB24CB69D54437E6B71FB45B8CF185017DF5ECBAA8DB78C441CB00

Function 00007FF66090AD44 Relevance: 32.2, APIs: 16, Strings: 2, Instructions: 705COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF66090ABF8: _getptd.LIBCMT ref: 00007FF66090AC0A

_errno.LIBCMT ref: 00007FF66090ADB2
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66090ADBD
_fileno.LIBCMT ref: 00007FF66090ADF5
_errno.LIBCMT ref: 00007FF66090AE66
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66090AE71
write_multi_char.LIBCMT ref: 00007FF66090B43E
write_multi_char.LIBCMT ref: 00007FF66090B470
write_multi_char.LIBCMT ref: 00007FF66090B51C
free.LIBCMT ref: 00007FF66090B535
write_char.LIBCMT ref: 00007FF66090B674
write_char.LIBCMT ref: 00007FF66090B695

Strings

@, xrefs: 00007FF66090ADE1
, xrefs: 00007FF66090B40E

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: write_multi_char$_errno_invalid_parameter_noinfowrite_char$_fileno_getptdfree
String ID: $@
API String ID: 1084558760-1077428164
Opcode ID: 658b0638e96a2018847d66b84efea279705a0a6da686782ae5e0afd207c87506
Instruction ID: 7d300196fee459ace5d602c9caff3859fef4ce16387efef6ae78b36e95db241d
Opcode Fuzzy Hash: 658b0638e96a2018847d66b84efea279705a0a6da686782ae5e0afd207c87506
Instruction Fuzzy Hash: 9952D162A1C642E6FB658B18945037E6AB2BF41784F142639DA4FCE7D6CF3DE940C780

Function 028864D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 194COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 028864EB

Part of subcall function 0287E2A0: _amsg_exit.LIBCMT ref: 0287E2B6

GetUserDefaultLCID.KERNEL32 ref: 028865EB
GetLocaleInfoW.KERNEL32 ref: 0288664F
IsValidCodePage.KERNEL32 ref: 028866C1
IsValidLocale.KERNEL32 ref: 028866D7
GetLocaleInfoA.KERNEL32 ref: 02886751
GetLocaleInfoA.KERNEL32 ref: 0288676E
_itow_s.LIBCMT ref: 0288678C

Strings

Norwegian-Nynorsk, xrefs: 02886712
OCP, xrefs: 0288662B
ACP, xrefs: 02886618

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Locale$Info$Valid$CodeDefaultPageUser_amsg_exit_getptd_itow_s
String ID: ACP$Norwegian-Nynorsk$OCP
API String ID: 1236750932-4064345498
Opcode ID: 9a2c596c094c2287d6757c1580c0f3a5b9abb677b0832c662cd382cd010940e6
Instruction ID: f4770be1faee562d97b31488070c58bbdb6a7a88040e527e03d5897b1b059d52
Opcode Fuzzy Hash: 9a2c596c094c2287d6757c1580c0f3a5b9abb677b0832c662cd382cd010940e6
Instruction Fuzzy Hash: A571BE7E3007A186EB25BF25E4487A923A9FB44B48F888526CF0D87688EF7CD845C741

Function 0286F780 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 143stringprocessCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 0286F813
lstrlenW.KERNEL32 ref: 0286F835
wsprintfW.USER32 ref: 0286F891
ExpandEnvironmentStringsW.KERNEL32 ref: 0286F8F8
lstrcatW.KERNEL32 ref: 0286F933
lstrcatW.KERNEL32 ref: 0286F940
lstrcpyW.KERNEL32 ref: 0286F94E
CreateProcessW.KERNEL32 ref: 0286F9BD

Strings

"%1, xrefs: 0286F8FE
h, xrefs: 0286F964
, xrefs: 0286F822
%s\shell\open\command, xrefs: 0286F883
WinSta0\Default, xrefs: 0286F970

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: lstrcatlstrlen$CreateEnvironmentExpandProcessStringslstrcpywsprintf
String ID: $"%1$%s\shell\open\command$WinSta0\Default$h
API String ID: 1783372451-2159495357
Opcode ID: e70bed83e782989fc0487152cab15a78fd48d91328039faaa8541382b054b103
Instruction ID: 212f48d1805dabb83c4e0be8e86315976dcfc3eba67978cda53d53447108fc63
Opcode Fuzzy Hash: e70bed83e782989fc0487152cab15a78fd48d91328039faaa8541382b054b103
Instruction Fuzzy Hash: EF51833E311A8595EB20DF65E8583E97366FB9874CF844025CB4E87E68EF38C246CB41

Function 02869710 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 112libraryloaderfileCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 02869746
GetProcAddress.KERNEL32 ref: 02869759
GetProcAddress.KERNEL32 ref: 0286976C
GetProcAddress.KERNEL32 ref: 0286977F
GetProcAddress.KERNEL32 ref: 02869792
CreateFileW.KERNEL32 ref: 028697FF
WriteFile.KERNEL32 ref: 0286984F
CloseHandle.KERNEL32 ref: 02869872

Strings

InternetOpenW, xrefs: 0286974C
InternetOpenUrlW, xrefs: 0286975F
InternetReadFile, xrefs: 02869785
wininet.dll, xrefs: 0286973C
InternetCloseHandle, xrefs: 02869772

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: AddressProc$File$CloseCreateHandleLibraryLoadWrite
String ID: InternetCloseHandle$InternetOpenUrlW$InternetOpenW$InternetReadFile$wininet.dll
API String ID: 933684181-1032619545
Opcode ID: d6150c431756500377e6d13ee1469ee8492a15e05ab10de94b05086a6ef9d668
Instruction ID: da3c7773f4649d2d042a911f8001328ba2d1052cb0f9df0b9f3fde1a67e4264d
Opcode Fuzzy Hash: d6150c431756500377e6d13ee1469ee8492a15e05ab10de94b05086a6ef9d668
Instruction Fuzzy Hash: 7D41A32D31565646EF20CF62F818B666360FB89BE8F949126DE4E47B94DF3CC14A8B00

Function 02832A51 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 704COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 02832AA7
_errno.LIBCMT ref: 02832AAE
_invalid_parameter_noinfo.LIBCMT ref: 02832AB9

Strings

U, xrefs: 02833035

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: bdc9c5b48201d5cab8793ea432b9ced24bb94fac02a96976a29fb9171e5abc2b
Instruction ID: 6bf4ad0085ea32dba5deeb45afb35f1423c83d7155c774af854aa5089f0fe6ad
Opcode Fuzzy Hash: bdc9c5b48201d5cab8793ea432b9ced24bb94fac02a96976a29fb9171e5abc2b
Instruction Fuzzy Hash: ED221839218A498BD72ADF6CC8457BAB3E1FB85704F54065EE88BC3155DB74E842CBC2

Function 028811B0 Relevance: 20.3, APIs: 13, Instructions: 753COMMON

Download Yara Rule

APIs

Part of subcall function 02875D58: _getptd.LIBCMT ref: 02875D6A

_errno.LIBCMT ref: 02881227
_invalid_parameter_noinfo.LIBCMT ref: 02881232
DecodePointer.KERNEL32 ref: 0288180C
DecodePointer.KERNEL32 ref: 0288184D
DecodePointer.KERNEL32 ref: 02881872
write_multi_char.LIBCMT ref: 0288190C
write_multi_char.LIBCMT ref: 02881941
write_char.LIBCMT ref: 0288198D
write_multi_char.LIBCMT ref: 028819E5
free.LIBCMT ref: 02881A0C
_errno.LIBCMT ref: 02881CC7
_invalid_parameter_noinfo.LIBCMT ref: 02881CD2

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: DecodePointerwrite_multi_char$_errno_invalid_parameter_noinfo$_getptdfreewrite_char
String ID:
API String ID: 3562693915-0
Opcode ID: d58751d878f3980e8ae9990ffb1ed5ef57901bb55af9d072bad2d2e8a0fde4ef
Instruction ID: 8603538d9800548b4b23365d71336d86b6840e5114856ba9a0efba10b19bbdd8
Opcode Fuzzy Hash: d58751d878f3980e8ae9990ffb1ed5ef57901bb55af9d072bad2d2e8a0fde4ef
Instruction Fuzzy Hash: 6842E27E60868486EB24AB69D44837E7BB2F781798F18451ADF4EC7B94DF79C442CB00

Function 0286F9F0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 138registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0286FA66
RegQueryValueExW.ADVAPI32 ref: 0286FAD9
lstrcpyW.KERNEL32 ref: 0286FC30
RegCloseKey.ADVAPI32 ref: 0286FC42
RegCloseKey.ADVAPI32 ref: 0286FC4D

Strings

%08X, xrefs: 0286FBDE

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Close$OpenQueryValuelstrcpy
String ID: %08X
API String ID: 2032971926-3773563069
Opcode ID: d4dcac77e52b290c5c99e958f3a08ee84a86dd612c1d2329fd870c9631bd3da2
Instruction ID: 6cf591655e6a20ca693fd055706917daa93fd092053c2574b4659800d2ed8ef0
Opcode Fuzzy Hash: d4dcac77e52b290c5c99e958f3a08ee84a86dd612c1d2329fd870c9631bd3da2
Instruction Fuzzy Hash: 4D51827A319A8086EB60CB15F48876BB361F7D9794F945125EB8E83F68DF38C146CB04

Function 028698B0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 102threadinjectionprocessCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 02869950
CreateProcessA.KERNEL32 ref: 028699B8
VirtualAllocEx.KERNEL32 ref: 028699E9
WriteProcessMemory.KERNEL32 ref: 02869A0A
GetThreadContext.KERNEL32 ref: 02869A24
SetThreadContext.KERNEL32 ref: 02869A3E
ResumeThread.KERNEL32 ref: 02869A51

Strings

Windows\System32\svchost.exe, xrefs: 02869956
%s%s, xrefs: 02869964
@, xrefs: 028699DE
h, xrefs: 02869924

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Thread$ContextProcess$AllocCreateDirectoryMemoryResumeSystemVirtualWrite
String ID: %s%s$@$Windows\System32\svchost.exe$h
API String ID: 4033188109-2160973000
Opcode ID: f9087cf5fae0cee7d505e30a2631e8a65dd45cc2cab60f045d47eef95fa297c2
Instruction ID: 4ef771d4c516bce8c72f528b13d6c50c21e3b313d2feb680281c38d2170b0e6b
Opcode Fuzzy Hash: f9087cf5fae0cee7d505e30a2631e8a65dd45cc2cab60f045d47eef95fa297c2
Instruction Fuzzy Hash: 46419F7A204BC185EB20CF65E8447AAB7A5F788B88F844015DB8D9BE68DF7DC255CB00

Function 00007FF660906C80 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 101threadinjectionprocessCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 00007FF660906D2B
CreateProcessA.KERNEL32 ref: 00007FF660906D92
VirtualAllocEx.KERNEL32 ref: 00007FF660906DC1
WriteProcessMemory.KERNEL32 ref: 00007FF660906DE0
GetThreadContext.KERNEL32 ref: 00007FF660906E01
SetThreadContext.KERNEL32 ref: 00007FF660906E1F
ResumeThread.KERNEL32 ref: 00007FF660906E31

Strings

%s%s, xrefs: 00007FF660906D40
@, xrefs: 00007FF660906DB6
h, xrefs: 00007FF660906CF5
Windows\System32\tracerpt.exe, xrefs: 00007FF660906D31

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Thread$ContextProcess$AllocCreateDirectoryMemoryResumeSystemVirtualWrite
String ID: %s%s$@$Windows\System32\tracerpt.exe$h
API String ID: 4033188109-528786837
Opcode ID: ccbe77caa5910820af2e6a65459cec20809b89b451be36ee65506754dcdfb72f
Instruction ID: 6aa163169cfdd629af8be38e126b262c921dc7e1d247424853ad1a97f04be1db
Opcode Fuzzy Hash: ccbe77caa5910820af2e6a65459cec20809b89b451be36ee65506754dcdfb72f
Instruction Fuzzy Hash: BC41303260CA82D5E720CF21E8407AA73B6FB88B44F446139DA8D8BB5ADF7DD555CB40

Function 02868F30 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 02868F45
OpenProcessToken.ADVAPI32 ref: 02868F58
LookupPrivilegeValueW.ADVAPI32 ref: 02868F78
AdjustTokenPrivileges.ADVAPI32 ref: 02868FA2
CloseHandle.KERNEL32 ref: 02868FAD
GetModuleHandleA.KERNEL32 ref: 02868FBA
GetProcAddress.KERNEL32 ref: 02868FCA
OpenProcess.KERNEL32 ref: 02869002

Strings

SeDebugPrivilege, xrefs: 02868F67
NtDll.dll, xrefs: 02868FB3
NtSetInformationProcess, xrefs: 02868FC0

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Process$HandleOpenToken$AddressAdjustCloseCurrentLookupModulePrivilegePrivilegesProcValue
String ID: NtDll.dll$NtSetInformationProcess$SeDebugPrivilege
API String ID: 2787840106-1577477132
Opcode ID: d7562ad186f9c76f12a185dc633e30c61f1f79ca552b767149f0c40940437c0f
Instruction ID: 4435a1dfed2fe14412d8ab3aa9c71dbad64319f9c9aa266cbf64e3dbc0fbc544
Opcode Fuzzy Hash: d7562ad186f9c76f12a185dc633e30c61f1f79ca552b767149f0c40940437c0f
Instruction Fuzzy Hash: E421507A316B4186EB10DB61F41C36AB3A1FB99B48FC44116DA4E47B54EF7CC18ACB40

Function 0286C400 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 169timeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 0286C440
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 0286C507
CreateEventW.KERNEL32 ref: 0286C548
CreateEventW.KERNEL32 ref: 0286C576
CreateEventW.KERNEL32 ref: 0286C5A4
timeGetTime.WINMM ref: 0286C6BA
CreateEventW.KERNEL32 ref: 0286C6CF
CreateEventW.KERNEL32 ref: 0286C6E3

Strings

<, xrefs: 0286C487
<, xrefs: 0286C48E

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CreateEvent$CountCriticalInitializeSectionSpinTimetime
String ID: <$<
API String ID: 4111701721-213342407
Opcode ID: 50d1c9d799ae0883ac624c27727ad0547cbe81534f72b6f884d53c983f92a473
Instruction ID: aabc164531cfd7d8402cf857ae631e9e550b3a94410a73894a34866b8d79b2bf
Opcode Fuzzy Hash: 50d1c9d799ae0883ac624c27727ad0547cbe81534f72b6f884d53c983f92a473
Instruction Fuzzy Hash: B181797A211B9186E744CF34E85879D33A9F744F48F58823ADF598B798CF798051CB60

Function 00007FF66090A30C Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 159fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 00007FF66090A351
_set_error_mode.LIBCMT ref: 00007FF66090A362
GetModuleFileNameW.KERNEL32 ref: 00007FF66090A3C4

Part of subcall function 00007FF66090A740: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF66090A7E2), ref: 00007FF66090A758

GetStdHandle.KERNEL32 ref: 00007FF66090A4D9
WriteFile.KERNEL32 ref: 00007FF66090A536

Strings

Runtime Error!Program: , xrefs: 00007FF66090A391
..., xrefs: 00007FF66090A416
ceil, xrefs: 00007FF66090A31C
Microsoft Visual C++ Runtime Library, xrefs: 00007FF66090A47D
<program name unknown>, xrefs: 00007FF66090A3D3

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: File_set_error_mode$CurrentHandleModuleNameProcessWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $ceil
API String ID: 2183313154-2708072404
Opcode ID: 44de1f721c027da7a128cc94a5ad70c9ea0fd816ea6c17f66893cfbd735dff7b
Instruction ID: e6eb3e5bac654839e34024f92357f80c02c597e67cb5b61d9d27824c310a8c9e
Opcode Fuzzy Hash: 44de1f721c027da7a128cc94a5ad70c9ea0fd816ea6c17f66893cfbd735dff7b
Instruction Fuzzy Hash: CD51E321B1C642E1F624D725A8156BA62B7FF84780F406339EE5FCAB97DF3CE5058680

Function 0287D638 Relevance: 17.2, APIs: 11, Instructions: 726COMMON

Download Yara Rule

APIs

Part of subcall function 02875D58: _getptd.LIBCMT ref: 02875D6A

_errno.LIBCMT ref: 0287D6AF
_invalid_parameter_noinfo.LIBCMT ref: 0287D6BA
DecodePointer.KERNEL32 ref: 0287DC76
DecodePointer.KERNEL32 ref: 0287DCB7
DecodePointer.KERNEL32 ref: 0287DCDC
write_multi_char.LIBCMT ref: 0287DD6E
write_multi_char.LIBCMT ref: 0287DDA3
write_char.LIBCMT ref: 0287DDF2
write_multi_char.LIBCMT ref: 0287DE4A

Part of subcall function 0287D58C: _errno.LIBCMT ref: 0287D5B0

free.LIBCMT ref: 0287DE71

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: DecodePointerwrite_multi_char$_errno$_getptd_invalid_parameter_noinfofreewrite_char
String ID:
API String ID: 1806013980-0
Opcode ID: 3782c11b08637887bbe0001277ea22891da8fc78fac2bcefdce39dbaa47e7f8d
Instruction ID: 2b9e86fc6205e13a495600775cd0c86aaa615b91b0ae7d2839ff160e0938a8e3
Opcode Fuzzy Hash: 3782c11b08637887bbe0001277ea22891da8fc78fac2bcefdce39dbaa47e7f8d
Instruction Fuzzy Hash: C742E17F60868486EB258B69D4403BEBBB1FB81B88F185416DF4ED7BA4DB79C440CB40

Function 0287C15C Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 159fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 0287C1A1
_set_error_mode.LIBCMT ref: 0287C1B2
GetModuleFileNameW.KERNEL32 ref: 0287C214
GetStdHandle.KERNEL32 ref: 0287C329
WriteFile.KERNEL32 ref: 0287C386

Strings

<program name unknown>, xrefs: 0287C223
..., xrefs: 0287C266
Microsoft Visual C++ Runtime Library, xrefs: 0287C2CD
Runtime Error!Program: , xrefs: 0287C1E1

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: File_set_error_mode$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 1085760375-4022980321
Opcode ID: e5986bc7307d270abcff6f1ccec38af2cc00fd336f8f20fecfb491107040158e
Instruction ID: 91862472f9fc432717ae4636d202ecb13b58fda21904bc22bab61ab1b5e2bac1
Opcode Fuzzy Hash: e5986bc7307d270abcff6f1ccec38af2cc00fd336f8f20fecfb491107040158e
Instruction Fuzzy Hash: BA51F12D314B9082EB24DB2AB85876A7396F789B84F988527DE5D83B44EF3CC105CB05

Function 02825CE1 Relevance: 15.4, APIs: 10, Instructions: 379COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02825D03
_invalid_parameter_noinfo.LIBCMT ref: 02825D0F
_errno.LIBCMT ref: 02825D39
__tzset.LIBCMT ref: 02825D56
_get_daylight.LIBCMT ref: 02825D5F
_get_daylight.LIBCMT ref: 02825D70
_get_daylight.LIBCMT ref: 02825D81
_isindst.LIBCMT ref: 02825DC5
_isindst.LIBCMT ref: 02825E15
__getgmtimebuf.LIBCMT ref: 0282600F

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: d0b0b07664f7923d28e5a94db292f98a3d0de7146a782759a966602d04d626a2
Instruction ID: 2b612f9e46aa2dba66310e0e126a42e1c5bb3f3a61a82743230abffff232edf0
Opcode Fuzzy Hash: d0b0b07664f7923d28e5a94db292f98a3d0de7146a782759a966602d04d626a2
Instruction Fuzzy Hash: 9BA1E639760A094BDB5CEF3CC8992B576D2FB58306B84817FE806CA695EF78C4858B41

Function 02876210 Relevance: 15.3, APIs: 10, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02876232
_invalid_parameter_noinfo.LIBCMT ref: 0287623E
_errno.LIBCMT ref: 02876268
__tzset.LIBCMT ref: 02876285
_get_daylight.LIBCMT ref: 0287628E
_get_daylight.LIBCMT ref: 0287629F
_get_daylight.LIBCMT ref: 028762B0
_isindst.LIBCMT ref: 028762F4
_isindst.LIBCMT ref: 02876344
__getgmtimebuf.LIBCMT ref: 0287653E

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: a70f963267a58262a1adff73ee213b64dec8076670613ca4b6e4b64573aef9ec
Instruction ID: 47a648d09f91883e2ea3444c180b34b69256853162cc05e01154dff3cf019c19
Opcode Fuzzy Hash: a70f963267a58262a1adff73ee213b64dec8076670613ca4b6e4b64573aef9ec
Instruction Fuzzy Hash: F881D5BA710B5587DB68DF39C95576967AAE754788F049036DF0DCBB48FB38D0018B00

Function 02869590 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 028695A7
OpenProcessToken.ADVAPI32 ref: 028695BA
LookupPrivilegeValueW.ADVAPI32 ref: 028695E5
AdjustTokenPrivileges.ADVAPI32 ref: 02869608
GetLastError.KERNEL32 ref: 0286960E
CloseHandle.KERNEL32 ref: 0286961D
CloseHandle.KERNEL32 ref: 02869638

Strings

SeShutdownPrivilege, xrefs: 028695CB

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3435690185-3733053543
Opcode ID: e0d185422709b0f3b431866f5e592452b7913cc4dbfaabb4369ff8a97e2ecd24
Instruction ID: cb8b463c90778c2e171852b40677e1476a1115e572f6265a39081da3406a0c4c
Opcode Fuzzy Hash: e0d185422709b0f3b431866f5e592452b7913cc4dbfaabb4369ff8a97e2ecd24
Instruction Fuzzy Hash: D711917A226A41C6E750DF24F85976A73B0FB98B44FD09016EA8E86A24DF3CC085CB00

Function 02889F10 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02875D58: _getptd.LIBCMT ref: 02875D6A

_errno.LIBCMT ref: 02889F60
_invalid_parameter_noinfo.LIBCMT ref: 02889F6A
_errno.LIBCMT ref: 02889F8C
_invalid_parameter_noinfo.LIBCMT ref: 02889F98
_errno.LIBCMT ref: 02889FC0
_cftoe_l.LIBCMT ref: 0288A004

Strings

gfffffff, xrefs: 0288A28F

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$_cftoe_l_getptd
String ID: gfffffff
API String ID: 1282097019-1523873471
Opcode ID: e40ebfce44de0193f49e8945cf09baf4b1bed02b34854e78f2b7ff374fd64eef
Instruction ID: e5e0a249f9068ecd50ac9273faf80e900320baaaf177bddcea7efb89c67ac95c
Opcode Fuzzy Hash: e40ebfce44de0193f49e8945cf09baf4b1bed02b34854e78f2b7ff374fd64eef
Instruction Fuzzy Hash: 5AA1426F7047C88ADB19DB29C6403AD7BA5E7117A8F188622CF5A877D5E739D015C301

Function 00007FF6609124BC Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF66090ABF8: _getptd.LIBCMT ref: 00007FF66090AC0A

_errno.LIBCMT ref: 00007FF66091250C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF660912516
_errno.LIBCMT ref: 00007FF660912538
_invalid_parameter_noinfo.LIBCMT ref: 00007FF660912544
_errno.LIBCMT ref: 00007FF66091256C
_cftoe_l.LIBCMT ref: 00007FF6609125B0

Strings

gfffffff, xrefs: 00007FF66091283B

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$_cftoe_l_getptd
String ID: gfffffff
API String ID: 1282097019-1523873471
Opcode ID: c07b627f99c2cd4ae9dd9b17e96f21b7b9fb9e47b31fd93882c95997571751ba
Instruction ID: 5546514789b20108174a3abb30253d604444a4855a97daea44120582ca3e702f
Opcode Fuzzy Hash: c07b627f99c2cd4ae9dd9b17e96f21b7b9fb9e47b31fd93882c95997571751ba
Instruction Fuzzy Hash: 88B16B63B08386E6EB11DB2585403AD6BBAEB12794F149771CB5D8B7D7DE3CA821C300

Function 00007FF66090A5F4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF66090A661
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF66090A679
RtlVirtualUnwind.KERNEL32 ref: 00007FF66090A6B3
IsDebuggerPresent.KERNEL32 ref: 00007FF66090A6E9
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF66090A6F3
UnhandledExceptionFilter.KERNEL32 ref: 00007FF66090A6FE

Strings

ceil, xrefs: 00007FF66090A600

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID: ceil
API String ID: 1239891234-3069211559
Opcode ID: 3144257c3ae2fa2d6dbd42b967809008da2bff6455cce039acfe86bdf2b0df6d
Instruction ID: 6a0b8e90a73c96f8b005c550ada112e5cb83ac44cd06f674f1005b9f057fe2fc
Opcode Fuzzy Hash: 3144257c3ae2fa2d6dbd42b967809008da2bff6455cce039acfe86bdf2b0df6d
Instruction Fuzzy Hash: FB317332608B81E6DB20CF25E4402AE73B5FB94794F501239EA9D87B96DF7CD545CB40

Function 0286A670 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75injectionmemorysynchronizationCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32 ref: 0286A6A2
WriteProcessMemory.KERNEL32 ref: 0286A70E
WriteProcessMemory.KERNEL32 ref: 0286A735
CreateRemoteThread.KERNEL32 ref: 0286A75A
WaitForSingleObject.KERNEL32 ref: 0286A76B
VirtualFreeEx.KERNEL32 ref: 0286A782

Strings

@, xrefs: 0286A69A

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: MemoryProcessVirtualWrite$AllocCreateFreeObjectRemoteSingleThreadWait
String ID: @
API String ID: 1392168757-2766056989
Opcode ID: 1d0e15d9e6b6db6943f3edc044253c50b2dda0163e44e70869125fe5ad0bacd3
Instruction ID: 0994459e5bac08c364ed85218b8fa4f57077cdbadc72bd67ff21bb7191aa5860
Opcode Fuzzy Hash: 1d0e15d9e6b6db6943f3edc044253c50b2dda0163e44e70869125fe5ad0bacd3
Instruction Fuzzy Hash: 6031183A205B8486E724CB25F808B5AB7A4F799B94F948225EBCC43F68DF3CC111CB44

Function 0286AB60 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0286AB77
OpenProcessToken.ADVAPI32 ref: 0286AB88
LookupPrivilegeValueW.ADVAPI32 ref: 0286ABA8
AdjustTokenPrivileges.ADVAPI32 ref: 0286ABD0
GetLastError.KERNEL32 ref: 0286ABD6
CloseHandle.KERNEL32 ref: 0286ABE6

Strings

SeDebugPrivilege, xrefs: 0286AB97

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3398352648-2896544425
Opcode ID: f912f805f90fedc5f3d9f29b34704b1a31fd86a9546a1cec50171bf6703898f4
Instruction ID: bda7cfea4822efa4a7453f938aac0e7852233ed91add65d264bb6f6d2a6d80ca
Opcode Fuzzy Hash: f912f805f90fedc5f3d9f29b34704b1a31fd86a9546a1cec50171bf6703898f4
Instruction Fuzzy Hash: 8201527A216B46C6EB00CF25F84875A77B1F798B44FD49116EA8E43A28DF7CC059CB40

Function 02874F50 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 0287BA43
RtlLookupFunctionEntry.KERNEL32 ref: 0287BA62
RtlVirtualUnwind.KERNEL32 ref: 0287BAAE
IsDebuggerPresent.KERNEL32 ref: 0287BB20
SetUnhandledExceptionFilter.KERNEL32 ref: 0287BB38
UnhandledExceptionFilter.KERNEL32 ref: 0287BB45
GetCurrentProcess.KERNEL32 ref: 0287BB5E
TerminateProcess.KERNEL32 ref: 0287BB6C

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: 2aa89304d9d681174ee0ff907444ba6424267dead1d14bc8b1f46d942951e3dd
Instruction ID: 95dae1b1b53f6a8dc958dc20855aed8427feaabb78b7d9b107b50feb355ee5fd
Opcode Fuzzy Hash: 2aa89304d9d681174ee0ff907444ba6424267dead1d14bc8b1f46d942951e3dd
Instruction Fuzzy Hash: F131D73D106B84C5EB50DB54F85836AB3B5F789759F918126DA8E83B64EFBCC094CB01

Function 00007FF660908AD0 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF660909B2F
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF660909B4E
RtlVirtualUnwind.KERNEL32 ref: 00007FF660909B9A
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF66090A727), ref: 00007FF660909C0C
SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF66090A727), ref: 00007FF660909C24
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF66090A727), ref: 00007FF660909C31
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF66090A727), ref: 00007FF660909C4A
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF66090A727), ref: 00007FF660909C58

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: a174535eb0d5241deb48ece9e46a2be905d6ec3f467502f47f0e199c436921ae
Instruction ID: 79155b3d1b45a7cedfbec9527305e14a065738f8c028883cece194ec7a458c8a
Opcode Fuzzy Hash: a174535eb0d5241deb48ece9e46a2be905d6ec3f467502f47f0e199c436921ae
Instruction Fuzzy Hash: 2F312C35A1CB46E9EB509B10F45436A73B6FB84794F50223AD98D8AB67DFBCE044C740

Function 0287E8A0 Relevance: 10.6, APIs: 7, Instructions: 142COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0287E904

Part of subcall function 0287AAE0: Sleep.KERNEL32 ref: 0287AB25

free.LIBCMT ref: 0287E982
free.LIBCMT ref: 0287E9C9
GetLocaleInfoW.KERNEL32 ref: 0287EA00
GetLocaleInfoW.KERNEL32 ref: 0287EA2A
free.LIBCMT ref: 0287EA37
GetLocaleInfoW.KERNEL32 ref: 0287EA62

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: InfoLocalefree$ErrorLastSleep
String ID:
API String ID: 3746651342-0
Opcode ID: c13859b603e604d7dd6b6c796a500a98c745365b111dbd1df3118129deea9de9
Instruction ID: 14c6e73cb8c2718593739eb86988f09fefc3d6cdf87f1700f048b6c790a54e23
Opcode Fuzzy Hash: c13859b603e604d7dd6b6c796a500a98c745365b111dbd1df3118129deea9de9
Instruction Fuzzy Hash: BC41152FB1574442EB75AB25A91473AA296BB98BC9F808025CE4DC7B14EF3CC401CB01

Function 0286E29A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

OpenEventLogW.ADVAPI32 ref: 0286E2C7
ClearEventLogW.ADVAPI32 ref: 0286E2DA
CloseEventLog.ADVAPI32 ref: 0286E2E3

Strings

System, xrefs: 0286E2B0
Application, xrefs: 0286E29A
Security, xrefs: 0286E2A5

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: Application$Security$System
API String ID: 1391105993-2169399579
Opcode ID: 96663923b0ee05f66fc94d5c4e2f229e10f6e7c594b8d536ad0441e8402e872b
Instruction ID: 7464eecfd61ea567b7cd196d0812ab2b4a4a2bdb7b0210904fa912ce48de893f
Opcode Fuzzy Hash: 96663923b0ee05f66fc94d5c4e2f229e10f6e7c594b8d536ad0441e8402e872b
Instruction Fuzzy Hash: 19F04F3E602B80C9EB159B25F8087A573A4FB58758F848136DE5D43B14EF38C1D6D300

Function 0287C444 Relevance: 9.1, APIs: 6, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 0287C4B1
RtlLookupFunctionEntry.KERNEL32 ref: 0287C4C9
RtlVirtualUnwind.KERNEL32 ref: 0287C503
IsDebuggerPresent.KERNEL32 ref: 0287C539
SetUnhandledExceptionFilter.KERNEL32 ref: 0287C543
UnhandledExceptionFilter.KERNEL32 ref: 0287C54E

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 78c7d4cd206edf1b6561dabf2e90c836c4c6f27cb28aca6aab5a030fd30f2f43
Instruction ID: 46f9efddd286f45aee803d7347166694d777d603129237ea12d14202d93bec53
Opcode Fuzzy Hash: 78c7d4cd206edf1b6561dabf2e90c836c4c6f27cb28aca6aab5a030fd30f2f43
Instruction Fuzzy Hash: 2431963A204F8186DB20DF29E8447AE73A4F789758F900126EB9D83B58DF38C545CB00

Function 028690B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 028690C3
OpenProcessToken.ADVAPI32 ref: 028690D6
LookupPrivilegeValueW.ADVAPI32 ref: 02869105
AdjustTokenPrivileges.ADVAPI32 ref: 0286914A

Strings

SeDebugPrivilege, xrefs: 028690FC

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 2349140579-2896544425
Opcode ID: 54d9294af7c7f8491c8ebf4ea155e670f436f307aa670cb1e1a1b6be12c31483
Instruction ID: a915281231e35378461c60490ae813b4a4895758cfb5ff2db241ad28aed6c637
Opcode Fuzzy Hash: 54d9294af7c7f8491c8ebf4ea155e670f436f307aa670cb1e1a1b6be12c31483
Instruction Fuzzy Hash: B6112E7A209B8186EB50DF65F45935AB3B0F799748FD4401AEA8E87B18DF7DD019CB00

Function 02863BB0 Relevance: 7.8, APIs: 5, Instructions: 251memorytimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 02863C7A
VirtualAlloc.KERNEL32 ref: 02863CEF
VirtualFree.KERNEL32 ref: 02863D29
VirtualAlloc.KERNEL32 ref: 02863E85
VirtualFree.KERNEL32 ref: 02863EBA

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Virtual$AllocFree$Timetime
String ID:
API String ID: 3637049079-0
Opcode ID: d02a2a73f8a004f25326808967a150621f58b1e4c2b4bce21b140e42ef69546e
Instruction ID: b09e86796d7a72ffd1c23bab44a6f96c060139228db1a3863d7cae86016d9cb9
Opcode Fuzzy Hash: d02a2a73f8a004f25326808967a150621f58b1e4c2b4bce21b140e42ef69546e
Instruction Fuzzy Hash: D091BF7E300A849BDB19DF2AD198B6977A6F744F88F408529DB0AC7B14DF34D4A1CB50

Function 02865930 Relevance: 7.8, APIs: 5, Instructions: 250memorytimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 02865A08
VirtualAlloc.KERNEL32 ref: 02865A83
VirtualFree.KERNEL32 ref: 02865ABD
VirtualAlloc.KERNEL32 ref: 02865C27
VirtualFree.KERNEL32 ref: 02865C5C

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Virtual$AllocFree$Timetime
String ID:
API String ID: 3637049079-0
Opcode ID: 4ff45d25d52f66431eb5be40b81c55b6477ffb433d7455a93790e8431ec41cdf
Instruction ID: 6cb059e88cca6e391f5011658fba02abaff181d60f2777147210aa45ea8b6699
Opcode Fuzzy Hash: 4ff45d25d52f66431eb5be40b81c55b6477ffb433d7455a93790e8431ec41cdf
Instruction Fuzzy Hash: A591E17A310A458BDB18CF29D198B7D73A6F744B88F848529DB0AC7B18DF38D5A1C780

Function 02885FCC Relevance: 7.7, APIs: 5, Instructions: 165COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 02885FF3

Part of subcall function 0287E2A0: _amsg_exit.LIBCMT ref: 0287E2B6

GetLocaleInfoA.KERNEL32 ref: 02886028
GetLocaleInfoA.KERNEL32 ref: 02886080
GetLocaleInfoA.KERNEL32 ref: 02886174

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: InfoLocale$_amsg_exit_getptd
String ID:
API String ID: 3133215516-0
Opcode ID: 1ac9af4ac5f84c1ac2db0ee65c74d4854ca8eaddeb5a6752524009ef227a59e5
Instruction ID: 5bc01f4114f0d6ccd70ce130cac98eb784b6d447e373ad4990c299a3cb6ce24f
Opcode Fuzzy Hash: 1ac9af4ac5f84c1ac2db0ee65c74d4854ca8eaddeb5a6752524009ef227a59e5
Instruction Fuzzy Hash: 62618D3E710A85D7DB19EF65DA447EAB3A5F78874AF44402AC71ACB705EB38E064CB01

Function 02887664 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 028876AF
GetLocaleInfoW.KERNEL32 ref: 02887740
WideCharToMultiByte.KERNEL32 ref: 0288777B
free.LIBCMT ref: 0288778F

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: InfoLocale$ByteCharMultiWidefree
String ID:
API String ID: 40707599-0
Opcode ID: 11f3d4f53239f0c4f39ff4503c8ebb60816277d2ad75e44c7ab8db5b0185f449
Instruction ID: 01d50eb7c32af1ec7d0412898720fcf3182f23b56a5b23b0b6483d2fe3e37a68
Opcode Fuzzy Hash: 11f3d4f53239f0c4f39ff4503c8ebb60816277d2ad75e44c7ab8db5b0185f449
Instruction Fuzzy Hash: 3731427E211A4086DB11AF29D80075AB7A6F758BE8FA84616DB6D87B94DF38C501C700

Function 0287B340 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0287B379

Part of subcall function 0287E2A0: _amsg_exit.LIBCMT ref: 0287E2B6

Part of subcall function 0287B104: _getptd.LIBCMT ref: 0287B13E

Part of subcall function 0287AA60: malloc.LIBCMT ref: 0287AA8B
Part of subcall function 0287AA60: Sleep.KERNEL32 ref: 0287AA9E

free.LIBCMT ref: 0287B5D6
free.LIBCMT ref: 0287B60D
free.LIBCMT ref: 0287B61A

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$_getptd$Sleep_amsg_exitmalloc
String ID:
API String ID: 1310838139-0
Opcode ID: 1dc8cd8ae9f8e08abec6e49b415cb2c8d0129041e61a27614cfd938455c6127e
Instruction ID: f6a4e22a61bd1087b65d142aff6733c81889dea653a2cb52a32ff4765a83697e
Opcode Fuzzy Hash: 1dc8cd8ae9f8e08abec6e49b415cb2c8d0129041e61a27614cfd938455c6127e
Instruction Fuzzy Hash: 5991D17E3016849ADB24DF2AE5847AAB7A6F78878CF544126DF4D87B14EF38D055CB00

Function 00007FF660916130 Relevance: 5.8, Strings: 4, Instructions: 796COMMONLIBRARYCODE

Download Yara Rule

Strings

1#QNAN, xrefs: 00007FF6609162CD
1#IND, xrefs: 00007FF66091625F
1#SNAN, xrefs: 00007FF66091621A
1#INF, xrefs: 00007FF660916296

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID:
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 0-2761157908
Opcode ID: e04492fe7783e9350fb6ad516c2b891bc40bfb42d811b819843ac43adcea1734
Instruction ID: 32e39e84cec21a21c2210027b8ea0362713c4c6e4d280ae7f4fde98c7918a5a9
Opcode Fuzzy Hash: e04492fe7783e9350fb6ad516c2b891bc40bfb42d811b819843ac43adcea1734
Instruction Fuzzy Hash: 0962E577F18252DAF7248F748010BBD37BABB54348F40A675DE09ABB86DE38A915C740

Function 0288BFC0 Relevance: 5.8, Strings: 4, Instructions: 795COMMONLIBRARYCODE

Download Yara Rule

Strings

1#INF, xrefs: 0288C126
1#SNAN, xrefs: 0288C0AA
1#IND, xrefs: 0288C0EF
1#QNAN, xrefs: 0288C15D

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID:
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 0-2761157908
Opcode ID: 7df000bd44c2d7560c978c0048061725c1add1b8a1df7d99afdefb37d4ab0dba
Instruction ID: 3aedd2be26b133dd98e3222d35bf0d80478a1403911a45c6382a4d3695e75841
Opcode Fuzzy Hash: 7df000bd44c2d7560c978c0048061725c1add1b8a1df7d99afdefb37d4ab0dba
Instruction Fuzzy Hash: 8852D17FB242558BE728EFB9C010BAD37B2B75478CB44901ADE0AA7E48E7348515CB64

