Edit tour

Windows Analysis Report
vYeaC4s9zP.exe

Overview

General Information

Sample name:	vYeaC4s9zP.exe renamed because original name is a hash value
Original sample name:	26cb6c247cdfb5215bc60ac7abd12322.exe
Analysis ID:	1583860
MD5:	26cb6c247cdfb5215bc60ac7abd12322
SHA1:	d1ca8142469039a57cb43d3bebe369d0a00aa08b
SHA256:	da7c7cbc0d451b55c5a9312532b3e07d52e25399cb10e96cb2479a10407d4600
Tags:	exeValleyRATuser-abuse_ch
Infos:

Detection

GhostRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GhostRat

AI detected suspicious sample

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Found evasive API chain (may stop execution after checking mutex)

Found stalling execution ending in API Sleep call

Sample is not signed and drops a device driver

Sigma detected: Potentially Suspicious Malware Callback Communication

Tries to detect sandboxes / dynamic malware analysis system (QueryWinSAT)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks for available system drives (often done to infect USB drives)

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Creates driver files

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found evasive API chain checking for process token information

Installs a global mouse hook

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Stores large binary data to the registry

Classification

Process Tree

System is w10x64

vYeaC4s9zP.exe (PID: 1216 cmdline: "C:\Users\user\Desktop\vYeaC4s9zP.exe" MD5: 26CB6C247CDFB5215BC60AC7ABD12322)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
vYeaC4s9zP.exe	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: vYeaC4s9zP.exe PID: 1216	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.vYeaC4s9zP.exe.7ff6b2990000.0.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.2.vYeaC4s9zP.exe.7ff6b2990000.0.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 27.124.4.60, DestinationIsIpv6: false, DestinationPort: 4433, EventID: 3, Image: C:\Users\user\Desktop\vYeaC4s9zP.exe, Initiated: true, ProcessId: 1216, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Suricata Signatures

ET MALWARE Anonymous RAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-03T18:47:02.929641+0100	2052875	1	A Network Trojan was detected	192.168.2.5	49704	27.124.4.60	4433	TCP
2025-01-03T18:48:08.634869+0100	2052875	1	A Network Trojan was detected	192.168.2.5	49704	27.124.4.60	4433	TCP
2025-01-03T18:49:15.394711+0100	2052875	1	A Network Trojan was detected	192.168.2.5	49979	27.124.4.60	10443	TCP
2025-01-03T18:50:19.461038+0100	2052875	1	A Network Trojan was detected	192.168.2.5	49982	27.124.4.60	4433	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: vYeaC4s9zP.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Source: vYeaC4s9zP.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File opened: [:	Jump to behavior

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B299F410 GetLastInputInfo,GetTickCount,wsprintfW,GetForegroundWindow,GetWindowTextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,SHGetFolderPathW,lstrcatW,CreateFileW,lstrlenW,WriteFile,CloseHandle,FindFirstFileW,FindClose,_invalid_parameter_noinfo_noreturn,		0_2_00007FF6B299F410
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29C3EF0 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00007FF6B29C3EF0

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Code function: 0_2_00007FF6B29962F0 gethostname,gethostbyname,inet_ntoa,inet_ntoa,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,LoadLibraryW,GetProcAddress,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,FreeLibrary,GetSystemInfo,wsprintfW,GetDriveTypeW,GetDiskFreeSpaceExW,GlobalMemoryStatusEx,GetForegroundWindow,GetWindowTextW,lstrlenW,GetLocalTime,wsprintfW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,lstrcpyW,CloseHandle,CoInitializeEx,CoCreateInstance,SysFreeString,CoUninitialize,RegOpenKeyExW,RegQueryInfoKeyW,RegEnumKeyExW,lstrlenW,lstrlenW,RegCloseKey,lstrlenW,GetTickCount,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,lstrcpyW,lstrcatW,lstrlenW,GetLocalTime,wsprintfW,RegOpenKeyExW,RegDeleteValueW,RegCloseKey,RegCreateKeyW,lstrlenW,RegSetValueExW,RegCloseKey,RegCloseKey,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,

0_2_00007FF6B29962F0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.5:49704 -> 27.124.4.60:4433
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.5:49979 -> 27.124.4.60:10443
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.5:49982 -> 27.124.4.60:4433

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 27.124.4.60:4433

Source: Joe Sandbox View

ASN Name: BCPL-SGBGPNETGlobalASNSG BCPL-SGBGPNETGlobalASNSG

Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60
Source: unknown	TCP traffic detected without corresponding DNS query: 27.124.4.60

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Code function: 0_2_00007FF6B2993B00 select,recv,timeGetTime,

0_2_00007FF6B2993B00

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Code function: [esc]

0_2_00007FF6B299ADB0

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Code function: 0_2_00007FF6B29A0E20 _invalid_parameter_noinfo_noreturn,lstrlenW,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,CloseClipboard,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6B29A0E20

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

0_2_00007FF6B29A0E20

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

0_2_00007FF6B29A0E20

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Code function: 0_2_00007FF6B299FD10 GetVersion,GetDesktopWindow,GetDC,CreateCompatibleDC,GetDC,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateCompatibleBitmap,SelectObject,SetStretchBltMode,GetSystemMetrics,GetSystemMetrics,StretchBlt,GetDIBits,DeleteObject,DeleteObject,ReleaseDC,DeleteObject,DeleteObject,ReleaseDC,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6B299FD10

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Code function: 0_2_00007FF6B2997250 MultiByteToWideChar,MultiByteToWideChar,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,CreateMutexExW,GetLastError,Sleep,CreateMutexW,GetLastError,lstrlenW,lstrcmpW,SleepEx,GetModuleHandleW,GetConsoleWindow,SHGetFolderPathW,lstrcatW,CreateMutexW,WaitForSingleObject,CreateFileW,GetFileSize,CloseHandle,DeleteFileW,ReleaseMutex,DirectInput8Create,GetTickCount,GetKeyState,