Function 0286FD50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 0286FD5D
ShellExecuteW.SHELL32 ref: 0286FDEF

Strings

runas, xrefs: 0286FDD2

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ExecuteShelllstrlen
String ID: runas
API String ID: 1628651668-4000483414
Opcode ID: 03c83d6ad0da52786a385f4ff622b1f094f52ef991941f4b5a3df462a20804f7
Instruction ID: c49bb082f7ac6256a6cd1732ab93f5b1e0ca644785dafae8ab74a5610f0db0e3
Opcode Fuzzy Hash: 03c83d6ad0da52786a385f4ff622b1f094f52ef991941f4b5a3df462a20804f7
Instruction Fuzzy Hash: EF11A52970468182DF14DB19F4093AAA361E789BD8F998225DF6D8BB98EF3DC1458B04

Function 028307E1 Relevance: 4.8, APIs: 3, Instructions: 302COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02830802
_invalid_parameter_noinfo.LIBCMT ref: 0283080E
_errno.LIBCMT ref: 0283083B

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 243fa11f22f8bdf27a2221707ecb54d1361e1111186494d5edbf34577f52ae8c
Instruction ID: f6d836c26efbe610657dc4c70cc07bbfad3b90c9ad806d8c3bb777f5a91942d2
Opcode Fuzzy Hash: 243fa11f22f8bdf27a2221707ecb54d1361e1111186494d5edbf34577f52ae8c
Instruction Fuzzy Hash: 86815A35764C0E0FD70D9E2C8C6A3B436C6E7E8316718927EE84BCF7A6EA34D4468641

Function 02880D10 Relevance: 4.7, APIs: 3, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02880D31
_invalid_parameter_noinfo.LIBCMT ref: 02880D3D
_errno.LIBCMT ref: 02880D6A

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 2fde4e05e0105f80059fa488bb3d222ec5cec105b56ed491c952f13e4f7ac73a
Instruction ID: 95225541f16dcf4dac87e930102d3a902287e293b00dd5c795e3f635eea57357
Opcode Fuzzy Hash: 2fde4e05e0105f80059fa488bb3d222ec5cec105b56ed491c952f13e4f7ac73a
Instruction Fuzzy Hash: 81611BABB116494BCB1C9B28DD51364A656A7D8744F48D236EA09CFBD8F73CE6018740

Function 028838D0 Relevance: 4.7, APIs: 3, Instructions: 199fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 0288390A

Part of subcall function 02882C08: _errno.LIBCMT ref: 02882C11
Part of subcall function 02882C08: _invalid_parameter_noinfo.LIBCMT ref: 02882C1C

ReadFile.KERNEL32 ref: 028839F7

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: FileRead_errno_fileno_invalid_parameter_noinfo
String ID:
API String ID: 1416837532-0
Opcode ID: a41427fd89fcf87a3ba39a7780490a73b7d354980b6212fe82374946e61b6ed5
Instruction ID: ad01b961e4211c3f3d0bf26cf7d7e550350ec13ca9bb94167ac5c77bad827553
Opcode Fuzzy Hash: a41427fd89fcf87a3ba39a7780490a73b7d354980b6212fe82374946e61b6ed5
Instruction Fuzzy Hash: F5710F6E305BC88AEB21FF25D5843A96B65F700FD8F48559ADE4D83B98DB38C482C700

Function 0288629C Relevance: 4.6, APIs: 3, Instructions: 70COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 028862BE

Part of subcall function 0287E2A0: _amsg_exit.LIBCMT ref: 0287E2B6

GetLocaleInfoA.KERNEL32 ref: 028862F3

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: InfoLocale_amsg_exit_getptd
String ID:
API String ID: 488165793-0
Opcode ID: 971ec5c8b3d1054b5cb36a7d5b7c52b067c4aa6ec322e4142c4c8dd05412ca27
Instruction ID: 37f8bd2b5340b9dbb3dba5d7c3a39fabe408bb868d0467d8b6f2e359ee1f6500
Opcode Fuzzy Hash: 971ec5c8b3d1054b5cb36a7d5b7c52b067c4aa6ec322e4142c4c8dd05412ca27
Instruction Fuzzy Hash: 5C217E3A314AC1D7DB28EB65D9447EAB3A2F788749F844026972AC7644EF38E464CB01

Function 0281E911 Relevance: 4.2, Strings: 3, Instructions: 440COMMON

Download Yara Rule

Strings

gfff, xrefs: 0281EA0F
gfff, xrefs: 0281E9E9
, xrefs: 0281EADD

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: malloc
String ID: $gfff$gfff
API String ID: 2803490479-4202476792
Opcode ID: c3e908681918788f643dfaf2f53a5c456d5ccb5fda57e6a8831e1b144d632076
Instruction ID: daed600a83c486256930f96ec7afa465ec317ccd32e4cc68f92c638e9fb708cf
Opcode Fuzzy Hash: c3e908681918788f643dfaf2f53a5c456d5ccb5fda57e6a8831e1b144d632076
Instruction Fuzzy Hash: B3D1C534A24B0C8FD759EF7CD44936977E2FF5C305F10422AA84AD7295DB349856CB81

Function 02816271 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 617COMMON

Download Yara Rule

APIs

Part of subcall function 028250C9: malloc.LIBCMT ref: 028250E3

Part of subcall function 02826045: _errno.LIBCMT ref: 02826063
Part of subcall function 02826045: _invalid_parameter_noinfo.LIBCMT ref: 0282606F

Part of subcall function 02826045: _errno.LIBCMT ref: 028260B1

_localtime64.LIBCMT ref: 0281688A

Part of subcall function 028252B1: _errno.LIBCMT ref: 028252D0
Part of subcall function 028252B1: _invalid_parameter_noinfo.LIBCMT ref: 028252DC

Strings

d, xrefs: 02816653

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$_localtime64malloc
String ID: d
API String ID: 3448128200-2564639436
Opcode ID: cfb5ec3b757334179c745541fa8331162734935ea313afeefcc79cfe94a5bac1
Instruction ID: d4f8988077d79a45c9a242966b3bfb9bed39d1693c1a594cc8d8bc9aecc571fb
Opcode Fuzzy Hash: cfb5ec3b757334179c745541fa8331162734935ea313afeefcc79cfe94a5bac1
Instruction Fuzzy Hash: 13228539618A198FDB19EF28DC95AEAB7E5FB54301F10462ED44BC3190EF34E645CB82

Function 0288B75C Relevance: 3.6, APIs: 2, Instructions: 613COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0288B7BF
_invalid_parameter_noinfo.LIBCMT ref: 0288B7CA

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: 4f06327e431c14d4e28563d6f0fcc8eedea745598733e2efd600a7036ac67516
Instruction ID: a592b764c9f55a859eaac3e555d2f051695300c72f38c94e6fd9af86cc2e1af6
Opcode Fuzzy Hash: 4f06327e431c14d4e28563d6f0fcc8eedea745598733e2efd600a7036ac67516
Instruction Fuzzy Hash: 8922007FB042898EEB24AF69D0507EC3762B79478CF84401ADF4AE7B95D739854AC701

Function 00007FF6609158CC Relevance: 3.6, APIs: 2, Instructions: 613COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF66091592F
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66091593A

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: 83054cf6376330cdffa8c0059fbe92ae39825d7729f5d374ebb6e6e75b54dafc
Instruction ID: 87e490d43297585b83997cb37ce60d7fd114234f111c0508d65f8e82768bf249
Opcode Fuzzy Hash: 83054cf6376330cdffa8c0059fbe92ae39825d7729f5d374ebb6e6e75b54dafc
Instruction Fuzzy Hash: 1032C376F08242EAF7648E6580407BC27BBBB14348F966276CE499B7C6CE3DA945C341

Function 028301F5 Relevance: 3.3, APIs: 2, Instructions: 311COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 02830467
_get_daylight.LIBCMT ref: 028304ED

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _get_daylight
String ID:
API String ID: 4143689357-0
Opcode ID: a7799652e9771fadd063df120e63502b2c124946250e25ebb5e0f696f08c898f
Instruction ID: e4116e78905961fb899d042ba0fac1b7ed45a30eb8748cde5fc9aaa4d99e526e
Opcode Fuzzy Hash: a7799652e9771fadd063df120e63502b2c124946250e25ebb5e0f696f08c898f
Instruction Fuzzy Hash: 1B9137797186054FC70DDE28DC926B573DAE799208F18D13ED887CB695EA30E50287C2

Function 0282BC2D Relevance: 3.2, APIs: 2, Instructions: 240COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 0282BC72
_set_error_mode.LIBCMT ref: 0282BC83

Part of subcall function 02825C59: _errno.LIBCMT ref: 02825C78
Part of subcall function 02825C59: _invalid_parameter_noinfo.LIBCMT ref: 02825C84

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _set_error_mode$_errno_invalid_parameter_noinfo
String ID:
API String ID: 1239817535-0
Opcode ID: e5986bc7307d270abcff6f1ccec38af2cc00fd336f8f20fecfb491107040158e
Instruction ID: 16befc9308deb146c85e5a37c82ffa364d77c08363af95e82f12ba11cb00fa5a
Opcode Fuzzy Hash: e5986bc7307d270abcff6f1ccec38af2cc00fd336f8f20fecfb491107040158e
Instruction Fuzzy Hash: F851D43C7189184B972CEF2CA85577A73D6EB84308B10852ED45FC3191DF34D58A8B86

Function 02880724 Relevance: 3.2, APIs: 2, Instructions: 235COMMONLIBRARYCODE

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 02880996

Part of subcall function 02881010: _errno.LIBCMT ref: 02881019
Part of subcall function 02881010: _invalid_parameter_noinfo.LIBCMT ref: 02881024

_get_daylight.LIBCMT ref: 02880A1C

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _get_daylight$_errno_invalid_parameter_noinfo
String ID:
API String ID: 3559991230-0
Opcode ID: 693b50c2c61a72bb5be5a43c63dc8e884891f7c57c6b944760cd3464cf5c7f55
Instruction ID: f5c2bd24ce901227b9dd3cc3b10e739c3bf3946db6c212b92f0db28d40bc7dd9
Opcode Fuzzy Hash: 693b50c2c61a72bb5be5a43c63dc8e884891f7c57c6b944760cd3464cf5c7f55
Instruction Fuzzy Hash: 6B81347AB142448BD31CEF28ED517687756F3E8345F58D126DA0ACBB94EB38EA44CB40

Function 02885E54 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 02885E7B

Part of subcall function 0287E2A0: _amsg_exit.LIBCMT ref: 0287E2B6

GetLocaleInfoA.KERNEL32 ref: 02885EB0

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: InfoLocale_amsg_exit_getptd
String ID:
API String ID: 488165793-0
Opcode ID: 72fd4da99e1eca86bf0af2b7fcd366b18db1c26e7bfc871149967434169bcbd1
Instruction ID: c31c8be23888425fa9bc6bff8564a9a2f485bcba884ba5939cef56082f8cabe2
Opcode Fuzzy Hash: 72fd4da99e1eca86bf0af2b7fcd366b18db1c26e7bfc871149967434169bcbd1
Instruction Fuzzy Hash: 56119A3A310B8496DB28DB65E84939AB3A1F388B84F894126CA5D87B14DF3CE565CB40

Function 0286E2F7 Relevance: 3.0, APIs: 2, Instructions: 23shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 02868E90: GetModuleFileNameW.KERNEL32 ref: 02868EBB
Part of subcall function 02868E90: GetCommandLineW.KERNEL32 ref: 02868EC1
Part of subcall function 02868E90: GetStartupInfoW.KERNEL32 ref: 02868ECF
Part of subcall function 02868E90: CreateProcessW.KERNEL32 ref: 02868F12
Part of subcall function 02868E90: ExitProcess.KERNEL32 ref: 02868F1B

ExitProcess.KERNEL32 ref: 0286E2FF

Part of subcall function 02869590: GetCurrentProcess.KERNEL32 ref: 028695A7
Part of subcall function 02869590: OpenProcessToken.ADVAPI32 ref: 028695BA
Part of subcall function 02869590: LookupPrivilegeValueW.ADVAPI32 ref: 028695E5
Part of subcall function 02869590: AdjustTokenPrivileges.ADVAPI32 ref: 02869608
Part of subcall function 02869590: GetLastError.KERNEL32 ref: 0286960E
Part of subcall function 02869590: CloseHandle.KERNEL32 ref: 0286961D

ExitWindowsEx.USER32 ref: 0286E315

Part of subcall function 02869590: CloseHandle.KERNEL32 ref: 02869638

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Process$Exit$CloseHandleToken$AdjustCommandCreateCurrentErrorFileInfoLastLineLookupModuleNameOpenPrivilegePrivilegesStartupValueWindows
String ID:
API String ID: 2667809516-0
Opcode ID: 3c0d1a23d52f457355619f8c4f60c2d13a0e5bbfb86ce9e69f907c3db4830095
Instruction ID: ce69ca36bfefc4c9ce8117d21ecf16fe7ca8ab11fc6f7013202d07a5ab9e30e1
Opcode Fuzzy Hash: 3c0d1a23d52f457355619f8c4f60c2d13a0e5bbfb86ce9e69f907c3db4830095
Instruction Fuzzy Hash: 0CE0263F20004081F329A774B40D3BE6202BB54725F8484378B4A829C0CE3CC0D9C700

Function 02818C41 Relevance: 2.8, Strings: 2, Instructions: 328COMMON

Download Yara Rule

Strings

@, xrefs: 02818EE6
h, xrefs: 02818CAC

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID:
String ID: @$h
API String ID: 0-1029331998
Opcode ID: 356ccbaab360810557ff1889964b79b5fb888c02031f73d35a44d1c4fd0df39d
Instruction ID: 50241bca88ae762be536d3d6941675ff40d662bbd530958fc296ea2fab484405
Opcode Fuzzy Hash: 356ccbaab360810557ff1889964b79b5fb888c02031f73d35a44d1c4fd0df39d
Instruction Fuzzy Hash: 50B18130618B488FEB69EF28D8593AA77E5FB98305F10452EA44AC3150DF78D646CB86

Function 0281BED1 Relevance: 2.7, Strings: 2, Instructions: 239COMMON

Download Yara Rule

Strings

<, xrefs: 0281BF58
<, xrefs: 0281BF5F

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID:
String ID: <$<
API String ID: 0-213342407
Opcode ID: 98a197b1dfcb439f9b42374c2483925932d179a832b92e6ab5457db0d87ca901
Instruction ID: e6012b8ed667173c8694a33fafb888b0f291d80425f0cb63f7de4e83bded372a
Opcode Fuzzy Hash: 98a197b1dfcb439f9b42374c2483925932d179a832b92e6ab5457db0d87ca901
Instruction Fuzzy Hash: 0B9129B4654B198FDBA8DF28D4D43953BE5FB48704F1842BEAC0ECE29ADB7484458F90

Function 0281F251 Relevance: 2.7, Strings: 2, Instructions: 220COMMON

Download Yara Rule

Strings

, xrefs: 0281F2F3
h, xrefs: 0281F435

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID:
String ID: $h
API String ID: 0-1972213566
Opcode ID: 124b82c8d50a204065bd587dc34c92b796fd0174f8e441d9f7b48019000610ec
Instruction ID: e75f37734762d4cc9fc3bc899947992f58c0ca1ea29634601a33ccfae48eac72
Opcode Fuzzy Hash: 124b82c8d50a204065bd587dc34c92b796fd0174f8e441d9f7b48019000610ec
Instruction Fuzzy Hash: ED61D539518B5D8BDB29EF18D8556EE73A5FBA8304F00412AD44BD3190DF38D545CB82

Function 02819381 Relevance: 2.7, Strings: 2, Instructions: 164COMMON

Download Yara Rule

Strings

h, xrefs: 028193F5
@, xrefs: 028194AF

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID:
String ID: @$h
API String ID: 0-1029331998
Opcode ID: 5025959564ab3faa289aa8550610bf0afeee09811a97fb26354f2346fbb6e16f
Instruction ID: 53b5dc2312e645ab967a4aee4c41195234fbb7532ededb987704de9e7d326263
Opcode Fuzzy Hash: 5025959564ab3faa289aa8550610bf0afeee09811a97fb26354f2346fbb6e16f
Instruction Fuzzy Hash: 1951AD34618B888FDB24EF58DC956EAB7E6FB98305F10452EE48AD3150DB78D505CB82

Function 02862850 Relevance: 1.8, Strings: 1, Instructions: 599COMMON

Download Yara Rule

Strings

[RO] %ld bytes, xrefs: 0286299A, 02862EF8, 0286305F

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID:
String ID: [RO] %ld bytes
API String ID: 0-772938740
Opcode ID: 60834e6f4583ff2073803517480cd448bedc657b73e3056a1d09e1ab8287d4ec
Instruction ID: 03737e26e84504f90a3a84fb887731af6ff125905704f410730b48f4e26595c1
Opcode Fuzzy Hash: 60834e6f4583ff2073803517480cd448bedc657b73e3056a1d09e1ab8287d4ec
Instruction Fuzzy Hash: 0142AD7B2092C48FC329CF29A44479EBBA0F355B48F048169DFC587B4ADB78E995CB50

Function 00007FF660902880 Relevance: 1.8, Strings: 1, Instructions: 599COMMON

Download Yara Rule

Strings

[RO] %ld bytes, xrefs: 00007FF6609029CA, 00007FF660902F28, 00007FF66090308F

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID:
String ID: [RO] %ld bytes
API String ID: 0-772938740
Opcode ID: 1ed3bb2f404239d74be1f07793ca469e9cb85950aa033daddafdfd33a72f81d3
Instruction ID: 209c2666ab2b87c751454eb7ac7870533da766c490b28655aeb934391d5dcd7c
Opcode Fuzzy Hash: 1ed3bb2f404239d74be1f07793ca469e9cb85950aa033daddafdfd33a72f81d3
Instruction Fuzzy Hash: 1A52BD336092C5CBC369CF28A44069EBBB1F755B48F048139DBCA8BB46DB78E955CB50

Function 0287B104 Relevance: 1.7, APIs: 1, Instructions: 156COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0287B13E

Part of subcall function 0287E2A0: _amsg_exit.LIBCMT ref: 0287E2B6

Part of subcall function 0287BCB0: _errno.LIBCMT ref: 0287BCC8
Part of subcall function 0287BCB0: _invalid_parameter_noinfo.LIBCMT ref: 0287BCD4

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _amsg_exit_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 1050512615-0
Opcode ID: 56d26e3ddcb19a20ffe236ab2256934773d61558547c107b185ec60b1d05a747
Instruction ID: 18e93da4b670927c5488fd6672b61f89ffe47d7030fad1e60caaa1b66f8dbcab
Opcode Fuzzy Hash: 56d26e3ddcb19a20ffe236ab2256934773d61558547c107b185ec60b1d05a747
Instruction Fuzzy Hash: DA519F2E31568586EB64EB66A51076EA796FB95BCCF488421DF49C7B08EF38C046CB00

Function 02885F3C Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 02885F70

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b6433f08f774cc9b7ccbf9f35c9ffbfafaf009a608a4a475b2de2a5dd20ebf61
Instruction ID: d88ea642e71709e382bb33f0fbcd1761f4def77e67a3ded7834ca3860ce1fe64
Opcode Fuzzy Hash: b6433f08f774cc9b7ccbf9f35c9ffbfafaf009a608a4a475b2de2a5dd20ebf61
Instruction Fuzzy Hash: 6001D83E200A84CADB246B29E4407697761F384F88FDA8021EB8EC7B05CF2CC982C745

Function 028863CC Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32 ref: 0288641C

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 86c6855a89ec0db458ed3bf3d980259346bfaeada53e02e6f2725571e57c10e3
Instruction ID: 47616241308cbe05d12c724d9b6b3ba1ff6e8736d67d36eec1f3183d5895c98e
Opcode Fuzzy Hash: 86c6855a89ec0db458ed3bf3d980259346bfaeada53e02e6f2725571e57c10e3
Instruction Fuzzy Hash: 5201D27E6007158BEB18AF34C1593AE33A1F754B0DF48C015CA0D8228DDBB8C1A4C781

Function 02886464 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32 ref: 02886499

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 77f7268211c430a149d89f8c5cb0cfbd65e001ec13637245fec6bc435423f769
Instruction ID: 0faf35f93e18ce6a04034fd16c6f157fc4e47f119f39aa25054ae27af357c0e6
Opcode Fuzzy Hash: 77f7268211c430a149d89f8c5cb0cfbd65e001ec13637245fec6bc435423f769
Instruction Fuzzy Hash: BEF02BAE700A1847FB18AB35C0153AE2396E3D4B0DF58C011CB0DC238DEBBCC1958741

Function 0286E327 Relevance: 1.5, APIs: 1, Instructions: 18shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 02869590: GetCurrentProcess.KERNEL32 ref: 028695A7
Part of subcall function 02869590: OpenProcessToken.ADVAPI32 ref: 028695BA
Part of subcall function 02869590: LookupPrivilegeValueW.ADVAPI32 ref: 028695E5
Part of subcall function 02869590: AdjustTokenPrivileges.ADVAPI32 ref: 02869608
Part of subcall function 02869590: GetLastError.KERNEL32 ref: 0286960E
Part of subcall function 02869590: CloseHandle.KERNEL32 ref: 0286961D

ExitWindowsEx.USER32 ref: 0286E336

Part of subcall function 02869590: CloseHandle.KERNEL32 ref: 02869638

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 1224073a08023476192b8fdb180ad1ba590ad23baeb0f21c7d276e99a92b5457
Instruction ID: 7834796eb007a6e58dcc79f15b52bfd4c623c793be617654acda3c2bf93344ae
Opcode Fuzzy Hash: 1224073a08023476192b8fdb180ad1ba590ad23baeb0f21c7d276e99a92b5457
Instruction Fuzzy Hash: FFD0123F61548085F366A765B4097A9A611B794765F4441378A5A425C19E3880D5C601

Function 0286E348 Relevance: 1.5, APIs: 1, Instructions: 18shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 02869590: GetCurrentProcess.KERNEL32 ref: 028695A7
Part of subcall function 02869590: OpenProcessToken.ADVAPI32 ref: 028695BA
Part of subcall function 02869590: LookupPrivilegeValueW.ADVAPI32 ref: 028695E5
Part of subcall function 02869590: AdjustTokenPrivileges.ADVAPI32 ref: 02869608
Part of subcall function 02869590: GetLastError.KERNEL32 ref: 0286960E
Part of subcall function 02869590: CloseHandle.KERNEL32 ref: 0286961D

ExitWindowsEx.USER32 ref: 0286E357

Part of subcall function 02869590: CloseHandle.KERNEL32 ref: 02869638

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CloseHandleProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID:
API String ID: 681424410-0
Opcode ID: 3fc61ff9c0979fd17788cd91d3c036018cd6bdd26dea6f5539fe8350fcd86185
Instruction ID: 40094087d627193c6c66ff6797278740c5e4dbd9188e692dd121e921d27ee2ee
Opcode Fuzzy Hash: 3fc61ff9c0979fd17788cd91d3c036018cd6bdd26dea6f5539fe8350fcd86185
Instruction Fuzzy Hash: F1D05B3F655484C5F366A735F4097F96211B794765F4441378F5E435C1DE3880D5C701

Function 02812E41 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

0u, xrefs: 02813026

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID:
String ID: 0u
API String ID: 0-3203441087
Opcode ID: 230c60ee35afb213df79a87b6159f30a0b26ac14629d54ba8f8f21aec2be995b
Instruction ID: a4963ab9fa671486fe1d22c1521acc116b2fa9181a827e5996018e88d9f9f2e8
Opcode Fuzzy Hash: 230c60ee35afb213df79a87b6159f30a0b26ac14629d54ba8f8f21aec2be995b
Instruction Fuzzy Hash: 8E91517061CB488FE768DF68D84576AB7E1FB99714F10492EE48BC3250DB38E446CB86

Function 00007FF66090CF6C Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF66090CF77

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9a8ff2a500159e3ed63b44506368299f85c51e85dfafb5f360626af238714718
Instruction ID: 66cba34ca797f9ec9d03733414b0973743c6adcd00fbc65214ecaa7e26089366
Opcode Fuzzy Hash: 9a8ff2a500159e3ed63b44506368299f85c51e85dfafb5f360626af238714718
Instruction Fuzzy Hash: 21B01252F1D403F1D608AB21DC8106112B36F5C330FD01970C10EC83A1DE6C91DB8700

Function 0287ACE0 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

_.,, xrefs: 0287AD60

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID:
String ID: _.,
API String ID: 0-2709443920
Opcode ID: e31d07fcf6d54c54d03e096f0b8f8fafd2347b123dfff4ee4059f28eda7688d6
Instruction ID: 9fed5eeb7fad7f1f39ce1fe14030a245160365094c8d297b1539b911b905afcd
Opcode Fuzzy Hash: e31d07fcf6d54c54d03e096f0b8f8fafd2347b123dfff4ee4059f28eda7688d6
Instruction Fuzzy Hash: 3841EF3E2006954AEB3CDB35D815B6E3B52E788788F588916DF8EC3A49DF39C541C700

Function 02812321 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a26efb2382bebc86a84c9b0f4c2d4f5d906f26eebd129ee0a5fc2402c688c2c
Instruction ID: ba998ecb98c65532fad332ab0152b116a5e5d2036e7418fde820bde26d753210
Opcode Fuzzy Hash: 4a26efb2382bebc86a84c9b0f4c2d4f5d906f26eebd129ee0a5fc2402c688c2c
Instruction Fuzzy Hash: 47528F346187858FD729CF2C84816A9BBE0FB59700F54896DDCCACB786D770E846CB92

Function 0286B2B0 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69569ac12d3564895eabb157a727b03a37ed29424b7d8047274a8acab6f1ff88
Instruction ID: 6bebf5c68d567bedf1122ff2a6c0e50e3dd2b8f34050ff38a9eef90a10b7732e
Opcode Fuzzy Hash: 69569ac12d3564895eabb157a727b03a37ed29424b7d8047274a8acab6f1ff88
Instruction Fuzzy Hash: F422D577B785504BD71CCB19E892FA977A2F394308749A52CEA17D3F44DA3DEA06CA00

Function 02821261 Relevance: .5, Instructions: 487COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: fe5c5f6412552521fe62fd147e46515a6ebc7e01adc23d764eccdfe49d4ade41
Instruction ID: 92112394cdc5bc8864e5abd586a4d6888d90686da5b8f4a3f7f5d4bc19827479
Opcode Fuzzy Hash: fe5c5f6412552521fe62fd147e46515a6ebc7e01adc23d764eccdfe49d4ade41
Instruction Fuzzy Hash: AD02A3385186588FE729EF28EC897E977E5FB89301F50422AD44FC71A1DF38A545CB82

Function 02813681 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d85790fe404774060850294cd7f9e8d6fe2b40ab218384e9ddc9023300c67734
Instruction ID: 4eb33fd42af9cae580a42cd2af064ecf527dc10a99ee9623c74120867b552291
Opcode Fuzzy Hash: d85790fe404774060850294cd7f9e8d6fe2b40ab218384e9ddc9023300c67734
Instruction Fuzzy Hash: A4B1D038608E098FCB0DEF2CC485A75B3E6FB95305710866DD85AC7699DB30E892CBC1

Function 02815401 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5221c24a0aca7a35ce8e6bb95fda48a6eff604485ecec7086a039e45792fa10a
Instruction ID: a04704caab6695a38b1350ade94d4cc62b2c76a9cda492280011901ce1bd04ff
Opcode Fuzzy Hash: 5221c24a0aca7a35ce8e6bb95fda48a6eff604485ecec7086a039e45792fa10a
Instruction Fuzzy Hash: 80B1EF38618E098FDB1DDF2CC485679B3E6FB84305B54862DE85AC7695DB34E892CBC0

Function 02817271 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc4f5f27ffffb8a2ccb8d492bd126fd03bcc1ac993aa5b4277202d1db652280
Instruction ID: 20b942282c0f00f23cfd1731a8af916340eb4ca658fbc11f00850acf84c051a8
Opcode Fuzzy Hash: 2cc4f5f27ffffb8a2ccb8d492bd126fd03bcc1ac993aa5b4277202d1db652280
Instruction Fuzzy Hash: C9A1AE3451CA488FDB68EF28D885AA9B7F5FB88304F10426EE44ED71A5DB34D946CF81

Function 0282A7B1 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba8c07e4631684e0d76da1a4f5ad0135142228191c63919e84cd2b37062d56e
Instruction ID: 557df867ecfd95b74a6d07f78bc3e5027d3d09466176dea08307d759a55d789d
Opcode Fuzzy Hash: 7ba8c07e4631684e0d76da1a4f5ad0135142228191c63919e84cd2b37062d56e
Instruction Fuzzy Hash: 1541B43C628A684FDB2DEE39985937B73D2FF44315F55896EC49BC3140DB24C9C98682

Function 0288CA74 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction ID: d7d6dd8f21dd6e6c5b243b6926e85a25733b909815c9fda69e4203557a16b530
Opcode Fuzzy Hash: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction Fuzzy Hash: 9651DD7BB156A18BD72C9F18E444F6C3AA9F794389B61E03ADB16D7F04D776C8508B00

Function 00007FF660916C50 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction ID: 34a9fa0ce148b0145d6029dd30b26951899dac8d898050a3eb86756b8de7d133
Opcode Fuzzy Hash: 5e1e48596fdf5ea50ef3df4a9aab293c2a7286e8955242186005ffd8a8896482
Instruction Fuzzy Hash: 1F51F576F182A28BE7588F18E404E683BAAF794341F51E138DB168BF81DE79DC50CB40

Function 02834A9D Relevance: 107.8, APIs: 86, Instructions: 270COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 02834AB2

Part of subcall function 02824FD1: _errno.LIBCMT ref: 02824FF1

free.LIBCMT ref: 02834ABB
free.LIBCMT ref: 02834AC4
free.LIBCMT ref: 02834ACD
free.LIBCMT ref: 02834AD6
free.LIBCMT ref: 02834ADF
free.LIBCMT ref: 02834AE7
free.LIBCMT ref: 02834AF0
free.LIBCMT ref: 02834AF9
free.LIBCMT ref: 02834B02
free.LIBCMT ref: 02834B0B
free.LIBCMT ref: 02834B14
free.LIBCMT ref: 02834B1D
free.LIBCMT ref: 02834B26
free.LIBCMT ref: 02834B2F
free.LIBCMT ref: 02834B38
free.LIBCMT ref: 02834B44
free.LIBCMT ref: 02834B50
free.LIBCMT ref: 02834B5C
free.LIBCMT ref: 02834B68
free.LIBCMT ref: 02834B74
free.LIBCMT ref: 02834B80
free.LIBCMT ref: 02834B8C
free.LIBCMT ref: 02834B98
free.LIBCMT ref: 02834BA4
free.LIBCMT ref: 02834BB0
free.LIBCMT ref: 02834BBC
free.LIBCMT ref: 02834BC8
free.LIBCMT ref: 02834BD4
free.LIBCMT ref: 02834BE0
free.LIBCMT ref: 02834BEC
free.LIBCMT ref: 02834BF8
free.LIBCMT ref: 02834C04
free.LIBCMT ref: 02834C10
free.LIBCMT ref: 02834C1C
free.LIBCMT ref: 02834C28
free.LIBCMT ref: 02834C34
free.LIBCMT ref: 02834C40
free.LIBCMT ref: 02834C4C
free.LIBCMT ref: 02834C58
free.LIBCMT ref: 02834C64
free.LIBCMT ref: 02834C70
free.LIBCMT ref: 02834C7C
free.LIBCMT ref: 02834C88
free.LIBCMT ref: 02834C94
free.LIBCMT ref: 02834CA0
free.LIBCMT ref: 02834CAC
free.LIBCMT ref: 02834CB8
free.LIBCMT ref: 02834CC4
free.LIBCMT ref: 02834CD0
free.LIBCMT ref: 02834CDC
free.LIBCMT ref: 02834CE8
free.LIBCMT ref: 02834CF4
free.LIBCMT ref: 02834D00
free.LIBCMT ref: 02834D0C
free.LIBCMT ref: 02834D18
free.LIBCMT ref: 02834D24
free.LIBCMT ref: 02834D30
free.LIBCMT ref: 02834D3C
free.LIBCMT ref: 02834D48
free.LIBCMT ref: 02834D54
free.LIBCMT ref: 02834D60
free.LIBCMT ref: 02834D6C
free.LIBCMT ref: 02834D78
free.LIBCMT ref: 02834D84
free.LIBCMT ref: 02834D90
free.LIBCMT ref: 02834D9C
free.LIBCMT ref: 02834DA8
free.LIBCMT ref: 02834DB4
free.LIBCMT ref: 02834DC0
free.LIBCMT ref: 02834DCC
free.LIBCMT ref: 02834DD8
free.LIBCMT ref: 02834DE4
free.LIBCMT ref: 02834DF0
free.LIBCMT ref: 02834DFC
free.LIBCMT ref: 02834E08
free.LIBCMT ref: 02834E14
free.LIBCMT ref: 02834E20
free.LIBCMT ref: 02834E2C
free.LIBCMT ref: 02834E38
free.LIBCMT ref: 02834E44
free.LIBCMT ref: 02834E50
free.LIBCMT ref: 02834E5C
free.LIBCMT ref: 02834E68
free.LIBCMT ref: 02834E74
free.LIBCMT ref: 02834E80

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: 9aa16b22ebdf764a21f270bcfe908f430863055a3e440207fba421ff0d466c6d
Instruction ID: 4733b0fbb7463ddc8571a0d08684253c7256426e72d50627cc4ef284f1ae381c
Opcode Fuzzy Hash: 9aa16b22ebdf764a21f270bcfe908f430863055a3e440207fba421ff0d466c6d
Instruction Fuzzy Hash: D8A16538121519CFD69EEBACC5E87993353BF8C340F848175884DCAD65CE225CDACB62

Function 02884FCC Relevance: 107.7, APIs: 86, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 02884FE1

Part of subcall function 02875500: HeapFree.KERNEL32 ref: 02875516
Part of subcall function 02875500: _errno.LIBCMT ref: 02875520
Part of subcall function 02875500: GetLastError.KERNEL32 ref: 02875528

free.LIBCMT ref: 02884FEA
free.LIBCMT ref: 02884FF3
free.LIBCMT ref: 02884FFC
free.LIBCMT ref: 02885005
free.LIBCMT ref: 0288500E
free.LIBCMT ref: 02885016
free.LIBCMT ref: 0288501F
free.LIBCMT ref: 02885028
free.LIBCMT ref: 02885031
free.LIBCMT ref: 0288503A
free.LIBCMT ref: 02885043
free.LIBCMT ref: 0288504C
free.LIBCMT ref: 02885055
free.LIBCMT ref: 0288505E
free.LIBCMT ref: 02885067
free.LIBCMT ref: 02885073
free.LIBCMT ref: 0288507F
free.LIBCMT ref: 0288508B
free.LIBCMT ref: 02885097
free.LIBCMT ref: 028850A3
free.LIBCMT ref: 028850AF
free.LIBCMT ref: 028850BB
free.LIBCMT ref: 028850C7
free.LIBCMT ref: 028850D3
free.LIBCMT ref: 028850DF
free.LIBCMT ref: 028850EB
free.LIBCMT ref: 028850F7
free.LIBCMT ref: 02885103
free.LIBCMT ref: 0288510F
free.LIBCMT ref: 0288511B
free.LIBCMT ref: 02885127
free.LIBCMT ref: 02885133
free.LIBCMT ref: 0288513F
free.LIBCMT ref: 0288514B
free.LIBCMT ref: 02885157
free.LIBCMT ref: 02885163
free.LIBCMT ref: 0288516F
free.LIBCMT ref: 0288517B
free.LIBCMT ref: 02885187
free.LIBCMT ref: 02885193
free.LIBCMT ref: 0288519F
free.LIBCMT ref: 028851AB
free.LIBCMT ref: 028851B7
free.LIBCMT ref: 028851C3
free.LIBCMT ref: 028851CF
free.LIBCMT ref: 028851DB
free.LIBCMT ref: 028851E7
free.LIBCMT ref: 028851F3
free.LIBCMT ref: 028851FF
free.LIBCMT ref: 0288520B
free.LIBCMT ref: 02885217
free.LIBCMT ref: 02885223
free.LIBCMT ref: 0288522F
free.LIBCMT ref: 0288523B
free.LIBCMT ref: 02885247
free.LIBCMT ref: 02885253
free.LIBCMT ref: 0288525F
free.LIBCMT ref: 0288526B
free.LIBCMT ref: 02885277
free.LIBCMT ref: 02885283
free.LIBCMT ref: 0288528F
free.LIBCMT ref: 0288529B
free.LIBCMT ref: 028852A7
free.LIBCMT ref: 028852B3
free.LIBCMT ref: 028852BF
free.LIBCMT ref: 028852CB
free.LIBCMT ref: 028852D7
free.LIBCMT ref: 028852E3
free.LIBCMT ref: 028852EF
free.LIBCMT ref: 028852FB
free.LIBCMT ref: 02885307
free.LIBCMT ref: 02885313
free.LIBCMT ref: 0288531F
free.LIBCMT ref: 0288532B
free.LIBCMT ref: 02885337
free.LIBCMT ref: 02885343
free.LIBCMT ref: 0288534F
free.LIBCMT ref: 0288535B
free.LIBCMT ref: 02885367
free.LIBCMT ref: 02885373
free.LIBCMT ref: 0288537F
free.LIBCMT ref: 0288538B
free.LIBCMT ref: 02885397
free.LIBCMT ref: 028853A3
free.LIBCMT ref: 028853AF

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 2c40a6e08a7c301d00fb85a56fb4c9de76b35cbe1190e94064d3f8bc8cf801af
Instruction ID: 5ede2eb0354fb7c6d26da3c8faeb5d044d24abcacc9581147475075902f1bfd4
Opcode Fuzzy Hash: 2c40a6e08a7c301d00fb85a56fb4c9de76b35cbe1190e94064d3f8bc8cf801af
Instruction Fuzzy Hash: F381582E251544C5DB45FF39C8A42AE2323EBC5F44FC44932CE6DDBA35EE29C8458B92

Function 00007FF660910A90 Relevance: 107.7, APIs: 86, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF660910AA5