0_2_00007FF6B2997250

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Jump to behavior

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Code function: 0_2_00007FF6B29AC1B0: CreateFileA,DeviceIoControl,

0_2_00007FF6B29AC1B0

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B299E3E9 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,ExitWindowsEx,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	0_2_00007FF6B299E3E9
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B299E4EE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,ExitWindowsEx,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,	0_2_00007FF6B299E4EE
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B299E46D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,ExitWindowsEx,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,	0_2_00007FF6B299E46D

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

File created: C:\ProgramData\kernelquick.sys

Jump to behavior

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29B8C10	0_2_00007FF6B29B8C10
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B299F410	0_2_00007FF6B299F410
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29AB500	0_2_00007FF6B29AB500
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B2991500	0_2_00007FF6B2991500
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B299FD10	0_2_00007FF6B299FD10
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29979E0	0_2_00007FF6B29979E0
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29962F0	0_2_00007FF6B29962F0
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B2997250	0_2_00007FF6B2997250
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B2998040	0_2_00007FF6B2998040
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29C1DA8	0_2_00007FF6B29C1DA8
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29AAD80	0_2_00007FF6B29AAD80
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B299B410	0_2_00007FF6B299B410
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B299D410	0_2_00007FF6B299D410
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29B536C	0_2_00007FF6B29B536C
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29B7340	0_2_00007FF6B29B7340
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29BB350	0_2_00007FF6B29BB350
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29BC51C	0_2_00007FF6B29BC51C
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29BFD30	0_2_00007FF6B29BFD30
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29C5D34	0_2_00007FF6B29C5D34
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29BA4F8	0_2_00007FF6B29BA4F8
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29BAC80	0_2_00007FF6B29BAC80
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29BF21C	0_2_00007FF6B29BF21C
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29B6228	0_2_00007FF6B29B6228
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29B5168	0_2_00007FF6B29B5168
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29C714C	0_2_00007FF6B29C714C
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29BD320	0_2_00007FF6B29BD320
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B2999320	0_2_00007FF6B2999320
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29A9250	0_2_00007FF6B29A9250
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29C2024	0_2_00007FF6B29C2024
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29C3760	0_2_00007FF6B29C3760
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29B4F5C	0_2_00007FF6B29B4F5C
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29C2744	0_2_00007FF6B29C2744
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29B6F3C	0_2_00007FF6B29B6F3C
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29997A0	0_2_00007FF6B29997A0
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29B577C	0_2_00007FF6B29B577C
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29A78F0	0_2_00007FF6B29A78F0
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29A0900	0_2_00007FF6B29A0900
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29B4D58	0_2_00007FF6B29B4D58
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B299CD40	0_2_00007FF6B299CD40
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29AA5A0	0_2_00007FF6B29AA5A0
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B299ADB0	0_2_00007FF6B299ADB0
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29B65AC	0_2_00007FF6B29B65AC
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29C8584	0_2_00007FF6B29C8584
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29B5578	0_2_00007FF6B29B5578
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29C3EF0	0_2_00007FF6B29C3EF0
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29A2EC0	0_2_00007FF6B29A2EC0
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B2992E50	0_2_00007FF6B2992E50
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29BF6B0	0_2_00007FF6B29BF6B0

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/1@0/1

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29AB500 SleepEx,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,RegOpenKeyExW,RegDeleteValueW,RegSetValueExW,RegCloseKey,SleepEx,CreateEventA,Sleep,Sleep,CloseHandle,_invalid_parameter_noinfo_noreturn,IsDebuggerPresent,LoadLibraryW,GetProcAddress,FreeLibrary,GetLocalTime,wsprintfW,CreateFileW,FreeLibrary,GetCurrentThreadId,GetCurrentProcessId,GetCurrentProcess,CloseHandle,FreeLibrary,	0_2_00007FF6B29AB500
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B299E3E9 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,ExitWindowsEx,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	0_2_00007FF6B299E3E9
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B299E4EE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,ExitWindowsEx,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,	0_2_00007FF6B299E4EE
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B299E46D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,ExitWindowsEx,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,	0_2_00007FF6B299E46D
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B2999320 GetSystemDirectoryA,CreateProcessA,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,OpenProcess,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,GetModuleFileNameA,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,ResumeThread,	0_2_00007FF6B2999320

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

0_2_00007FF6B29962F0

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Code function: 0_2_00007FF6B299F410 GetLastInputInfo,GetTickCount,wsprintfW,GetForegroundWindow,GetWindowTextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,SHGetFolderPathW,lstrcatW,CreateFileW,lstrlenW,WriteFile,CloseHandle,FindFirstFileW,FindClose,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6B299F410

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Code function: 0_2_00007FF6B29979E0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CoCreateInstance,wsprintfW,RegOpenKeyExW,RegQueryValueExW,lstrcatW,lstrcatW,RegCloseKey,lstrlenW,lstrcatW,CloseHandle,lstrcatW,lstrcatW,

0_2_00007FF6B29979E0

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Mutant created: \Sessions\1\BaseNamedObjects\????