Part of subcall function 00007FF660909030: HeapFree.KERNEL32(?,?,00000000,00007FF66090BA1C,?,?,?,00007FF66090938D,?,?,?,?,00007FF660914BEE), ref: 00007FF660909046
Part of subcall function 00007FF660909030: _errno.LIBCMT ref: 00007FF660909050
Part of subcall function 00007FF660909030: GetLastError.KERNEL32(?,?,00000000,00007FF66090BA1C,?,?,?,00007FF66090938D,?,?,?,?,00007FF660914BEE), ref: 00007FF660909058

free.LIBCMT ref: 00007FF660910AAE
free.LIBCMT ref: 00007FF660910AB7
free.LIBCMT ref: 00007FF660910AC0
free.LIBCMT ref: 00007FF660910AC9
free.LIBCMT ref: 00007FF660910AD2
free.LIBCMT ref: 00007FF660910ADA
free.LIBCMT ref: 00007FF660910AE3
free.LIBCMT ref: 00007FF660910AEC
free.LIBCMT ref: 00007FF660910AF5
free.LIBCMT ref: 00007FF660910AFE
free.LIBCMT ref: 00007FF660910B07
free.LIBCMT ref: 00007FF660910B10
free.LIBCMT ref: 00007FF660910B19
free.LIBCMT ref: 00007FF660910B22
free.LIBCMT ref: 00007FF660910B2B
free.LIBCMT ref: 00007FF660910B37
free.LIBCMT ref: 00007FF660910B43
free.LIBCMT ref: 00007FF660910B4F
free.LIBCMT ref: 00007FF660910B5B
free.LIBCMT ref: 00007FF660910B67
free.LIBCMT ref: 00007FF660910B73
free.LIBCMT ref: 00007FF660910B7F
free.LIBCMT ref: 00007FF660910B8B
free.LIBCMT ref: 00007FF660910B97
free.LIBCMT ref: 00007FF660910BA3
free.LIBCMT ref: 00007FF660910BAF
free.LIBCMT ref: 00007FF660910BBB
free.LIBCMT ref: 00007FF660910BC7
free.LIBCMT ref: 00007FF660910BD3
free.LIBCMT ref: 00007FF660910BDF
free.LIBCMT ref: 00007FF660910BEB
free.LIBCMT ref: 00007FF660910BF7
free.LIBCMT ref: 00007FF660910C03
free.LIBCMT ref: 00007FF660910C0F
free.LIBCMT ref: 00007FF660910C1B
free.LIBCMT ref: 00007FF660910C27
free.LIBCMT ref: 00007FF660910C33
free.LIBCMT ref: 00007FF660910C3F
free.LIBCMT ref: 00007FF660910C4B
free.LIBCMT ref: 00007FF660910C57
free.LIBCMT ref: 00007FF660910C63
free.LIBCMT ref: 00007FF660910C6F
free.LIBCMT ref: 00007FF660910C7B
free.LIBCMT ref: 00007FF660910C87
free.LIBCMT ref: 00007FF660910C93
free.LIBCMT ref: 00007FF660910C9F
free.LIBCMT ref: 00007FF660910CAB
free.LIBCMT ref: 00007FF660910CB7
free.LIBCMT ref: 00007FF660910CC3
free.LIBCMT ref: 00007FF660910CCF
free.LIBCMT ref: 00007FF660910CDB
free.LIBCMT ref: 00007FF660910CE7
free.LIBCMT ref: 00007FF660910CF3
free.LIBCMT ref: 00007FF660910CFF
free.LIBCMT ref: 00007FF660910D0B
free.LIBCMT ref: 00007FF660910D17
free.LIBCMT ref: 00007FF660910D23
free.LIBCMT ref: 00007FF660910D2F
free.LIBCMT ref: 00007FF660910D3B
free.LIBCMT ref: 00007FF660910D47
free.LIBCMT ref: 00007FF660910D53
free.LIBCMT ref: 00007FF660910D5F
free.LIBCMT ref: 00007FF660910D6B
free.LIBCMT ref: 00007FF660910D77
free.LIBCMT ref: 00007FF660910D83
free.LIBCMT ref: 00007FF660910D8F
free.LIBCMT ref: 00007FF660910D9B
free.LIBCMT ref: 00007FF660910DA7
free.LIBCMT ref: 00007FF660910DB3
free.LIBCMT ref: 00007FF660910DBF
free.LIBCMT ref: 00007FF660910DCB
free.LIBCMT ref: 00007FF660910DD7
free.LIBCMT ref: 00007FF660910DE3
free.LIBCMT ref: 00007FF660910DEF
free.LIBCMT ref: 00007FF660910DFB
free.LIBCMT ref: 00007FF660910E07
free.LIBCMT ref: 00007FF660910E13
free.LIBCMT ref: 00007FF660910E1F
free.LIBCMT ref: 00007FF660910E2B
free.LIBCMT ref: 00007FF660910E37
free.LIBCMT ref: 00007FF660910E43
free.LIBCMT ref: 00007FF660910E4F
free.LIBCMT ref: 00007FF660910E5B
free.LIBCMT ref: 00007FF660910E67
free.LIBCMT ref: 00007FF660910E73

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 60a7ffa4d2c1c72e481c1fc4b58fd09ff59adc118a18aaad8529e092a6129a8d
Instruction ID: 2041285450bba21d280aee62d3694cbf7a9bcb425f4560713d32d44a37a44d6e
Opcode Fuzzy Hash: 60a7ffa4d2c1c72e481c1fc4b58fd09ff59adc118a18aaad8529e092a6129a8d
Instruction Fuzzy Hash: 17A1652162E545D1E641BA31C8A53FD133AEFC4B84F449237D94EAE267CE16D846D3D0

Function 0286E457 Relevance: 49.3, APIs: 12, Strings: 16, Instructions: 280stringregistrysleepCOMMON

Download Yara Rule

APIs

Part of subcall function 028755F8: malloc.LIBCMT ref: 02875612

RegOpenKeyExW.ADVAPI32 ref: 0286E492
RegDeleteValueW.ADVAPI32 ref: 0286E4A3
RegSetValueExW.ADVAPI32 ref: 0286E4CE
RegCloseKey.ADVAPI32 ref: 0286E534
lstrlenW.KERNEL32 ref: 0286E5C7
lstrlenW.KERNEL32 ref: 0286E5D7
lstrlenW.KERNEL32 ref: 0286E6BD
lstrlenW.KERNEL32 ref: 0286E6CD

Part of subcall function 028755F8: _callnewh.LIBCMT ref: 02875606
Part of subcall function 028755F8: std::exception::exception.LIBCMT ref: 0287567F

Part of subcall function 028757E0: _errno.LIBCMT ref: 028757FF
Part of subcall function 028757E0: _invalid_parameter_noinfo.LIBCMT ref: 0287580B

lstrlenW.KERNEL32 ref: 0286E7AD
lstrlenW.KERNEL32 ref: 0286E7BD
RegCloseKey.ADVAPI32 ref: 0286E86C
Sleep.KERNEL32 ref: 0286E877

Strings

o2:, xrefs: 0286E6A8
IpDate, xrefs: 0286E49C, 0286E4B9
127.0.0.1, xrefs: 0286E778
o1:, xrefs: 0286E5B2
156.224.26.128, xrefs: 0286E592
8888, xrefs: 0286E6A1
o3:, xrefs: 0286E798
t1:, xrefs: 0286E5CD, 0286E60F
p1:, xrefs: 0286E599
Console, xrefs: 0286E476
6666, xrefs: 0286E5AB
t2:, xrefs: 0286E6C3, 0286E6FF
p2:, xrefs: 0286E68F
p3:, xrefs: 0286E77F
t3:, xrefs: 0286E7B3, 0286E7EF
156.224.26.128, xrefs: 0286E688

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: lstrlen$CloseValue$DeleteOpenSleep_callnewh_errno_invalid_parameter_noinfomallocstd::exception::exception
String ID: 127.0.0.1$156.224.26.128$156.224.26.128$6666$8888$Console$IpDate$o1:$o2:$o3:$p1:$p2:$p3:$t1:$t2:$t3:
API String ID: 2396878867-1569059169
Opcode ID: 7057c58cfab1a01797e5bb06403753000d21a5d3aa3c9a48ad22ea3845d09b6c
Instruction ID: 26195bb187b334c30c626d079b42b78c5f412e4e52f75f74974428aa26f233d8
Opcode Fuzzy Hash: 7057c58cfab1a01797e5bb06403753000d21a5d3aa3c9a48ad22ea3845d09b6c
Instruction Fuzzy Hash: BEB1FF6D702A5581EB10AF29E54CBB92362F754BCAF84D016CE0E97B65EF3CC18AC341

Function 00007FF66090DC88 Relevance: 40.4, APIs: 16, Strings: 7, Instructions: 136libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,?,?,00007FF6609010E2), ref: 00007FF66090DCCD
GetProcAddress.KERNEL32(?,?,?,?,00007FF6609010E2), ref: 00007FF66090DCE9
EncodePointer.KERNEL32(?,?,?,?,00007FF6609010E2), ref: 00007FF66090DCFB
GetProcAddress.KERNEL32(?,?,?,?,00007FF6609010E2), ref: 00007FF66090DD12
EncodePointer.KERNEL32(?,?,?,?,00007FF6609010E2), ref: 00007FF66090DD1B
GetProcAddress.KERNEL32(?,?,?,?,00007FF6609010E2), ref: 00007FF66090DD32
EncodePointer.KERNEL32(?,?,?,?,00007FF6609010E2), ref: 00007FF66090DD3B
GetProcAddress.KERNEL32(?,?,?,?,00007FF6609010E2), ref: 00007FF66090DD52
EncodePointer.KERNEL32(?,?,?,?,00007FF6609010E2), ref: 00007FF66090DD5B
GetProcAddress.KERNEL32(?,?,?,?,00007FF6609010E2), ref: 00007FF66090DD7A
EncodePointer.KERNEL32(?,?,?,?,00007FF6609010E2), ref: 00007FF66090DD83
DecodePointer.KERNEL32(?,?,?,?,00007FF6609010E2), ref: 00007FF66090DDB6
DecodePointer.KERNEL32(?,?,?,?,00007FF6609010E2), ref: 00007FF66090DDC6
DecodePointer.KERNEL32(?,?,?,?,00007FF6609010E2), ref: 00007FF66090DE1C
DecodePointer.KERNEL32(?,?,?,?,00007FF6609010E2), ref: 00007FF66090DE3D
DecodePointer.KERNEL32(?,?,?,?,00007FF6609010E2), ref: 00007FF66090DE57

Strings

USER32.DLL, xrefs: 00007FF66090DCC6
GetUserObjectInformationW, xrefs: 00007FF66090DD41
GetActiveWindow, xrefs: 00007FF66090DD01
GetProcessWindowStation, xrefs: 00007FF66090DD70
GetLastActivePopup, xrefs: 00007FF66090DD21
MessageBoxW, xrefs: 00007FF66090DCDF
ceil, xrefs: 00007FF66090DC8D

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL$ceil
API String ID: 2643518689-1731902841
Opcode ID: 3235768cab9551c74b9773b86dd77190edcad43fb14d3d9bf66f7ba374c6ba15
Instruction ID: 3034d2a90fcdf1d5accf7d110e8a2c318c9f6015a348565363807820e6f760f5
Opcode Fuzzy Hash: 3235768cab9551c74b9773b86dd77190edcad43fb14d3d9bf66f7ba374c6ba15
Instruction Fuzzy Hash: 2B51F524B1EB03F0FE55DB51A81417523BBAF59BD0F442679DC0E8EBA2EE7CA4558280

Function 02886B04 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 136libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 02886B49
GetProcAddress.KERNEL32 ref: 02886B65
EncodePointer.KERNEL32 ref: 02886B77
GetProcAddress.KERNEL32 ref: 02886B8E
EncodePointer.KERNEL32 ref: 02886B97
GetProcAddress.KERNEL32 ref: 02886BAE
EncodePointer.KERNEL32 ref: 02886BB7
GetProcAddress.KERNEL32 ref: 02886BCE
EncodePointer.KERNEL32 ref: 02886BD7
GetProcAddress.KERNEL32 ref: 02886BF6
EncodePointer.KERNEL32 ref: 02886BFF
DecodePointer.KERNEL32 ref: 02886C32
DecodePointer.KERNEL32 ref: 02886C42
DecodePointer.KERNEL32 ref: 02886C98
DecodePointer.KERNEL32 ref: 02886CB9
DecodePointer.KERNEL32 ref: 02886CD3

Strings

GetUserObjectInformationW, xrefs: 02886BBD
USER32.DLL, xrefs: 02886B42
GetProcessWindowStation, xrefs: 02886BEC
GetLastActivePopup, xrefs: 02886B9D
GetActiveWindow, xrefs: 02886B7D
MessageBoxW, xrefs: 02886B5B

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 2643518689-564504941
Opcode ID: dd5ed54e8927234f7e2481a09cd76468ffedfea20d48f418230764cb51715f96
Instruction ID: 317747fe2a1d638fe6cdcb560223cc1e452639969b954db9ef0563ef8e789c2b
Opcode Fuzzy Hash: dd5ed54e8927234f7e2481a09cd76468ffedfea20d48f418230764cb51715f96
Instruction Fuzzy Hash: 9C51F52C613B1591FE25EB52B85872523A5FB49BD5FD884268E1E83B20FF3DC185C311

Function 028879C4 Relevance: 32.0, APIs: 21, Instructions: 482COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 028879F5
_errno.LIBCMT ref: 028879FE
__doserrno.LIBCMT ref: 02887A58
_errno.LIBCMT ref: 02887A5F
_invalid_parameter_noinfo.LIBCMT ref: 028880CE

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfo
String ID:
API String ID: 2315031519-0
Opcode ID: 6dec9393c7a0cd143478fb176b74fc95ff16db06971bc2c8717270c6dc5f3db4
Instruction ID: 38ebf29c57960cd956275eef9c926a5c2f2d0803b84e034189efe32b54d83c00
Opcode Fuzzy Hash: 6dec9393c7a0cd143478fb176b74fc95ff16db06971bc2c8717270c6dc5f3db4
Instruction Fuzzy Hash: 0912366E6057C886EB22AF65C4803AD7B72F744B5CFA88605CF6E87795EB78C041C316

Function 02879994 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 334COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02877708: RtlLookupFunctionEntry.KERNEL32 ref: 0287777C

__GetUnwindTryBlock.LIBCMT ref: 028799F8
__SetUnwindTryBlock.LIBCMT ref: 02879A1F

Part of subcall function 028775BC: RaiseException.KERNEL32 ref: 02877637

__GetUnwindTryBlock.LIBCMT ref: 02879A29
_getptd.LIBCMT ref: 02879A7F
_getptd.LIBCMT ref: 02879A92
_getptd.LIBCMT ref: 02879A9E
_SetThrowImageBase.LIBCMT ref: 02879AB2
_getptd.LIBCMT ref: 02879B02
_getptd.LIBCMT ref: 02879B15
_getptd.LIBCMT ref: 02879B21
type_info::operator==.LIBCMT ref: 02879B88
std::exception::exception.LIBCMT ref: 02879BC1
_getptd.LIBCMT ref: 02879DF4
std::exception::exception.LIBCMT ref: 02879E6D

Strings

csm, xrefs: 02879A3F
csm, xrefs: 02879BE6
csm, xrefs: 02879ACD
bad exception, xrefs: 02879BAE

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseEntryExceptionFunctionImageLookupRaiseThrowtype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 1639654010-820278400
Opcode ID: 1b0893a1847b0cd35c406b737e4c3956a7af5d342df1b8808b3a7d7b6f68bc1b
Instruction ID: cd2afac6480e0bdc746bd57fc9e128cdccdf1a857aae70e7232b7fb3c3eb3b9f
Opcode Fuzzy Hash: 1b0893a1847b0cd35c406b737e4c3956a7af5d342df1b8808b3a7d7b6f68bc1b
Instruction Fuzzy Hash: 3ED1CE3E600A50CADB24EF7AD5847AE77A2F748B8CF444125DE4E97B18CB34D066CB46

Function 00007FF660913C88 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 334COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF660911988: RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6609119FC

__GetUnwindTryBlock.LIBCMT ref: 00007FF660913CEC
__SetUnwindTryBlock.LIBCMT ref: 00007FF660913D13

Part of subcall function 00007FF660909A88: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6609012E9), ref: 00007FF660909B03

__GetUnwindTryBlock.LIBCMT ref: 00007FF660913D1D
_getptd.LIBCMT ref: 00007FF660913D73
_getptd.LIBCMT ref: 00007FF660913D86
_getptd.LIBCMT ref: 00007FF660913D92
_SetThrowImageBase.LIBCMT ref: 00007FF660913DA6
_getptd.LIBCMT ref: 00007FF660913DF6
_getptd.LIBCMT ref: 00007FF660913E09
_getptd.LIBCMT ref: 00007FF660913E15
type_info::operator==.LIBCMT ref: 00007FF660913E7C
std::exception::exception.LIBCMT ref: 00007FF660913EB5
_getptd.LIBCMT ref: 00007FF6609140E8
std::exception::exception.LIBCMT ref: 00007FF660914161

Strings

bad exception, xrefs: 00007FF660913EA2
csm, xrefs: 00007FF660913EDA
csm, xrefs: 00007FF660913DC1
csm, xrefs: 00007FF660913D33

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseEntryExceptionFunctionImageLookupRaiseThrowtype_info::operator==
String ID: bad exception$csm$csm$csm
API String ID: 1639654010-820278400
Opcode ID: fbe037284dd962ea214ae2f94636b38ee292e4416248e112e6b35bf23fd221be
Instruction ID: 336bbb6e9f554fcbeb47da84a88d3852f7949d3e7f883f717dc7046dbc7b3a48
Opcode Fuzzy Hash: fbe037284dd962ea214ae2f94636b38ee292e4416248e112e6b35bf23fd221be
Instruction Fuzzy Hash: F1E1A226B08642E6EB249B3590402BD37BAFF19B88F446275DE4D8BB87CF38E455C740

Function 02829465 Relevance: 30.2, APIs: 14, Strings: 3, Instructions: 493COMMONLIBRARYCODE

Download Yara Rule

APIs

__GetUnwindTryBlock.LIBCMT ref: 028294C9
__SetUnwindTryBlock.LIBCMT ref: 028294F0
__GetUnwindTryBlock.LIBCMT ref: 028294FA
_getptd.LIBCMT ref: 02829550
_getptd.LIBCMT ref: 02829563
_getptd.LIBCMT ref: 0282956F
_SetThrowImageBase.LIBCMT ref: 02829583
_getptd.LIBCMT ref: 028295D3
_getptd.LIBCMT ref: 028295E6
_getptd.LIBCMT ref: 028295F2
type_info::operator==.LIBCMT ref: 02829659
std::exception::exception.LIBCMT ref: 02829692
_getptd.LIBCMT ref: 028298C5
std::exception::exception.LIBCMT ref: 0282993E

Strings

csm, xrefs: 028296B7
csm, xrefs: 0282959E
csm, xrefs: 02829510

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd$BlockUnwind$std::exception::exception$BaseImageThrowtype_info::operator==
String ID: csm$csm$csm
API String ID: 3798665358-393685449
Opcode ID: e703289ab1681031570886b67bdd3ad2315890cd872d463a38575eff1ac2c734
Instruction ID: b8d36873d5ac2e033beb456de41c20f5512815733fad92e01c32bf9d39a3e907
Opcode Fuzzy Hash: e703289ab1681031570886b67bdd3ad2315890cd872d463a38575eff1ac2c734
Instruction Fuzzy Hash: 7BE1C63C618A288FDF58AF6CD4442A9B3E1FF58315F64426ED84AD3255DB34E489CB83

Function 00007FF660908370 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 100libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF660908396
GetProcAddress.KERNEL32 ref: 00007FF6609083BE
FreeLibrary.KERNEL32 ref: 00007FF6609083CF

Strings

DbgHelp.dll, xrefs: 00007FF66090838F
%s-%04d%02d%02d-%02d%02d%02d.dmp, xrefs: 00007FF660908451
!analyze -v, xrefs: 00007FF66090844A
MiniDumpWriteDump, xrefs: 00007FF6609083AC

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: !analyze -v$%s-%04d%02d%02d-%02d%02d%02d.dmp$DbgHelp.dll$MiniDumpWriteDump
API String ID: 145871493-3774911088
Opcode ID: 480089490ec144e7b2b2c8ce8f4cc6496139fd37b894703ea7d60b2fbab28df8
Instruction ID: 2075b31c5a38139937974a86cc01489c196ac76d0f9e98c5ff4c634cedb51615
Opcode Fuzzy Hash: 480089490ec144e7b2b2c8ce8f4cc6496139fd37b894703ea7d60b2fbab28df8
Instruction Fuzzy Hash: BF414E3260CB81E6E6649B11B44426BB3B6FB89764F401335EA9E87B95DF7CD019DB00

Function 0286D780 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 224stringsleepregistryCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0286D7C8
wsprintfW.USER32 ref: 0286D810

Part of subcall function 02869A90: lstrlenW.KERNEL32 ref: 02869AC2
Part of subcall function 02869A90: lstrlenW.KERNEL32 ref: 02869ADC
Part of subcall function 02869A90: lstrlenW.KERNEL32 ref: 02869AE8

lstrlenW.KERNEL32 ref: 0286D87B
lstrlenW.KERNEL32 ref: 0286D88E
CreateEventA.KERNEL32 ref: 0286D9FE
RegOpenKeyExW.ADVAPI32 ref: 0286DA68
CloseHandle.KERNEL32 ref: 0286DAB0
Sleep.KERNEL32 ref: 0286DACE
CloseHandle.KERNEL32 ref: 0286DAF7
CloseHandle.KERNEL32 ref: 0286DB16

Strings

t1:, xrefs: 0286D884
p1:, xrefs: 0286D850
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 0286D802
Console\1, xrefs: 0286DA5A
o1:, xrefs: 0286D869

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: lstrlen$CloseHandle$CreateEventLocalOpenSleepTimewsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$Console\1$o1:$p1:$t1:
API String ID: 441366266-1614091359
Opcode ID: bd3ac582e7364394dc8e381559bbb6586ab408c141e2616aa4ae67c550a47077
Instruction ID: 3946db9edd1d0c4a27b102e5f647ad300cf7662e428be28d9fc444e7eadac737
Opcode Fuzzy Hash: bd3ac582e7364394dc8e381559bbb6586ab408c141e2616aa4ae67c550a47077
Instruction Fuzzy Hash: D291B17E305B85C6DB209F25E4487BE77A6F785B89F808116DA8E47B58DF38C245CB40

Function 028672A0 Relevance: 24.6, APIs: 2, Strings: 12, Instructions: 146windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 028672C2

Strings

Capsa, xrefs: 02867452, 0286747A
TaskExplorer, xrefs: 02867362
Metascan, xrefs: 028673AA
Malwarebytes, xrefs: 02867332
Wireshark, xrefs: 028673C2
Process, xrefs: 0286748E
Port, xrefs: 02867392
ApateDNS, xrefs: 0286731A
Fiddler, xrefs: 02867422
TCPEye, xrefs: 0286734A
Sniff, xrefs: 02867466
CurrPorts, xrefs: 0286737A

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: VisibleWindow
String ID: ApateDNS$Capsa$CurrPorts$Fiddler$Malwarebytes$Metascan$Port$Process$Sniff$TCPEye$TaskExplorer$Wireshark
API String ID: 1208467747-3439171801
Opcode ID: 6c83f4f935bc8fd318e5d8867c0384fad16a053bef60207c4fe23fe6007cb213
Instruction ID: 5fed9909608ced4e24797c59b35abad8db4baeb81a0571a9c8b57a64e4a80eb1
Opcode Fuzzy Hash: 6c83f4f935bc8fd318e5d8867c0384fad16a053bef60207c4fe23fe6007cb213
Instruction Fuzzy Hash: 64511A1CB02B1240ED19DF29B95C7749B96EB49798F8CA4719D4E8671AFF2CC1CACB40

Function 02871080 Relevance: 24.3, APIs: 16, Instructions: 279COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 028710A2
SetLastError.KERNEL32 ref: 028710C5

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 3bf04cb684953293119adb09c4abac423c49dbe06895ea3ccbae4e9aa986ae90
Instruction ID: 5b840d4f2e8413f8c07589db0fba0f5640e452a712c360f00853b54499f3b5ac
Opcode Fuzzy Hash: 3bf04cb684953293119adb09c4abac423c49dbe06895ea3ccbae4e9aa986ae90
Instruction Fuzzy Hash: 2DB18C3E312A4086DB14CF26E95876973A6FB48B88F888525CE4E87F54EF3CD595C710

Function 028641C0 Relevance: 21.1, APIs: 14, Instructions: 127networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 028641FB
WSAIoctl.WS2_32 ref: 02864250
setsockopt.WS2_32 ref: 02864272
setsockopt.WS2_32 ref: 02864294
WSACreateEvent.WS2_32 ref: 0286429A
lstrlenW.KERNEL32 ref: 028642A7
WideCharToMultiByte.KERNEL32 ref: 028642CA
lstrlenW.KERNEL32 ref: 028642E4
WideCharToMultiByte.KERNEL32 ref: 02864307
gethostbyname.WS2_32 ref: 02864314

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ByteCharMultiWidelstrlensetsockopt$CreateEventIoctlgethostbynamesocket
String ID:
API String ID: 2536029566-0
Opcode ID: 56f23a7e9dad3717f5929d4e235e4febecae6ecb8fe56b2f3ea6a90b2706ea7f
Instruction ID: d081505bd9c62cfcc8946ba94d759d03a650c36ac284d9b1f427bedb55f89aa8
Opcode Fuzzy Hash: 56f23a7e9dad3717f5929d4e235e4febecae6ecb8fe56b2f3ea6a90b2706ea7f
Instruction Fuzzy Hash: D351407A215B8086E720DF65F84475EB7A5F788BA4F544216EB9A83FA8DF3CC145CB00

Function 00007FF660904220 Relevance: 21.1, APIs: 14, Instructions: 127networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF66090425B
WSAIoctl.WS2_32 ref: 00007FF6609042B0
setsockopt.WS2_32 ref: 00007FF6609042D2
setsockopt.WS2_32 ref: 00007FF6609042F4
WSACreateEvent.WS2_32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF660903FF5), ref: 00007FF6609042FA
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF660903FF5), ref: 00007FF660904307
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF660903FF5), ref: 00007FF66090432A
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF660903FF5), ref: 00007FF660904344
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF660903FF5), ref: 00007FF660904367
gethostbyname.WS2_32 ref: 00007FF660904374

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ByteCharMultiWidelstrlensetsockopt$CreateEventIoctlgethostbynamesocket
String ID:
API String ID: 2536029566-0
Opcode ID: 45858b67ac74603b6c6b2e22d4f55fb0a5fbbce89fe0b74952fa120c8da17c65
Instruction ID: 3a64b309912350f79a5d8a2fad0a461a5994162bd241ac69a6493a75e44ea620
Opcode Fuzzy Hash: 45858b67ac74603b6c6b2e22d4f55fb0a5fbbce89fe0b74952fa120c8da17c65
Instruction Fuzzy Hash: 0D514172718B41D6E714CF65F84026AB7B6FB88BA4F101235EA9E87BA5CF7CD0458B40

Function 0287F438 Relevance: 19.6, APIs: 13, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 0287F490

Part of subcall function 0288572C: free.LIBCMT ref: 0288574A
Part of subcall function 0288572C: free.LIBCMT ref: 0288575C
Part of subcall function 0288572C: free.LIBCMT ref: 0288576E
Part of subcall function 0288572C: free.LIBCMT ref: 02885780
Part of subcall function 0288572C: free.LIBCMT ref: 02885792
Part of subcall function 0288572C: free.LIBCMT ref: 028857A4
Part of subcall function 0288572C: free.LIBCMT ref: 028857B6
Part of subcall function 0288572C: free.LIBCMT ref: 028857C8
Part of subcall function 0288572C: free.LIBCMT ref: 028857DA
Part of subcall function 0288572C: free.LIBCMT ref: 028857EC
Part of subcall function 0288572C: free.LIBCMT ref: 02885801
Part of subcall function 0288572C: free.LIBCMT ref: 02885816
Part of subcall function 0288572C: free.LIBCMT ref: 0288582B

free.LIBCMT ref: 0287F484

Part of subcall function 02875500: HeapFree.KERNEL32 ref: 02875516
Part of subcall function 02875500: _errno.LIBCMT ref: 02875520
Part of subcall function 02875500: GetLastError.KERNEL32 ref: 02875528

free.LIBCMT ref: 0287F4A6
__free_lconv_num.LIBCMT ref: 0287F4B2
free.LIBCMT ref: 0287F4BE
free.LIBCMT ref: 0287F4CA
free.LIBCMT ref: 0287F4EE
free.LIBCMT ref: 0287F502
free.LIBCMT ref: 0287F511
free.LIBCMT ref: 0287F51D
free.LIBCMT ref: 0287F54A
free.LIBCMT ref: 0287F572
free.LIBCMT ref: 0287F58C

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$ErrorFreeHeapLast__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 518839503-0
Opcode ID: a095135cf606bc1f33f2cc914cb62113a5949963045bc9d12005b9f13b61c917
Instruction ID: 7b5c1e002920487725403a9d9151bae30ac44c7b352ba28d659fd63cae6f08a7
Opcode Fuzzy Hash: a095135cf606bc1f33f2cc914cb62113a5949963045bc9d12005b9f13b61c917
Instruction Fuzzy Hash: 8F31E83E602A8485DF25EF6AD4503AC2362FB94B98F885436CF5D8BA64DF28C491C721

Function 00007FF66090F668 Relevance: 19.6, APIs: 13, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 00007FF66090F6C0

Part of subcall function 00007FF660910EEC: free.LIBCMT ref: 00007FF660910F0A
Part of subcall function 00007FF660910EEC: free.LIBCMT ref: 00007FF660910F1C
Part of subcall function 00007FF660910EEC: free.LIBCMT ref: 00007FF660910F2E
Part of subcall function 00007FF660910EEC: free.LIBCMT ref: 00007FF660910F40
Part of subcall function 00007FF660910EEC: free.LIBCMT ref: 00007FF660910F52
Part of subcall function 00007FF660910EEC: free.LIBCMT ref: 00007FF660910F64
Part of subcall function 00007FF660910EEC: free.LIBCMT ref: 00007FF660910F76
Part of subcall function 00007FF660910EEC: free.LIBCMT ref: 00007FF660910F88
Part of subcall function 00007FF660910EEC: free.LIBCMT ref: 00007FF660910F9A
Part of subcall function 00007FF660910EEC: free.LIBCMT ref: 00007FF660910FAC
Part of subcall function 00007FF660910EEC: free.LIBCMT ref: 00007FF660910FC1
Part of subcall function 00007FF660910EEC: free.LIBCMT ref: 00007FF660910FD6
Part of subcall function 00007FF660910EEC: free.LIBCMT ref: 00007FF660910FEB

free.LIBCMT ref: 00007FF66090F6B4

Part of subcall function 00007FF660909030: HeapFree.KERNEL32(?,?,00000000,00007FF66090BA1C,?,?,?,00007FF66090938D,?,?,?,?,00007FF660914BEE), ref: 00007FF660909046
Part of subcall function 00007FF660909030: _errno.LIBCMT ref: 00007FF660909050
Part of subcall function 00007FF660909030: GetLastError.KERNEL32(?,?,00000000,00007FF66090BA1C,?,?,?,00007FF66090938D,?,?,?,?,00007FF660914BEE), ref: 00007FF660909058

free.LIBCMT ref: 00007FF66090F6D6
__free_lconv_num.LIBCMT ref: 00007FF66090F6E2
free.LIBCMT ref: 00007FF66090F6EE
free.LIBCMT ref: 00007FF66090F6FA
free.LIBCMT ref: 00007FF66090F71E
free.LIBCMT ref: 00007FF66090F732
free.LIBCMT ref: 00007FF66090F741
free.LIBCMT ref: 00007FF66090F74D
free.LIBCMT ref: 00007FF66090F77A
free.LIBCMT ref: 00007FF66090F7A2
free.LIBCMT ref: 00007FF66090F7BC

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$ErrorFreeHeapLast__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 518839503-0
Opcode ID: 578f8deb9b1b94d1822c3a308d3ccdd43089e4846e4b09c0fbd9a79327202c1b
Instruction ID: 5571ab014d0d0ffb27ed37af941a754ba4cda4691d1ac3df309bcccb4a91a7cd
Opcode Fuzzy Hash: 578f8deb9b1b94d1822c3a308d3ccdd43089e4846e4b09c0fbd9a79327202c1b
Instruction Fuzzy Hash: 51418631A1E546D0EF549F11C4603B81376EF84B88F44623AD90F8E793CF6DA581C391

Function 02836DB5 Relevance: 18.2, APIs: 12, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 02836DE9

Part of subcall function 028326D9: _errno.LIBCMT ref: 028326E2
Part of subcall function 028326D9: _invalid_parameter_noinfo.LIBCMT ref: 028326ED

_fileno.LIBCMT ref: 02836E04
_fileno.LIBCMT ref: 02836E11
_fileno.LIBCMT ref: 02836E20

Part of subcall function 0282C389: _fileno.LIBCMT ref: 0282C3A6
Part of subcall function 0282C389: _errno.LIBCMT ref: 0282C3B6

_fileno.LIBCMT ref: 02836E4A
_fileno.LIBCMT ref: 02836E57
_fileno.LIBCMT ref: 02836E64
_fileno.LIBCMT ref: 02836E73
_fileno.LIBCMT ref: 02836E9D
_fileno.LIBCMT ref: 02836EAA
_fileno.LIBCMT ref: 02836EB7
_fileno.LIBCMT ref: 02836EC6

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _fileno$_errno$_invalid_parameter_noinfo
String ID:
API String ID: 482796045-0
Opcode ID: 54bd916b88af1bd575d78faf126a4c9598831ddf2921f80b296b0a36c5fb6732
Instruction ID: da8626b85c7b996ab933cc2b1a09324a74f7f0162efddf13e4ba03a0f5f5edda
Opcode Fuzzy Hash: 54bd916b88af1bd575d78faf126a4c9598831ddf2921f80b296b0a36c5fb6732
Instruction Fuzzy Hash: BF51072C228F5D5B875AAB2CC4D117973D6FF89318BA4072DD46BC31A1F72898528BC6

Function 028872E4 Relevance: 18.1, APIs: 12, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 02887318

Part of subcall function 02882C08: _errno.LIBCMT ref: 02882C11
Part of subcall function 02882C08: _invalid_parameter_noinfo.LIBCMT ref: 02882C1C

_fileno.LIBCMT ref: 02887333
_fileno.LIBCMT ref: 02887340
_fileno.LIBCMT ref: 0288734F

Part of subcall function 0287C8B8: _fileno.LIBCMT ref: 0287C8D5
Part of subcall function 0287C8B8: _errno.LIBCMT ref: 0287C8E5

_fileno.LIBCMT ref: 02887379
_fileno.LIBCMT ref: 02887386
_fileno.LIBCMT ref: 02887393
_fileno.LIBCMT ref: 028873A2
_fileno.LIBCMT ref: 028873CC
_fileno.LIBCMT ref: 028873D9
_fileno.LIBCMT ref: 028873E6
_fileno.LIBCMT ref: 028873F5

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _fileno$_errno$_invalid_parameter_noinfo
String ID:
API String ID: 482796045-0
Opcode ID: 0a44dc10160c913522ca1b89bfe8ceb34a2fb27583fbc32893239fcdff2a64c1
Instruction ID: 6dd6b65741786e8a12b5f1604a9001653d771e17bac2abd19b77c769745897a2
Opcode Fuzzy Hash: 0a44dc10160c913522ca1b89bfe8ceb34a2fb27583fbc32893239fcdff2a64c1
Instruction Fuzzy Hash: 8D512B2D61468185DB24BF3E859027DAB62FB41BACBA48311DF7EC77E4CF28C4128742

Function 02828CA1 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 02828CD1
_getptd.LIBCMT ref: 02828CE5
_getptd.LIBCMT ref: 02828D1F
_getptd.LIBCMT ref: 02828D2B
_getptd.LIBCMT ref: 02828D37
_CreateFrameInfo.LIBCMT ref: 02828D4C

Part of subcall function 02827685: _getptd.LIBCMT ref: 02827691
Part of subcall function 02827685: _getptd.LIBCMT ref: 0282769F
Part of subcall function 02827685: _getptd.LIBCMT ref: 028276B3

_getptd.LIBCMT ref: 02828D6A
_getptd.LIBCMT ref: 02828E70
_getptd.LIBCMT ref: 02828E7C

Strings

csm, xrefs: 02828E30

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd$CreateFrameInfo
String ID: csm
API String ID: 4181383844-1018135373
Opcode ID: 2863c0b21ae9c87ee342759e37cf71052126b54f7717bdb50064378975811c3c
Instruction ID: 52c6361c464663482a956450d7054fa5f62dde2748fed44f6b07aac16285804b
Opcode Fuzzy Hash: 2863c0b21ae9c87ee342759e37cf71052126b54f7717bdb50064378975811c3c
Instruction Fuzzy Hash: 37415ABC518F199FDBA8EF2C8445BA577E1FB59311F40066ED08DC3611DB30A88A8B86

Function 028791D0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 02879200

Part of subcall function 0287E2A0: _amsg_exit.LIBCMT ref: 0287E2B6

_getptd.LIBCMT ref: 02879214
_getptd.LIBCMT ref: 0287924E
_getptd.LIBCMT ref: 0287925A
_getptd.LIBCMT ref: 02879266
_CreateFrameInfo.LIBCMT ref: 0287927B

Part of subcall function 02877BB4: _getptd.LIBCMT ref: 02877BC0
Part of subcall function 02877BB4: _getptd.LIBCMT ref: 02877BCE
Part of subcall function 02877BB4: _getptd.LIBCMT ref: 02877BE2

_getptd.LIBCMT ref: 02879299
_getptd.LIBCMT ref: 0287939F
_getptd.LIBCMT ref: 028793AB

Strings

csm, xrefs: 0287935F

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd$CreateFrameInfo_amsg_exit
String ID: csm
API String ID: 2825728721-1018135373
Opcode ID: cc5a8e4b141e2d87edbd8aac0cfd5ab24d84c27de354049b2028b12f56ffd395
Instruction ID: 8df93168e7e39c65ff585d8e9729ab3192b82eff3880abfb0491bae8c0bff1c1
Opcode Fuzzy Hash: cc5a8e4b141e2d87edbd8aac0cfd5ab24d84c27de354049b2028b12f56ffd395
Instruction Fuzzy Hash: E7414C3E114B82C2CB30AB66E44076EB7A5F798BA8F445225DF9D87B54DF38C0A5CB41

Function 00007FF6609134C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF6609134F4

Part of subcall function 00007FF66090BA34: _amsg_exit.LIBCMT ref: 00007FF66090BA4A

_getptd.LIBCMT ref: 00007FF660913508
_getptd.LIBCMT ref: 00007FF660913542
_getptd.LIBCMT ref: 00007FF66091354E
_getptd.LIBCMT ref: 00007FF66091355A
_CreateFrameInfo.LIBCMT ref: 00007FF66091356F

Part of subcall function 00007FF660911E34: _getptd.LIBCMT ref: 00007FF660911E40
Part of subcall function 00007FF660911E34: _getptd.LIBCMT ref: 00007FF660911E4E
Part of subcall function 00007FF660911E34: _getptd.LIBCMT ref: 00007FF660911E62

_getptd.LIBCMT ref: 00007FF66091358D
_getptd.LIBCMT ref: 00007FF660913693
_getptd.LIBCMT ref: 00007FF66091369F

Strings

csm, xrefs: 00007FF660913653

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd$CreateFrameInfo_amsg_exit
String ID: csm
API String ID: 2825728721-1018135373
Opcode ID: f7c0f49ba4beedef2b7976ee9fce1622404532abdfe6423b84f5cde918012730
Instruction ID: 350a50084069510b83c445aa6c838ae714ccc8db45b16e48a89feeb058ec3cab
Opcode Fuzzy Hash: f7c0f49ba4beedef2b7976ee9fce1622404532abdfe6423b84f5cde918012730
Instruction Fuzzy Hash: 0F419436609782E6DA709B11E4403BA77B5FB48B94F505335EE8E4BB86DF38D055CB00

Function 028892C4 Relevance: 16.8, APIs: 11, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 028892EC
_invalid_parameter_noinfo.LIBCMT ref: 028892F7
__wtomb_environ.LIBCMT ref: 028893D9
_errno.LIBCMT ref: 028893E2
free.LIBCMT ref: 028894D3
SetEnvironmentVariableA.KERNEL32 ref: 02889604
_errno.LIBCMT ref: 02889611
free.LIBCMT ref: 0288961F
free.LIBCMT ref: 0288962C
free.LIBCMT ref: 02889653

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$_errno$EnvironmentVariable__wtomb_environ_invalid_parameter_noinfo
String ID:
API String ID: 101574016-0
Opcode ID: b7080e46a97cc4befa23429986d0ec0d682f8e2714469100a18a0e0df9c72b2a
Instruction ID: f3f89ccaa3e6df0aca0674f0cf6e580559487b1dfb3e0cc936f3ebf87623f82e
Opcode Fuzzy Hash: b7080e46a97cc4befa23429986d0ec0d682f8e2714469100a18a0e0df9c72b2a
Instruction Fuzzy Hash: AE91B16D702B8081EE15FB2AA91033E6696FB80B98F48C625CE5EC7B94EF38C055C711

Function 02865F40 Relevance: 16.6, APIs: 11, Instructions: 114COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 02865F68
EnterCriticalSection.KERNEL32 ref: 02865F8A
SetLastError.KERNEL32 ref: 02865F9D
LeaveCriticalSection.KERNEL32 ref: 02865FA7

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: aa91ab01f644cac6639e0b83305ceff7e62f4cd5bcc9a19ba73228942fb7bed4
Instruction ID: 283a0c866d39d061333da1b152528f532e42295c756621f848a61ace442a6afe
Opcode Fuzzy Hash: aa91ab01f644cac6639e0b83305ceff7e62f4cd5bcc9a19ba73228942fb7bed4
Instruction Fuzzy Hash: F041903E2006948BD754AF35E84CB2E7369FB48795F819236DA1BD32A0DF38C445CB41

Function 00007FF660905F80 Relevance: 16.6, APIs: 11, Instructions: 114COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF660905FA8
EnterCriticalSection.KERNEL32 ref: 00007FF660905FCA
SetLastError.KERNEL32 ref: 00007FF660905FDD
LeaveCriticalSection.KERNEL32 ref: 00007FF660905FE7

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: eaf03ce752c4ebeca000e1db7c8d3877467df09bf2b186c4518dfecdb3900678
Instruction ID: dec48bce9350534bec9c9a3a49b928df430cb925e1db491e2146e4043c910484
Opcode Fuzzy Hash: eaf03ce752c4ebeca000e1db7c8d3877467df09bf2b186c4518dfecdb3900678
Instruction Fuzzy Hash: 1C417D32A0C286DAE7549F25984866A73BAFF48751F002239DA1FCB392DF7CE485C740

Function 02866390 Relevance: 16.6, APIs: 11, Instructions: 98networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 028663D4
WSASetLastError.WS2_32 ref: 028663E6
LeaveCriticalSection.KERNEL32 ref: 028663F0

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: d38135fb4df71e6c80e8ec1e62eecfd2964b8a9f5f980a5a01061e436e37bc9f
Instruction ID: 89b2a8244bf0206e4bad9ac9019f7a2ecc38b40d916d81ef5eafef2ab90cf4d9
Opcode Fuzzy Hash: d38135fb4df71e6c80e8ec1e62eecfd2964b8a9f5f980a5a01061e436e37bc9f
Instruction Fuzzy Hash: 29315E3C3106A482E614AF2AE80C33A6359F79AB95F84D135DE2AC7B99EF3CC445C701

Function 00007FF6609063D0 Relevance: 16.6, APIs: 11, Instructions: 98networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF660906414
WSASetLastError.WS2_32 ref: 00007FF660906426
LeaveCriticalSection.KERNEL32 ref: 00007FF660906430

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: ce80470fa4deb6d6172187dcf98ae3ac5c2e22c2398dc0b25eb93d0e69b03d15
Instruction ID: db293f7e4334e357535224717006681656cc175912696b95665feb7356451bd1
Opcode Fuzzy Hash: ce80470fa4deb6d6172187dcf98ae3ac5c2e22c2398dc0b25eb93d0e69b03d15
Instruction Fuzzy Hash: AD316D20B0C652E2E6145B16A91427A7376EF85FA0F046239DA2FCB7A6DF3CE485D340

Function 0286FC70 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 52registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0286FCC1
RegDeleteValueW.ADVAPI32 ref: 0286FCCF
RegCloseKey.ADVAPI32 ref: 0286FCDA
RegCreateKeyW.ADVAPI32 ref: 0286FCFA
lstrlenW.KERNEL32 ref: 0286FD07
RegSetValueExW.ADVAPI32 ref: 0286FD29
RegCloseKey.ADVAPI32 ref: 0286FD34

Strings

Network, xrefs: 0286FC97
AppEvents, xrefs: 0286FC9E

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CloseValue$CreateDeleteOpenlstrlen
String ID: AppEvents$Network
API String ID: 3197061591-3733486940
Opcode ID: 8a321232281fbf681079ab08f7dcd2ccb76e80488ff50b598181f6d6f6baf471
Instruction ID: 08eef93266b265d48cbb53a4e6346e16cbfa105d0273fe68c7b2c70c6866216d
Opcode Fuzzy Hash: 8a321232281fbf681079ab08f7dcd2ccb76e80488ff50b598181f6d6f6baf471
Instruction Fuzzy Hash: 9D113A7A315A8086EB109F12F85875AB3A1F7A4BE5F948121EE5947FA8CF7CC149CB04

Function 0287A5D0 Relevance: 15.3, APIs: 10, Instructions: 253COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 0287A6F7

Part of subcall function 0287E8A0: GetLastError.KERNEL32 ref: 0287E904
Part of subcall function 0287E8A0: free.LIBCMT ref: 0287E982

free.LIBCMT ref: 0287A8BF
free.LIBCMT ref: 0287A8CF
free.LIBCMT ref: 0287A8DF
free.LIBCMT ref: 0287A8EB
free.LIBCMT ref: 0287A940
free.LIBCMT ref: 0287A948
free.LIBCMT ref: 0287A950
free.LIBCMT ref: 0287A958
free.LIBCMT ref: 0287A962

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$ErrorInfoLast
String ID:
API String ID: 189849726-0
Opcode ID: 5d548cc39369a58207a9c943e799f4ab131ac754e7ecf3cfda6414b3f6c95353
Instruction ID: acee899610963d6a79ebcf5756c9081eddbe5646e92489645a9e8d00fb903457
Opcode Fuzzy Hash: 5d548cc39369a58207a9c943e799f4ab131ac754e7ecf3cfda6414b3f6c95353
Instruction Fuzzy Hash: 58B19D3E3056D086CB19CF2AE4943AE77A5F748B88F85412ADAADC7B54EF39C151CB40

Function 02888DF0 Relevance: 15.2, APIs: 10, Instructions: 250COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 02888EE3
MultiByteToWideChar.KERNEL32 ref: 02888F62
MultiByteToWideChar.KERNEL32 ref: 02889009
MultiByteToWideChar.KERNEL32 ref: 0288902F

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ByteCharMultiWide$Info
String ID:
API String ID: 1775632426-0
Opcode ID: b15be38474aefe4c9613bb0d4762db6156c76aab2b1b8aacd7baaba64e94ff3e
Instruction ID: 73a995646d4f5123b5da21eff8b1dde130f005f2d30fb11e5b2a8032322cc4f2
Opcode Fuzzy Hash: b15be38474aefe4c9613bb0d4762db6156c76aab2b1b8aacd7baaba64e94ff3e
Instruction Fuzzy Hash: 6891E17F7047849ADB31AF29940436A7B92F744BA8FC88616DE6DD7B84EB38C545C340

Function 0287A0B0 Relevance: 15.2, APIs: 10, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 0287A14A
malloc.LIBCMT ref: 0287A1B3
MultiByteToWideChar.KERNEL32 ref: 0287A1E7
LCMapStringW.KERNEL32 ref: 0287A20E
LCMapStringW.KERNEL32 ref: 0287A256
malloc.LIBCMT ref: 0287A2B3

Part of subcall function 02875540: _FF_MSGBANNER.LIBCMT ref: 02875570
Part of subcall function 02875540: HeapAlloc.KERNEL32 ref: 02875595
Part of subcall function 02875540: _callnewh.LIBCMT ref: 028755AE
Part of subcall function 02875540: _errno.LIBCMT ref: 028755B9
Part of subcall function 02875540: _errno.LIBCMT ref: 028755C4

LCMapStringW.KERNEL32 ref: 0287A2E8
WideCharToMultiByte.KERNEL32 ref: 0287A328
free.LIBCMT ref: 0287A33C
free.LIBCMT ref: 0287A34D

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ByteCharMultiStringWide$_errnofreemalloc$AllocHeap_callnewh
String ID:
API String ID: 1080698880-0
Opcode ID: c6ac2012124e5f8258691178878140cf1341e8ec6c1aaf852dfb3bd8c808a96b
Instruction ID: b738150eb4e8eab006f5977276da82110ab4e88f1991ebcf288ed6314b3d507c
Opcode Fuzzy Hash: c6ac2012124e5f8258691178878140cf1341e8ec6c1aaf852dfb3bd8c808a96b
Instruction Fuzzy Hash: F871A53E314B8086DB299F2AD84035E77A6F748BA8F584625EF6E97B94DF38C141C710

Function 00007FF66091054C Relevance: 15.2, APIs: 10, Instructions: 206COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF660910889), ref: 00007FF6609105E6
malloc.LIBCMT ref: 00007FF66091064F
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF660910889), ref: 00007FF660910683
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF660910889), ref: 00007FF6609106AA
LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF660910889), ref: 00007FF6609106F2
malloc.LIBCMT ref: 00007FF66091074F

Part of subcall function 00007FF660909070: _FF_MSGBANNER.LIBCMT ref: 00007FF6609090A0
Part of subcall function 00007FF660909070: HeapAlloc.KERNEL32(?,?,4E00000000000000,00007FF66090C050,?,?,ceil,00007FF66090D951,?,?,?,00007FF66090D9FB,?,?,00000000,00007FF66090B951), ref: 00007FF6609090C5
Part of subcall function 00007FF660909070: _callnewh.LIBCMT ref: 00007FF6609090DE
Part of subcall function 00007FF660909070: _errno.LIBCMT ref: 00007FF6609090E9
Part of subcall function 00007FF660909070: _errno.LIBCMT ref: 00007FF6609090F4

LCMapStringW.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF660910889), ref: 00007FF660910784
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF660910889), ref: 00007FF6609107C4
free.LIBCMT ref: 00007FF6609107D8
free.LIBCMT ref: 00007FF6609107E9

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ByteCharMultiStringWide$_errnofreemalloc$AllocHeap_callnewh
String ID:
API String ID: 1080698880-0
Opcode ID: 8864ca2f36b3b28a6e37dacfbbe885c608440c4a788fc07bea0ef3c91e2c5cf3
Instruction ID: 0d0621e11b2288e5ee6749ebc55413896349d34367f43c12429eb5099f52bcdb
Opcode Fuzzy Hash: 8864ca2f36b3b28a6e37dacfbbe885c608440c4a788fc07bea0ef3c91e2c5cf3
Instruction Fuzzy Hash: 9E81E732B08742E6EB249F25984016976BBFB84BE4F441375EA5D8BBD6DFBDE4108700

Function 02886E70 Relevance: 15.1, APIs: 10, Instructions: 123COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02886EB7
_invalid_parameter_noinfo.LIBCMT ref: 02886EC3
_errno.LIBCMT ref: 02886F0D
_errno.LIBCMT ref: 02886F18
_errno.LIBCMT ref: 02886F4A
_invalid_parameter_noinfo.LIBCMT ref: 02886F54
WideCharToMultiByte.KERNEL32 ref: 02886FC6
GetLastError.KERNEL32 ref: 02886FE3
_errno.LIBCMT ref: 02887009
_invalid_parameter_noinfo.LIBCMT ref: 02887015

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 2295021086-0
Opcode ID: 2c14c3394b2ecc556a6275fb675dc450c69f306080c020ba5b1c371ee03d1d04
Instruction ID: 31f19b688dee23e8e23fd62f860fcc900d5cafa3d52387e833c13f4076ff0b77
Opcode Fuzzy Hash: 2c14c3394b2ecc556a6275fb675dc450c69f306080c020ba5b1c371ee03d1d04
Instruction Fuzzy Hash: 3F41083F6017618AEB21AF64C5403AD7765FB50BACF688125DE5DCBE98EB38C042CB01

Function 00007FF66090F95C Relevance: 15.1, APIs: 10, Instructions: 123COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF66090F9A3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66090F9AF
_errno.LIBCMT ref: 00007FF66090F9F9
_errno.LIBCMT ref: 00007FF66090FA04
_errno.LIBCMT ref: 00007FF66090FA36
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66090FA40
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000001FE,?,00007FF66090FB2F), ref: 00007FF66090FAB2
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000001FE,?,00007FF66090FB2F), ref: 00007FF66090FACF
_errno.LIBCMT ref: 00007FF66090FAF5
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66090FB01

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 2295021086-0
Opcode ID: bd3480430a4880f8b9bfe9aab1841d67a6c611096bbe8aa784dae63e06954dd0
Instruction ID: 1165de3ec412ae5884c5b23c9ac071dbd0dd76d0e8f439889abf113646c4a06e
Opcode Fuzzy Hash: bd3480430a4880f8b9bfe9aab1841d67a6c611096bbe8aa784dae63e06954dd0
Instruction Fuzzy Hash: 8051B822E4C642E9FB619B2484503BC36B2AF4476CF146339DA5E8EFC7DE3C96458784

Function 02881EF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 02881F11

Part of subcall function 0287AAE0: Sleep.KERNEL32 ref: 0287AB25

GetFileType.KERNEL32 ref: 0288207C
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 028820BA

Strings

@, xrefs: 02882175

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CountCriticalFileInfoInitializeSectionSleepSpinStartupType
String ID: @
API String ID: 3473179607-2766056989
Opcode ID: 21fc890b1cf6f154f092da3c0a2ad5574b5904b4a85eae7bf654cd8d67533bcf
Instruction ID: 2afa6393ed3d64c934785c3219164e976628e64e0892ba466b346da506bf18b0
Opcode Fuzzy Hash: 21fc890b1cf6f154f092da3c0a2ad5574b5904b4a85eae7bf654cd8d67533bcf
Instruction Fuzzy Hash: 77816C7A301BC586DB149F24D58832976A1F745B78F548325DA7A837E8EF38C456C301

Function 00007FF66090A0F0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 00007FF66090A119

Part of subcall function 00007FF66090D9D8: _amsg_exit.LIBCMT ref: 00007FF66090DA02

DecodePointer.KERNEL32(?,?,00000000,?,?,ceil,00000000,00007FF66090A2DD,?,?,00000000,00007FF66090DA07,?,?,00000000,00007FF66090B951), ref: 00007FF66090A14C
DecodePointer.KERNEL32(?,?,00000000,?,?,ceil,00000000,00007FF66090A2DD,?,?,00000000,00007FF66090DA07,?,?,00000000,00007FF66090B951), ref: 00007FF66090A16A
DecodePointer.KERNEL32(?,?,00000000,?,?,ceil,00000000,00007FF66090A2DD,?,?,00000000,00007FF66090DA07,?,?,00000000,00007FF66090B951), ref: 00007FF66090A1AA
DecodePointer.KERNEL32(?,?,00000000,?,?,ceil,00000000,00007FF66090A2DD,?,?,00000000,00007FF66090DA07,?,?,00000000,00007FF66090B951), ref: 00007FF66090A1C4
DecodePointer.KERNEL32(?,?,00000000,?,?,ceil,00000000,00007FF66090A2DD,?,?,00000000,00007FF66090DA07,?,?,00000000,00007FF66090B951), ref: 00007FF66090A1D4
ExitProcess.KERNEL32 ref: 00007FF66090A260

Strings

ceil, xrefs: 00007FF66090A100

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: DecodePointer$ExitProcess_amsg_exit_lock
String ID: ceil
API String ID: 3411037476-3069211559
Opcode ID: 9a183ae1f03644b8a62f51de8d9c4146bcd30d60da9bb7abc91cae87c8d0ceca
Instruction ID: a303b82fb761b4b3a7c3ad9ab895e4c72ae17e3f0cba991a4250c7fe3f7b5eb5
Opcode Fuzzy Hash: 9a183ae1f03644b8a62f51de8d9c4146bcd30d60da9bb7abc91cae87c8d0ceca
Instruction Fuzzy Hash: E0414D31A1EA42E1E6549B05FC4013972BAFF88784F446239DA5E8B7A7DF7CE451C780

Function 0286A7B0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 0286A7BD
GetProcAddress.KERNEL32 ref: 0286A7D5
GetProcAddress.KERNEL32 ref: 0286A7EC
GetProcAddress.KERNEL32 ref: 0286A803

Strings

ZwQueryObject, xrefs: 0286A7DB
ntdll.dll, xrefs: 0286A7B6
ZwQueryInformationProcess, xrefs: 0286A7CB
ZwQuerySystemInformation, xrefs: 0286A7F2

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ZwQueryInformationProcess$ZwQueryObject$ZwQuerySystemInformation$ntdll.dll
API String ID: 667068680-3590752221
Opcode ID: 8a0be3c6d33e8e2dd6bfebc5c516e81d155b332878859c9dd15496a47ec7d989
Instruction ID: caa1a5e89d0cd46ca044e35adea1c4dc64a3fe82169f56138c0ef14b58bd09df
Opcode Fuzzy Hash: 8a0be3c6d33e8e2dd6bfebc5c516e81d155b332878859c9dd15496a47ec7d989
Instruction Fuzzy Hash: 6111126CA03B4990FF0A8B02F89C32223E0F718708FD8902AC85D467A0EF3C81DAC741

Function 02837BB9 Relevance: 13.6, APIs: 9, Instructions: 111COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 02837BE2
_errno.LIBCMT ref: 02837BEB
__doserrno.LIBCMT ref: 02837C49
_errno.LIBCMT ref: 02837C50
_invalid_parameter_noinfo.LIBCMT ref: 02837CB4

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfo
String ID:
API String ID: 2315031519-0
Opcode ID: 4862a53a2d00355b2cdfb6728f68fce1447d9864874779d523ba4aac90f1cc33
Instruction ID: af9624a91abb8a2afe8a43f63bfa7611d0e957a54f2c2d8c59ae5ee3dbbea240
Opcode Fuzzy Hash: 4862a53a2d00355b2cdfb6728f68fce1447d9864874779d523ba4aac90f1cc33
Instruction Fuzzy Hash: CA31F8BD10C7154EE30E6F6C988513DB7D2EB46320F45126DD546C72A1DAB4DC428AD3

Function 02866200 Relevance: 13.6, APIs: 9, Instructions: 101timenetworkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0286626A
timeGetTime.WINMM ref: 02866298
WSASetLastError.WS2_32 ref: 028662B9
LeaveCriticalSection.KERNEL32 ref: 028662C3
timeGetTime.WINMM ref: 028662DA
SetEvent.KERNEL32 ref: 02866314
LeaveCriticalSection.KERNEL32 ref: 02866326
LeaveCriticalSection.KERNEL32 ref: 02866355
WSASetLastError.WS2_32 ref: 0286637E

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalSection$Leave$ErrorLastTimetime$EnterEvent
String ID:
API String ID: 3019579578-0
Opcode ID: dd50ce443d7a7c7a2503f875a105e6cc88d9067b5d064de374ba49bafdefeff6
Instruction ID: a55b0781b3503dbc526ceaab8b089ad6717e75b89509e0fd7347cb762d3288d0
Opcode Fuzzy Hash: dd50ce443d7a7c7a2503f875a105e6cc88d9067b5d064de374ba49bafdefeff6
Instruction Fuzzy Hash: 3441493E2146908BD7309F25E54833EB765F798B58F884216DB9A83B65EF3CE485CB40

Function 00007FF660906240 Relevance: 13.6, APIs: 9, Instructions: 101timenetworkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6609062AA
timeGetTime.WINMM ref: 00007FF6609062D8
WSASetLastError.WS2_32 ref: 00007FF6609062F9
LeaveCriticalSection.KERNEL32 ref: 00007FF660906303
timeGetTime.WINMM ref: 00007FF66090631A
SetEvent.KERNEL32 ref: 00007FF660906354
LeaveCriticalSection.KERNEL32 ref: 00007FF660906366
LeaveCriticalSection.KERNEL32 ref: 00007FF660906395
WSASetLastError.WS2_32 ref: 00007FF6609063BE

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalSection$Leave$ErrorLastTimetime$EnterEvent
String ID:
API String ID: 3019579578-0
Opcode ID: 1cc5bff3dd2912bbf840fa48739d8834fcdebc8cdae61fe5ead118e36bb8da40
Instruction ID: 59e872662dacb3dccf4bec406a21addef14504cde5d34b28e951a2b2cdedb9e5
Opcode Fuzzy Hash: 1cc5bff3dd2912bbf840fa48739d8834fcdebc8cdae61fe5ead118e36bb8da40
Instruction Fuzzy Hash: 11412B22A08642D7E7749B15E44023A73B6FB94B50F042239DB9F8BB96DF7CE485C780

Function 028880E8 Relevance: 13.6, APIs: 9, Instructions: 81COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 02888111
_errno.LIBCMT ref: 0288811A
__doserrno.LIBCMT ref: 02888178
_errno.LIBCMT ref: 0288817F
_invalid_parameter_noinfo.LIBCMT ref: 028881E3

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfo
String ID:
API String ID: 2315031519-0
Opcode ID: 851380517a92b732ebc85122174d012e05205685cd47dc9c50f7059f0234a667
Instruction ID: 7e8e580bb99820aaa96121585010fffb503715ee15e3828f267d6efbcb454b03
Opcode Fuzzy Hash: 851380517a92b732ebc85122174d012e05205685cd47dc9c50f7059f0234a667
Instruction Fuzzy Hash: E5210A3EB0028886D716BF699C8033EBA66B7807A4FC94519DE25CB3A1DF7CC441CB12

Function 028660E0 Relevance: 13.6, APIs: 9, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 028660FA
TryEnterCriticalSection.KERNEL32 ref: 0286611B
TryEnterCriticalSection.KERNEL32 ref: 0286612D
SetLastError.KERNEL32 ref: 02866146
LeaveCriticalSection.KERNEL32 ref: 02866150
LeaveCriticalSection.KERNEL32 ref: 0286615A

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 7e876657705aafb2821538dd1f535f86e1477a843cf3583b913b0a5c36b37387
Instruction ID: 9f5aa0fa3551b6bdcdd7d12e85fa53c93bd906797a89e0288e9b1123737c7db4
Opcode Fuzzy Hash: 7e876657705aafb2821538dd1f535f86e1477a843cf3583b913b0a5c36b37387
Instruction Fuzzy Hash: 72314D3EA21690C7DB50DF28E84836D37A9FB54B4CF948025DB0AC6665EF3DC88AC740

Function 00007FF660906120 Relevance: 13.6, APIs: 9, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF66090613A
TryEnterCriticalSection.KERNEL32 ref: 00007FF66090615B
TryEnterCriticalSection.KERNEL32 ref: 00007FF66090616D
SetLastError.KERNEL32 ref: 00007FF660906186
LeaveCriticalSection.KERNEL32 ref: 00007FF660906190
LeaveCriticalSection.KERNEL32 ref: 00007FF66090619A

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 3a839ef8a6bf8d7d73b88de66420fd037dbe664b26c5089cd47badf1e2dfdb2a
Instruction ID: 399ecbb5cc0e6bb6c96c7a0febf9b54fe155f62b9302d18cbcc2f59981b4207a
Opcode Fuzzy Hash: 3a839ef8a6bf8d7d73b88de66420fd037dbe664b26c5089cd47badf1e2dfdb2a
Instruction Fuzzy Hash: 37313932A1C506E6EB548F28D5441AD33B6FB44B48F502235DA1ECA3A6DF39E98AC740

Function 0286F630 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0286F6AD
WriteFile.KERNEL32 ref: 0286F6DE
CloseHandle.KERNEL32 ref: 0286F6EB
lstrlenW.KERNEL32 ref: 0286F6F6
wsprintfW.USER32 ref: 0286F71C

Strings

%s %s, xrefs: 0286F715

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: File$CloseCreateHandleWritelstrlenwsprintf
String ID: %s %s
API String ID: 2369136734-2939940506
Opcode ID: fb82c7389f2e52e8ed19e3e83665f2a219b46dd41d64a773a90c546ccedf99c7
Instruction ID: bccc325bea38cbe4f08853d383aa5990ef4bd486af46b7655f0c591640cb5411
Opcode Fuzzy Hash: fb82c7389f2e52e8ed19e3e83665f2a219b46dd41d64a773a90c546ccedf99c7
Instruction Fuzzy Hash: 4031B33A31498595EB20CF25F8487ABB365F7D4798F8441119B5E87EA8DF3CC549CB40

Function 02832585 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0283259C
_invalid_parameter_noinfo.LIBCMT ref: 028325A7

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: ba147bacc2b5e060ee5a802c7efa88b2d7141a420072347e719a083b69a0ed4b
Instruction ID: 390afb26f0f315dba0bf7ac28dd5ee581e36b697982da92ebd2ec49bdbd39ea2
Opcode Fuzzy Hash: ba147bacc2b5e060ee5a802c7efa88b2d7141a420072347e719a083b69a0ed4b
Instruction Fuzzy Hash: 3041C23C214A0A5BDB5AEF2DC89436877E1FF55318B240719DC5AC319AE764DC92CBC2

Function 02864A70 Relevance: 12.1, APIs: 8, Instructions: 120memorynetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 02864C70: EnterCriticalSection.KERNEL32 ref: 02864C9E
Part of subcall function 02864C70: LeaveCriticalSection.KERNEL32 ref: 02864CF2

send.WS2_32 ref: 02864AC3
EnterCriticalSection.KERNEL32 ref: 02864AD7
LeaveCriticalSection.KERNEL32 ref: 02864AEB
HeapFree.KERNEL32 ref: 02864B67
WSAGetLastError.WS2_32 ref: 02864BB4
EnterCriticalSection.KERNEL32 ref: 02864BC8
LeaveCriticalSection.KERNEL32 ref: 02864C16
HeapFree.KERNEL32 ref: 02864C54

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalSection$EnterLeave$FreeHeap$ErrorLastsend
String ID:
API String ID: 1701177279-0
Opcode ID: 0f41ccaa659a3fbdd162dac1c10e9f0415eaaa72adcae5368495915b1afd0a29
Instruction ID: db7642d65153ff518c2663844a49cc1ee72a9f45e027d8d12d47c1f6111d2572
Opcode Fuzzy Hash: 0f41ccaa659a3fbdd162dac1c10e9f0415eaaa72adcae5368495915b1afd0a29
Instruction Fuzzy Hash: 9C517C3E201A808AE774CF6AE4583AD73A1F748B98F508025DB4E87F64DF38D5A5C740

Function 00007FF660904AD0 Relevance: 12.1, APIs: 8, Instructions: 120memorynetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF660904CD0: EnterCriticalSection.KERNEL32 ref: 00007FF660904CFE
Part of subcall function 00007FF660904CD0: LeaveCriticalSection.KERNEL32 ref: 00007FF660904D52

send.WS2_32 ref: 00007FF660904B23
EnterCriticalSection.KERNEL32 ref: 00007FF660904B37
LeaveCriticalSection.KERNEL32 ref: 00007FF660904B4B
HeapFree.KERNEL32 ref: 00007FF660904BC7
WSAGetLastError.WS2_32 ref: 00007FF660904C14
EnterCriticalSection.KERNEL32 ref: 00007FF660904C28
LeaveCriticalSection.KERNEL32 ref: 00007FF660904C76
HeapFree.KERNEL32 ref: 00007FF660904CB4

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalSection$EnterLeave$FreeHeap$ErrorLastsend
String ID:
API String ID: 1701177279-0
Opcode ID: c1be7f863ec74c84b7929cd5dfa0ec5487756cd30b1768cbd88e9af37da90106
Instruction ID: 4fc6b1bf4e4d8ae7ffdec052a7e22137371ff541df39b7d17b2158689f8abc48
Opcode Fuzzy Hash: c1be7f863ec74c84b7929cd5dfa0ec5487756cd30b1768cbd88e9af37da90106
Instruction Fuzzy Hash: 0B51B172608A81EAE764CF26D4403AD33B6FB54B84F005238DB4E8BB95DF78E595C780

Function 02863F10 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32 ref: 02863F72

Part of subcall function 02861370: free.LIBCMT ref: 02861390
Part of subcall function 02861370: malloc.LIBCMT ref: 028613BC

setsockopt.WS2_32 ref: 0286400D
setsockopt.WS2_32 ref: 02864037
ResetEvent.KERNEL32 ref: 02864085
SetLastError.KERNEL32 ref: 028640B0
GetLastError.KERNEL32 ref: 028640C8

Part of subcall function 02864D20: GetCurrentThreadId.KERNEL32 ref: 02864D2D

SetLastError.KERNEL32 ref: 028640DA

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ErrorLast$setsockopt$CreateCurrentEventResetThreadTimerWaitablefreemalloc
String ID:
API String ID: 3356772049-0
Opcode ID: b62db397012c45f7f6159a48d9087b38499f2d1e65472d174db3c1d68d875640
Instruction ID: 2d696b764342f4f72ab956a9a81c4cd66869d90d8d0b8daba98362a1175a13eb
Opcode Fuzzy Hash: b62db397012c45f7f6159a48d9087b38499f2d1e65472d174db3c1d68d875640
Instruction Fuzzy Hash: DB419D7A601B909BE714CF25E50836E77A0F748748F548126DB8987B54DF7ED069CF40

Function 02882AB4 Relevance: 12.1, APIs: 8, Instructions: 95COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 02882ACB
_invalid_parameter_noinfo.LIBCMT ref: 02882AD6

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: 10261713ebaca9735ebdeaa53afc57adbaf780813d6bed4f92c405acd57ecea8
Instruction ID: d651ee235fce638edb3ad61ca4e5630efdc24cc2928c8340ab78c37ec3a09522
Opcode Fuzzy Hash: 10261713ebaca9735ebdeaa53afc57adbaf780813d6bed4f92c405acd57ecea8
Instruction Fuzzy Hash: AF31F63E6156C4C2DB24AF39C68033C37A1FB05798F244615DF6AC7698DB38C4A2DB01

Function 02865400 Relevance: 12.1, APIs: 8, Instructions: 82networksleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 02865430
timeGetTime.WINMM ref: 02865456
GetCurrentThreadId.KERNEL32 ref: 02865479
send.WS2_32 ref: 028654BC
SetEvent.KERNEL32 ref: 028654DA
WSACloseEvent.WS2_32 ref: 028654F0
shutdown.WS2_32 ref: 02865509
closesocket.WS2_32 ref: 02865513

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Event$CloseCurrentSleepThreadTimeclosesocketsendshutdowntime
String ID:
API String ID: 929257074-0
Opcode ID: d80bd20e404b5833ff99a516d4d3aea9d62cab81a5f619cabeebe738e59a6503
Instruction ID: 22ef2823b69911ffb6cb3878c35d02de2e8c9789d3cddfc8ecb01865c51ba77f
Opcode Fuzzy Hash: d80bd20e404b5833ff99a516d4d3aea9d62cab81a5f619cabeebe738e59a6503
Instruction Fuzzy Hash: 0D31627E61169087D7219F79E84C32C7362F784F69F989225DA6E87A98CF38C885C740

Function 00007FF660905460 Relevance: 12.1, APIs: 8, Instructions: 82networksleeptimeCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FF660905490
timeGetTime.WINMM ref: 00007FF6609054B6
GetCurrentThreadId.KERNEL32 ref: 00007FF6609054D9
send.WS2_32 ref: 00007FF66090551C
SetEvent.KERNEL32 ref: 00007FF66090553A
WSACloseEvent.WS2_32 ref: 00007FF660905550
shutdown.WS2_32 ref: 00007FF660905569
closesocket.WS2_32 ref: 00007FF660905573

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Event$CloseCurrentSleepThreadTimeclosesocketsendshutdowntime
String ID:
API String ID: 929257074-0
Opcode ID: e6689e71db0ff1669b26d14558efafb386105a6056d856fa6fa8066e84783edc
Instruction ID: d0a25f38af20eaca9daf9012e2f6a608c0a4cad24113a8fcbfd2e4a97337fe46
Opcode Fuzzy Hash: e6689e71db0ff1669b26d14558efafb386105a6056d856fa6fa8066e84783edc
Instruction Fuzzy Hash: E7313B72A08642D6E7149F25D84017A3377FB44FA5F142335EA5A8A7DACF38D885C780

Function 02864F40 Relevance: 12.1, APIs: 8, Instructions: 64windowCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 02864F67
MsgWaitForMultipleObjects.USER32 ref: 02864F98
PeekMessageW.USER32 ref: 02864FB4
TranslateMessage.USER32 ref: 02864FC5
DispatchMessageW.USER32 ref: 02864FD0
PeekMessageW.USER32 ref: 02864FEB
SetLastError.KERNEL32 ref: 02865017
CloseHandle.KERNEL32 ref: 0286502C

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Message$Peek$CloseDispatchErrorEventHandleLastMultipleObjectsTranslateWait
String ID:
API String ID: 1713936993-0
Opcode ID: 4271cb4c7969a4cce060b49edca004edc8465e505ab8869e0f42c4e3588366c3
Instruction ID: 2c0cd9b3cde6cb784377d44e6efcd25a4b2b1b056a0990cf52d2077695831e46
Opcode Fuzzy Hash: 4271cb4c7969a4cce060b49edca004edc8465e505ab8869e0f42c4e3588366c3
Instruction Fuzzy Hash: 00218E7E621A4187E720DF74E45CB2A33A1FB94708FE49225DB5AC6AA4DF38C449CB01

Function 00007FF660904E60 Relevance: 12.1, APIs: 8, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,00007FF660904E44), ref: 00007FF660904E85
ResetEvent.KERNEL32(?,?,00000000,00007FF660904E44), ref: 00007FF660904E92
ResetEvent.KERNEL32(?,?,00000000,00007FF660904E44), ref: 00007FF660904E9F
ResetEvent.KERNEL32(?,?,00000000,00007FF660904E44), ref: 00007FF660904EAC
HeapFree.KERNEL32 ref: 00007FF660904F0F
HeapDestroy.KERNEL32(?,?,00000000,00007FF660904E44), ref: 00007FF660904F2F
HeapCreate.KERNEL32(?,?,00000000,00007FF660904E44), ref: 00007FF660904F49
SetEvent.KERNEL32 ref: 00007FF660904F7D

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Event$HeapReset$CreateCriticalDestroyEnterFreeSection
String ID:
API String ID: 1658878062-0
Opcode ID: b8e90da5e81a1c5bd4b7ea335600b5e9df7185687b6b9f4d8d1a246453650ad8
Instruction ID: 819e44934bedd1d433d023e933074fa4b95bee01ba07b9ba149e147b3dab6e38
Opcode Fuzzy Hash: b8e90da5e81a1c5bd4b7ea335600b5e9df7185687b6b9f4d8d1a246453650ad8
Instruction Fuzzy Hash: C531D732608A82F2E64CDB21D5442ADB379FB48B80F405236DB6E87752CF78A5B9C740

Function 00007FF660904FA0 Relevance: 12.1, APIs: 8, Instructions: 64windowCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 00007FF660904FC7
MsgWaitForMultipleObjects.USER32 ref: 00007FF660904FF8
PeekMessageW.USER32 ref: 00007FF660905014
TranslateMessage.USER32 ref: 00007FF660905025
DispatchMessageW.USER32 ref: 00007FF660905030
PeekMessageW.USER32 ref: 00007FF66090504B
SetLastError.KERNEL32 ref: 00007FF660905077
CloseHandle.KERNEL32 ref: 00007FF66090508C

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Message$Peek$CloseDispatchErrorEventHandleLastMultipleObjectsTranslateWait
String ID:
API String ID: 1713936993-0
Opcode ID: 446e21ef8d1e23cb48fe62aa3044cfdae947c01fbde446d7c73040613798d1b3
Instruction ID: c7fac76d3cf3575bdab3006c22232295eb2b536d833ade9dbf88cfe057011a73
Opcode Fuzzy Hash: 446e21ef8d1e23cb48fe62aa3044cfdae947c01fbde446d7c73040613798d1b3
Instruction Fuzzy Hash: D6218E22A18542E2F7608F24D45477A32B2FF84B44F546238DA5ECA6A5DF7CD8498A40

Function 02882E54 Relevance: 12.1, APIs: 8, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 02882E7B

Part of subcall function 0287C3BC: _set_error_mode.LIBCMT ref: 0287C3C5
Part of subcall function 0287C3BC: _set_error_mode.LIBCMT ref: 0287C3D4

Part of subcall function 0287C15C: _set_error_mode.LIBCMT ref: 0287C1A1
Part of subcall function 0287C15C: _set_error_mode.LIBCMT ref: 0287C1B2
Part of subcall function 0287C15C: GetModuleFileNameW.KERNEL32 ref: 0287C214

Part of subcall function 0287BDC8: ExitProcess.KERNEL32 ref: 0287BDD7
Part of subcall function 0287BDC8: _amsg_exit.LIBCMT ref: 02882F66

Part of subcall function 0287AA60: malloc.LIBCMT ref: 0287AA8B
Part of subcall function 0287AA60: Sleep.KERNEL32 ref: 0287AA9E

_errno.LIBCMT ref: 02882EBD
_lock.LIBCMT ref: 02882ED1
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 02882EE7
free.LIBCMT ref: 02882EF4
_errno.LIBCMT ref: 02882EF9
LeaveCriticalSection.KERNEL32 ref: 02882F1C

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_amsg_exit_lockfreemalloc
String ID:
API String ID: 2779410436-0
Opcode ID: b0843a267ec6ba422468d13235b83ff60fcdfb8e34f7d610862d6568bd9aa951
Instruction ID: dcf135662695fe3cda244907ab4a091a10da27302162c9d00c764da46fa282b7
Opcode Fuzzy Hash: b0843a267ec6ba422468d13235b83ff60fcdfb8e34f7d610862d6568bd9aa951
Instruction Fuzzy Hash: 2521BE3D61168482EB25BB65F40872A6266FB85788F889035DE4AC7A98CF3CC440CB16

Function 00007FF66090D8F0 Relevance: 12.1, APIs: 8, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 00007FF66090D917

Part of subcall function 00007FF66090A56C: _set_error_mode.LIBCMT ref: 00007FF66090A575
Part of subcall function 00007FF66090A56C: _set_error_mode.LIBCMT ref: 00007FF66090A584

Part of subcall function 00007FF66090A30C: _set_error_mode.LIBCMT ref: 00007FF66090A351
Part of subcall function 00007FF66090A30C: _set_error_mode.LIBCMT ref: 00007FF66090A362
Part of subcall function 00007FF66090A30C: GetModuleFileNameW.KERNEL32 ref: 00007FF66090A3C4

Part of subcall function 00007FF660909F5C: ExitProcess.KERNEL32 ref: 00007FF660909F6B

Part of subcall function 00007FF66090C020: malloc.LIBCMT ref: 00007FF66090C04B
Part of subcall function 00007FF66090C020: Sleep.KERNEL32(?,?,ceil,00007FF66090D951,?,?,?,00007FF66090D9FB,?,?,00000000,00007FF66090B951,?,?,00000000,00007FF66090BA08), ref: 00007FF66090C05E