Source: vYeaC4s9zP.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: vYeaC4s9zP.exe

ReversingLabs: Detection: 52%

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62BE5D10-60EB-11d0-BD3B-00A0C911CE86}\InprocServer32

Jump to behavior

Source: vYeaC4s9zP.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: vYeaC4s9zP.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: vYeaC4s9zP.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Code function: 0_2_00007FF6B29AB500 SleepEx,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,RegOpenKeyExW,RegDeleteValueW,RegSetValueExW,RegCloseKey,SleepEx,CreateEventA,Sleep,Sleep,CloseHandle,_invalid_parameter_noinfo_noreturn,IsDebuggerPresent,LoadLibraryW,GetProcAddress,FreeLibrary,GetLocalTime,wsprintfW,CreateFileW,FreeLibrary,GetCurrentThreadId,GetCurrentProcessId,GetCurrentProcess,CloseHandle,FreeLibrary,

0_2_00007FF6B29AB500

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

File created: C:\ProgramData\kernelquick.sys

Jump to behavior

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Code function: 0_2_00007FF6B299E36A OpenEventLogW,ClearEventLogW,CloseEventLog,

0_2_00007FF6B299E36A

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE VenkernalData_info

Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_0-21519

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Stalling execution: Execution stalls by calling Sleep

graph_0-21060

Tries to detect sandboxes / dynamic malware analysis system (QueryWinSAT)

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{05DF8D13-C355-47F4-A11E-851B338CEFB8}

Jump to behavior

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

0_2_00007FF6B29962F0

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Window / User API: threadDelayed 3355			Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Window / User API: threadDelayed 5945			Jump to behavior

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-21550

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-21595

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe TID: 6180	Thread sleep count: 149 > 30	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe TID: 6180	Thread sleep time: -149000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe TID: 2228	Thread sleep count: 3355 > 30	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe TID: 2228	Thread sleep time: -33550s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe TID: 6180	Thread sleep count: 5945 > 30	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe TID: 6180	Thread sleep time: -5945000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B299F410 GetLastInputInfo,GetTickCount,wsprintfW,GetForegroundWindow,GetWindowTextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,SHGetFolderPathW,lstrcatW,CreateFileW,lstrlenW,WriteFile,CloseHandle,FindFirstFileW,FindClose,_invalid_parameter_noinfo_noreturn,		0_2_00007FF6B299F410
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29C3EF0 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00007FF6B29C3EF0

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

0_2_00007FF6B29962F0

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Code function: 0_2_00007FF6B29991A0 GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

0_2_00007FF6B29991A0

Source: vYeaC4s9zP.exe, 00000000.00000002.4457353364.00000232B0997000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: vYeaC4s9zP.exe, 00000000.00000002.4457353364.00000232B0997000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

0_2_00007FF6B29AB500

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Code function: 0_2_00007FF6B29AC70C GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF6B29AC70C

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

0_2_00007FF6B29962F0

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

0_2_00007FF6B29AB500

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Code function: 0_2_00007FF6B2998690 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,LookupAccountSidW,GetLastError,GetProcessHeap,HeapFree,

0_2_00007FF6B2998690

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29ABCD0 SetUnhandledExceptionFilter,GetConsoleWindow,ShowWindow,GetCurrentThreadId,PostThreadMessageA,GetInputState,CreateThread,WaitForSingleObject,CloseHandle,Sleep,	0_2_00007FF6B29ABCD0
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29AB500 SleepEx,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,RegOpenKeyExW,RegDeleteValueW,RegSetValueExW,RegCloseKey,SleepEx,CreateEventA,Sleep,Sleep,CloseHandle,_invalid_parameter_noinfo_noreturn,IsDebuggerPresent,LoadLibraryW,GetProcAddress,FreeLibrary,GetLocalTime,wsprintfW,CreateFileW,FreeLibrary,GetCurrentThreadId,GetCurrentProcessId,GetCurrentProcess,CloseHandle,FreeLibrary,	0_2_00007FF6B29AB500
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29B3A6C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6B29B3A6C
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29AE8E0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6B29AE8E0
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29AE54C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6B29AE54C
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: 0_2_00007FF6B29AE6F4 SetUnhandledExceptionFilter,	0_2_00007FF6B29AE6F4

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Code function: 0_2_00007FF6B2999320 GetSystemDirectoryA,CreateProcessA,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,OpenProcess,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,GetModuleFileNameA,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,ResumeThread,

0_2_00007FF6B2999320

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

0_2_00007FF6B2999320

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Code function: GetSystemDirectoryA,CreateProcessA,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,OpenProcess,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,GetModuleFileNameA,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\System32\svchost.exe

0_2_00007FF6B2999320

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

0_2_00007FF6B29AB500

Source: vYeaC4s9zP.exe, 00000000.00000002.4457353364.00000232B0A2D000.00000004.00000020.00020000.00000000.sdmp, vYeaC4s9zP.exe, 00000000.00000003.3401375137.00000232B0A5C000.00000004.00000020.00020000.00000000.sdmp, vYeaC4s9zP.exe, 00000000.00000003.2993766265.00000232B0A62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0 minProgram Manager
Source: vYeaC4s9zP.exe, 00000000.00000002.4457353364.00000232B0A3B000.00000004.00000020.00020000.00000000.sdmp, vYeaC4s9zP.exe, 00000000.00000002.4457721462.00000232B3750000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Code function: 0_2_00007FF6B29CC8C0 cpuid

0_2_00007FF6B29CC8C0

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: gethostname,gethostbyname,inet_ntoa,inet_ntoa,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,LoadLibraryW,GetProcAddress,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,FreeLibrary,GetSystemInfo,wsprintfW,GetDriveTypeW,GetDiskFreeSpaceExW,GlobalMemoryStatusEx,GetForegroundWindow,GetWindowTextW,lstrlenW,GetLocalTime,wsprintfW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,lstrcpyW,CloseHandle,CoInitializeEx,CoCreateInstance,SysFreeString,CoUninitialize,RegOpenKeyExW,RegQueryInfoKeyW,RegEnumKeyExW,lstrlenW,lstrlenW,RegCloseKey,lstrlenW,GetTickCount,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,lstrcpyW,lstrcatW,lstrlenW,GetLocalTime,wsprintfW,RegOpenKeyExW,RegDeleteValueW,RegCloseKey,RegCreateKeyW,lstrlenW,RegSetValueExW,RegCloseKey,RegCloseKey,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,	0_2_00007FF6B29962F0
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF6B29C7BA0
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: GetLocaleInfoW,	0_2_00007FF6B29C0D10
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: EnumSystemLocalesW,	0_2_00007FF6B29C7B08
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: EnumSystemLocalesW,	0_2_00007FF6B29C7A38
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: GetLocaleInfoW,	0_2_00007FF6B29C7FF0
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF6B29C7F40
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF6B29C8124
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: EnumSystemLocalesW,	0_2_00007FF6B29C0838
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: GetLocaleInfoW,	0_2_00007FF6B29C7DE8
Source: C:\Users\user\Desktop\vYeaC4s9zP.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF6B29C76DC