_errno.LIBCMT ref: 00007FF66090D959
_lock.LIBCMT ref: 00007FF66090D96D
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,00007FF66090D9FB,?,?,00000000,00007FF66090B951,?,?,00000000,00007FF66090BA08,?,?,?,00007FF66090938D), ref: 00007FF66090D983
free.LIBCMT ref: 00007FF66090D990
_errno.LIBCMT ref: 00007FF66090D995
LeaveCriticalSection.KERNEL32(?,?,?,00007FF66090D9FB,?,?,00000000,00007FF66090B951,?,?,00000000,00007FF66090BA08,?,?,?,00007FF66090938D), ref: 00007FF66090D9B8

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_lockfreemalloc
String ID:
API String ID: 113790786-0
Opcode ID: 1cf7f058a8983c64bfdf0fb23590526f2e0664be90d8ed4957796866281ab8dc
Instruction ID: a3dbbc99b065f660fb216f6fa1165a660ccf3352ba3bc4f0845397bec269ecd3
Opcode Fuzzy Hash: 1cf7f058a8983c64bfdf0fb23590526f2e0664be90d8ed4957796866281ab8dc
Instruction Fuzzy Hash: 32213921E1E642E1F754AB10A41477A6276EF80794F046638E59FCEBC3CF7CA44087C1

Function 0282A0A1 Relevance: 11.6, APIs: 9, Instructions: 379COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 0282A390
free.LIBCMT ref: 0282A3A0
free.LIBCMT ref: 0282A3B0
free.LIBCMT ref: 0282A3BC
free.LIBCMT ref: 0282A411
free.LIBCMT ref: 0282A419
free.LIBCMT ref: 0282A421
free.LIBCMT ref: 0282A429
free.LIBCMT ref: 0282A433

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 79754162f90728ee6296ef0ddc862aca26a0c0dc80cbfdd284a51caaacb4e720
Instruction ID: 44f03e741779e455905655ad5d4e0ff87f994be36579aba339701404967e864c
Opcode Fuzzy Hash: 79754162f90728ee6296ef0ddc862aca26a0c0dc80cbfdd284a51caaacb4e720
Instruction Fuzzy Hash: 02C1C138618A588BC71DDF6CD4942A9B7E1FF58304F54412EE88EC7252DB35D58ACB82

Function 02862360 Relevance: 10.8, APIs: 2, Strings: 5, Instructions: 339COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 02862576
malloc.LIBCMT ref: 0286265D

Part of subcall function 02875540: _FF_MSGBANNER.LIBCMT ref: 02875570
Part of subcall function 02875540: HeapAlloc.KERNEL32 ref: 02875595
Part of subcall function 02875540: _callnewh.LIBCMT ref: 028755AE
Part of subcall function 02875540: _errno.LIBCMT ref: 028755B9
Part of subcall function 02875540: _errno.LIBCMT ref: 028755C4

Strings

input probe, xrefs: 028626D5
input psh: sn=%lu ts=%lu, xrefs: 0286260E
input wins: %lu, xrefs: 028626FE
input ack: sn=%lu rtt=%ld rto=%ld, xrefs: 028625D1
[RI] %d bytes, xrefs: 0286239A

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$AllocHeap_callnewhfreemalloc
String ID: [RI] %d bytes$input ack: sn=%lu rtt=%ld rto=%ld$input probe$input psh: sn=%lu ts=%lu$input wins: %lu
API String ID: 3198430600-868042568
Opcode ID: de8006860ad337ec869959be84dcfe28e187b4c96f07af96b08ed4f7a32076d6
Instruction ID: 1056f590b59911a62c502426d3b406211af0b405c0c85c8ecfcf70939319e376
Opcode Fuzzy Hash: de8006860ad337ec869959be84dcfe28e187b4c96f07af96b08ed4f7a32076d6
Instruction Fuzzy Hash: 73D1D17E6046808BD774CF29E85877A7BA1F384B98F1840A1DF9AC3B59DB38D840CB41

Function 00007FF660902390 Relevance: 10.8, APIs: 2, Strings: 5, Instructions: 339COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF6609025A6
malloc.LIBCMT ref: 00007FF66090268D

Part of subcall function 00007FF660909070: _FF_MSGBANNER.LIBCMT ref: 00007FF6609090A0
Part of subcall function 00007FF660909070: HeapAlloc.KERNEL32(?,?,4E00000000000000,00007FF66090C050,?,?,ceil,00007FF66090D951,?,?,?,00007FF66090D9FB,?,?,00000000,00007FF66090B951), ref: 00007FF6609090C5
Part of subcall function 00007FF660909070: _callnewh.LIBCMT ref: 00007FF6609090DE
Part of subcall function 00007FF660909070: _errno.LIBCMT ref: 00007FF6609090E9
Part of subcall function 00007FF660909070: _errno.LIBCMT ref: 00007FF6609090F4

Strings

input psh: sn=%lu ts=%lu, xrefs: 00007FF66090263E
input wins: %lu, xrefs: 00007FF66090272E
input ack: sn=%lu rtt=%ld rto=%ld, xrefs: 00007FF660902601
[RI] %d bytes, xrefs: 00007FF6609023CA
input probe, xrefs: 00007FF660902705

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$AllocHeap_callnewhfreemalloc
String ID: [RI] %d bytes$input ack: sn=%lu rtt=%ld rto=%ld$input probe$input psh: sn=%lu ts=%lu$input wins: %lu
API String ID: 3198430600-868042568
Opcode ID: dda5b54ef822ff448da02969afc54e1d0890a7d0193f906d4744a84604512da3
Instruction ID: 9f71e9afad22afefc8dc05c92b6cd443fadcaaa0d549de4569044c896ba94592
Opcode Fuzzy Hash: dda5b54ef822ff448da02969afc54e1d0890a7d0193f906d4744a84604512da3
Instruction Fuzzy Hash: 0EE1A972A0C682DBE7748B25A45066A77B2FB44744F145235DB9FCB786DE3CE841CB80

Function 02885838 Relevance: 10.8, APIs: 7, Instructions: 305COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 028858BC
free.LIBCMT ref: 028858E1
free.LIBCMT ref: 02885CA6
free.LIBCMT ref: 02885CB2

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1a90412cadf6408d59a9c1127363ccd9d752b955525589c9e26a3219661490d0
Instruction ID: 652674415b9aee2ae54cc64a43300722ff304ac6ce774c57cd697dfcd7d437ab
Opcode Fuzzy Hash: 1a90412cadf6408d59a9c1127363ccd9d752b955525589c9e26a3219661490d0
Instruction Fuzzy Hash: 86C1C83E700B5489DB20DF66E484A9E77A5F799788F814926CF9D87B14EF78C205CB40

Function 00007FF66090D3CC Relevance: 10.7, APIs: 7, Instructions: 184COMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 00007FF66090D3ED

Part of subcall function 00007FF66090C0A0: Sleep.KERNEL32(?,?,ceil,00007FF66090B9E3,?,?,?,00007FF66090938D,?,?,?,?,00007FF660914BEE), ref: 00007FF66090C0E5

GetFileType.KERNEL32 ref: 00007FF66090D558
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF66090D596

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CountCriticalFileInfoInitializeSectionSleepSpinStartupType
String ID:
API String ID: 3473179607-0
Opcode ID: eff7a9d518b47b5a0bc449bc8e70df270870fd33741806fcd9b591f6a57ce8e5
Instruction ID: 126f5e3c3d1c5c6fa4c11fdfb65d6af7d7a098792ab898a130af6ca6bd1ce47d
Opcode Fuzzy Hash: eff7a9d518b47b5a0bc449bc8e70df270870fd33741806fcd9b591f6a57ce8e5
Instruction Fuzzy Hash: 6D816E62A09B82E6EB148F14D84432937B2EB44B78F546339DA7E8A3D6DF3CE455C740

Function 028643D0 Relevance: 10.7, APIs: 7, Instructions: 154threadnetworktimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 02864400
SetWaitableTimer.KERNEL32 ref: 02864442
WSAWaitForMultipleEvents.WS2_32 ref: 028644EC
SetLastError.KERNEL32 ref: 02864597
GetLastError.KERNEL32 ref: 0286459D
WSAGetLastError.WS2_32 ref: 028645CA
GetCurrentThreadId.KERNEL32 ref: 028645FF

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ErrorLast$CurrentThread$EventsMultipleTimerWaitWaitable
String ID:
API String ID: 3058130114-0
Opcode ID: 233744dc1db25240e62441a4cfda316594facda456fb24716390902636e45cb6
Instruction ID: 04cdd0d1b6148f07a2f9a3afa1df35bb4ef611408d3199c346a6de5b1e131b00
Opcode Fuzzy Hash: 233744dc1db25240e62441a4cfda316594facda456fb24716390902636e45cb6
Instruction Fuzzy Hash: 1F515D3E201B8186DB609F39A85C36D23A5F748B98F988626DF6EC7B98DF35C444C711

Function 00007FF660904430 Relevance: 10.7, APIs: 7, Instructions: 154threadnetworktimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF660904460
SetWaitableTimer.KERNEL32 ref: 00007FF6609044A2
WSAWaitForMultipleEvents.WS2_32 ref: 00007FF66090454C
SetLastError.KERNEL32 ref: 00007FF6609045F7
GetLastError.KERNEL32 ref: 00007FF6609045FD
WSAGetLastError.WS2_32 ref: 00007FF66090462A
GetCurrentThreadId.KERNEL32 ref: 00007FF66090465F

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ErrorLast$CurrentThread$EventsMultipleTimerWaitWaitable
String ID:
API String ID: 3058130114-0
Opcode ID: 7b60ca50b3758f1c58badd931637b434e66ff62f720dd5cba929699bab1da5df
Instruction ID: d93746e6eafcd8d88999c035de652de02b3517ac2aec3522eecaf710a70f83e5
Opcode Fuzzy Hash: 7b60ca50b3758f1c58badd931637b434e66ff62f720dd5cba929699bab1da5df
Instruction Fuzzy Hash: CB61B271A08A42E6EB549F24984426A23B6FB14B58F142339EE1FCB7D6DF38E4408740

Function 02838341 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 0283835C

Part of subcall function 028326D9: _errno.LIBCMT ref: 028326E2
Part of subcall function 028326D9: _invalid_parameter_noinfo.LIBCMT ref: 028326ED

_errno.LIBCMT ref: 0283836C
_errno.LIBCMT ref: 0283838A
_isatty.LIBCMT ref: 028383EB
_getbuf.LIBCMT ref: 028383F7

Strings

, xrefs: 02838377

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-3916222277
Opcode ID: 3f5d46b04a604bc5b79a1a1652a8fb6aba7d8c85590462c3b1725dfb1c4ad4a1
Instruction ID: e605f5750b382acd73cc0c154fcb250033e71d509feb5745a46b4d0a52cd38c0
Opcode Fuzzy Hash: 3f5d46b04a604bc5b79a1a1652a8fb6aba7d8c85590462c3b1725dfb1c4ad4a1
Instruction Fuzzy Hash: CE41E33D114A098FCB5AEF2CC4C636A77E1FB44324B188259E85ACB399D774C895CBC2

Function 0286DE7E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 119registryCOMMON

Download Yara Rule

APIs

Part of subcall function 028755F8: malloc.LIBCMT ref: 02875612

Part of subcall function 028755F8: _callnewh.LIBCMT ref: 02875606
Part of subcall function 028755F8: std::exception::exception.LIBCMT ref: 0287567F

RegCreateKeyW.ADVAPI32 ref: 0286DFC4
RegDeleteValueW.ADVAPI32 ref: 0286E008
RegSetValueExW.ADVAPI32 ref: 0286E028
RegCloseKey.ADVAPI32 ref: 0286E03F
CloseHandle.KERNEL32 ref: 0286E8D3

Strings

Console\1, xrefs: 0286DFB6

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CloseValue$CreateDeleteHandle_callnewhmallocstd::exception::exception
String ID: Console\1
API String ID: 2917754286-1035756066
Opcode ID: 79e2d56a9128d92d31829ef0773e95739c522c826726edbe564f461e8648c642
Instruction ID: bd02f2b9d38addecfd8beb4cde51e8dfb44acd764e7256bce66348d2129ebbb7
Opcode Fuzzy Hash: 79e2d56a9128d92d31829ef0773e95739c522c826726edbe564f461e8648c642
Instruction Fuzzy Hash: CB518C3E301B8086DB58DB16E958BAE73A9F788B84F814125DE8E87B54DF38C151CB45

Function 02888870 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 0288888B

Part of subcall function 02882C08: _errno.LIBCMT ref: 02882C11
Part of subcall function 02882C08: _invalid_parameter_noinfo.LIBCMT ref: 02882C1C

_errno.LIBCMT ref: 0288889B
_errno.LIBCMT ref: 028888B9
_isatty.LIBCMT ref: 0288891A
_getbuf.LIBCMT ref: 02888926

Strings

, xrefs: 028888A6

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-3916222277
Opcode ID: 47412365dcfa2e42fa8e0b0a19150e860b7c19c74a8c32afa72c73f7cbb34592
Instruction ID: 881956e3d4d3988debd04ea86445b9086923551321d75acc08f802a34bbfe094
Opcode Fuzzy Hash: 47412365dcfa2e42fa8e0b0a19150e860b7c19c74a8c32afa72c73f7cbb34592
Instruction Fuzzy Hash: 1D41B67E610B0886DB28FF2DD84532D7761EB84BA8F544215CE69C73D8EB78C851C782

Function 02827AF1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 02827B18
_invalid_parameter_noinfo.LIBCMT ref: 02827B23
_fileno.LIBCMT ref: 02827B46
_errno.LIBCMT ref: 02827BB6
_invalid_parameter_noinfo.LIBCMT ref: 02827BC1

Strings

@, xrefs: 02827B39

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno
String ID: @
API String ID: 3947385824-2766056989
Opcode ID: c59bcbb70bdc2dd793f40e48e33bab8fac7fcf3cd1580ce031325b872c95e3c5
Instruction ID: 9ef100a68287b2895936dd5a3247b17ba92ad0846edb8f0230496cc55b6c4fa9
Opcode Fuzzy Hash: c59bcbb70bdc2dd793f40e48e33bab8fac7fcf3cd1580ce031325b872c95e3c5
Instruction Fuzzy Hash: 2E31093D214D194F9768EB2E8894339B1D2FB89334B99476ED82DC71E5CB7488898742

Function 028279ED Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 02827A0D
_invalid_parameter_noinfo.LIBCMT ref: 02827A18
_fileno.LIBCMT ref: 02827A38
_errno.LIBCMT ref: 02827AA8
_invalid_parameter_noinfo.LIBCMT ref: 02827AB3

Strings

@, xrefs: 02827A2B

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno
String ID: @
API String ID: 3947385824-2766056989
Opcode ID: 2a3b2a4cd214041c74d131aa7b21a7eccb1e02e7ccffb0f930f8d01a64b21150
Instruction ID: b2b745662d9d6dbf13c210a7397033a6689b125ffd5faa673f95352efac544f0
Opcode Fuzzy Hash: 2a3b2a4cd214041c74d131aa7b21a7eccb1e02e7ccffb0f930f8d01a64b21150
Instruction Fuzzy Hash: D921393C114E594ED718AF3D8C94338B692EB95334B99036DD82BC71E1DB3885DA8742

Function 0287BF5C Relevance: 10.6, APIs: 7, Instructions: 99COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 0287BF85

Part of subcall function 02882F3C: _amsg_exit.LIBCMT ref: 02882F66

DecodePointer.KERNEL32 ref: 0287BFB8
DecodePointer.KERNEL32 ref: 0287BFD6
DecodePointer.KERNEL32 ref: 0287C016
DecodePointer.KERNEL32 ref: 0287C030
DecodePointer.KERNEL32 ref: 0287C040
ExitProcess.KERNEL32 ref: 0287C0CC

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: DecodePointer$ExitProcess_amsg_exit_lock
String ID:
API String ID: 3411037476-0
Opcode ID: 4bb4ea8fb43c9b0b7e49429b916e00b17a5996c68506e0998d6447385f4766d2
Instruction ID: d977305682132cf29fd5285be05e82af8f4adafb2cab15ecc0fcf54dc03e8801
Opcode Fuzzy Hash: 4bb4ea8fb43c9b0b7e49429b916e00b17a5996c68506e0998d6447385f4766d2
Instruction Fuzzy Hash: EA316B3E217B4181EA109F25FC4831977A5F798BD9FA48026DE8E83B24EF78C095C742

Function 00007FF660903EF0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6609040A0: CreateWaitableTimerW.KERNEL32(?,?,?,00007FF660903F50), ref: 00007FF6609040B9
Part of subcall function 00007FF6609040A0: free.LIBCMT ref: 00007FF6609040F6
Part of subcall function 00007FF6609040A0: malloc.LIBCMT ref: 00007FF660904131

setsockopt.WS2_32 ref: 00007FF660903FB6
setsockopt.WS2_32 ref: 00007FF660903FE0
ResetEvent.KERNEL32 ref: 00007FF66090402E
SetLastError.KERNEL32 ref: 00007FF660904059
GetLastError.KERNEL32 ref: 00007FF660904071

Part of subcall function 00007FF660904D80: GetCurrentThreadId.KERNEL32 ref: 00007FF660904D8D

SetLastError.KERNEL32 ref: 00007FF660904083

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ErrorLast$setsockopt$CreateCurrentEventResetThreadTimerWaitablefreemalloc
String ID:
API String ID: 3356772049-0
Opcode ID: 30a6aa270136fc93e7a2b6b9d1edab1a6bf69228c00d1860cce5d377f71fb7bc
Instruction ID: 5c6a6a6fe181376e87aa14bf27bfa589285b81aa60aef1660fcdeb4e33fafc05
Opcode Fuzzy Hash: 30a6aa270136fc93e7a2b6b9d1edab1a6bf69228c00d1860cce5d377f71fb7bc
Instruction Fuzzy Hash: 68418172A09B42E7E7108F25E50436A77B5FB48748F144239EB8D8BB92CF7DE0658B40

Function 0287730C Relevance: 10.6, APIs: 7, Instructions: 93threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0287BD14: HeapCreate.KERNEL32 ref: 0287BD2A
Part of subcall function 0287BD14: GetVersion.KERNEL32 ref: 0287BD3C
Part of subcall function 0287BD14: HeapSetInformation.KERNEL32 ref: 0287BD5A

_RTC_Initialize.LIBCMT ref: 0287733E
GetCommandLineA.KERNEL32 ref: 02877343

Part of subcall function 02882630: GetEnvironmentStringsW.KERNEL32 ref: 02882649
Part of subcall function 02882630: WideCharToMultiByte.KERNEL32 ref: 028826A0
Part of subcall function 02882630: WideCharToMultiByte.KERNEL32 ref: 028826DB
Part of subcall function 02882630: free.LIBCMT ref: 028826E8
Part of subcall function 02882630: FreeEnvironmentStringsW.KERNEL32 ref: 028826F3

Part of subcall function 02881EF0: GetStartupInfoW.KERNEL32 ref: 02881F11

__setargv.LIBCMT ref: 0287736C
_cinit.LIBCMT ref: 02877380

Part of subcall function 0287E13C: FlsFree.KERNEL32 ref: 0287E14B
Part of subcall function 0287E13C: DeleteCriticalSection.KERNEL32 ref: 02882DE7
Part of subcall function 0287E13C: free.LIBCMT ref: 02882DF0
Part of subcall function 0287E13C: DeleteCriticalSection.KERNEL32 ref: 02882E17

Part of subcall function 028821C4: free.LIBCMT ref: 02882215

Part of subcall function 0287AAE0: Sleep.KERNEL32 ref: 0287AB25

FlsSetValue.KERNEL32 ref: 0287741A
GetCurrentThreadId.KERNEL32 ref: 0287742E
free.LIBCMT ref: 0287743D

Part of subcall function 02875500: HeapFree.KERNEL32 ref: 02875516
Part of subcall function 02875500: _errno.LIBCMT ref: 02875520
Part of subcall function 02875500: GetLastError.KERNEL32 ref: 02875528

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$FreeHeap$ByteCharCriticalDeleteEnvironmentMultiSectionStringsWide$CommandCreateCurrentErrorInfoInformationInitializeLastLineSleepStartupThreadValueVersion__setargv_cinit_errno
String ID:
API String ID: 125979975-0
Opcode ID: 62d3da235f01ba21526005285f6cd45cbae75165d48adf9a6ab2c7e0940372bd
Instruction ID: 7be2559b82c07b6faa1ee29a0d2c8487633594ea87a8873bd67c9f077f86b262
Opcode Fuzzy Hash: 62d3da235f01ba21526005285f6cd45cbae75165d48adf9a6ab2c7e0940372bd
Instruction Fuzzy Hash: AC317E3CA4264286FF28BB78584832E9197AB5535DF98C17ACD19C5294FF38C091CB73

Function 02833785 Relevance: 10.6, APIs: 7, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 028337A8
_errno.LIBCMT ref: 028337B0

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: e39b6d2089daf4d4073d4d58c1da8825e9c538b0487b3bad0c323805675e4389
Instruction ID: 69a5d60aac6d58fd5ccaa06a91af40663ce5ae2575d9a3124876032cadeada42
Opcode Fuzzy Hash: e39b6d2089daf4d4073d4d58c1da8825e9c538b0487b3bad0c323805675e4389
Instruction Fuzzy Hash: 0321287D618A084EE31E6F5CD89637873C1FB46321F49029DD546C72A2D7A86C4186E3

Function 028331B1 Relevance: 10.6, APIs: 7, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 028331D4
_errno.LIBCMT ref: 028331DC

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 2439d78e238f4b406dbb2099e9f50d018f4921c7879633d4acecbc07e4d2803a
Instruction ID: 7b76bbc95f48d9027f524605aa791d8c06d628b3afc6c9723a2e71fa60438958
Opcode Fuzzy Hash: 2439d78e238f4b406dbb2099e9f50d018f4921c7879633d4acecbc07e4d2803a
Instruction Fuzzy Hash: D721F53D6487484EE31E6B5CD88A33877C2FB46722F49029DD946C71A1D6E86C4186E3

Function 02878020 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 02878047
_invalid_parameter_noinfo.LIBCMT ref: 02878052
_fileno.LIBCMT ref: 02878075
_errno.LIBCMT ref: 028780E5
_invalid_parameter_noinfo.LIBCMT ref: 028780F0

Strings

@, xrefs: 02878068

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno
String ID: @
API String ID: 3947385824-2766056989
Opcode ID: 466a3c6f6b967cddcba7308fcb5cac7cf08bdcb7ecb45c03e2a1f3a9014e102e
Instruction ID: 08b399eda2a725cc9064923eefacecdb3792ed83fd50a76c0bbe18dc645977b3
Opcode Fuzzy Hash: 466a3c6f6b967cddcba7308fcb5cac7cf08bdcb7ecb45c03e2a1f3a9014e102e
Instruction Fuzzy Hash: D221286E600A4441DF199B2D9C483396262AB80BB8F589726DA2EC72E5DF3CC441D712

Function 02877F1C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 02877F3C
_invalid_parameter_noinfo.LIBCMT ref: 02877F47
_fileno.LIBCMT ref: 02877F67
_errno.LIBCMT ref: 02877FD7
_invalid_parameter_noinfo.LIBCMT ref: 02877FE2

Strings

@, xrefs: 02877F5A

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno
String ID: @
API String ID: 3947385824-2766056989
Opcode ID: 4455c7f436b0a2d8c21ac2de2215c568954be8c117ee4757739655cbea58f595
Instruction ID: 4d365dae03467109537b16bd4b56b798f29c483840e9782ae9d7719966f8c69b
Opcode Fuzzy Hash: 4455c7f436b0a2d8c21ac2de2215c568954be8c117ee4757739655cbea58f595
Instruction Fuzzy Hash: 3221283E201A4541DF199B3DDCA8339A251AB80B78F599722DA3FC62E4DF3CC041D702

Function 0282C519 Relevance: 10.6, APIs: 7, Instructions: 75COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0282C53D
_errno.LIBCMT ref: 0282C556
write_char.LIBCMT ref: 0282C56B
_errno.LIBCMT ref: 0282C578
write_char.LIBCMT ref: 0282C58A
_errno.LIBCMT ref: 0282C593
_errno.LIBCMT ref: 0282C59D

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$write_char
String ID:
API String ID: 1772936973-0
Opcode ID: befc4e31688ca027fc467a0091b09bfe04993e8a5ec8ed331c858a993eb204c6
Instruction ID: e271df36bb5cf753cdcbfb5c74760e2ac52d3efa00cbd1592bdba0a9851f48b8
Opcode Fuzzy Hash: befc4e31688ca027fc467a0091b09bfe04993e8a5ec8ed331c858a993eb204c6
Instruction Fuzzy Hash: C311A97D408B688FCB64AB6C814432833E0FB5A310F5A11AAD56CC7221D374DCC88BC7

Function 0286A440 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0286A494
std::exception::exception.LIBCMT ref: 0286A4E0
std::exception::exception.LIBCMT ref: 0286A528

Part of subcall function 028775BC: RaiseException.KERNEL32 ref: 02877637

Strings

ios_base::failbit set, xrefs: 0286A4D5
ios_base::eofbit set, xrefs: 0286A51D
ios_base::badbit set, xrefs: 0286A489

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: std::exception::exception$ExceptionRaise
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 127205192-1866435925
Opcode ID: 03de42b1d57c69098daac0204ad33a72ce76f433452482d42a03222e607276e7
Instruction ID: 2a2ffc0ae8549ffdcc59718982a9e2f3cba90208b1da8986d20786dd4b710d10
Opcode Fuzzy Hash: 03de42b1d57c69098daac0204ad33a72ce76f433452482d42a03222e607276e7
Instruction Fuzzy Hash: 2131083AA01B1599EB00DBA4E8447EC33B5B74434CF98481ADE1D57B28EF74C256C740

Function 02833925 Relevance: 10.6, APIs: 7, Instructions: 71COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 0283393E
_errno.LIBCMT ref: 02833946
_close_nolock.LIBCMT ref: 0283399D

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: __doserrno_close_nolock_errno
String ID:
API String ID: 186997739-0
Opcode ID: 6f2b7d36461e4a0d181c2c2b0b56c0f7b2e919e7de38a3e7e4e2102f7147be67
Instruction ID: 5eaaec870ad89502a66eb2da074b199825aeaf407e1aaad46c17f150980f4308
Opcode Fuzzy Hash: 6f2b7d36461e4a0d181c2c2b0b56c0f7b2e919e7de38a3e7e4e2102f7147be67
Instruction Fuzzy Hash: 03112C3E1096449FD30A7F6CD88532876D2FB43322F5516ADDC1AC71D1DAB888848BD7

Function 028836E0 Relevance: 10.6, APIs: 7, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 02883703
_errno.LIBCMT ref: 0288370B

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 0d4cd8a73f2e7e400c7d0e7b591efabca8c63f0e7fa36032bab0b7c7c0917382
Instruction ID: 014ee9fac226320a295b5bddb1e96c28dda2f1b25427cefb4063d0a6cc547aa5
Opcode Fuzzy Hash: 0d4cd8a73f2e7e400c7d0e7b591efabca8c63f0e7fa36032bab0b7c7c0917382
Instruction Fuzzy Hash: FE11567E71028446E7167F29DC4032EB612AB80BA9F8D8265DE15CB3E1CB7CC841CB22

Function 00007FF66090E0DC Relevance: 10.6, APIs: 7, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF66090E0FF
_errno.LIBCMT ref: 00007FF66090E107

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: f4454937c5e5bbaa0e9d0a0c22758e5a6eeff2523f96aab8d469512271315ee2
Instruction ID: 5dd44a7ebb2cee7347285fcbc8c8339f9c21e3c267c1d2e59a0951dd95c1d6fb
Opcode Fuzzy Hash: f4454937c5e5bbaa0e9d0a0c22758e5a6eeff2523f96aab8d469512271315ee2
Instruction Fuzzy Hash: E5219032B1C542E1F7556B1598052BD65729F80BB1F096339EA2E8E3D3DE7CA4408B90

Function 00007FF66090E920 Relevance: 10.6, APIs: 7, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF66090E943
_errno.LIBCMT ref: 00007FF66090E94B

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 5a090e99aeee2951a657be0a8c4efb463e857be8daee4d60eaed3aa4b73c4070
Instruction ID: d22f1d9bd6f01a37220030f0a94781279c1e221fc1c81f62901f6d48209c7015
Opcode Fuzzy Hash: 5a090e99aeee2951a657be0a8c4efb463e857be8daee4d60eaed3aa4b73c4070
Instruction Fuzzy Hash: 0D21D422E1C642E5F7456F25984537D2533AF80761F096339EA2E8F3E3DEBCA4408B90

Function 02883CB4 Relevance: 10.6, APIs: 7, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 02883CD7
_errno.LIBCMT ref: 02883CDF

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: c8ff8ee70364361b3dc83590c2d90dbe629010f301a2ce9629a4b457e90024a1
Instruction ID: fe8a4d8efc355c0dae0388fe10d375f2435fbbec40c9db4bd72bb62aa797e397
Opcode Fuzzy Hash: c8ff8ee70364361b3dc83590c2d90dbe629010f301a2ce9629a4b457e90024a1
Instruction Fuzzy Hash: 2E11D22E71168442EB167F19D85032E7612A780FB5F8D4749EE398B3E1EB7CD4818B62

Function 028837C0 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 028837D9
FlushFileBuffers.KERNEL32 ref: 0288383C
GetLastError.KERNEL32 ref: 02883846
__doserrno.LIBCMT ref: 02883856
_errno.LIBCMT ref: 0288385D

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$BuffersErrorFileFlushLast__doserrno
String ID:
API String ID: 1845094721-0
Opcode ID: 052eaff4a4bf768fdab472bc5fd2df4f04601910d83273a053cf8ccc3b032aca
Instruction ID: 08d94580e83e051543ec110b856ee71bfb99101c04302f7ad1f14908debf5ac3
Opcode Fuzzy Hash: 052eaff4a4bf768fdab472bc5fd2df4f04601910d83273a053cf8ccc3b032aca
Instruction Fuzzy Hash: 2E112B3EB0578446DB157FA9D88432E7612AB80FA4F8D856DDA2A8B3A0DF7CC841C711

Function 00007FF6609113CC Relevance: 10.6, APIs: 7, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF6609113E5
FlushFileBuffers.KERNEL32(?,00000000,00000000,00007FF660910446,?,?,00000001,00007FF6609104EF,?,?,?,?,?,00007FF66090EBA5), ref: 00007FF660911448
GetLastError.KERNEL32(?,00000000,00000000,00007FF660910446,?,?,00000001,00007FF6609104EF,?,?,?,?,?,00007FF66090EBA5), ref: 00007FF660911452
__doserrno.LIBCMT ref: 00007FF660911462
_errno.LIBCMT ref: 00007FF660911469

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$BuffersErrorFileFlushLast__doserrno
String ID:
API String ID: 1845094721-0
Opcode ID: 17d30c8fc9599290ce3f70905f1a86dc7465141df05744b8eccb52f7b4e97e35
Instruction ID: b55889b4d671590a835a39dcd0af0d338f6270850312e12e3bee3701120cdfee
Opcode Fuzzy Hash: 17d30c8fc9599290ce3f70905f1a86dc7465141df05744b8eccb52f7b4e97e35
Instruction Fuzzy Hash: 9B21C221F0C643F5F7155FA5988427D257AAF91B90F142379E61E8E3E3CE6CA840C740

Function 02883E54 Relevance: 10.6, APIs: 7, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 02883E6D
_errno.LIBCMT ref: 02883E75
_close_nolock.LIBCMT ref: 02883ECC

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: __doserrno_close_nolock_errno
String ID:
API String ID: 186997739-0
Opcode ID: 449afea29cff9f96f01fd31e2d1eae9b8e244c4fb90c52916936df59702f190e
Instruction ID: 44c340bf68f36518ac9401ab2477d4f5e360d9cd3fa685b0236e74fb1eaec36a
Opcode Fuzzy Hash: 449afea29cff9f96f01fd31e2d1eae9b8e244c4fb90c52916936df59702f190e
Instruction Fuzzy Hash: 7111503FB0028446E715BF2DD88431D7612A780B65F9D4569DA1ACB7D1DB7CC440CB21

Function 00007FF660911560 Relevance: 10.6, APIs: 7, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF660911579
_errno.LIBCMT ref: 00007FF660911581
_close_nolock.LIBCMT ref: 00007FF6609115D8

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: __doserrno_close_nolock_errno
String ID:
API String ID: 186997739-0
Opcode ID: bda87b43c9d570eecaee3d7bd9474c424701c106e53aae398468428abc392862
Instruction ID: fee4699256ae76d34aaa9f5226edf45e2f26dfdc5ff0c4cd0fb1ffcbda2ae934
Opcode Fuzzy Hash: bda87b43c9d570eecaee3d7bd9474c424701c106e53aae398468428abc392862
Instruction Fuzzy Hash: 3A119D22E1C282F1F7056B25998527D6637AFD17A0F196378E51F8F3D3CE7CA4408650

Function 0287CA48 Relevance: 10.6, APIs: 7, Instructions: 51COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0287CA6C
_errno.LIBCMT ref: 0287CA85
write_char.LIBCMT ref: 0287CA9A
_errno.LIBCMT ref: 0287CAA7
write_char.LIBCMT ref: 0287CAB9
_errno.LIBCMT ref: 0287CAC2
_errno.LIBCMT ref: 0287CACC

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$write_char
String ID:
API String ID: 1772936973-0
Opcode ID: 553ff7a640bda5d3f087a58087b0c5fe603f7e2afa60208906e828a7eb11613b
Instruction ID: a0b26b21ce92710d7c5d0460de8e9c27ac464c4bd82c356e473b2471bf2f8903
Opcode Fuzzy Hash: 553ff7a640bda5d3f087a58087b0c5fe603f7e2afa60208906e828a7eb11613b
Instruction Fuzzy Hash: D211C27E500B808BD721AF66A40031EB7A0F3A8FD5F584052CF588B755CB3CC491CB42

Function 0287D58C Relevance: 10.6, APIs: 7, Instructions: 51COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0287D5B0
_errno.LIBCMT ref: 0287D5C9
write_char.LIBCMT ref: 0287D5DF
_errno.LIBCMT ref: 0287D5ED
write_char.LIBCMT ref: 0287D602
_errno.LIBCMT ref: 0287D60B
_errno.LIBCMT ref: 0287D615

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$write_char
String ID:
API String ID: 1772936973-0
Opcode ID: 671de168d03ae217984e1b1287bd742c961c49be666fcdf1db50e274fe126a0f
Instruction ID: 4c62541afd08afb67e499e002577230b1c54cdc9123f1f373631b9c9ffbe174c
Opcode Fuzzy Hash: 671de168d03ae217984e1b1287bd742c961c49be666fcdf1db50e274fe126a0f
Instruction Fuzzy Hash: 6D115A7E900B808BDB21AF5A944032E7661FB94F98F595025DF598B755CB3CC482CF42

Function 00007FF66090AC9C Relevance: 10.6, APIs: 7, Instructions: 51COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF66090ACC0
_errno.LIBCMT ref: 00007FF66090ACD9
write_char.LIBCMT ref: 00007FF66090ACEE
_errno.LIBCMT ref: 00007FF66090ACFB
write_char.LIBCMT ref: 00007FF66090AD0D
_errno.LIBCMT ref: 00007FF66090AD16
_errno.LIBCMT ref: 00007FF66090AD20

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$write_char
String ID:
API String ID: 1772936973-0
Opcode ID: c1d3ccc9aad43bc67af73f482cb02ec735a242584822cbb9a96a93b359dba97b
Instruction ID: c6636079e882b0ce6286ea2dc404855dc07999f96cfac6e18b0942a4eaf95a7c
Opcode Fuzzy Hash: c1d3ccc9aad43bc67af73f482cb02ec735a242584822cbb9a96a93b359dba97b
Instruction Fuzzy Hash: D0115E3280C782E6E7605B51940036976B1FB94B90F196238DB8E4BBD3CE3CE84187C1

Function 02868E90 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 02868EBB
GetCommandLineW.KERNEL32 ref: 02868EC1
GetStartupInfoW.KERNEL32 ref: 02868ECF
CreateProcessW.KERNEL32 ref: 02868F12
ExitProcess.KERNEL32 ref: 02868F1B

Strings

, xrefs: 02868F06

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Process$CommandCreateExitFileInfoLineModuleNameStartup
String ID:
API String ID: 3421218197-3916222277
Opcode ID: d4be7e06b31d663aed38c78f28249248fafd060fd5c9b0da482a79e76a279693
Instruction ID: 24d76a2053f786f3c6fbb568f2606533d73960b5d431e56130eb9268d154df85
Opcode Fuzzy Hash: d4be7e06b31d663aed38c78f28249248fafd060fd5c9b0da482a79e76a279693
Instruction Fuzzy Hash: 2A014F3A215B8182DB608B64F84935BB7A4F394794F905126E78A43F68DF3CC145CB00

Function 0286E8DF Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0286E906
RegDeleteValueW.ADVAPI32 ref: 0286E917
RegSetValueExW.ADVAPI32 ref: 0286E93E
RegCloseKey.ADVAPI32 ref: 0286E948

Strings

Console, xrefs: 0286E8EA
IpDatespecial, xrefs: 0286E910, 0286E921

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Value$CloseDeleteOpen
String ID: Console$IpDatespecial
API String ID: 3183427449-1840232981
Opcode ID: 46a845e2221ca44cf1185620c2cc3f604d55b02dd79e17f295db38f463142a96
Instruction ID: c5f713aa5a670293623e32ee2ebaecab2bde9744ba1946e2fd6ad7741a98f590
Opcode Fuzzy Hash: 46a845e2221ca44cf1185620c2cc3f604d55b02dd79e17f295db38f463142a96
Instruction Fuzzy Hash: F701217A716A8086EB21CB15F8597993770F799BA8F848112CF9D13B95CF3CC18AC704

Function 02878E98 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 02878EB7

Part of subcall function 0287E2A0: _amsg_exit.LIBCMT ref: 0287E2B6

Part of subcall function 02882978: _getptd.LIBCMT ref: 0288297C

_getptd.LIBCMT ref: 02878EC9
_getptd.LIBCMT ref: 02878ED7

Strings

MOC, xrefs: 02878EA7
RCC, xrefs: 02878E9F
csm, xrefs: 02878EAF

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd$_amsg_exit
String ID: MOC$RCC$csm
API String ID: 2610988583-2671469338
Opcode ID: 2f656466f72e01974a1df93c8b86b1b6fb3d43157e53be49a4e22abd606d8b83
Instruction ID: eaeb312f1d14772d80fdf51b9ccb6b03f6fcc0a4ef2b15857fa0ba0db41aa04c
Opcode Fuzzy Hash: 2f656466f72e01974a1df93c8b86b1b6fb3d43157e53be49a4e22abd606d8b83
Instruction Fuzzy Hash: 69E0123F910144CAD7257F6984483AC3661F7A8B0AFD6D9A59648C2310C7BCC480AE13

Function 00007FF6609131A8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 20COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF6609131C7

Part of subcall function 00007FF66090BA34: _amsg_exit.LIBCMT ref: 00007FF66090BA4A

Part of subcall function 00007FF66090DA94: _getptd.LIBCMT ref: 00007FF66090DA98

_getptd.LIBCMT ref: 00007FF6609131D9
_getptd.LIBCMT ref: 00007FF6609131E7

Strings

RCC, xrefs: 00007FF6609131AF
MOC, xrefs: 00007FF6609131B7
csm, xrefs: 00007FF6609131BF

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd$_amsg_exit
String ID: MOC$RCC$csm
API String ID: 2610988583-2671469338
Opcode ID: d0c629851adb83669a1057044e1c73a61abea7eb16c4708499e842e3cc9a1464
Instruction ID: c6e3a6219c7e8d789f40ca0cd851a760820f531c119ec4df6046f046997b4480
Opcode Fuzzy Hash: d0c629851adb83669a1057044e1c73a61abea7eb16c4708499e842e3cc9a1464
Instruction Fuzzy Hash: 68F03035B0D102E5E7552B2480063F831F7EF98B05F85F7B8D6498A3838FAC68818A52

Function 0282EBD1 Relevance: 9.2, APIs: 6, Instructions: 164COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0282EBF0

Part of subcall function 0282E80D: _getptd.LIBCMT ref: 0282E817

Part of subcall function 0282A531: malloc.LIBCMT ref: 0282A55C

free.LIBCMT ref: 0282EC7B

Part of subcall function 02824FD1: _errno.LIBCMT ref: 02824FF1

_lock.LIBCMT ref: 0282ECAB
free.LIBCMT ref: 0282ED4E
free.LIBCMT ref: 0282ED7A
_errno.LIBCMT ref: 0282ED7F

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$_errno_getptd$_lockmalloc
String ID:
API String ID: 1369581901-0
Opcode ID: 6627a91fce6e6f9bd605d3e47a486a9597166daa8d056ce2c6ca4d44098f1495
Instruction ID: fa6dd6a6b664187301b098e9136a5bf43bb3cdfbd8dbd2eb41facd069d1eb7b2
Opcode Fuzzy Hash: 6627a91fce6e6f9bd605d3e47a486a9597166daa8d056ce2c6ca4d44098f1495
Instruction Fuzzy Hash: 9D513B3C614A188FEB65EF6C988076577E2FB88314F14415EC88EC7252DB34B886CB97

Function 00007FF6609055B0 Relevance: 9.2, APIs: 6, Instructions: 155memorythreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF6609055D3
VirtualAlloc.KERNEL32 ref: 00007FF660905660
VirtualFree.KERNEL32 ref: 00007FF6609056A2
VirtualAlloc.KERNEL32 ref: 00007FF66090572F
VirtualFree.KERNEL32 ref: 00007FF660905771
GetCurrentThreadId.KERNEL32 ref: 00007FF660905833

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Virtual$AllocCurrentFreeThread
String ID:
API String ID: 1155560630-0
Opcode ID: cd68a7855d9bff61e79928e65f9b1f850c339330868a212f2d92ce5f7b1a21b2
Instruction ID: 69456b355ec8ab2e232170a996e270156f4bab969482349618fb7c73013e8e1d
Opcode Fuzzy Hash: cd68a7855d9bff61e79928e65f9b1f850c339330868a212f2d92ce5f7b1a21b2
Instruction Fuzzy Hash: C2714932718A81E7D65D8B25A14036AB3BAFB44B84F405238EB5E8B755DF38F561CB40

Function 02811261 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 02811296
malloc.LIBCMT ref: 02811302

Part of subcall function 02825011: _FF_MSGBANNER.LIBCMT ref: 02825041
Part of subcall function 02825011: _callnewh.LIBCMT ref: 0282507F
Part of subcall function 02825011: _errno.LIBCMT ref: 0282508A
Part of subcall function 02825011: _errno.LIBCMT ref: 02825095

free.LIBCMT ref: 0281132B

Part of subcall function 02824FD1: _errno.LIBCMT ref: 02824FF1

Strings

d, xrefs: 028113D6
d, xrefs: 028113A2
d, xrefs: 028113AC

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$malloc$_callnewhfree
String ID: d$d$d
API String ID: 1789327305-1898527202
Opcode ID: e4bca791a3ca6fc00bfabf83367b606d4990b6dba4dc514ecbcba51caafa37f7
Instruction ID: 7b9b1c14037322a7c002e0502aa488583ee01159efd720a4c7a80505acc48210
Opcode Fuzzy Hash: e4bca791a3ca6fc00bfabf83367b606d4990b6dba4dc514ecbcba51caafa37f7
Instruction Fuzzy Hash: A25104B4424A198FDB95DF1CC088B957BE4FB18704F4581AA990CCB26ADB74C884CFA1

Function 0287F100 Relevance: 9.1, APIs: 6, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0287F11F

Part of subcall function 0287E2A0: _amsg_exit.LIBCMT ref: 0287E2B6

Part of subcall function 0287ED3C: _getptd.LIBCMT ref: 0287ED46
Part of subcall function 0287ED3C: _amsg_exit.LIBCMT ref: 0287EDE3

Part of subcall function 0287EDF8: GetOEMCP.KERNEL32 ref: 0287EE22

Part of subcall function 0287AA60: malloc.LIBCMT ref: 0287AA8B
Part of subcall function 0287AA60: Sleep.KERNEL32 ref: 0287AA9E

free.LIBCMT ref: 0287F1AA

Part of subcall function 02875500: HeapFree.KERNEL32 ref: 02875516
Part of subcall function 02875500: _errno.LIBCMT ref: 02875520
Part of subcall function 02875500: GetLastError.KERNEL32 ref: 02875528

_lock.LIBCMT ref: 0287F1DA
free.LIBCMT ref: 0287F27D
free.LIBCMT ref: 0287F2A9
_errno.LIBCMT ref: 0287F2AE

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$_amsg_exit_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 3894533514-0
Opcode ID: 03e3f508a065664d853cee889eabf6afe27cfefa4609284178044c8b375e6fe5
Instruction ID: 95c7d78e9ace65ed44edbb9c5eda9680ae924cc9d9bac68995f591d08be2818b
Opcode Fuzzy Hash: 03e3f508a065664d853cee889eabf6afe27cfefa4609284178044c8b375e6fe5
Instruction Fuzzy Hash: BF41A13E61168086E714DB6AE44032EB7A2F7A4B88F588117CE5EC7B58CF7CC442C791

Function 00007FF66090F330 Relevance: 9.1, APIs: 6, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF66090F34F

Part of subcall function 00007FF66090BA34: _amsg_exit.LIBCMT ref: 00007FF66090BA4A

Part of subcall function 00007FF66090EF6C: _getptd.LIBCMT ref: 00007FF66090EF76
Part of subcall function 00007FF66090EF6C: _amsg_exit.LIBCMT ref: 00007FF66090F013

Part of subcall function 00007FF66090F028: GetOEMCP.KERNEL32 ref: 00007FF66090F052

Part of subcall function 00007FF66090C020: malloc.LIBCMT ref: 00007FF66090C04B
Part of subcall function 00007FF66090C020: Sleep.KERNEL32(?,?,ceil,00007FF66090D951,?,?,?,00007FF66090D9FB,?,?,00000000,00007FF66090B951,?,?,00000000,00007FF66090BA08), ref: 00007FF66090C05E

free.LIBCMT ref: 00007FF66090F3DA

Part of subcall function 00007FF660909030: HeapFree.KERNEL32(?,?,00000000,00007FF66090BA1C,?,?,?,00007FF66090938D,?,?,?,?,00007FF660914BEE), ref: 00007FF660909046
Part of subcall function 00007FF660909030: _errno.LIBCMT ref: 00007FF660909050
Part of subcall function 00007FF660909030: GetLastError.KERNEL32(?,?,00000000,00007FF66090BA1C,?,?,?,00007FF66090938D,?,?,?,?,00007FF660914BEE), ref: 00007FF660909058

_lock.LIBCMT ref: 00007FF66090F40A
free.LIBCMT ref: 00007FF66090F4AD
free.LIBCMT ref: 00007FF66090F4D9
_errno.LIBCMT ref: 00007FF66090F4DE

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$_amsg_exit_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 3894533514-0
Opcode ID: de94af9eb20aff71365a2e79f7747a0a6ec5dd64a421ced7859fa65583d8f430
Instruction ID: b85175a1c1e527354c14f38d1ba2994fd71fefb75c2c07ecb9851cb1871661d4
Opcode Fuzzy Hash: de94af9eb20aff71365a2e79f7747a0a6ec5dd64a421ced7859fa65583d8f430
Instruction Fuzzy Hash: 4351C421A0C642E1E7549B25945027A76B7FB80B48F14623ADD5FCBBA7CF3CE542C784

Function 02861790 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 028617C5
malloc.LIBCMT ref: 02861831

Part of subcall function 02875540: _FF_MSGBANNER.LIBCMT ref: 02875570
Part of subcall function 02875540: HeapAlloc.KERNEL32 ref: 02875595
Part of subcall function 02875540: _callnewh.LIBCMT ref: 028755AE
Part of subcall function 02875540: _errno.LIBCMT ref: 028755B9
Part of subcall function 02875540: _errno.LIBCMT ref: 028755C4

free.LIBCMT ref: 0286185A

Part of subcall function 02875500: HeapFree.KERNEL32 ref: 02875516
Part of subcall function 02875500: _errno.LIBCMT ref: 02875520
Part of subcall function 02875500: GetLastError.KERNEL32 ref: 02875528

Strings

d, xrefs: 028618DB
d, xrefs: 02861904
d, xrefs: 028618D1

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$Heapmalloc$AllocErrorFreeLast_callnewhfree
String ID: d$d$d
API String ID: 161857241-1898527202
Opcode ID: 413d3b361f1ae2f37866b78383e34ea41cab92c9d9dfaf27fd664dffe3c6aa16
Instruction ID: 05682dac2632a5a498b94e1eac2bfb0f061a59e2df6e161d373332605caf8301
Opcode Fuzzy Hash: 413d3b361f1ae2f37866b78383e34ea41cab92c9d9dfaf27fd664dffe3c6aa16
Instruction Fuzzy Hash: 0941047A112B90C9E7818F25E4483993BB9F748F88F59813ADB8C4B758EF79C454CB60

Function 00007FF6609017C0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 00007FF6609017F5
malloc.LIBCMT ref: 00007FF660901861

Part of subcall function 00007FF660909070: _FF_MSGBANNER.LIBCMT ref: 00007FF6609090A0
Part of subcall function 00007FF660909070: HeapAlloc.KERNEL32(?,?,4E00000000000000,00007FF66090C050,?,?,ceil,00007FF66090D951,?,?,?,00007FF66090D9FB,?,?,00000000,00007FF66090B951), ref: 00007FF6609090C5
Part of subcall function 00007FF660909070: _callnewh.LIBCMT ref: 00007FF6609090DE
Part of subcall function 00007FF660909070: _errno.LIBCMT ref: 00007FF6609090E9
Part of subcall function 00007FF660909070: _errno.LIBCMT ref: 00007FF6609090F4

free.LIBCMT ref: 00007FF66090188A

Part of subcall function 00007FF660909030: HeapFree.KERNEL32(?,?,00000000,00007FF66090BA1C,?,?,?,00007FF66090938D,?,?,?,?,00007FF660914BEE), ref: 00007FF660909046
Part of subcall function 00007FF660909030: _errno.LIBCMT ref: 00007FF660909050
Part of subcall function 00007FF660909030: GetLastError.KERNEL32(?,?,00000000,00007FF66090BA1C,?,?,?,00007FF66090938D,?,?,?,?,00007FF660914BEE), ref: 00007FF660909058

Strings

d, xrefs: 00007FF660901934
d, xrefs: 00007FF66090190B
d, xrefs: 00007FF660901901

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$Heapmalloc$AllocErrorFreeLast_callnewhfree
String ID: d$d$d
API String ID: 161857241-1898527202
Opcode ID: e9053c7a343c0b83d9d295b64127538e78e5f548f8b7e2bc9a1aaa569d59c23e
Instruction ID: 182f177ac06ec53fa75a718f72eaa7e8e4cf37e7b890b7c9c8418090a1511975
Opcode Fuzzy Hash: e9053c7a343c0b83d9d295b64127538e78e5f548f8b7e2bc9a1aaa569d59c23e
Instruction Fuzzy Hash: 7C412832519B91C5E7408F20E4003993AF9F744F88F19923ADA8D4B789EF79D454CBA0

Function 02832925 Relevance: 9.1, APIs: 6, Instructions: 82COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 0283294C

Part of subcall function 0282BE8D: _set_error_mode.LIBCMT ref: 0282BE96
Part of subcall function 0282BE8D: _set_error_mode.LIBCMT ref: 0282BEA5

Part of subcall function 0282BC2D: _set_error_mode.LIBCMT ref: 0282BC72
Part of subcall function 0282BC2D: _set_error_mode.LIBCMT ref: 0282BC83

Part of subcall function 0282A531: malloc.LIBCMT ref: 0282A55C

_errno.LIBCMT ref: 0283298E
_lock.LIBCMT ref: 028329A2
free.LIBCMT ref: 028329C5
_errno.LIBCMT ref: 028329CA

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _set_error_mode$_errno$_lockfreemalloc
String ID:
API String ID: 360200360-0
Opcode ID: 94b0533748bce51f3f0ee7a44595441a65b1f51acf6d8cfd0de9afd4f5187e95
Instruction ID: c85e2e83a2465b4f81cd462ec9c8b06b81e5d28f0c4f91e5abc36db0ce40698b
Opcode Fuzzy Hash: 94b0533748bce51f3f0ee7a44595441a65b1f51acf6d8cfd0de9afd4f5187e95
Instruction Fuzzy Hash: DF21CF3C208A2D8FE765BFA8D85472972D1FB89316F40053C980AC3294CB788C84CB82

Function 02882630 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 02882649
WideCharToMultiByte.KERNEL32 ref: 028826A0
WideCharToMultiByte.KERNEL32 ref: 028826DB
free.LIBCMT ref: 028826E8
FreeEnvironmentStringsW.KERNEL32 ref: 028826F3
FreeEnvironmentStringsW.KERNEL32 ref: 02882701

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$free
String ID:
API String ID: 517548149-0
Opcode ID: 39ac4e38675b56c40c8c307033e4f7505f59e0a7c34ad5e5f182410cea7ce816
Instruction ID: 33c2ddab086f877d602ec2d1b89f0bbb1ab257e2a899aa184c4f007b935ea788
Opcode Fuzzy Hash: 39ac4e38675b56c40c8c307033e4f7505f59e0a7c34ad5e5f182410cea7ce816
Instruction Fuzzy Hash: 43213D7A615BC086DB24EF26B41471AB7A5FB88FD4F888025DE8A87B19EF3CD450C704

Function 028652F0 Relevance: 9.1, APIs: 6, Instructions: 66synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32 ref: 0286530C
ResetEvent.KERNEL32 ref: 02865319
timeGetTime.WINMM ref: 0286531F
WaitForSingleObject.KERNEL32 ref: 02865373
ResetEvent.KERNEL32 ref: 02865390

Part of subcall function 02864D20: GetCurrentThreadId.KERNEL32 ref: 02864D2D

ResetEvent.KERNEL32 ref: 028653B7

Part of subcall function 028759EC: _errno.LIBCMT ref: 02875A17
Part of subcall function 028759EC: _invalid_parameter_noinfo.LIBCMT ref: 02875A22

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: EventReset$CurrentObjectSingleThreadTimeWait_errno_invalid_parameter_noinfotime
String ID:
API String ID: 2543248268-0
Opcode ID: d50bf74d6e22cde16153601e1c4afc7f6e0cc1e21fea4f5b3574960e88087405
Instruction ID: 8beb4607f3ffe5006d5f3685079d97e8c871e2960a792dbb9ec29aefb6fd7520
Opcode Fuzzy Hash: d50bf74d6e22cde16153601e1c4afc7f6e0cc1e21fea4f5b3574960e88087405
Instruction Fuzzy Hash: 0C21397A204B9086DB45CF25E84836D7364FB89F98FA88121DE5DD7B68DF38C581C740

Function 00007FF660905350 Relevance: 9.1, APIs: 6, Instructions: 66synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32 ref: 00007FF66090536C
ResetEvent.KERNEL32 ref: 00007FF660905379
timeGetTime.WINMM ref: 00007FF66090537F
WaitForSingleObject.KERNEL32 ref: 00007FF6609053D3
ResetEvent.KERNEL32 ref: 00007FF6609053F0

Part of subcall function 00007FF660904D80: GetCurrentThreadId.KERNEL32 ref: 00007FF660904D8D

ResetEvent.KERNEL32 ref: 00007FF660905417

Part of subcall function 00007FF6609094DC: _errno.LIBCMT ref: 00007FF660909507
Part of subcall function 00007FF6609094DC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF660909512

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: EventReset$CurrentObjectSingleThreadTimeWait_errno_invalid_parameter_noinfotime
String ID:
API String ID: 2543248268-0
Opcode ID: 3c273d08d9a1588e0da29e7cbdea0a8e994acad75351d05f79bf53ec50dd0d72
Instruction ID: 7eac60ca80c7543a5c3e25d83fe9e2dac608db7337feb72328b8637256dee66a
Opcode Fuzzy Hash: 3c273d08d9a1588e0da29e7cbdea0a8e994acad75351d05f79bf53ec50dd0d72
Instruction Fuzzy Hash: 16217C36608A81D6E740CF21E8402AA73B6FB48F94F185235DE4ECB76ADF78D5868740

Function 02864D20 Relevance: 9.1, APIs: 6, Instructions: 57networkthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 02864D2D

Part of subcall function 02864100: SwitchToThread.KERNEL32 ref: 0286413E
Part of subcall function 02864100: SetLastError.KERNEL32 ref: 02864185

send.WS2_32 ref: 02864D79
SetEvent.KERNEL32 ref: 02864D97
WSACloseEvent.WS2_32 ref: 02864DAB
shutdown.WS2_32 ref: 02864DC4
closesocket.WS2_32 ref: 02864DCE

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: EventThread$CloseCurrentErrorLastSwitchclosesocketsendshutdown
String ID:
API String ID: 779811758-0
Opcode ID: 9bc6ea2ebeeba2fb3f83fde7a834929fe9b253913c8843f74cc280f85b5423e1
Instruction ID: 5887e387a8479ec71517c3134e5fa923bb55216a1e6c757bd4fc980489bcee95
Opcode Fuzzy Hash: 9bc6ea2ebeeba2fb3f83fde7a834929fe9b253913c8843f74cc280f85b5423e1
Instruction Fuzzy Hash: 7221333E60164186EB20AF79E85832D7362FB98FB8F944321DB3987698DF34C885C740

Function 00007FF660904D80 Relevance: 9.1, APIs: 6, Instructions: 57networkthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF660904D8D

Part of subcall function 00007FF660904160: SwitchToThread.KERNEL32(?,?,00000000,00007FF660904D9D), ref: 00007FF66090419E
Part of subcall function 00007FF660904160: SetLastError.KERNEL32(?,?,00000000,00007FF660904D9D), ref: 00007FF6609041E5

send.WS2_32 ref: 00007FF660904DD9
SetEvent.KERNEL32 ref: 00007FF660904DF7
WSACloseEvent.WS2_32 ref: 00007FF660904E0B
shutdown.WS2_32 ref: 00007FF660904E24
closesocket.WS2_32 ref: 00007FF660904E2E

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: EventThread$CloseCurrentErrorLastSwitchclosesocketsendshutdown
String ID:
API String ID: 779811758-0
Opcode ID: 2fa192ee69b06f1eeb25edd6ab0f4da1fe6a6614d325027052db3e123256aa8b
Instruction ID: 825d878e6846e1e7ee154b3747e14e590b1f70beee6efd999fee8d2b3a91dafa
Opcode Fuzzy Hash: 2fa192ee69b06f1eeb25edd6ab0f4da1fe6a6614d325027052db3e123256aa8b
Instruction Fuzzy Hash: 6F215171A08642D2EB149F25E4501293376FF98FA4F445335DA2E8B7D6DE38D8858780

Function 0287E21C Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0287E226
FlsGetValue.KERNEL32 ref: 0287E234
SetLastError.KERNEL32 ref: 0287E28C

Part of subcall function 0287AAE0: Sleep.KERNEL32 ref: 0287AB25

FlsSetValue.KERNEL32 ref: 0287E260
free.LIBCMT ref: 0287E283

Part of subcall function 0287E164: _lock.LIBCMT ref: 0287E1B8
Part of subcall function 0287E164: _lock.LIBCMT ref: 0287E1D7

GetCurrentThreadId.KERNEL32 ref: 0287E274

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: 413cfe39aa25b23b0b14b7556f2c0eeaded75c2f83ecb0192f175fd880dcee4d
Instruction ID: cf394af59f04072d4b876194fc74c520265da1b5bc23c96f76b21abcec6e61f8
Opcode Fuzzy Hash: 413cfe39aa25b23b0b14b7556f2c0eeaded75c2f83ecb0192f175fd880dcee4d
Instruction Fuzzy Hash: EE01866D60270183EB85AF75E4983296292BB5CBA4FD8C235DA2A837D4EF3CC445C711

Function 00007FF66090B9B0 Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF66090938D,?,?,?,?,00007FF660914BEE,?,?,?,?,00007FF660912ED1), ref: 00007FF66090B9BA
FlsGetValue.KERNEL32(?,?,?,00007FF66090938D,?,?,?,?,00007FF660914BEE,?,?,?,?,00007FF660912ED1), ref: 00007FF66090B9C8
SetLastError.KERNEL32(?,?,?,00007FF66090938D,?,?,?,?,00007FF660914BEE,?,?,?,?,00007FF660912ED1), ref: 00007FF66090BA20

Part of subcall function 00007FF66090C0A0: Sleep.KERNEL32(?,?,ceil,00007FF66090B9E3,?,?,?,00007FF66090938D,?,?,?,?,00007FF660914BEE), ref: 00007FF66090C0E5

FlsSetValue.KERNEL32(?,?,?,00007FF66090938D,?,?,?,?,00007FF660914BEE,?,?,?,?,00007FF660912ED1), ref: 00007FF66090B9F4
free.LIBCMT ref: 00007FF66090BA17

Part of subcall function 00007FF66090B8F8: _lock.LIBCMT ref: 00007FF66090B94C
Part of subcall function 00007FF66090B8F8: _lock.LIBCMT ref: 00007FF66090B96B

GetCurrentThreadId.KERNEL32 ref: 00007FF66090BA08

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: 4213d91c3c88d15f51b7cb7809fe6c775b8414f6b8c9181202556ccbea47a494
Instruction ID: d568053f8fe35e02b1b19febbdd2d44efb3de31cb21f252aa0e37a1c02d063e0
Opcode Fuzzy Hash: 4213d91c3c88d15f51b7cb7809fe6c775b8414f6b8c9181202556ccbea47a494
Instruction Fuzzy Hash: 1D017524B0D702E2FB459B75945517922BBAF48750F086B38C92E8A3D3EE3CE845C210

Function 02811411 Relevance: 9.0, APIs: 7, Instructions: 259COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 02811480
free.LIBCMT ref: 028114D0
free.LIBCMT ref: 02811520
free.LIBCMT ref: 02811570
free.LIBCMT ref: 0281159B
free.LIBCMT ref: 028115BC

Part of subcall function 02824FD1: _errno.LIBCMT ref: 02824FF1

free.LIBCMT ref: 028115FA

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$_errno
String ID:
API String ID: 2288870239-0
Opcode ID: fb9f54a9f244550df940d026c32715cce55ac9c12273f06423ac3a9ba640441a
Instruction ID: f11118bee49f3d81bd1218ebef9e09b4ed6b49d387a9d04903fbea4b867abda6
Opcode Fuzzy Hash: fb9f54a9f244550df940d026c32715cce55ac9c12273f06423ac3a9ba640441a
Instruction Fuzzy Hash: 4D91AEB8105A4DCFCB99EFACC098B69B7E5FF59308B14449DC14EDB261CB71A882CB51

Function 0282922D Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0282925E
_getptd.LIBCMT ref: 0282927C
_CallSETranslator.LIBCMT ref: 028292C4

Part of subcall function 02827505: _getptd.LIBCMT ref: 0282752C

Strings

RCC, xrefs: 0282929A
MOC, xrefs: 02829292

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd$CallTranslator
String ID: MOC$RCC
API String ID: 3569367362-2084237596
Opcode ID: cb34173580a42dfacebeea2d5b2fd6fdecd6c43d53704b8f6108025bf97ea43f
Instruction ID: dc310bfcf581928c029a6ba5fef05ef7674a08a79599f84954ed754193d50b6a
Opcode Fuzzy Hash: cb34173580a42dfacebeea2d5b2fd6fdecd6c43d53704b8f6108025bf97ea43f
Instruction Fuzzy Hash: F361E638118B2D8FD724FF58C0047E6B3E1FB84308F644A6ED44AC7515DBB4A599CB82

Function 00007FF660901970 Relevance: 8.9, APIs: 7, Instructions: 157COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 00007FF6609019DF
free.LIBCMT ref: 00007FF660901A2F
free.LIBCMT ref: 00007FF660901A7F
free.LIBCMT ref: 00007FF660901ACF
free.LIBCMT ref: 00007FF660901AFA
free.LIBCMT ref: 00007FF660901B1B
free.LIBCMT ref: 00007FF660901B59

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 39caf3c37a47655031c94e0de5774d4aa99865a29994b72ed535d303bf2608d5
Instruction ID: b42ac2f7898e1fdfdf2a405e076ff9827aa5794a94ef2996d05d573c1eef1fc3
Opcode Fuzzy Hash: 39caf3c37a47655031c94e0de5774d4aa99865a29994b72ed535d303bf2608d5
Instruction Fuzzy Hash: 4A715D7360AB81D5DB51DF69E0502AD77B6EB55B84F58A13AC78E4B306CF38E461C300

Function 0287975C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0287978D

Part of subcall function 0287E2A0: _amsg_exit.LIBCMT ref: 0287E2B6

_getptd.LIBCMT ref: 028797AB
_CallSETranslator.LIBCMT ref: 028797F3

Part of subcall function 02877A34: _getptd.LIBCMT ref: 02877A5B

Strings

MOC, xrefs: 028797C1
RCC, xrefs: 028797C9

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd$CallTranslator_amsg_exit
String ID: MOC$RCC
API String ID: 1374396951-2084237596
Opcode ID: b2d025f7e271158a0b314ad1bef8ace00e4e0695c6d6e4d82c4aff9e558a4ce5
Instruction ID: 5a02fb48761fe7ac25cfd6dc279774548e8e7661cf1e1a9b80b00afe7d85007a
Opcode Fuzzy Hash: b2d025f7e271158a0b314ad1bef8ace00e4e0695c6d6e4d82c4aff9e558a4ce5
Instruction Fuzzy Hash: 8E51CF7A604AC5D6CF20DF19E5807ADB361FB80B8DF49452ADB9E87608DF78C152CB01

Function 00007FF660913A50 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 143COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF660913A81

Part of subcall function 00007FF66090BA34: _amsg_exit.LIBCMT ref: 00007FF66090BA4A

_getptd.LIBCMT ref: 00007FF660913A9F
_CallSETranslator.LIBCMT ref: 00007FF660913AE7

Part of subcall function 00007FF660911CB4: _getptd.LIBCMT ref: 00007FF660911CDB

Strings

MOC, xrefs: 00007FF660913AB5
RCC, xrefs: 00007FF660913ABD

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd$CallTranslator_amsg_exit
String ID: MOC$RCC
API String ID: 1374396951-2084237596
Opcode ID: 71d4d7f3723b5425788edb4ff7159e0c2d35ca9445fe2397f069a4d9efb0fa2f
Instruction ID: b80ccef3a540c4082a7bb455c77f8f7616646c271cde8204ef5edb03bb498393
Opcode Fuzzy Hash: 71d4d7f3723b5425788edb4ff7159e0c2d35ca9445fe2397f069a4d9efb0fa2f
Instruction Fuzzy Hash: 85614D72B08A82E5DA20CB15D0803B9B77AFB81B88F449675DB8E8B796DF78D151C700

Function 02861940 Relevance: 8.9, APIs: 7, Instructions: 135COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 028619AF
free.LIBCMT ref: 028619FF
free.LIBCMT ref: 02861A4F
free.LIBCMT ref: 02861A9F
free.LIBCMT ref: 02861ACA
free.LIBCMT ref: 02861AEB
free.LIBCMT ref: 02861B29

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 46e5c42acb55ef602981079806f2a339f8179ab2e4ea52cfa33c98ebef37ded6
Instruction ID: e12873fbd45a13a348be8aff4497bdf3bf71932afcdd5b45345f469bdd4704e0
Opcode Fuzzy Hash: 46e5c42acb55ef602981079806f2a339f8179ab2e4ea52cfa33c98ebef37ded6
Instruction Fuzzy Hash: 1151053E202B84C5CB549F29E58836DB366F708B88F9C9016CB9E97715EF3AD4A1C315

Function 02827C09 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 02827C25

Part of subcall function 028326D9: _errno.LIBCMT ref: 028326E2
Part of subcall function 028326D9: _invalid_parameter_noinfo.LIBCMT ref: 028326ED

_errno.LIBCMT ref: 02827C8E
_invalid_parameter_noinfo.LIBCMT ref: 02827C99
_getbuf.LIBCMT ref: 02827CCD

Strings

@, xrefs: 02827CEA

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno_getbuf
String ID: @
API String ID: 3036866907-2766056989
Opcode ID: 6e7c207d42a18353b67d0f256d14af4aa84329ee3b20535ed05c0923c9c5ad37
Instruction ID: e8a42c229d1d221d948a974ee31f859f6ba75a6f16a654274b2972be0f4eb040
Opcode Fuzzy Hash: 6e7c207d42a18353b67d0f256d14af4aa84329ee3b20535ed05c0923c9c5ad37
Instruction Fuzzy Hash: 4931B83C124A688EF75D9F3D84C933476D1FB55329F68229CD85ACA1D6D73884CAC681

Function 02878138 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 02878154

Part of subcall function 02882C08: _errno.LIBCMT ref: 02882C11
Part of subcall function 02882C08: _invalid_parameter_noinfo.LIBCMT ref: 02882C1C

_errno.LIBCMT ref: 028781BD
_invalid_parameter_noinfo.LIBCMT ref: 028781C8
_getbuf.LIBCMT ref: 028781FC

Strings

@, xrefs: 02878219

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno_getbuf
String ID: @
API String ID: 3036866907-2766056989
Opcode ID: 8d7ce136ce8f7f1f231367dd9a059eef84ecd512c068b24ec2d55b06d3899124
Instruction ID: 8097c5a3439ccbaf33365068ebb2830583f5a1dc428cca4a09967e78fe5ae2ee
Opcode Fuzzy Hash: 8d7ce136ce8f7f1f231367dd9a059eef84ecd512c068b24ec2d55b06d3899124
Instruction Fuzzy Hash: A531D66F610F8885DF298F38D84C3382751E751BBDF599601CE2E862E5CB78C891D7A1

Function 028792D5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 02879328
_getptd.LIBCMT ref: 028792DD

Part of subcall function 0287E2A0: _amsg_exit.LIBCMT ref: 0287E2B6

_getptd.LIBCMT ref: 0287939F
_getptd.LIBCMT ref: 028793AB

Strings

csm, xrefs: 0287935F

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd$ExceptionRaise_amsg_exit
String ID: csm
API String ID: 4155239085-1018135373
Opcode ID: df9b9db6a6bbbd15e90c5ace666b783b32aabbdd6a22e9d59f25dd2b1799e60b
Instruction ID: 5bf61277dddad2911320426b7df4329e414b556101d3732f1871dd7b2a515193
Opcode Fuzzy Hash: df9b9db6a6bbbd15e90c5ace666b783b32aabbdd6a22e9d59f25dd2b1799e60b
Instruction Fuzzy Hash: 6821083E204641C6DB30DF16E04475EB365F799BA9F494226DFAE43B94CB39D886CB01

Function 00007FF6609135C9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF66091361C
_getptd.LIBCMT ref: 00007FF6609135D1

Part of subcall function 00007FF66090BA34: _amsg_exit.LIBCMT ref: 00007FF66090BA4A

_getptd.LIBCMT ref: 00007FF660913693
_getptd.LIBCMT ref: 00007FF66091369F

Strings

csm, xrefs: 00007FF660913653

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd$ExceptionRaise_amsg_exit
String ID: csm
API String ID: 4155239085-1018135373
Opcode ID: 9353493ea25706b6dc90e2ff27a29bc00a94e76970d53f38476d2ffead27e1f6
Instruction ID: c1f159a4b34e232e5025b1dbe04ad16c91507f80567e6f188e6681e3470b123f
Opcode Fuzzy Hash: 9353493ea25706b6dc90e2ff27a29bc00a94e76970d53f38476d2ffead27e1f6
Instruction Fuzzy Hash: 1D316C36608642E6E7709B21A00536E7376FB887A5F409375DE9E4B786CF3DE842CB40

Function 0286E951 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0286E974
RegDeleteValueW.ADVAPI32 ref: 0286E985
RegCloseKey.ADVAPI32 ref: 0286E98F

Strings

Console, xrefs: 0286E958
IpDatespecial, xrefs: 0286E97E

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Console$IpDatespecial
API String ID: 849931509-1840232981
Opcode ID: b025ef4eb51c44f48957f4b35409c7e843425d9afe9ad078bec9dd5431dc71bf
Instruction ID: 308dc3c91116c7492f213ba2ecb9d49b788b49afd93b604f96d896bc441f6669
Opcode Fuzzy Hash: b025ef4eb51c44f48957f4b35409c7e843425d9afe9ad078bec9dd5431dc71bf
Instruction Fuzzy Hash: 23F05E3A711A85CAEB21DB65F808B997360F754BADF808112CE5D13A98DF38C1CAC740

Function 028854C4 Relevance: 7.7, APIs: 5, Instructions: 168COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 02885557
__free_lconv_num.LIBCMT ref: 0288562B
free.LIBCMT ref: 02885637
free.LIBCMT ref: 028856E6
free.LIBCMT ref: 028856F2

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$__free_lconv_num
String ID:
API String ID: 1547021563-0
Opcode ID: 0972748b3299ccda1293d1965588bd6f12e48a98b94eb4eeacb18aa3f4afee27
Instruction ID: f31297955a24ae27e0ba51d0729342196f0b2838fe96ade485ea7c278a0f2457
Opcode Fuzzy Hash: 0972748b3299ccda1293d1965588bd6f12e48a98b94eb4eeacb18aa3f4afee27
Instruction Fuzzy Hash: C451913E311B848ADB24EF26E4407AA77A6F784B88F854526DE9E87715DF3CC152C740

Function 0282B345 Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0282B36B
_invalid_parameter_noinfo.LIBCMT ref: 0282B376
_getptd.LIBCMT ref: 0282B382
_lock.LIBCMT ref: 0282B3BB
_lock.LIBCMT ref: 0282B44E

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _lock$_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808128820-0
Opcode ID: 9441f5ab7ec443429837251121a8f35dc82b3e26f8158eac5b6752c49b38b939
Instruction ID: d71fd12de8fdd85ed011040b809df055409fb06f7b39641ea3cab01b84055f3d
Opcode Fuzzy Hash: 9441f5ab7ec443429837251121a8f35dc82b3e26f8158eac5b6752c49b38b939
Instruction Fuzzy Hash: C141E23C619A1C4FE758EB2C9890B7933D2FBA8314F14416DDC4EC3295DB249C8A8B93

Function 0282C389 Relevance: 7.6, APIs: 5, Instructions: 150COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 0282C3A6

Part of subcall function 028326D9: _errno.LIBCMT ref: 028326E2
Part of subcall function 028326D9: _invalid_parameter_noinfo.LIBCMT ref: 028326ED

_errno.LIBCMT ref: 0282C3B6
_errno.LIBCMT ref: 0282C3D2
_isatty.LIBCMT ref: 0282C433
_getbuf.LIBCMT ref: 0282C43F

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-0
Opcode ID: 3a1171754d4b4170047c6cc9e54148eef069f994d9e669cb0a89bd27f0e9310b
Instruction ID: f8c1bc91ed90ed3b532f907deefefd78a838b3952cb80c6a80ca58d9520863de
Opcode Fuzzy Hash: 3a1171754d4b4170047c6cc9e54148eef069f994d9e669cb0a89bd27f0e9310b
Instruction Fuzzy Hash: F841D03D114A284FCB58EF2CC49573A77E1FB48310B59469AD85ACB29AD774C8C5CBC2

Function 0287C8B8 Relevance: 7.6, APIs: 5, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 0287C8D5

Part of subcall function 02882C08: _errno.LIBCMT ref: 02882C11
Part of subcall function 02882C08: _invalid_parameter_noinfo.LIBCMT ref: 02882C1C

_errno.LIBCMT ref: 0287C8E5
_errno.LIBCMT ref: 0287C901
_isatty.LIBCMT ref: 0287C962
_getbuf.LIBCMT ref: 0287C96E

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-0
Opcode ID: 381ea5d0cd2b533c0e117cf2450131a3f5c5659705f4c7803b8e4f8ae10362d7
Instruction ID: cecd8112a40f7311b00cee71936977f80b2453d5fe4f1e60b1a682f907dbac1a
Opcode Fuzzy Hash: 381ea5d0cd2b533c0e117cf2450131a3f5c5659705f4c7803b8e4f8ae10362d7
Instruction Fuzzy Hash: 1F41D27E610B448ADB589F2DD45032D7761E784FA9F184217CBAAC73D5EB38C491CB81

Function 00007FF66090AA68 Relevance: 7.6, APIs: 5, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 00007FF66090AA85

Part of subcall function 00007FF66090ECC8: _errno.LIBCMT ref: 00007FF66090ECD1
Part of subcall function 00007FF66090ECC8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66090ECDC

_errno.LIBCMT ref: 00007FF66090AA95
_errno.LIBCMT ref: 00007FF66090AAB1
_isatty.LIBCMT ref: 00007FF66090AB12
_getbuf.LIBCMT ref: 00007FF66090AB1E

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_fileno_getbuf_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574049805-0
Opcode ID: 4f60cfe29fde747d4f6edf3b98704d3458481cfd96a237e93bfce69436bb82ae
Instruction ID: 1d3cd0e2d56722ebaee240e48c7ee3358cd8d42bd75b52cd6dc5fb2bc8081fa8
Opcode Fuzzy Hash: 4f60cfe29fde747d4f6edf3b98704d3458481cfd96a237e93bfce69436bb82ae
Instruction Fuzzy Hash: E141A062A1C606D6EB549F28D45127836B3EB44B54F142339DA6F8B3D7EE2CE851C7C0

Function 028714C0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 028714EF
SetLastError.KERNEL32 ref: 02871582

Strings

Main, xrefs: 028714D2

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ErrorLast
String ID: Main
API String ID: 1452528299-521822810
Opcode ID: 84099bf8a725d166ee20315b1c9746f156bee2e17b322136615ebfaf6b4ec049
Instruction ID: b0ea128494876eb17ed772ad7517543fd628b9d7a2f0e8f65f11e7c253cb4b3b
Opcode Fuzzy Hash: 84099bf8a725d166ee20315b1c9746f156bee2e17b322136615ebfaf6b4ec049
Instruction Fuzzy Hash: 32417E7AB15A54CBDB18CF15E44876973A1F748B88F488025DB8E87B48DF38D591CB40

Function 02870E90 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32 ref: 02870ECC
realloc.LIBCMT ref: 02870F33

Part of subcall function 02877238: malloc.LIBCMT ref: 02877255

IsBadReadPtr.KERNEL32 ref: 02870FB9
SetLastError.KERNEL32 ref: 02870FDA
SetLastError.KERNEL32 ref: 02870FF8