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

0_2_00007FF6B29AB500

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

Code function: 0_2_00007FF6B29C1DA8 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF6B29C1DA8

Source: C:\Users\user\Desktop\vYeaC4s9zP.exe

0_2_00007FF6B299FD10

Source: vYeaC4s9zP.exe, 00000000.00000000.2002290232.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmp, vYeaC4s9zP.exe, 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: KSafeTray.exe

Stealing of Sensitive Information

Yara detected GhostRat

Source: Yara match	File source: vYeaC4s9zP.exe, type: SAMPLE
Source: Yara match	File source: 0.0.vYeaC4s9zP.exe.7ff6b2990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vYeaC4s9zP.exe.7ff6b2990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: vYeaC4s9zP.exe PID: 1216, type: MEMORYSTR

Remote Access Functionality

Yara detected GhostRat

Source: Yara match	File source: vYeaC4s9zP.exe, type: SAMPLE
Source: Yara match	File source: 0.0.vYeaC4s9zP.exe.7ff6b2990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vYeaC4s9zP.exe.7ff6b2990000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: vYeaC4s9zP.exe PID: 1216, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	12 Native API	1 Windows Service	1 Access Token Manipulation	1 Modify Registry	121 Input Capture	2 System Time Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Windows Service	1 Virtualization/Sandbox Evasion	LSASS Memory	151 Security Software Discovery	Remote Desktop Protocol	121 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	211 Process Injection	1 Access Token Manipulation	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Archive Collected Data	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	211 Process Injection	NTDS	3 Process Discovery	Distributed Component Object Model	3 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 Peripheral Device Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	26 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
vYeaC4s9zP.exe	53%	ReversingLabs	Win64.Trojan.SpywareX

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
27.124.4.60	unknown	Singapore		64050	BCPL-SGBGPNETGlobalASNSG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583860
Start date and time:	2025-01-03 18:46:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	vYeaC4s9zP.exe renamed because original name is a hash value
Original Sample Name:	26cb6c247cdfb5215bc60ac7abd12322.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 43 Number of non-executed functions: 118
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 13.107.246.45, 4.245.163.56
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
VT rate limit hit for: vYeaC4s9zP.exe

Simulations

Behavior and APIs

Time	Type	Description
12:47:29	API Interceptor	6249292x Sleep call for process: vYeaC4s9zP.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BCPL-SGBGPNETGlobalASNSG	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	134.122.133.80
	BrSgiTp1iH.exe	Get hash	malicious	GhostRat	Browse	134.122.135.95
	http://smbc.usobd.com	Get hash	malicious	Unknown	Browse	134.122.128.92
	zhuzhu.exe	Get hash	malicious	GhostRat, XRed	Browse	118.107.44.219
	017069451a4dbc523a1165a2f1bd361a762bb40856778.exe	Get hash	malicious	Unknown	Browse	27.124.34.140
	Lets-x64.exe	Get hash	malicious	Nitol, Zegost	Browse	202.79.169.178
	KL-3.1.16.exe	Get hash	malicious	Nitol, Zegost	Browse	143.92.60.116
	Whyet-4.9.exe	Get hash	malicious	Nitol, Zegost	Browse	118.107.45.13
	QQyisSetups64.exe	Get hash	malicious	GhostRat	Browse	118.107.44.219
	wyySetups64.exe	Get hash	malicious	GhostRat	Browse	118.107.44.219

Process:	C:\Users\user\Desktop\vYeaC4s9zP.exe
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	2.6616157143988106
Encrypted:	false
SSDEEP:	3:tblM6lEjln:tbhEZn
MD5:	AE50B29A0B8DCC411F24F1863B0EAFDE
SHA1:	D415A55627B1ADED8E4B2CBBA402F816B0461155
SHA-256:	6B4BBBCE480FBC50D39A8EC4B72CDB7D781B151921E063DD899FD9B736ADCF68
SHA-512:	D9A9BA42D99BE32D26667060BE1D523DCD20EAFA187A67F7919002CC6DA349FD058053C9C6F721D6FDB730EA02FBAA3013E51C0C653368BD6B3F57A4C0FCABA8
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.060229389313906
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	vYeaC4s9zP.exe
File size:	389'632 bytes
MD5:	26cb6c247cdfb5215bc60ac7abd12322
SHA1:	d1ca8142469039a57cb43d3bebe369d0a00aa08b
SHA256:	da7c7cbc0d451b55c5a9312532b3e07d52e25399cb10e96cb2479a10407d4600
SHA512:	188e695ca51398726ead3b322f9069c0984779fbd58dbbddaf5bf50175eb09231c0ecb32b90625e1dd4deb805c34cff779add38e5c184450b2909f5508fcb649
SSDEEP:	6144:gKtL0RSVgMoEao8ItdKwzBFdYmT+xmyiRLBVgLhkM:ltwSqEao8It4wlDCxmPkx
TLSH:	B2848E49F79405F8E5678138C9634916EBB27C6D03A09BDF33A4866A2F237D0AD3E711
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........A...A...A.......D...............@.......@...Q(..K...Q(..S...Q(..........U.......X...A...m....)..S....)..@...RichA..........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14001e13c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x677168C7 [Sun Dec 29 15:20:39 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d7444b6dc7c8cddb50fba5269ad57bce