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ErrorLastRead$mallocrealloc
String ID:
API String ID: 3638135368-0
Opcode ID: 29ff069d9a5630de77bab8c1bef4471da58ecb6172fdba01688657c43c45e91a
Instruction ID: 0b39d5be697a08cfd606d53b4e3bb1131d6cad81df69fb73fcc7ea98a5581139
Opcode Fuzzy Hash: 29ff069d9a5630de77bab8c1bef4471da58ecb6172fdba01688657c43c45e91a
Instruction Fuzzy Hash: 16415D3E205B84C7DB209F16E4547AAB7A0FB48B99F488425DF8E87B65DF78E085C710

Function 0287B874 Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0287B89A
_invalid_parameter_noinfo.LIBCMT ref: 0287B8A5
_getptd.LIBCMT ref: 0287B8B1
_lock.LIBCMT ref: 0287B8EA
_lock.LIBCMT ref: 0287B97D

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _lock$_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 2808128820-0
Opcode ID: b7a6682e71fa9ca0f23f12acf299cb83072229e033a8220aa42f242abf8997f2
Instruction ID: dc8bafd25c34680ddc2d0b0981ceab9af032cd83b15e4ffeca4619a51d023422
Opcode Fuzzy Hash: b7a6682e71fa9ca0f23f12acf299cb83072229e033a8220aa42f242abf8997f2
Instruction Fuzzy Hash: D9417E3E20668485EB14FF26D94476A73A3FB85BD8F488125CE5E8BB54EF78C051CB06

Function 02884158 Relevance: 7.6, APIs: 5, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 028841B2
malloc.LIBCMT ref: 02884216
MultiByteToWideChar.KERNEL32 ref: 0288425E
GetStringTypeW.KERNEL32 ref: 02884275
free.LIBCMT ref: 02884289

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ByteCharMultiWide$StringTypefreemalloc
String ID:
API String ID: 307345228-0
Opcode ID: bfc7af66d6703da52bfe69fa20a0ec25bf490c970911e5871b8f8c191284c125
Instruction ID: 42cc0eae4be88eca10a287687ed61800f704a52bd3967fa325a788e465d5e4ae
Opcode Fuzzy Hash: bfc7af66d6703da52bfe69fa20a0ec25bf490c970911e5871b8f8c191284c125
Instruction Fuzzy Hash: 77319F7F300B818ADB10AF25D8007A963A6FB58BF8F994212EE2D87BD4DF38C4018701

Function 00007FF6609108B0 Relevance: 7.6, APIs: 5, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,00007FF660910A6B), ref: 00007FF66091090A
malloc.LIBCMT ref: 00007FF66091096E
MultiByteToWideChar.KERNEL32(?,?,?,?,?,?,?,00007FF660910A6B), ref: 00007FF6609109B6
GetStringTypeW.KERNEL32(?,?,?,?,?,?,?,00007FF660910A6B), ref: 00007FF6609109CD
free.LIBCMT ref: 00007FF6609109E1

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ByteCharMultiWide$StringTypefreemalloc
String ID:
API String ID: 307345228-0
Opcode ID: e70f9f49b4bf10f7c9a397bbad2514da52a9a5bda9101d0c48d23cf0e55f0220
Instruction ID: 4639caa978f6d947c172d87d1dd8be50de0184daecf07ea49644c7b23198041f
Opcode Fuzzy Hash: e70f9f49b4bf10f7c9a397bbad2514da52a9a5bda9101d0c48d23cf0e55f0220
Instruction Fuzzy Hash: 16419422B08741E5FB108F2598105A963BAFF84BB8F185376EE6D8B7D6DE7DD4118340

Function 0286C930 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0286C963

Part of subcall function 02875540: _FF_MSGBANNER.LIBCMT ref: 02875570
Part of subcall function 02875540: HeapAlloc.KERNEL32 ref: 02875595
Part of subcall function 02875540: _callnewh.LIBCMT ref: 028755AE
Part of subcall function 02875540: _errno.LIBCMT ref: 028755B9
Part of subcall function 02875540: _errno.LIBCMT ref: 028755C4

free.LIBCMT ref: 0286C98B
CreateDIBSection.GDI32 ref: 0286C9F7
free.LIBCMT ref: 0286CA16

Part of subcall function 0286D280: GetObjectW.GDI32 ref: 0286D2B2

free.LIBCMT ref: 0286CA56

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$_errno$AllocCreateHeapObjectSection_callnewhmalloc
String ID:
API String ID: 2034203143-0
Opcode ID: a2d0313cfa7d0c66887be27b82d6d882aa3239715030336f8aa708ac968e3a49
Instruction ID: a6238720457fd5d40f4943df89c7cbaa5e4e8fd81bcfcea203e360ec334f9c3e
Opcode Fuzzy Hash: a2d0313cfa7d0c66887be27b82d6d882aa3239715030336f8aa708ac968e3a49
Instruction Fuzzy Hash: 4C31553E20568086DB15DF26D40876AF795FB88B89F8C8426DF9D97B24EF78D111C700

Function 028648F0 Relevance: 7.6, APIs: 5, Instructions: 91networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 02864924
SetLastError.KERNEL32 ref: 0286495E
WSAGetLastError.WS2_32 ref: 028649B2
WSASetLastError.WS2_32 ref: 02864A08
GetLastError.KERNEL32 ref: 02864A17

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: 36fda355891a9b6a2a41bb1c4455046136ab9c6b80eef1ec788c7483a912b158
Instruction ID: 1915e7427bea3a9ea0d80bfb0c4bc3fff0e5b963026996d22bdaad459a40c38e
Opcode Fuzzy Hash: 36fda355891a9b6a2a41bb1c4455046136ab9c6b80eef1ec788c7483a912b158
Instruction Fuzzy Hash: 91316B7E204A80C6EB209F39E44836D2761F749B99F984526DF1DC7BA8DF3AC484CB11

Function 00007FF660904950 Relevance: 7.6, APIs: 5, Instructions: 91networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF660904984
SetLastError.KERNEL32 ref: 00007FF6609049BE
WSAGetLastError.WS2_32 ref: 00007FF660904A12
WSASetLastError.WS2_32 ref: 00007FF660904A68
GetLastError.KERNEL32 ref: 00007FF660904A77

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: e4f8957da8d65f30d38b13d09da8badb50e03e5984e11ac3259b2f877bd45eac
Instruction ID: 6169240e825dec2bdf5ba67e5314d18b3a85a9c84899df5f771cc1158490ae31
Opcode Fuzzy Hash: e4f8957da8d65f30d38b13d09da8badb50e03e5984e11ac3259b2f877bd45eac
Instruction Fuzzy Hash: 14419472B0CA41D5E7509F28E44436E23B2EB55B84F541639DA1ECB79ADF3DD4848B80

Function 0288CE60 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 0288CEA1
_exception_enabled.LIBCMT ref: 0288CEC4

Part of subcall function 0288CDA4: _set_statfp.LIBCMT ref: 0288CDCB
Part of subcall function 0288CDA4: _set_statfp.LIBCMT ref: 0288CE3E

_raise_exc.LIBCMT ref: 0288CF10
_ctrlfp.LIBCMT ref: 0288CF50
_ctrlfp.LIBCMT ref: 0288CF81

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _ctrlfp$_set_statfp$_exception_enabled_raise_exc
String ID:
API String ID: 3456427917-0
Opcode ID: 1aba8912174c80f48c1f205ea0e6b1cbf11b6fb09252fd53c66cda772265d1f3
Instruction ID: d65b62eaf6fb5588a9a54e1087b938c312005bbdce383631e2ed28a60da07a5c
Opcode Fuzzy Hash: 1aba8912174c80f48c1f205ea0e6b1cbf11b6fb09252fd53c66cda772265d1f3
Instruction Fuzzy Hash: F0315F3A614F848AD711EF29E84066FB775FB8A798F041216FE8D9BA58DF78C441CB00

Function 00007FF660912DB8 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

_ctrlfp.LIBCMT ref: 00007FF660912DF9
_exception_enabled.LIBCMT ref: 00007FF660912E1C

Part of subcall function 00007FF660912CFC: _set_statfp.LIBCMT ref: 00007FF660912D23
Part of subcall function 00007FF660912CFC: _set_statfp.LIBCMT ref: 00007FF660912D96

_raise_exc.LIBCMT ref: 00007FF660912E68
_ctrlfp.LIBCMT ref: 00007FF660912EA8
_ctrlfp.LIBCMT ref: 00007FF660912ED9

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _ctrlfp$_set_statfp$_exception_enabled_raise_exc
String ID:
API String ID: 3456427917-0
Opcode ID: ec85eac3057d4a959c5fd9faad8141c4a2bc6fb97e23b1e6474f11119bd41e60
Instruction ID: e30c48282c2324d52cd03939d9e69f09236716d92aab23ccc65df8833fe89d50
Opcode Fuzzy Hash: ec85eac3057d4a959c5fd9faad8141c4a2bc6fb97e23b1e6474f11119bd41e60
Instruction Fuzzy Hash: 5F318232B18A85D6E710DF24A4012AEB776FB89388F002335FA8D4AB5ADF3CD441CB00

Function 02876724 Relevance: 7.6, APIs: 5, Instructions: 80memorythreadCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 02876776
GetSystemInfo.KERNEL32 ref: 0287678D
SetThreadStackGuarantee.KERNEL32 ref: 0287679F
VirtualAlloc.KERNEL32 ref: 028767F2
VirtualProtect.KERNEL32 ref: 0287680C

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Virtual$AllocGuaranteeInfoProtectQueryStackSystemThread
String ID:
API String ID: 513674450-0
Opcode ID: 075c36b3ca135fdc652563b5ac2541178ceec77664d81c65090f73d39e80c9e7
Instruction ID: 6538774c222f4918c208f67ed945d8af2ad4c2a815c106573018db78b4f6032b
Opcode Fuzzy Hash: 075c36b3ca135fdc652563b5ac2541178ceec77664d81c65090f73d39e80c9e7
Instruction Fuzzy Hash: C131583A311A959EDB24CF35E8547D933A4F74878CF888129DA5E87B48EF38D545C740

Function 02833291 Relevance: 7.6, APIs: 5, Instructions: 78COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 028332AA
__doserrno.LIBCMT ref: 02833327
_errno.LIBCMT ref: 0283332E

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$__doserrno
String ID:
API String ID: 2614100947-0
Opcode ID: 800d099e4cba60736708ed37c98d79b550133b1203d55932b7dfc71724dd1719
Instruction ID: 069ba36bdf5e9426e8ad84f07dbb254c6e5e654ee22113f1497466c53e35495c
Opcode Fuzzy Hash: 800d099e4cba60736708ed37c98d79b550133b1203d55932b7dfc71724dd1719
Instruction Fuzzy Hash: 5021383C6086448FD71AAF6CE89523D76D1EB85324F4D45ADD41AC7191CBB8C84087D6

Function 0282D05D Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0282D081
_errno.LIBCMT ref: 0282D09A
_errno.LIBCMT ref: 0282D0BE
_errno.LIBCMT ref: 0282D0DC
_errno.LIBCMT ref: 0282D0E6

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: 56325473ece89c43913ab42bac2eec84427b1d3a9a27b51c81ea3f767b85194f
Instruction ID: 5093d91fe783e06af9c7e736cb9d7704f16fd3a29fd51e10eaf984aaf3d85e3e
Opcode Fuzzy Hash: 56325473ece89c43913ab42bac2eec84427b1d3a9a27b51c81ea3f767b85194f
Instruction Fuzzy Hash: DF11BE3D508B288FCB68AB6C84493247BE1FB59310F5811AAD54CC7261D7B89CCACB87

Function 02875B64 Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0287BDC8: _amsg_exit.LIBCMT ref: 02882F66

DecodePointer.KERNEL32 ref: 02875B8D
DecodePointer.KERNEL32 ref: 02875B9D
EncodePointer.KERNEL32 ref: 02875C1B

Part of subcall function 0287AB64: realloc.LIBCMT ref: 0287AB8F
Part of subcall function 0287AB64: Sleep.KERNEL32 ref: 0287ABAB

EncodePointer.KERNEL32 ref: 02875C2B
EncodePointer.KERNEL32 ref: 02875C38

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Pointer$Encode$Decode$Sleep_amsg_exitrealloc
String ID:
API String ID: 1162480733-0
Opcode ID: 1c272021f84b2579e31e02946320267b97f2c365d49e819e98475682d178a89d
Instruction ID: 68ce2b19beb7eb002176ec7a6636112a219796d40766f5491fc0e80bda8f570a
Opcode Fuzzy Hash: 1c272021f84b2579e31e02946320267b97f2c365d49e819e98475682d178a89d
Instruction Fuzzy Hash: 69215B2D702B4481EB15AB62F94831AA7A6F789BC5FC4D825CE4E87B24EF7CD085C301

Function 00007FF66090961C Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,00000000,00007FF660909731,?,?,?,?,00007FF6609091A3), ref: 00007FF660909645
DecodePointer.KERNEL32(?,?,00000000,00007FF660909731,?,?,?,?,00007FF6609091A3), ref: 00007FF660909655

Part of subcall function 00007FF66090C1B4: _errno.LIBCMT ref: 00007FF66090C1BD
Part of subcall function 00007FF66090C1B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF66090C1C8

EncodePointer.KERNEL32(?,?,00000000,00007FF660909731,?,?,?,?,00007FF6609091A3), ref: 00007FF6609096D3

Part of subcall function 00007FF66090C124: realloc.LIBCMT ref: 00007FF66090C14F
Part of subcall function 00007FF66090C124: Sleep.KERNEL32(?,?,00000000,00007FF6609096C3,?,?,00000000,00007FF660909731,?,?,?,?,00007FF6609091A3), ref: 00007FF66090C16B

EncodePointer.KERNEL32(?,?,00000000,00007FF660909731,?,?,?,?,00007FF6609091A3), ref: 00007FF6609096E3
EncodePointer.KERNEL32(?,?,00000000,00007FF660909731,?,?,?,?,00007FF6609091A3), ref: 00007FF6609096F0

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Pointer$Encode$Decode$Sleep_errno_invalid_parameter_noinforealloc
String ID:
API String ID: 1909145217-0
Opcode ID: ecada074d5a0a7123039d1954c0b31d342863ec9009fb92d5d2dea83d0352a09
Instruction ID: 5b797107b58517406c08a7419b825bc30d4bbdcbc486bfc4002fa62d59571ca1
Opcode Fuzzy Hash: ecada074d5a0a7123039d1954c0b31d342863ec9009fb92d5d2dea83d0352a09
Instruction Fuzzy Hash: A1217121B1DA42E1EA059B11E94807A62B7FF44BC0B446A39DA1E8F767DF7CE084C380

Function 0286D1B0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32 ref: 0286D1F8
SelectObject.GDI32 ref: 0286D209
SetDIBColorTable.GDI32 ref: 0286D21F
SelectObject.GDI32 ref: 0286D232
DeleteDC.GDI32 ref: 0286D254

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ObjectSelect$ColorCompatibleCreateDeleteTable
String ID:
API String ID: 3899591553-0
Opcode ID: aea2d29c66071ab4bceb5e6f64975c6cb6b9eb1a8a263ab540639364755b0d74
Instruction ID: e1802f1ffc3c68338ef65f8e38533c8c2ad06f1045fe31eddb6927655441de25
Opcode Fuzzy Hash: aea2d29c66071ab4bceb5e6f64975c6cb6b9eb1a8a263ab540639364755b0d74
Instruction Fuzzy Hash: BC117C3A301B10C9EB55DF66F498B293364FB98F98F64A025DE4A93B18CF39C485C380

Function 0286C890 Relevance: 7.6, APIs: 5, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 0286C8CA
EnterCriticalSection.KERNEL32 ref: 0286C8D7
EnterCriticalSection.KERNEL32 ref: 0286C8EC
GdiplusShutdown.GDIPLUS ref: 0286C8FE
LeaveCriticalSection.KERNEL32 ref: 0286C912

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalSection$Enter$DeleteGdiplusLeaveObjectShutdown
String ID:
API String ID: 1513102227-0
Opcode ID: 47c32264752e366559c11a188ac99593ceaf011ed73af6a10e627e5836cbe9c1
Instruction ID: 0668048546b0330f15a578eff8ce86b1e23cf3f5fff0fa284a14ad2653060018
Opcode Fuzzy Hash: 47c32264752e366559c11a188ac99593ceaf011ed73af6a10e627e5836cbe9c1
Instruction Fuzzy Hash: 0E214A7E212B4481EB249B68EC5C3642364FB28B38F98C21BCA6D836E0DF798447C300

Function 0286A9A0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0286A9C2
malloc.LIBCMT ref: 0286A9D0

Part of subcall function 02875540: _FF_MSGBANNER.LIBCMT ref: 02875570
Part of subcall function 02875540: HeapAlloc.KERNEL32 ref: 02875595
Part of subcall function 02875540: _callnewh.LIBCMT ref: 028755AE
Part of subcall function 02875540: _errno.LIBCMT ref: 028755B9
Part of subcall function 02875540: _errno.LIBCMT ref: 028755C4

GetCurrentProcessId.KERNEL32 ref: 0286AA07
free.LIBCMT ref: 0286AA23
CloseHandle.KERNEL32 ref: 0286AA2B

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Process_errno$AllocCloseCurrentHandleHeapOpen_callnewhfreemalloc
String ID:
API String ID: 1715275611-0
Opcode ID: c394f2033b8ada5d2d783f5011fe782673c571999c97d0cb0aede26748a8ddc7
Instruction ID: 61c81f6d64ce2b04ed2a2738bbf07998fa913c4b87414347d51da79105ceb391
Opcode Fuzzy Hash: c394f2033b8ada5d2d783f5011fe782673c571999c97d0cb0aede26748a8ddc7
Instruction Fuzzy Hash: 12116D3E710A4086DB649B16E50836D6361F788B88FC88125DB9E57B59DF39C491C750

Function 02828715 Relevance: 7.5, APIs: 5, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0282872A
_invalid_parameter_noinfo.LIBCMT ref: 02828735
_freebuf.LIBCMT ref: 0282874E
_fileno.LIBCMT ref: 02828756

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_fileno_freebuf_invalid_parameter_noinfo
String ID:
API String ID: 228234209-0
Opcode ID: 9b8945a01a406cd1ac831ca273cda5d643df3cbecfdeb2c523a6de6a35bb6735
Instruction ID: 48cb79d6444450865375cfd0681dc6d42e9e7a80a22244f8c31f2a4a2143aba1
Opcode Fuzzy Hash: 9b8945a01a406cd1ac831ca273cda5d643df3cbecfdeb2c523a6de6a35bb6735
Instruction Fuzzy Hash: A701D62D214A195EDF19ABBD449433971C2BB89378F58436C4819C71C5DA74C8C9C7E2

Function 02865DD0 Relevance: 7.5, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 02865DF5
EnterCriticalSection.KERNEL32 ref: 02865DFF
LeaveCriticalSection.KERNEL32 ref: 02865E0F
LeaveCriticalSection.KERNEL32 ref: 02865E19

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 71fe61b111dbe12e8dda685ea8694a1dc0aa0ddfb773c4f5c26901a55c0952e0
Instruction ID: 6802d1c268338f8495fbee050327a94dd5ff24c86a0bae1c3dbb6c0ef1c77703
Opcode Fuzzy Hash: 71fe61b111dbe12e8dda685ea8694a1dc0aa0ddfb773c4f5c26901a55c0952e0
Instruction Fuzzy Hash: F0111C3A635A4483DBA09B65F4983AE6360F758755FC49022DBCB83A50DF3CD48AC700

Function 00007FF660905E10 Relevance: 7.5, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,00007FF660904E7E,?,?,00000000,00007FF660904E44), ref: 00007FF660905E35
EnterCriticalSection.KERNEL32(?,?,00000000,00007FF660904E7E,?,?,00000000,00007FF660904E44), ref: 00007FF660905E3F
LeaveCriticalSection.KERNEL32(?,?,00000000,00007FF660904E7E,?,?,00000000,00007FF660904E44), ref: 00007FF660905E4F
LeaveCriticalSection.KERNEL32(?,?,00000000,00007FF660904E7E,?,?,00000000,00007FF660904E44), ref: 00007FF660905E59

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: d0535108d2faffde62c4ad6e510cb9d391b63625fe126b8c96127d7e5368dc19
Instruction ID: 3f327e447c3cbb4ce7aedcc2fbe8a2bcef676090415a44a9ceb44f89fd5cb6eb
Opcode Fuzzy Hash: d0535108d2faffde62c4ad6e510cb9d391b63625fe126b8c96127d7e5368dc19
Instruction Fuzzy Hash: 08114C32A28945D3EB949B21F4443AA6371FB48750F446131DB8F86B61CF7CE98AC700

Function 02837DDD Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 02837DE6
_errno.LIBCMT ref: 02837DEE

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: fa741961b582ee7b67e6576bbdc250400e5bcedb0d675f31e0db02a7ef4224cf
Instruction ID: 8955683bd4fca0f8e42517874d0664780039ccec76d4f45ab0d522b009031c9c
Opcode Fuzzy Hash: fa741961b582ee7b67e6576bbdc250400e5bcedb0d675f31e0db02a7ef4224cf
Instruction Fuzzy Hash: 98F0287D12485C4EE70EAB28C984368B7D3FF0232AF894288C405CB1E0C7BC9C848A92

Function 02882794 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 028827CB
GetCurrentProcessId.KERNEL32 ref: 028827D6
GetCurrentThreadId.KERNEL32 ref: 028827E2
GetTickCount.KERNEL32 ref: 028827EE
QueryPerformanceCounter.KERNEL32 ref: 028827FF

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: be49b71be2468d602ce2b86d554d21e0fe8525651c21df714ca60d01e100c69a
Instruction ID: a277209362d834b3222214212227a1226167ea3fdce691efd7360fa4d68fce62
Opcode Fuzzy Hash: be49b71be2468d602ce2b86d554d21e0fe8525651c21df714ca60d01e100c69a
Instruction Fuzzy Hash: F5015229226B4582EB90CF21F84935573A0F75DFA0F98A621EE5E47B64DF3CC9958700

Function 00007FF66090D710 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF66090D747
GetCurrentProcessId.KERNEL32 ref: 00007FF66090D752
GetCurrentThreadId.KERNEL32 ref: 00007FF66090D75E
GetTickCount.KERNEL32 ref: 00007FF66090D76A
QueryPerformanceCounter.KERNEL32 ref: 00007FF66090D77B

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 98e16b1ec0ad293c89ca25142769c411a4e3d743e8d3f271fefc4cf6040d5f50
Instruction ID: 6d0a262e305f0d5b575583ea19b6d7e57d82bc17ccd8e5a97b13d43cb10bfa96
Opcode Fuzzy Hash: 98e16b1ec0ad293c89ca25142769c411a4e3d743e8d3f271fefc4cf6040d5f50
Instruction Fuzzy Hash: DC015B31B1DA01E2EB418F21E944266637AFB49B90F443B70EE5E8B7A5DF7CD9958300

Function 0288830C Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 02888315
_errno.LIBCMT ref: 0288831D

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 9c05f4c1c36c7b5831c53dd5cc1829f6975137ad5d23c81940f0ce13bd6f0dca
Instruction ID: 02b0cbb86b5e0d3a49099b2b31324e9fddf79dc44e240fd3baddf38a2300fa79
Opcode Fuzzy Hash: 9c05f4c1c36c7b5831c53dd5cc1829f6975137ad5d23c81940f0ce13bd6f0dca
Instruction Fuzzy Hash: 9DF0626EA1264C86EF057B19C88032C76529B50B79FDD8715CA3E8A3E1CB7C84418B12

Function 00007FF6609100DC Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 00007FF6609100E5
_errno.LIBCMT ref: 00007FF6609100ED

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: b2568e6a52513f616cc9bf7babecad4815ad7cdb92447009d9c431ea0fd75076
Instruction ID: ef7990b58df4f96e35dade4d24d0215973d245a03a12db98feda6138efbfcca7
Opcode Fuzzy Hash: b2568e6a52513f616cc9bf7babecad4815ad7cdb92447009d9c431ea0fd75076
Instruction Fuzzy Hash: 6C01AD62F1C646E5FB056B14888137C21739F90B25F616379D52E8E3E3CFAE60508A50

Function 028658A0 Relevance: 7.5, APIs: 5, Instructions: 26synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 028658B0
WaitForSingleObject.KERNEL32 ref: 028658C0
Sleep.KERNEL32 ref: 028658CB
CloseHandle.KERNEL32 ref: 028658EA
CloseHandle.KERNEL32 ref: 028658F7

Part of subcall function 02864D20: GetCurrentThreadId.KERNEL32 ref: 02864D2D

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CloseHandleObjectSingleWait$CurrentSleepThread
String ID:
API String ID: 570250148-0
Opcode ID: decc56ae74fd69e27b6cea45ca757f20852d30087eeae71558a9b79a526937d1
Instruction ID: de1997cabb5e85b9069a1595170124bd6edc2deb2e1a2b7b56ca00c886bcf6cc
Opcode Fuzzy Hash: decc56ae74fd69e27b6cea45ca757f20852d30087eeae71558a9b79a526937d1
Instruction Fuzzy Hash: EDF01D3E211A84C2E7059F7AEC193283320F799F59F98C221CF2A477A5CF388885C350

Function 00007FF6609059B0 Relevance: 7.5, APIs: 5, Instructions: 26synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF6609059C0
WaitForSingleObject.KERNEL32 ref: 00007FF6609059D0
Sleep.KERNEL32 ref: 00007FF6609059DB
CloseHandle.KERNEL32 ref: 00007FF6609059FA
CloseHandle.KERNEL32 ref: 00007FF660905A07

Part of subcall function 00007FF660904D80: GetCurrentThreadId.KERNEL32 ref: 00007FF660904D8D

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CloseHandleObjectSingleWait$CurrentSleepThread
String ID:
API String ID: 570250148-0
Opcode ID: 892c36502c9aa2b1c275c7a3c19491e1c66a3c365f8122baa1cd80770b25c1c6
Instruction ID: 8cf47be57414ef9485e9195b4d587c06c699c41f5823140566f14cb60d428c72
Opcode Fuzzy Hash: 892c36502c9aa2b1c275c7a3c19491e1c66a3c365f8122baa1cd80770b25c1c6
Instruction Fuzzy Hash: 0CF04472604949D2F705DF31E8141793335FB88F65F181330CD2E8A395CF7898899350

Function 02864640 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115networkCOMMON

Download Yara Rule

APIs

WSAEnumNetworkEvents.WS2_32 ref: 02864678
WSAGetLastError.WS2_32 ref: 02864686
WSAResetEvent.WS2_32 ref: 028646C3

Strings

, xrefs: 0286478C

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: EnumErrorEventEventsLastNetworkReset
String ID:
API String ID: 1050048411-3916222277
Opcode ID: bae50107dfc8bbf13130f036befb9453e5ae5370985c1f6d570d448442856cd2
Instruction ID: ce376781aaf52a6fd31b59362999aeaf610fc17bcf940175beebf8fc166ba6dd
Opcode Fuzzy Hash: bae50107dfc8bbf13130f036befb9453e5ae5370985c1f6d570d448442856cd2
Instruction Fuzzy Hash: 0B41657E2046888BE334CF29E40832E77E2F785B8CF550114CA9DC7759EBBAC9498B40

Function 00007FF6609046A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115networkCOMMON

Download Yara Rule

APIs

WSAEnumNetworkEvents.WS2_32 ref: 00007FF6609046D8
WSAGetLastError.WS2_32(?,?,?,00007FF66090455E), ref: 00007FF6609046E6
WSAResetEvent.WS2_32(?,?,?,00007FF66090455E), ref: 00007FF660904723

Strings

, xrefs: 00007FF6609047EC

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: EnumErrorEventEventsLastNetworkReset
String ID:
API String ID: 1050048411-3916222277
Opcode ID: 828e8a55efaf8f4e93ed5acb76a083e09fbb0b5487182bc448ae793a037f2d46
Instruction ID: bc575ab9b18d767719af5dadbaf1cacab486f84b6322ed8dd3bcc346bd20fae5
Opcode Fuzzy Hash: 828e8a55efaf8f4e93ed5acb76a083e09fbb0b5487182bc448ae793a037f2d46
Instruction Fuzzy Hash: 73519EB290C642D6E7208F25940432A73F6EB95B48F155239DE4E8B39ADF7DE8458F80

Function 02828DA6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 02828DAE
_getptd.LIBCMT ref: 02828E70
_getptd.LIBCMT ref: 02828E7C

Strings

csm, xrefs: 02828E30

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 745c27bf58ce9136a60d1a91a6c4d13b24bddf59c14694e7ed41f0101153d043
Instruction ID: a741265d0b60a2e3b5a25005fcf87bfec38cd020c0f195281b4cae9bd3d47eb0
Opcode Fuzzy Hash: 745c27bf58ce9136a60d1a91a6c4d13b24bddf59c14694e7ed41f0101153d043
Instruction Fuzzy Hash: 59314C7C118B148FDB28EF1CD491B69B3E1FB58311F44066DD48AC7651D731B88ACB96

Function 0288A560 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

_fltout2.LIBCMT ref: 0288A59B
_errno.LIBCMT ref: 0288A5A5
_invalid_parameter_noinfo.LIBCMT ref: 0288A5AC

Strings

-, xrefs: 0288A5C7

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_fltout2_invalid_parameter_noinfo
String ID: -
API String ID: 485257318-2547889144
Opcode ID: 463438e0c886120289d20cd45b1c6b5be8d0021f23f58bee05a5ba304ed753cf
Instruction ID: b86c674e7ff2fb15200d4df8011a1e2cf397caf50525893af0dbac5e5a149436
Opcode Fuzzy Hash: 463438e0c886120289d20cd45b1c6b5be8d0021f23f58bee05a5ba304ed753cf
Instruction Fuzzy Hash: D931F56E304A8486DB24EF29E84075AB7A1BB45BE8F544213DE9C87BD9DF3DC485CB01

Function 00007FF660912B0C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

_fltout2.LIBCMT ref: 00007FF660912B47
_errno.LIBCMT ref: 00007FF660912B51
_invalid_parameter_noinfo.LIBCMT ref: 00007FF660912B58

Strings

-, xrefs: 00007FF660912B73

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_fltout2_invalid_parameter_noinfo
String ID: -
API String ID: 485257318-2547889144
Opcode ID: 618538ce884b31deba6e1646cd0d9800068b1e888b6e4428242c9665014ee262
Instruction ID: fb822ce8b0657554cf233f674381ab29b755c440048b2493b8d5c342933565be
Opcode Fuzzy Hash: 618538ce884b31deba6e1646cd0d9800068b1e888b6e4428242c9665014ee262
Instruction Fuzzy Hash: D531082270C681D1EA21AE21A4003AAB776AB567D4F146371EF9D8BBC6DE3CD805CB00

Function 0288A978 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0288A991
_invalid_parameter_noinfo.LIBCMT ref: 0288A99D
_errno.LIBCMT ref: 0288A9C4

Strings

1, xrefs: 0288AA13

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: 1
API String ID: 2819658684-2212294583
Opcode ID: da590a33fde7f73029e2fedf7efd99da0c6cb8fba08786571a8317b2cb5ff795
Instruction ID: 12f8a40c9234ffe8ff9a70c7a84099fe2af6a510608ca4bb9794228fe37d449c
Opcode Fuzzy Hash: da590a33fde7f73029e2fedf7efd99da0c6cb8fba08786571a8317b2cb5ff795
Instruction Fuzzy Hash: 4711272E21D6C495DB1FAF3889503286B55E741748F8AC053875AD7783E73DC950C712

Function 00007FF66091464C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF660914665
_invalid_parameter_noinfo.LIBCMT ref: 00007FF660914671
_errno.LIBCMT ref: 00007FF660914698

Strings

1, xrefs: 00007FF6609146E7

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: 1
API String ID: 2819658684-2212294583
Opcode ID: c24aa144a5a2c35a8fdb484c0746f0b94e6cfc09c221b34de806f61d68da000b
Instruction ID: 05bc108a8dffcce97b5238e234f37e817f18df7aa86e9b5f1402b499b5927c25
Opcode Fuzzy Hash: c24aa144a5a2c35a8fdb484c0746f0b94e6cfc09c221b34de806f61d68da000b
Instruction Fuzzy Hash: 1721FB12B1D6C2E5F7169F24841027C5ABA9F4A78CF55E2B1D64A8E3D3DE2E9801CF10

Function 028755F8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

_callnewh.LIBCMT ref: 02875606
malloc.LIBCMT ref: 02875612

Part of subcall function 02875540: _FF_MSGBANNER.LIBCMT ref: 02875570
Part of subcall function 02875540: HeapAlloc.KERNEL32 ref: 02875595
Part of subcall function 02875540: _callnewh.LIBCMT ref: 028755AE
Part of subcall function 02875540: _errno.LIBCMT ref: 028755B9
Part of subcall function 02875540: _errno.LIBCMT ref: 028755C4

std::exception::exception.LIBCMT ref: 0287567F

Strings

bad allocation, xrefs: 0287564F

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _callnewh_errno$AllocHeapmallocstd::exception::exception
String ID: bad allocation
API String ID: 2837191506-2104205924
Opcode ID: 40a2d582bb1ecb2220c378ddd3ce206ee5079f0b2690b48e48e38b89efa330d8
Instruction ID: 6843cbbe27a9c08c66902a5fc21897539eefe50ed06f37a371245a9d3b931b70
Opcode Fuzzy Hash: 40a2d582bb1ecb2220c378ddd3ce206ee5079f0b2690b48e48e38b89efa330d8
Instruction Fuzzy Hash: 7B015A6D21270591FF20EF18F8443642361F744384FC88526CE8E86A62EF7CC288CB02

Function 0287BD8C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0287BD9B
GetProcAddress.KERNEL32 ref: 0287BDB0

Strings

CorExitProcess, xrefs: 0287BDA6
mscoree.dll, xrefs: 0287BD94

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 6f0d2907b1ebdc80269f3466a428568ae1999691cd8246c2ae25d5ed097e1493
Instruction ID: 3b80ec078dd180cab58184b0fbd69e1021bfd88e6a4ddfdeb1ddac11e685729a
Opcode Fuzzy Hash: 6f0d2907b1ebdc80269f3466a428568ae1999691cd8246c2ae25d5ed097e1493
Instruction Fuzzy Hash: D3D05E1D74370082EF1AAFA0F8883B813525BA8718FDC5029891E46350FF2CD6C9C300

Function 00007FF660909F20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,000000FF,00007FF660909F69,?,?,00000028,00007FF6609090B9,?,?,4E00000000000000,00007FF66090C050,?,?,ceil,00007FF66090D951), ref: 00007FF660909F2F
GetProcAddress.KERNEL32(?,?,000000FF,00007FF660909F69,?,?,00000028,00007FF6609090B9,?,?,4E00000000000000,00007FF66090C050,?,?,ceil,00007FF66090D951), ref: 00007FF660909F44

Strings

CorExitProcess, xrefs: 00007FF660909F3A
mscoree.dll, xrefs: 00007FF660909F28

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 8532fc609fad59ffe6e62cafeae73a037ed505a12b62afac9e0faec1dfd416e1
Instruction ID: e95aafddca8d188f4e6f6c76cab8f5e4e98c199c005da81ee7a66614e8ca4365
Opcode Fuzzy Hash: 8532fc609fad59ffe6e62cafeae73a037ed505a12b62afac9e0faec1dfd416e1
Instruction Fuzzy Hash: 95E01210F1D703E1FE1D5B90A85413522B7AF48741B4875BDD51ECE392EEBCA9499340

Function 0287AF28 Relevance: 6.4, APIs: 5, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 0287AA60: malloc.LIBCMT ref: 0287AA8B
Part of subcall function 0287AA60: Sleep.KERNEL32 ref: 0287AA9E

free.LIBCMT ref: 0287B054
free.LIBCMT ref: 0287B070

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$Sleepmalloc
String ID:
API String ID: 1995388493-0
Opcode ID: 6bf55eee69ab9036b927e96da7cfe64225efdf1552398c5a6e05237ef784cdb0
Instruction ID: 07d9e2d4b41145476b0bc3aa2d7500754ced85c44b3d7043f766d84f0cb4b863
Opcode Fuzzy Hash: 6bf55eee69ab9036b927e96da7cfe64225efdf1552398c5a6e05237ef784cdb0
Instruction Fuzzy Hash: 0E41983A301B4497DB14DF2AE99035A73A5F784B98F888525CF5D83B20EF38D561C741

Function 02871670 Relevance: 6.3, APIs: 5, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

free.LIBCMT ref: 028716B5
free.LIBCMT ref: 028716F5
free.LIBCMT ref: 02871748
GetProcessHeap.KERNEL32 ref: 02871755
HeapFree.KERNEL32 ref: 02871763

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$Heap$FreeProcess
String ID:
API String ID: 3493288988-0
Opcode ID: 750bef86013f7828302a439500eeb8c2bf117d80014398df721acf859931a48d
Instruction ID: 96666d5527eb1eb35e6ef3c8f21d28ec45de1e54cb65bf29c9f7d962b3278fad
Opcode Fuzzy Hash: 750bef86013f7828302a439500eeb8c2bf117d80014398df721acf859931a48d
Instruction Fuzzy Hash: 5431342A711A5093DB28DB6AE5447696361FB88F94F888121DF9E93F14DF38D4A2CB40

Function 02826A29 Relevance: 6.2, APIs: 4, Instructions: 220COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 02826A58
_invalid_parameter_noinfo.LIBCMT ref: 02826A63
iswctype.LIBCMT ref: 02826A9C
_errno.LIBCMT ref: 02826BC6

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfoiswctype
String ID:
API String ID: 248606491-0
Opcode ID: 97ec92455e3c7918d41b8261675ed43ac07a1cfb8a1a9c8953e80a2ad2af7bba
Instruction ID: 68546701c7f39253f40d2086b9673ba1819382778b38b487004022661d769d5d
Opcode Fuzzy Hash: 97ec92455e3c7918d41b8261675ed43ac07a1cfb8a1a9c8953e80a2ad2af7bba
Instruction Fuzzy Hash: 63512C7E9086398BEB38252DD84637632CDFB41764F64526ADD9BC7190F760C4DE42C2

Function 02876F58 Relevance: 6.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 02876F87
_invalid_parameter_noinfo.LIBCMT ref: 02876F92
iswctype.LIBCMT ref: 02876FCB
_errno.LIBCMT ref: 028770F5

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfoiswctype
String ID:
API String ID: 248606491-0
Opcode ID: babcbb0527e906c5f606c468c7be68239314e6d00d1a24a3f123e2f318ae27e5
Instruction ID: 5d4d2dc6d85106063c2d8c01c31cdf900b2b6ddedde0aab7f0bbb3aad3774a62
Opcode Fuzzy Hash: babcbb0527e906c5f606c468c7be68239314e6d00d1a24a3f123e2f318ae27e5
Instruction Fuzzy Hash: B341336FA0052184EF345A3ECC4177EA186BB40BACF598522DEA9C7584F778C482C753

Function 00007FF66090CD38 Relevance: 6.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF66090CD67
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66090CD72
iswctype.LIBCMT ref: 00007FF66090CDAB
_errno.LIBCMT ref: 00007FF66090CED5

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfoiswctype
String ID:
API String ID: 248606491-0
Opcode ID: 94b972fa06678f78d860e6f5b723ba573def77772fbd1e0a4943df1ed3bb4a81
Instruction ID: 50af0d63a92f60febdcde5a85bfcf082dd5bf74e08a18e71f68878ce4fc6310f
Opcode Fuzzy Hash: 94b972fa06678f78d860e6f5b723ba573def77772fbd1e0a4943df1ed3bb4a81
Instruction Fuzzy Hash: CE51BF93D0C153E4FBB45729D80137A21E3AF40B54F146B39DA5BCA7C3EE2CAC8192A1