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F94BD06CB60h
dec eax
add esp, 28h
jmp 00007F94BD06C3B7h
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F94BD06C552h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F94BD06C555h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F94BD06C54Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007F94BD06C55Ah
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
cmp ecx, dword ptr [00036E59h]
jne 00007F94BD06C552h
dec eax
rol ecx, 10h
test cx, FFFFh
jne 00007F94BD06C543h
ret
dec eax
ror ecx, 10h
jmp 00007F94BD06CC5Bh
int3
int3
dec eax
mov dword ptr [esp+00h], ebx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x523b0	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x60000	0x3420	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x64000	0xc80	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4c7b0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4c980	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4c670	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3f000	0x918	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3dbf0	0x3dc00	d3f6189e43bbd290b28f7518c02b76a1	False	0.5461593813259109	data	6.462564110280856	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3f000	0x1519e	0x15200	13c0b12c937ab96a5d21e4441a19f16c	False	0.4149986131656805	data	4.932093126288018	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x55000	0xaa6c	0x7c00	38d4eff7b357db402101654f0fe35b27	False	0.10600428427419355	DOS executable (block device driver \377\3)	1.5549509551669303	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x60000	0x3420	0x3600	20b7b9769859dd90801ea597a1d992be	False	0.4626736111111111	data	5.517914471579984	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x64000	0xc80	0xe00	316f5780e4a2c74c1946985bacab1ae4	False	0.4916294642857143	data	5.228910762857474	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	QueryDosDeviceW, WriteProcessMemory, GetCommandLineW, GetCurrentProcess, WriteFile, OutputDebugStringA, GetModuleFileNameW, GetProcessId, CreateMutexW, GetLocaleInfoW, LocalAlloc, CreateFileW, GetVersionExW, K32GetProcessImageFileNameW, GetSystemDirectoryW, ResumeThread, GetModuleHandleA, OpenProcess, GetVersion, GetLogicalDriveStringsW, CreateToolhelp32Snapshot, MultiByteToWideChar, Process32NextW, GetDiskFreeSpaceExW, GetSystemDirectoryA, LoadLibraryA, lstrcatW, GlobalAlloc, Process32FirstW, GlobalFree, GetSystemInfo, LoadLibraryW, GetLocalTime, VirtualProtectEx, GetThreadContext, GetProcAddress, VirtualAllocEx, LocalFree, ExitProcess, GetCurrentProcessId, GlobalMemoryStatusEx, CreateProcessW, GetModuleHandleW, FreeLibrary, GetConsoleWindow, lstrcpyW, CreateRemoteThread, CreateProcessA, SetThreadContext, GetModuleFileNameA, GetTickCount, lstrcmpW, GetDriveTypeW, GetExitCodeProcess, SetFilePointer, ReleaseMutex, GlobalSize, DeleteFileW, GlobalLock, GetFileSize, GlobalUnlock, FindFirstFileW, ExpandEnvironmentStringsW, FindClose, GetFileAttributesW, TerminateThread, VirtualProtect, IsBadReadPtr, CreateThread, IsDebuggerPresent, SetUnhandledExceptionFilter, WriteConsoleW, GetCurrentThreadId, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, SetFilePointerEx, SetStdHandle, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, GetTimeZoneInformation, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, LCMapStringW, CompareStringW, FlsFree, FlsSetValue, GetStartupInfoW, CreateWaitableTimerW, SetWaitableTimer, TryEnterCriticalSection, WideCharToMultiByte, ResetEvent, CreateEventW, lstrlenW, CancelIo, GetNativeSystemInfo, SetLastError, lstrcmpiW, CreateEventA, CloseHandle, SetEvent, Sleep, HeapFree, WaitForSingleObject, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, EnterCriticalSection, HeapCreate, GetProcessHeap, DeleteCriticalSection, HeapDestroy, DecodePointer, HeapAlloc, HeapReAlloc, GetLastError, HeapSize, InitializeCriticalSectionEx, VirtualAlloc, VirtualFree, FlsGetValue, FlsAlloc, GetFileType, GetCommandLineA, GetStdHandle, VirtualQuery, GetModuleHandleExW, FreeLibraryAndExitThread, ExitThread, LoadLibraryExW, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, RtlPcToFileHeader, RtlUnwindEx, lstrcpyA, CreateFileA, GetSystemDefaultLangID, DeviceIoControl, TerminateProcess, InitializeSListHead, GetSystemTimeAsFileTime, QueryPerformanceCounter, IsProcessorFeaturePresent, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, SleepConditionVariableSRW, WakeAllConditionVariable, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, GetCPInfo, LCMapStringEx, EncodePointer, CompareStringEx, GetStringTypeW, RaiseException, OutputDebugStringW, SwitchToThread
USER32.dll	MsgWaitForMultipleObjects, GetWindowTextW, wsprintfW, GetForegroundWindow, GetLastInputInfo, GetClipboardData, CloseClipboard, OpenClipboard, GetKeyState, ReleaseDC, GetDesktopWindow, SetClipboardData, ExitWindowsEx, EmptyClipboard, GetSystemMetrics, GetDC, GetInputState, PostThreadMessageA, TranslateMessage, DispatchMessageW, PeekMessageW, ShowWindow
GDI32.dll	CreateCompatibleBitmap, SelectObject, CreateDIBSection, SetDIBColorTable, CreateCompatibleDC, StretchBlt, GetDIBits, GetDeviceCaps, GetObjectW, SetStretchBltMode, DeleteObject, DeleteDC
ADVAPI32.dll	OpenProcessToken, RegQueryValueExW, AllocateAndInitializeSid, FreeSid, CheckTokenMembership, ClearEventLogW, CloseEventLog, OpenEventLogW, LookupPrivilegeValueW, AdjustTokenPrivileges, GetCurrentHwProfileW, RegCloseKey, RegQueryInfoKeyW, GetSidSubAuthorityCount, GetSidSubAuthority, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCreateKeyW, RegDeleteValueW, LookupAccountSidW, GetTokenInformation
SHELL32.dll	SHGetFolderPathW
ole32.dll	CreateStreamOnHGlobal, GetHGlobalFromStream, CoInitialize, CoUninitialize, CoCreateInstance
OLEAUT32.dll	SysFreeString
WS2_32.dll	WSASetLastError, WSAEventSelect, WSAResetEvent, WSAWaitForMultipleEvents, WSAEnumNetworkEvents, WSAGetLastError, WSACleanup, WSAIoctl, closesocket, WSACreateEvent, select, WSAStartup, send, socket, connect, recv, htons, setsockopt, inet_ntoa, WSACloseEvent, gethostbyname, gethostname, shutdown
WINMM.dll	timeGetTime
gdiplus.dll	GdipCreateBitmapFromStream, GdipBitmapUnlockBits, GdipCloneImage, GdipAlloc, GdiplusShutdown, GdipDrawImageI, GdipCreateBitmapFromScan0, GdipCreateBitmapFromHBITMAP, GdipGetImageWidth, GdipGetImagePalette, GdipDeleteGraphics, GdipGetImageEncodersSize, GdipGetImageGraphicsContext, GdipFree, GdipGetImagePixelFormat, GdipDisposeImage, GdipSaveImageToStream, GdipBitmapLockBits, GdipGetImagePaletteSize, GdiplusStartup, GdipGetImageHeight, GdipGetImageEncoders
dxgi.dll	CreateDXGIFactory
DINPUT8.dll	DirectInput8Create

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-03T18:47:02.929641+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.5	49704	27.124.4.60	4433	TCP
2025-01-03T18:48:08.634869+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.5	49704	27.124.4.60	4433	TCP
2025-01-03T18:49:15.394711+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.5	49979	27.124.4.60	10443	TCP
2025-01-03T18:50:19.461038+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.5	49982	27.124.4.60	4433	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 18:47:01.539664030 CET	49704	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:47:01.544502974 CET	4433	49704	27.124.4.60	192.168.2.5
Jan 3, 2025 18:47:01.544594049 CET	49704	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:47:02.318195105 CET	49704	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:47:02.323122025 CET	4433	49704	27.124.4.60	192.168.2.5
Jan 3, 2025 18:47:02.323139906 CET	4433	49704	27.124.4.60	192.168.2.5
Jan 3, 2025 18:47:02.323151112 CET	4433	49704	27.124.4.60	192.168.2.5
Jan 3, 2025 18:47:02.323277950 CET	4433	49704	27.124.4.60	192.168.2.5
Jan 3, 2025 18:47:02.832179070 CET	4433	49704	27.124.4.60	192.168.2.5
Jan 3, 2025 18:47:02.884821892 CET	49704	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:47:02.924619913 CET	49704	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:47:02.929469109 CET	4433	49704	27.124.4.60	192.168.2.5
Jan 3, 2025 18:47:02.929480076 CET	4433	49704	27.124.4.60	192.168.2.5
Jan 3, 2025 18:47:02.929488897 CET	4433	49704	27.124.4.60	192.168.2.5
Jan 3, 2025 18:47:02.929569960 CET	4433	49704	27.124.4.60	192.168.2.5
Jan 3, 2025 18:47:02.929641008 CET	49704	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:47:02.934348106 CET	4433	49704	27.124.4.60	192.168.2.5
Jan 3, 2025 18:47:18.541146040 CET	49704	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:47:18.545909882 CET	4433	49704	27.124.4.60	192.168.2.5
Jan 3, 2025 18:47:18.841541052 CET	4433	49704	27.124.4.60	192.168.2.5
Jan 3, 2025 18:47:18.884809971 CET	49704	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:47:35.744191885 CET	49704	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:47:35.749047995 CET	4433	49704	27.124.4.60	192.168.2.5
Jan 3, 2025 18:47:36.044631004 CET	4433	49704	27.124.4.60	192.168.2.5
Jan 3, 2025 18:47:36.088000059 CET	49704	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:47:52.135030985 CET	49704	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:47:52.139791012 CET	4433	49704	27.124.4.60	192.168.2.5
Jan 3, 2025 18:47:52.584821939 CET	4433	49704	27.124.4.60	192.168.2.5
Jan 3, 2025 18:47:52.634732008 CET	49704	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:08.634869099 CET	49704	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:08.634964943 CET	49704	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:08.639667034 CET	4433	49704	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:08.639723063 CET	49704	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:13.589364052 CET	49977	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:13.594346046 CET	10443	49977	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:13.594434023 CET	49977	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:14.445863008 CET	49977	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:14.450746059 CET	10443	49977	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:14.450762987 CET	10443	49977	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:14.450771093 CET	10443	49977	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:14.450844049 CET	10443	49977	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:15.024406910 CET	10443	49977	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:15.141279936 CET	49977	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:15.146148920 CET	10443	49977	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:15.146173954 CET	10443	49977	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:15.146184921 CET	10443	49977	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:15.146217108 CET	49977	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:15.146363974 CET	10443	49977	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:15.151034117 CET	10443	49977	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:29.541017056 CET	49977	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:29.541117907 CET	49977	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:29.545862913 CET	10443	49977	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:29.545917988 CET	49977	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:34.503190994 CET	49978	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:34.508099079 CET	4433	49978	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:34.508199930 CET	49978	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:35.338960886 CET	49978	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:35.343863010 CET	4433	49978	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:35.343880892 CET	4433	49978	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:35.343939066 CET	4433	49978	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:35.344003916 CET	4433	49978	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:35.696419954 CET	4433	49978	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:35.744044065 CET	49978	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:35.798353910 CET	49978	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:35.803508043 CET	4433	49978	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:35.803527117 CET	4433	49978	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:35.803539038 CET	4433	49978	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:35.803553104 CET	4433	49978	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:35.803558111 CET	49978	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:35.808348894 CET	4433	49978	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:51.651451111 CET	49978	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:48:51.656332016 CET	4433	49978	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:51.959949017 CET	4433	49978	27.124.4.60	192.168.2.5
Jan 3, 2025 18:48:52.009646893 CET	49978	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:08.244127035 CET	49978	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:08.244180918 CET	49978	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:08.250267982 CET	4433	49978	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:08.250327110 CET	49978	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:13.197494030 CET	49979	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:13.202337027 CET	10443	49979	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:13.202416897 CET	49979	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:14.749775887 CET	49979	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:14.754604101 CET	10443	49979	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:14.754693985 CET	10443	49979	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:14.754703045 CET	10443	49979	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:14.754762888 CET	10443	49979	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:15.309130907 CET	10443	49979	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:15.353349924 CET	49979	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:15.389827967 CET	49979	