Function 0287C684 Relevance: 6.2, APIs: 4, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 0287C6D2
_invalid_parameter_noinfo.LIBCMT ref: 0287C6DD
DecodePointer.KERNEL32 ref: 0287C78C
_lock.LIBCMT ref: 0287C7B7

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: DecodePointer_errno_invalid_parameter_noinfo_lock
String ID:
API String ID: 27599310-0
Opcode ID: e43bc938b8dff1f3acc60e90529e3d7fb630203bf193b243dbf91122d21e0fda
Instruction ID: 3145355e7bdf742177ef1e4461df3ef00c232571c64ac41ed06d17e94c63860e
Opcode Fuzzy Hash: e43bc938b8dff1f3acc60e90529e3d7fb630203bf193b243dbf91122d21e0fda
Instruction Fuzzy Hash: BB517B3EA05B4486EA29DF2DE88833A66A2F7C57D8F58851BDA5EC7714DF38C481C701

Function 00007FF66090A834 Relevance: 6.2, APIs: 4, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF66090A882
_invalid_parameter_noinfo.LIBCMT ref: 00007FF66090A88D
DecodePointer.KERNEL32(?,?,?,?,?,00007FF6609091E4,?,?,?,?,00007FF66090219E), ref: 00007FF66090A93C
_lock.LIBCMT ref: 00007FF66090A967

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: DecodePointer_errno_invalid_parameter_noinfo_lock
String ID:
API String ID: 27599310-0
Opcode ID: 2e1f47d07c568a67316eefeacd6411d58cf0c130c40cf9c6aca4e33faf3add32
Instruction ID: 028328173c34405a344d3a178578b7b159ceb31464def7678187535617180ff1
Opcode Fuzzy Hash: 2e1f47d07c568a67316eefeacd6411d58cf0c130c40cf9c6aca4e33faf3add32
Instruction Fuzzy Hash: A3516E32F0C642E6E6698B15A54023A62B3EF85750F156739D9AF8A796CF3CE841C2C0

Function 028289BD Relevance: 6.2, APIs: 4, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 028272C5: _getptd.LIBCMT ref: 028272C9

_getptd.LIBCMT ref: 028289FC
_SetImageBase.LIBCMT ref: 02828ACF
_getptd.LIBCMT ref: 02828AFD
_getptd.LIBCMT ref: 02828B0B

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd$BaseImage
String ID:
API String ID: 2482573191-0
Opcode ID: 04e4ddb59326ee2f6fd00dd5a9e934302c90db7294c98b3c1bfd7684be65c82c
Instruction ID: 362e0d503147d9eb3018ba0648ce11e8ba37fe06b4240ed739c45fe99dd8a9ed
Opcode Fuzzy Hash: 04e4ddb59326ee2f6fd00dd5a9e934302c90db7294c98b3c1bfd7684be65c82c
Instruction Fuzzy Hash: 6141293D214A244ED7187B3CC4056B932D2FB84324F24826ED44BC72A9DB74E8CA8A93

Function 0288A2F0 Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02875D58: _getptd.LIBCMT ref: 02875D6A

_errno.LIBCMT ref: 0288A32E
_invalid_parameter_noinfo.LIBCMT ref: 0288A338
_errno.LIBCMT ref: 0288A35C
_invalid_parameter_noinfo.LIBCMT ref: 0288A366

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd
String ID:
API String ID: 1297830140-0
Opcode ID: e0e4d029bbe353f1d1e69cf3c42486e835b68d278d4763bb0573f745e1b83faf
Instruction ID: daf870bd07ee08e07ddcbd3ebe5e510e024cc9f5a7694a2b7ba13b73739ec93c
Opcode Fuzzy Hash: e0e4d029bbe353f1d1e69cf3c42486e835b68d278d4763bb0573f745e1b83faf
Instruction Fuzzy Hash: BA41033E215B84CADB25EF29D58436E7BA1F784BD0F488126DB8E87B95DB78C045CB01

Function 00007FF66091289C Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF66090ABF8: _getptd.LIBCMT ref: 00007FF66090AC0A

_errno.LIBCMT ref: 00007FF6609128DA
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6609128E4
_errno.LIBCMT ref: 00007FF660912908
_invalid_parameter_noinfo.LIBCMT ref: 00007FF660912912

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd
String ID:
API String ID: 1297830140-0
Opcode ID: 9ca92d5bb05e79156cbab85d98cd5049689c098bd46746ebc4bd1871a1c2f17d
Instruction ID: 0c40a6a376257822e2a9277c1f9b16610b9de22ff5b65e1c20109b5f3be35c4e
Opcode Fuzzy Hash: 9ca92d5bb05e79156cbab85d98cd5049689c098bd46746ebc4bd1871a1c2f17d
Instruction Fuzzy Hash: 8C41BD22B0C782D6E751EB19C18426977B6EB45BD0F046275DA8E8BB93CF3CE855C740

Function 02838219 Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02838238
_invalid_parameter_noinfo.LIBCMT ref: 02838244
_errno.LIBCMT ref: 0283826E
_errno.LIBCMT ref: 028382D0

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 7be2ae340f5959406522c893d974e7f2dc4a3aef0f5b2582e14843318c479f82
Instruction ID: 6214d2552fd80a78885068835021e73eb46a2b91156b208792aa45ed79035f9a
Opcode Fuzzy Hash: 7be2ae340f5959406522c893d974e7f2dc4a3aef0f5b2582e14843318c479f82
Instruction Fuzzy Hash: CC312B2C618E894BD70E5A2C948833977C1FB6A305F6812BEE58BC7253D9A18C458795

Function 02878EEC Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 028777F4: _getptd.LIBCMT ref: 028777F8

_getptd.LIBCMT ref: 02878F2B

Part of subcall function 0287E2A0: _amsg_exit.LIBCMT ref: 0287E2B6

_SetImageBase.LIBCMT ref: 02878FFE
_getptd.LIBCMT ref: 0287902C
_getptd.LIBCMT ref: 0287903A

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd$BaseImage_amsg_exit
String ID:
API String ID: 2306399499-0
Opcode ID: 6bb4dafc34791a121fa802b960719f731f4456cd93f40c562d83455e5897cc48
Instruction ID: 4ab0909682a101cca75a8d1f9436a897a20f91a0bb72aa04460b7d6671acbdd1
Opcode Fuzzy Hash: 6bb4dafc34791a121fa802b960719f731f4456cd93f40c562d83455e5897cc48
Instruction Fuzzy Hash: 2D31B53E61068986CE20E72DD984A6DA7A2BB84FDDF558561CE1DC3760CB38C087DB02

Function 00007FF6609131FC Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF660911A74: _getptd.LIBCMT ref: 00007FF660911A78

_getptd.LIBCMT ref: 00007FF66091323B

Part of subcall function 00007FF66090BA34: _amsg_exit.LIBCMT ref: 00007FF66090BA4A

_SetImageBase.LIBCMT ref: 00007FF66091330E
_getptd.LIBCMT ref: 00007FF66091333C
_getptd.LIBCMT ref: 00007FF66091334A

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd$BaseImage_amsg_exit
String ID:
API String ID: 2306399499-0
Opcode ID: b5c06598e24a17d2af3d260348e39d1b732e80aecbaef9a16b5b1eba258a06ea
Instruction ID: 6919f9c5987c5efd52f654ddac1a6edc457adabd1cf07f8681636c8329602416
Opcode Fuzzy Hash: b5c06598e24a17d2af3d260348e39d1b732e80aecbaef9a16b5b1eba258a06ea
Instruction Fuzzy Hash: 2941B722B09543E1EA20A725D4411BD6ABAAF46B94F55D771DA1D8B7E3CE3CE5428200

Function 028254BD Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 028254E8
_invalid_parameter_noinfo.LIBCMT ref: 028254F3
_getptd.LIBCMT ref: 02825519
free.LIBCMT ref: 02825584

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 4053972703-0
Opcode ID: 7481bf8148e7d156cf8c311b37150eb594a00842ee05393b003d335b8423385e
Instruction ID: 8f49919767d401af60aacf166e488ac77e8b4ed7152733a93137104d0898e000
Opcode Fuzzy Hash: 7481bf8148e7d156cf8c311b37150eb594a00842ee05393b003d335b8423385e
Instruction Fuzzy Hash: 4021B738208F194FD758FFAC985963A77D6FB98311F00062E984DC3261DB64D8848B83

Function 00007FF6609072A0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 90stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF6609072CF
lstrlenW.KERNEL32 ref: 00007FF6609072F0
lstrlenW.KERNEL32 ref: 00007FF6609072FC

Strings

|p1:156.224.26.128|o1:6666|t1:1|p2:156.224.26.128|o2:8888|t2:1|p3:127.0.0.1|o3:80|t3:1|dd:1|cl:1|fz:, xrefs: 00007FF6609072E6

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: lstrlen
String ID: |p1:156.224.26.128|o1:6666|t1:1|p2:156.224.26.128|o2:8888|t2:1|p3:127.0.0.1|o3:80|t3:1|dd:1|cl:1|fz:
API String ID: 1659193697-3454465827
Opcode ID: 32b2e33b096677a599e1476ba1b417f22cd16269792abd837077c77c15f759a6
Instruction ID: b7847cc7ec11a27f204aac4c55c9ce1091d4770db5ee45205036b844def85652
Opcode Fuzzy Hash: 32b2e33b096677a599e1476ba1b417f22cd16269792abd837077c77c15f759a6
Instruction Fuzzy Hash: 1C310B21E0C656E5FA28CB11B8441BAB3B6FF88B94B04A238DD4F8A756DE7CE541D340

Function 0286A860 Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0286A897
Process32FirstW.KERNEL32 ref: 0286A90F
Process32NextW.KERNEL32 ref: 0286A950
CloseHandle.KERNEL32 ref: 0286A96C

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 02b47b998f259fe205a3e2606ef92517168e540379220ccbf34bb92ef0d7b66a
Instruction ID: 34063473f2b79b9b8b4e337579f8eb3e8535e05e2b256f537339a3aa4555ca5f
Opcode Fuzzy Hash: 02b47b998f259fe205a3e2606ef92517168e540379220ccbf34bb92ef0d7b66a
Instruction Fuzzy Hash: 3731703E604A4582EF28CB29E45837A77A1FB88BA9F558229CE6E93754DF39C045C740

Function 02888748 Relevance: 6.1, APIs: 4, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 02888767
_invalid_parameter_noinfo.LIBCMT ref: 02888773
_errno.LIBCMT ref: 0288879D
_errno.LIBCMT ref: 028887FF

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 5dd80c5444172ec862273a62d1640867b1ef54dd1b25e438c22e6a4ff87602e9
Instruction ID: 8a6a507c1057c7bcef86bb8c43e16d7b0bf18eb3adc894430d0038d4c53a40e4
Opcode Fuzzy Hash: 5dd80c5444172ec862273a62d1640867b1ef54dd1b25e438c22e6a4ff87602e9
Instruction Fuzzy Hash: 23215B7E7083C88AD704FA79D95035E7B62E765784FD88422CB46C7742E779C845CB11

Function 028647F0 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32 ref: 0286482E
WSAGetLastError.WS2_32 ref: 02864839

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ErrorEventLastSelect
String ID:
API String ID: 1135597009-0
Opcode ID: cb030ebd4eb2ee841ca7b97a548f52db33a60d32a92dd19741f3f7cea45038d6
Instruction ID: 48efe3ef6585e1225ce0db8a8ec527fe05b0514089a6090ea4b84eaa142ef378
Opcode Fuzzy Hash: cb030ebd4eb2ee841ca7b97a548f52db33a60d32a92dd19741f3f7cea45038d6
Instruction Fuzzy Hash: 35218EBA60068087E750DF7AD44836D37A2E798B58FA44124CB1CCBB94DF7AC4C6CB50

Function 00007FF660904850 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

WSAEventSelect.WS2_32 ref: 00007FF66090488E
WSAGetLastError.WS2_32 ref: 00007FF660904899

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ErrorEventLastSelect
String ID:
API String ID: 1135597009-0
Opcode ID: 0be878fb768bf08b0c5fb6e885e8fe2ab6ec24c45cef932c45ab1ad02d861857
Instruction ID: e3ac108ed152b0cf2761d5dd5b50a9bc7a433260cb32ae6372cddc290eccfb75
Opcode Fuzzy Hash: 0be878fb768bf08b0c5fb6e885e8fe2ab6ec24c45cef932c45ab1ad02d861857
Instruction Fuzzy Hash: D521CCB2A08141C6E700CF3AD44836A33A2FB54B58F545238DA2DCB7D2DF79D886CB50

Function 02865050 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 0286506C
LeaveCriticalSection.KERNEL32 ref: 02865085
LeaveCriticalSection.KERNEL32 ref: 02865105
SetEvent.KERNEL32 ref: 02865125

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: b017e7a6f2334ba3780cffc380c5b460edc1420cb3fde9e064e142419b43089a
Instruction ID: ac6c818d45d75b1a7f8e90ebf88fe2e0cb05df0ddea1fc1ed2786d4329b44b67
Opcode Fuzzy Hash: b017e7a6f2334ba3780cffc380c5b460edc1420cb3fde9e064e142419b43089a
Instruction Fuzzy Hash: 1B21193A314B8593D758CF26E5843ADB364F748B94F948125DBAE83725DF38E4A1C740

Function 00007FF6609050B0 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6609050CC
LeaveCriticalSection.KERNEL32 ref: 00007FF6609050E5
LeaveCriticalSection.KERNEL32 ref: 00007FF660905165
SetEvent.KERNEL32 ref: 00007FF660905185

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: 03f9e94784ee446fcc446a6b9a97075121abf68d5be1871662565671ac975166
Instruction ID: 1b6d238c0285249c3909c43beb0497a818d7363579c47e896dab05b91b26b7cf
Opcode Fuzzy Hash: 03f9e94784ee446fcc446a6b9a97075121abf68d5be1871662565671ac975166
Instruction Fuzzy Hash: 6C212832708B85E2D698CB16E5802AAB3B5FB48B80F545135DB6E87721CF38E9A1C740

Function 0287E13C Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32 ref: 0287E14B
DeleteCriticalSection.KERNEL32 ref: 02882DE7
free.LIBCMT ref: 02882DF0
DeleteCriticalSection.KERNEL32 ref: 02882E17

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalDeleteSection$Freefree
String ID:
API String ID: 1250194111-0
Opcode ID: 89630a747caf77da89942a637bcf9e37fff0976dd385492cd44139862e950a8a
Instruction ID: bc568f018c3afe8ff4ad874af25ae4414a9e690d192d778adb801631a38581bf
Opcode Fuzzy Hash: 89630a747caf77da89942a637bcf9e37fff0976dd385492cd44139862e950a8a
Instruction Fuzzy Hash: 07118E3EA01A80C7EB18EF15F8543687760FB44BA4F9C8612DA5A47669DF38C091CB54

Function 02882C84 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 02882C98

Part of subcall function 02882F3C: _amsg_exit.LIBCMT ref: 02882F66

fclose.LIBCMT ref: 02882CC8
DeleteCriticalSection.KERNEL32 ref: 02882CEC
free.LIBCMT ref: 02882CFD

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalDeleteSection_amsg_exit_lockfclosefree
String ID:
API String ID: 594724896-0
Opcode ID: 2aa86dbb0ad97149f4f98bbfb16fd49b6472e5e52c6ca9ac48a45b795c7c226e
Instruction ID: 1c1f2bc7aeb2cfbad3d8f02d02daeba8fe9d6dcee3a4b4537e28f7ad5d1ae43f
Opcode Fuzzy Hash: 2aa86dbb0ad97149f4f98bbfb16fd49b6472e5e52c6ca9ac48a45b795c7c226e
Instruction Fuzzy Hash: 7A11823E61168082E710EB19E88832DBB61F7C4B58F558216CF5E83778CF39C4A2CB15

Function 0287ED3C Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0287ED46

Part of subcall function 0287E2A0: _amsg_exit.LIBCMT ref: 0287E2B6

_lock.LIBCMT ref: 0287ED74
free.LIBCMT ref: 0287EDAA
_amsg_exit.LIBCMT ref: 0287EDE3

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _amsg_exit$_getptd_lockfree
String ID:
API String ID: 2148533958-0
Opcode ID: 41950d0d650662fb9ca318be262181bdb2ba838ad8e8b222847fcf64ff023056
Instruction ID: 6b9ee42c39dc67f366a190e9cb278be2d7c8cf108d1123b7121c7431f423316e
Opcode Fuzzy Hash: 41950d0d650662fb9ca318be262181bdb2ba838ad8e8b222847fcf64ff023056
Instruction Fuzzy Hash: EF112E3E226A8086DBA49F29E8847A97761F788B84F4C4067DE4E43759DF28D4A0C701

Function 00007FF6609102E0 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 00007FF6609102F4

Part of subcall function 00007FF66090D9D8: _amsg_exit.LIBCMT ref: 00007FF66090DA02

fclose.LIBCMT ref: 00007FF660910324
DeleteCriticalSection.KERNEL32(?,?,?,?,?,00007FF66090EBB3), ref: 00007FF660910348
free.LIBCMT ref: 00007FF660910359

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalDeleteSection_amsg_exit_lockfclosefree
String ID:
API String ID: 594724896-0
Opcode ID: 78db43efc7c8f8b6f2111a7d5b2742e6ce96985b6946986547e2f26360c46e23
Instruction ID: b61e21d2a68d9e9a01e7de6c1a5e8731817312badec21ffeeca80e5032016d53
Opcode Fuzzy Hash: 78db43efc7c8f8b6f2111a7d5b2742e6ce96985b6946986547e2f26360c46e23
Instruction Fuzzy Hash: 6D117C25A18602E2E7149B19E48037C7376FB84B44F50A375DAAECB3A6CF3DE552C604

Function 00007FF66090EF6C Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF66090EF76

Part of subcall function 00007FF66090BA34: _amsg_exit.LIBCMT ref: 00007FF66090BA4A

_lock.LIBCMT ref: 00007FF66090EFA4
free.LIBCMT ref: 00007FF66090EFDA
_amsg_exit.LIBCMT ref: 00007FF66090F013

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _amsg_exit$_getptd_lockfree
String ID:
API String ID: 2148533958-0
Opcode ID: 7d7c657d20a7dd2b4e75e9e7dc412b9cbf1c6d67fe2fb29e532279fb9e9c9193
Instruction ID: a870b049998a7090e9db348cb6aac20f03aa8e01053b5d711002efdb06bbbfaf
Opcode Fuzzy Hash: 7d7c657d20a7dd2b4e75e9e7dc412b9cbf1c6d67fe2fb29e532279fb9e9c9193
Instruction Fuzzy Hash: DB113D22B1D642E2EB949B10E44077973B6FB44B40F486239DA5F8B797DF2CE450C780

Function 00007FF66090B8D0 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

FlsFree.KERNEL32(?,?,?,?,00007FF66090BC45,?,?,00000000,00007FF660909984), ref: 00007FF66090B8DF
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF66090BC45), ref: 00007FF66090D883
free.LIBCMT ref: 00007FF66090D88C
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF66090BC45), ref: 00007FF66090D8B3

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CriticalDeleteSection$Freefree
String ID:
API String ID: 1250194111-0
Opcode ID: c67542cc3d2d698b88e45379a5442c15c18af80ec950ad7c34deb963a0871383
Instruction ID: e3c2f9e75684256c545ad26b011677d88d8b1264e33c2a98102163e942f50a13
Opcode Fuzzy Hash: c67542cc3d2d698b88e45379a5442c15c18af80ec950ad7c34deb963a0871383
Instruction Fuzzy Hash: 31119031E0DA41E6FA158F11A45023863B6EF44B60F586B74DA6E8A3A6CF3CD884C740

Function 0287596C Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 028759A1
ExitThread.KERNEL32 ref: 028759A9
GetCurrentThreadId.KERNEL32 ref: 028759B0
_freefls.LIBCMT ref: 028759E1

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Thread$CurrentErrorExitLast_freefls
String ID:
API String ID: 217443660-0
Opcode ID: 592d292820fdcc37a8a5b07a798f5007001eef603de5d051769be239e375fdd9
Instruction ID: bfc80b525bddbb1c91861c0065802b53aa78b254f796c45bde72e312f82a34fd
Opcode Fuzzy Hash: 592d292820fdcc37a8a5b07a798f5007001eef603de5d051769be239e375fdd9
Instruction Fuzzy Hash: E3F01D3D702B4585DF08BF75E84935D329AAB09B96F9484348E5DCB314FE38C484C722

Function 02870210 Relevance: 6.0, APIs: 4, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 02861510: HeapFree.KERNEL32 ref: 02861556
Part of subcall function 02861510: free.LIBCMT ref: 02861582

HeapDestroy.KERNEL32 ref: 0287022E
HeapCreate.KERNEL32 ref: 0287023F
free.LIBCMT ref: 02870251
HeapDestroy.KERNEL32 ref: 02870274

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Heap$Destroyfree$CreateFree
String ID:
API String ID: 3907340440-0
Opcode ID: fb910f475e248c92b0ee4af45beb681a5d6336f248101098f2117f60791a146a
Instruction ID: ddf76175151fefa6f05f66af7b9a52a4568fe11083228cc5b33d41ee6d19421a
Opcode Fuzzy Hash: fb910f475e248c92b0ee4af45beb681a5d6336f248101098f2117f60791a146a
Instruction Fuzzy Hash: C4F0147E222A8097EB499F62E6983287361FB58B90F949416DF5A43B20DF34D4B0C710

Function 00007FF6609086F0 Relevance: 6.0, APIs: 4, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF660901540: HeapFree.KERNEL32 ref: 00007FF660901586
Part of subcall function 00007FF660901540: free.LIBCMT ref: 00007FF6609015B2

HeapDestroy.KERNEL32 ref: 00007FF66090870E
HeapCreate.KERNEL32 ref: 00007FF66090871F
free.LIBCMT ref: 00007FF660908731
HeapDestroy.KERNEL32 ref: 00007FF660908754

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: Heap$Destroyfree$CreateFree
String ID:
API String ID: 3907340440-0
Opcode ID: fcaa257793e5fadcfc70eac2341b6a548630f635855dc52f12f0612825e35ef9
Instruction ID: 100f26f1226e1b5b8c0dd1b3ca2076058db38795e1e264d76ba522f0e51d606c
Opcode Fuzzy Hash: fcaa257793e5fadcfc70eac2341b6a548630f635855dc52f12f0612825e35ef9
Instruction Fuzzy Hash: 05014F36719641E7EB488F61D6901693375FF44780B10A539DF5E47B11CF78E4B08340

Function 0287F60C Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0287F612

Part of subcall function 0287E2A0: _amsg_exit.LIBCMT ref: 0287E2B6

_getptd.LIBCMT ref: 0287F632
_lock.LIBCMT ref: 0287F645
_amsg_exit.LIBCMT ref: 0287F673

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: f73260c00caa837c4d3d9f8a59bd0010eec5b05e7670a8abfb7bea24928e3992
Instruction ID: 6026d33659a225880530aed446311c177ee66aa40d8cca9c08fb34dd1c92c487
Opcode Fuzzy Hash: f73260c00caa837c4d3d9f8a59bd0010eec5b05e7670a8abfb7bea24928e3992
Instruction Fuzzy Hash: BDF0FE2D622541C2EA28BF66C844BB92762E7A5B48F4C4179CF0D877A5DF14C491DB12

Function 00007FF66090F83C Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF66090F842

Part of subcall function 00007FF66090BA34: _amsg_exit.LIBCMT ref: 00007FF66090BA4A

_getptd.LIBCMT ref: 00007FF66090F862
_lock.LIBCMT ref: 00007FF66090F875
_amsg_exit.LIBCMT ref: 00007FF66090F8A3

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: 41071648471df9d3322a353edf5a3ab4de664c8de62a61506e4f03b2c3d18dde
Instruction ID: edb62f7217ef3047ab89a6b281f7b6d8e137f1c2d11cddf8f6c950b4ee7f1de0
Opcode Fuzzy Hash: 41071648471df9d3322a353edf5a3ab4de664c8de62a61506e4f03b2c3d18dde
Instruction Fuzzy Hash: 63F0E711A4E142E2FA54EB5188517F822B2EF48B44F48633DDE0F8F7D39F2CA541D695

Function 028632F0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 0286332D
CancelIo.KERNEL32 ref: 0286333A
closesocket.WS2_32 ref: 0286334A
SetEvent.KERNEL32 ref: 02863354

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CancelEventclosesocketsetsockopt
String ID:
API String ID: 852421847-0
Opcode ID: 5fed5ac1a6c0e25038b08101fba0c49ff6199068559f4a30632e6729f0e15d68
Instruction ID: 6c5b32b64e18f15430fab3090670b6637623938b62e0849808605150a90c93b8
Opcode Fuzzy Hash: 5fed5ac1a6c0e25038b08101fba0c49ff6199068559f4a30632e6729f0e15d68
Instruction Fuzzy Hash: D9F04F3A201B8087E7149F25E55835AB371FB89B64FA44325CBB947BE4CF39C065CB00

Function 02863B40 Relevance: 6.0, APIs: 4, Instructions: 22synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 02863B50
Sleep.KERNEL32 ref: 02863B5B
WaitForSingleObject.KERNEL32 ref: 02863B70
WaitForSingleObject.KERNEL32 ref: 02863B80

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: ObjectSingleWait$Sleep
String ID:
API String ID: 2961732021-0
Opcode ID: a82aa5ed7ef335a9b865fcb5ba273442daed7ef383871e9b9812ef4d3b324817
Instruction ID: 63b183d625ed1d83b6e84a9f8a950ce2dc9696ac6c58335f10da68bf57b66788
Opcode Fuzzy Hash: a82aa5ed7ef335a9b865fcb5ba273442daed7ef383871e9b9812ef4d3b324817
Instruction Fuzzy Hash: 5EF01C7A211A44C6F7409F7ADC183583360F79EB69F958322CB7D462E5CF388485C350

Function 02879E88 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 02879EAC

Part of subcall function 0287E2A0: _amsg_exit.LIBCMT ref: 0287E2B6

Strings

csm, xrefs: 02879FE3
csm, xrefs: 02879ED9

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _amsg_exit_getptd
String ID: csm$csm
API String ID: 4217099735-3733052814
Opcode ID: a301923d45d768f53e4ff1bf8f3989137dba7043ec0d64a7539cc695a05f00f4
Instruction ID: 7c5756997a938ad1b277d62ac03dc4ab059d3b16ae4543ca95c3d5f9e07aa6aa
Opcode Fuzzy Hash: a301923d45d768f53e4ff1bf8f3989137dba7043ec0d64a7539cc695a05f00f4
Instruction Fuzzy Hash: 79519B3E204680CACB288F2AD48076DB7A5F359B99F488125DE9DD7B58CB38D491CB02

Function 00007FF66091417C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF6609141A0

Part of subcall function 00007FF66090BA34: _amsg_exit.LIBCMT ref: 00007FF66090BA4A

Strings

csm, xrefs: 00007FF6609141CD
csm, xrefs: 00007FF6609142D7

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _amsg_exit_getptd
String ID: csm$csm
API String ID: 4217099735-3733052814
Opcode ID: 101f134f4e12a7d59dd54e5d86992c5274962396a685041d1e783f31e629751d
Instruction ID: 52ba7b930e3c37cb968c1472fe77b35f98c4314b69afc897cf23f3e6afa71198
Opcode Fuzzy Hash: 101f134f4e12a7d59dd54e5d86992c5274962396a685041d1e783f31e629751d
Instruction Fuzzy Hash: 1C51A632B08242D5EB608E25914037D76BAFB49B88F445375EA6D9BB86CF3CE491CB41

Function 0286DCA4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

Part of subcall function 028755F8: malloc.LIBCMT ref: 02875612

wsprintfW.USER32 ref: 0286DCF8
CloseHandle.KERNEL32 ref: 0286DE6B

Strings

%s_bin, xrefs: 0286DCEE

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: CloseHandlemallocwsprintf
String ID: %s_bin
API String ID: 2399101171-2665034546
Opcode ID: f89af850d70fafd9c450e0015fdbbbd6af059b6c7c0169ba37591b7b0b900e9d
Instruction ID: 7a3351ac1c5733933c1e4ac455c13e4101d264655f5cf8e702184693d30a47cc
Opcode Fuzzy Hash: f89af850d70fafd9c450e0015fdbbbd6af059b6c7c0169ba37591b7b0b900e9d
Instruction Fuzzy Hash: 1441AD2E701A9481EF50EF66E408B7D236AFB85F88F488126CE5D87788DF39C149C702

Function 02825281 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 02825202
_invalid_parameter_noinfo.LIBCMT ref: 0282520D

Strings

B, xrefs: 02825232

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: b2b1431cd55b683814269cea7d1a1a7e7268a5820bfd4734ba4b4440490ac067
Instruction ID: 840b7ca20a45f7e6f282e20cd42f1e74b8e3dfad7c7f318cce536f43ce430b0b
Opcode Fuzzy Hash: b2b1431cd55b683814269cea7d1a1a7e7268a5820bfd4734ba4b4440490ac067
Instruction Fuzzy Hash: A5219339258B5C8FC748EF6D844462AB7D1FB9C324F94076EA45DC7291CB78C984CB82

Function 028261D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 0282617A
_invalid_parameter_noinfo.LIBCMT ref: 02826185

Strings

B, xrefs: 028261B1

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: e7192767c34a9623a5d1a89167f59ebb02eb77dc64806a58f83736d32f6d4f2d
Instruction ID: 28de93f17ae59bc4fa6cd073d82fb2fde294a8cd84549374ec10fc41f15b1fa5
Opcode Fuzzy Hash: e7192767c34a9623a5d1a89167f59ebb02eb77dc64806a58f83736d32f6d4f2d
Instruction Fuzzy Hash: DF11BF34618B1C8FC744EF5C9485769B7E2FB98324F10476EA419C32A1DF78D884CB82

Function 0288D797 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 0288D85B

Strings

csm, xrefs: 0288D7BE
csm, xrefs: 0288D817

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: d6e929b15d94968c4dcae8ba8a550ecf849421d0443b38efa222e2e13b2dfd33
Instruction ID: df86a076173bdc891e8eddc14a259b3dc0776f23595bef8fb57ee0c74b5613af
Opcode Fuzzy Hash: d6e929b15d94968c4dcae8ba8a550ecf849421d0443b38efa222e2e13b2dfd33
Instruction Fuzzy Hash: B621B47B500A44CADB309F76C4843983B75F358BADF8A6219EA4D8BB58CB75C484C784

Function 00007FF660917323 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 00007FF6609173E7

Strings

csm, xrefs: 00007FF66091734A
csm, xrefs: 00007FF6609173A3

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd
String ID: csm$csm
API String ID: 3186804695-3733052814
Opcode ID: 2390259f5c7b96c66dbe66369981e250b2529a0f82c8583acd2dcf66a4ceee86
Instruction ID: c51a42a026c34b4c98e13404553d4c08e1917766c38a68280763853f16a809ba
Opcode Fuzzy Hash: 2390259f5c7b96c66dbe66369981e250b2529a0f82c8583acd2dcf66a4ceee86
Instruction Fuzzy Hash: FE310B73604606CADB608F26D0802AC3B7AF758B9CF862375EA4D4BB95CF75D881C784

Function 028757B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 02875731
_invalid_parameter_noinfo.LIBCMT ref: 0287573C

Strings

B, xrefs: 02875761

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: 69ea10b5aa7fc4c94b3da25204908f538d83001d58fe88acc6dd5c106ed87c29
Instruction ID: 55264d8162efde1814a1e6ea9013a6972cbec9969c05f6171d114efde06340df
Opcode Fuzzy Hash: 69ea10b5aa7fc4c94b3da25204908f538d83001d58fe88acc6dd5c106ed87c29
Instruction Fuzzy Hash: 2111307E614784C6DB209F16E44025AB7A1F798BE8F984225AF9D97B55CF3CC541CF00

Function 00007FF6609092C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 00007FF660909245
_invalid_parameter_noinfo.LIBCMT ref: 00007FF660909250

Strings

B, xrefs: 00007FF660909275

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: 9b4439fc7c8faf101ecdfea0264f82894208d5a38c9186357c889f9d5f545f4f
Instruction ID: 7bfa37ac462f12784ff0f2a9145497f8cf5c3cf9fe9ed39b4488cd5a50c9fbfa
Opcode Fuzzy Hash: 9b4439fc7c8faf101ecdfea0264f82894208d5a38c9186357c889f9d5f545f4f
Instruction Fuzzy Hash: 7611637261C741D6EB209B15D44026976B2FB88B94F545339EB9E4BB9ACE3CD540CA40

Function 02876700 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 028766A9
_invalid_parameter_noinfo.LIBCMT ref: 028766B4

Strings

B, xrefs: 028766E0

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: 69a3a8124c829fc22fade150a83cc64c850d83050ea355695546101ce870de63
Instruction ID: 7c872f118e77ee89daae4b37a5659b0e0c6f24d33e787520b4875651d6f1a9fc
Opcode Fuzzy Hash: 69a3a8124c829fc22fade150a83cc64c850d83050ea355695546101ce870de63
Instruction Fuzzy Hash: 540100BA610A4082DB10DF12E44039AB765F798FE8F988320AF5C47BA5DF38C140CB00

Function 0288D897 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 02877C2C: _getptd.LIBCMT ref: 02877C39
Part of subcall function 02877C2C: _getptd.LIBCMT ref: 02877C4C

_getptd.LIBCMT ref: 0288D8F8
_getptd.LIBCMT ref: 0288D90B

Strings

csm, xrefs: 0288D8B7

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: b4a5c6ca7b0824ff1c597d2069204a834d0011f023a00befa5de174d093b4a23
Instruction ID: 4f125f40697da17a3baf89287e45eea7cdb3d79deb0a2835f21a1ed380148073
Opcode Fuzzy Hash: b4a5c6ca7b0824ff1c597d2069204a834d0011f023a00befa5de174d093b4a23
Instruction Fuzzy Hash: F8012C6E6407418ACB30AF3598447BC2375EB99F6DF894925CE5D8B644CB30C585CB01

Function 00007FF660917423 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF660911EAC: _getptd.LIBCMT ref: 00007FF660911EB9
Part of subcall function 00007FF660911EAC: _getptd.LIBCMT ref: 00007FF660911ECC

_getptd.LIBCMT ref: 00007FF660917484
_getptd.LIBCMT ref: 00007FF660917497

Strings

csm, xrefs: 00007FF660917443

Memory Dump Source

Source File: 00000000.00000002.3244143790.00007FF660901000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF660900000, based on PE: true

Associated: 00000000.00000002.3244084924.00007FF660900000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244175387.00007FF660918000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244230955.00007FF66091E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3244260316.00007FF660925000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff660900000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: _getptd
String ID: csm
API String ID: 3186804695-1018135373
Opcode ID: 4682075a758e49528a487afa047c3333b91a60c7711f6bd7727fe6ef45998704
Instruction ID: e581fe65ea9d9b5f965f7a43aeea05462267df471e898751aa72f81b04867c0b
Opcode Fuzzy Hash: 4682075a758e49528a487afa047c3333b91a60c7711f6bd7727fe6ef45998704
Instruction Fuzzy Hash: 1B014022A05247E5EB749F65D8402B827BAEB54B59F4423B9DD0D8F797CF28E481C740

Function 0281C401 Relevance: 5.2, APIs: 4, Instructions: 156COMMON

Download Yara Rule

APIs

malloc.LIBCMT ref: 0281C434

Part of subcall function 02825011: _FF_MSGBANNER.LIBCMT ref: 02825041
Part of subcall function 02825011: _callnewh.LIBCMT ref: 0282507F
Part of subcall function 02825011: _errno.LIBCMT ref: 0282508A
Part of subcall function 02825011: _errno.LIBCMT ref: 02825095

free.LIBCMT ref: 0281C45C
free.LIBCMT ref: 0281C4E7
free.LIBCMT ref: 0281C527

Memory Dump Source

Source File: 00000000.00000002.3242861449.0000000002810000.00000040.00001000.00020000.00000000.sdmp, Offset: 02810000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2810000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$_errno$_callnewhmalloc
String ID:
API String ID: 2761444284-0
Opcode ID: 41aa70f8018d2aebca106d91cb34d39965c9ad2e17f13fc8d01bbcb11a335b68
Instruction ID: 1438388390393ec1f427f29d35ee4fa7ea4eef060ba62a50a52eccf84497fc4f
Opcode Fuzzy Hash: 41aa70f8018d2aebca106d91cb34d39965c9ad2e17f13fc8d01bbcb11a335b68
Instruction Fuzzy Hash: 1441F23865CB1E8FC729EF5D9481776B7D9FB88304B00852E998EC3251DB70E8468B83

Function 0287314C Relevance: 5.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

free.LIBCMT ref: 02873171

Part of subcall function 02875500: HeapFree.KERNEL32 ref: 02875516
Part of subcall function 02875500: _errno.LIBCMT ref: 02875520
Part of subcall function 02875500: GetLastError.KERNEL32 ref: 02875528

free.LIBCMT ref: 02873184
free.LIBCMT ref: 02873197
free.LIBCMT ref: 028731AA

Memory Dump Source

Source File: 00000000.00000002.3242905680.0000000002860000.00000040.00001000.00020000.00000000.sdmp, Offset: 02860000, based on PE: true

Associated: 00000000.00000002.3242905680.00000000028A9000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2860000_44ba92cfe6426e6b641bda018ec4850696b32035a60e8.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: 8ae717418b747786a6bdd70cc3524a69f5d92fbf5ae73ae9309fde861978cd30
Instruction ID: 56ddbd05a6268c39790d4a44f15f4d3b66a45a9f3f1b92b5473e3040c80f6153
Opcode Fuzzy Hash: 8ae717418b747786a6bdd70cc3524a69f5d92fbf5ae73ae9309fde861978cd30
Instruction Fuzzy Hash: 5FF0621E202A4488DF24EFB4C0A43396321EB94F7CF980B149E7E89594CF28C480D792

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\DisplaySessionContainers.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Windows Analysis Report
44ba92cfe6426e6b641bda018ec4850696b32035a60e8.exe

Function 028667A0 Relevance: 93.1, APIs: 37, Strings: 16, Instructions: 394
registrystringnetworkCOMMON

Function 02871790 Relevance: 70.3, APIs: 27, Strings: 13, Instructions: 325
sleepregistrylibraryCOMMON

Function 02872280 Relevance: 51.0, APIs: 18, Strings: 11, Instructions: 223
stringclipboardsleepCOMMON

Function 00007FF660906860 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 213
registrymemoryCOMMON

Function 02868220 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 117
memoryCOMMON

Function 02863370 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 168
networkstringtimeCOMMON

Function 00007FF660903390 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 168
networkstringtimeCOMMON

Function 02871E70 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 121
synchronizationfilekeyboardCOMMON

Function 028802A4 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 292
timeCOMMONLIBRARYCODE

Function 028677A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 199
stringregistrycomCOMMON

Function 02867EA0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 102
memoryCOMMON

Function 0286F2E0 Relevance: 34.7, APIs: 23, Instructions: 201
memorywindowCOMMON

Function 0286CEB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 225
windowCOMMON

Function 0286CA90 Relevance: 27.3, APIs: 18, Instructions: 283
windowCOMMON

Function 02867580 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 67
synchronizationsleepstringCOMMON