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:15.394653082 CET	10443	49979	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:15.394663095 CET	10443	49979	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:15.394670010 CET	10443	49979	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:15.394711018 CET	49979	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:15.394778967 CET	10443	49979	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:15.399530888 CET	10443	49979	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:29.556636095 CET	49979	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:29.556749105 CET	49979	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:29.562632084 CET	10443	49979	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:29.562691927 CET	49979	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:34.510080099 CET	49980	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:34.514926910 CET	4433	49980	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:34.515021086 CET	49980	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:35.289638042 CET	49980	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:35.294584990 CET	4433	49980	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:35.294595957 CET	4433	49980	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:35.294651031 CET	4433	49980	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:35.294658899 CET	4433	49980	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:35.645710945 CET	4433	49980	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:35.697072029 CET	49980	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:35.754518986 CET	49980	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:35.759339094 CET	4433	49980	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:35.759349108 CET	4433	49980	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:35.759356022 CET	4433	49980	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:35.759394884 CET	49980	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:35.759496927 CET	4433	49980	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:35.764121056 CET	4433	49980	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:51.165927887 CET	49980	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:51.165990114 CET	49980	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:51.170815945 CET	4433	49980	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:51.170876980 CET	49980	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:56.119447947 CET	49981	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:56.124392986 CET	10443	49981	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:56.127475023 CET	49981	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:56.988761902 CET	49981	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:57.171279907 CET	10443	49981	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:57.171341896 CET	10443	49981	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:57.171353102 CET	10443	49981	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:57.171361923 CET	10443	49981	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:57.580425978 CET	10443	49981	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:57.679378986 CET	49981	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:57.684276104 CET	10443	49981	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:57.684319019 CET	49981	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:49:57.684355021 CET	10443	49981	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:57.684401035 CET	10443	49981	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:57.684411049 CET	10443	49981	27.124.4.60	192.168.2.5
Jan 3, 2025 18:49:57.689100027 CET	10443	49981	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:12.556510925 CET	49981	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:12.556545019 CET	49981	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:12.561317921 CET	10443	49981	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:12.561408043 CET	49981	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:17.510011911 CET	49982	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:17.514879942 CET	4433	49982	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:17.515064001 CET	49982	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:18.994870901 CET	49982	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:19.000178099 CET	4433	49982	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:19.000191927 CET	4433	49982	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:19.000252008 CET	4433	49982	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:19.000262022 CET	4433	49982	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:19.346244097 CET	4433	49982	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:19.400150061 CET	49982	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:19.456024885 CET	49982	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:19.460963011 CET	4433	49982	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:19.460987091 CET	4433	49982	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:19.460995913 CET	4433	49982	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:19.461004972 CET	4433	49982	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:19.461038113 CET	49982	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:19.465773106 CET	4433	49982	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:34.790818930 CET	49982	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:34.790875912 CET	49982	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:34.795619011 CET	4433	49982	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:34.797878981 CET	49982	4433	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:39.744297028 CET	49983	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:39.749154091 CET	10443	49983	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:39.750062943 CET	49983	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:40.617860079 CET	49983	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:40.622762918 CET	10443	49983	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:40.622776031 CET	10443	49983	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:40.622783899 CET	10443	49983	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:40.622916937 CET	10443	49983	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:41.187941074 CET	10443	49983	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:41.243880033 CET	49983	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:41.442517042 CET	49983	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:41.447504044 CET	10443	49983	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:41.447518110 CET	10443	49983	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:41.447525978 CET	10443	49983	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:41.447534084 CET	10443	49983	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:41.447587013 CET	49983	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:41.452334881 CET	10443	49983	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:55.853358030 CET	49983	10443	192.168.2.5	27.124.4.60
Jan 3, 2025 18:50:55.858172894 CET	10443	49983	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:56.155967951 CET	10443	49983	27.124.4.60	192.168.2.5
Jan 3, 2025 18:50:56.243864059 CET	49983	10443	192.168.2.5	27.124.4.60

Target ID:	0
Start time:	12:46:53
Start date:	03/01/2025
Path:	C:\Users\user\Desktop\vYeaC4s9zP.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\vYeaC4s9zP.exe"
Imagebase:	0x7ff6b2990000
File size:	389'632 bytes
MD5 hash:	26CB6C247CDFB5215BC60AC7ABD12322
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	38%
Total number of Nodes:	1041
Total number of Limit Nodes:	42

Executed Functions

Function 00007FF6B29962F0 Relevance: 193.3, APIs: 81, Strings: 29, Instructions: 845
registrystringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

gethostname.WS2_32 ref: 00007FF6B2996394
gethostbyname.WS2_32 ref: 00007FF6B299639E
inet_ntoa.WS2_32 ref: 00007FF6B29963BB
inet_ntoa.WS2_32 ref: 00007FF6B299640B
MultiByteToWideChar.KERNEL32 ref: 00007FF6B2996469
MultiByteToWideChar.KERNEL32 ref: 00007FF6B299648D
GetLastInputInfo.USER32 ref: 00007FF6B29964A5
GetTickCount.KERNEL32 ref: 00007FF6B29964AB
wsprintfW.USER32 ref: 00007FF6B29964DE
MultiByteToWideChar.KERNEL32 ref: 00007FF6B299651F
LoadLibraryW.KERNEL32 ref: 00007FF6B299652C
GetProcAddress.KERNEL32 ref: 00007FF6B2996548
RegOpenKeyExW.KERNEL32 ref: 00007FF6B29965ED
RegQueryValueExW.KERNEL32 ref: 00007FF6B2996618
RegCloseKey.KERNEL32 ref: 00007FF6B2996645
FreeLibrary.KERNEL32 ref: 00007FF6B2996656
GetSystemInfo.KERNEL32 ref: 00007FF6B299666F
wsprintfW.USER32 ref: 00007FF6B2996687
GetDriveTypeW.KERNEL32 ref: 00007FF6B29966B6
GetDiskFreeSpaceExW.KERNEL32 ref: 00007FF6B29966D9
GlobalMemoryStatusEx.KERNEL32 ref: 00007FF6B299671D
GetForegroundWindow.USER32 ref: 00007FF6B2996799
GetWindowTextW.USER32 ref: 00007FF6B29967B4
lstrlenW.KERNEL32 ref: 00007FF6B29967C4
GetLocalTime.KERNEL32 ref: 00007FF6B2996803
wsprintfW.USER32 ref: 00007FF6B299681D
MultiByteToWideChar.KERNEL32 ref: 00007FF6B29964FB

Part of subcall function 00007FF6B29B87A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29B87C6

lstrlenW.KERNEL32 ref: 00007FF6B2996845
GetModuleHandleW.KERNEL32 ref: 00007FF6B299688E
GetProcAddress.KERNEL32 ref: 00007FF6B299689E
GetNativeSystemInfo.KERNEL32 ref: 00007FF6B29968AD
GetSystemInfo.KERNEL32 ref: 00007FF6B29968B1
wsprintfW.USER32 ref: 00007FF6B29968F8
GetCurrentProcessId.KERNEL32 ref: 00007FF6B299690D
OpenProcess.KERNEL32 ref: 00007FF6B299692B
K32GetProcessImageFileNameW.KERNEL32 ref: 00007FF6B299694D
GetLogicalDriveStringsW.KERNEL32 ref: 00007FF6B2996967
lstrcmpiW.KERNEL32 ref: 00007FF6B29969A8
lstrcmpiW.KERNEL32 ref: 00007FF6B29969BC
QueryDosDeviceW.KERNEL32 ref: 00007FF6B29969F6

Part of subcall function 00007FF6B29ADE98: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B29ADEC8
Part of subcall function 00007FF6B29ADE98: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B29ADECE

Part of subcall function 00007FF6B29991A0: GetModuleHandleW.KERNEL32 ref: 00007FF6B29991BD
Part of subcall function 00007FF6B29991A0: GetProcAddress.KERNEL32 ref: 00007FF6B29991CD
Part of subcall function 00007FF6B29991A0: GetNativeSystemInfo.KERNEL32 ref: 00007FF6B29991DD

lstrlenW.KERNEL32 ref: 00007FF6B2996A07
lstrcpyW.KERNEL32 ref: 00007FF6B2996A48
CloseHandle.KERNEL32 ref: 00007FF6B2996A51
CoInitializeEx.COMBASE ref: 00007FF6B2996A62
CoCreateInstance.COMBASE ref: 00007FF6B2996A87
SysFreeString.OLEAUT32 ref: 00007FF6B2996B3C
CoUninitialize.OLE32 ref: 00007FF6B2996B7E
RegOpenKeyExW.KERNEL32 ref: 00007FF6B2996BE7
RegQueryInfoKeyW.ADVAPI32 ref: 00007FF6B2996C47
RegEnumKeyExW.ADVAPI32 ref: 00007FF6B2996CDF
lstrlenW.KERNEL32 ref: 00007FF6B2996CEC
lstrlenW.KERNEL32 ref: 00007FF6B2996CFE
RegCloseKey.ADVAPI32 ref: 00007FF6B2996D4C
lstrlenW.KERNEL32 ref: 00007FF6B2996D59

Part of subcall function 00007FF6B29B9248: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29B927B

Part of subcall function 00007FF6B29979E0: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6B2997A6B
Part of subcall function 00007FF6B29979E0: Process32FirstW.KERNEL32 ref: 00007FF6B2997A88
Part of subcall function 00007FF6B29979E0: Process32NextW.KERNEL32 ref: 00007FF6B2997AC3
Part of subcall function 00007FF6B29979E0: CloseHandle.KERNEL32 ref: 00007FF6B2997AD0
Part of subcall function 00007FF6B29979E0: CoCreateInstance.COMBASE ref: 00007FF6B2997B1F

GetTickCount.KERNEL32 ref: 00007FF6B2996DA1

Part of subcall function 00007FF6B29B8B9C: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6B29B8BB0

wsprintfW.USER32 ref: 00007FF6B2996E19
GetLocaleInfoW.KERNEL32 ref: 00007FF6B2996E36
GetSystemDirectoryW.KERNEL32 ref: 00007FF6B2996E48
GetCurrentHwProfileW.ADVAPI32 ref: 00007FF6B2996E5C
lstrlenW.KERNEL32 ref: 00007FF6B2996EDB
GetLocalTime.KERNEL32 ref: 00007FF6B2996F17
wsprintfW.USER32 ref: 00007FF6B2996F31
RegOpenKeyExW.KERNEL32 ref: 00007FF6B2996F56
RegDeleteValueW.KERNEL32 ref: 00007FF6B2996F6A
RegCloseKey.ADVAPI32 ref: 00007FF6B2996F77
RegCreateKeyW.ADVAPI32 ref: 00007FF6B2996F8E
lstrlenW.KERNEL32 ref: 00007FF6B2996F9B
RegSetValueExW.KERNEL32 ref: 00007FF6B2996FC3
RegCloseKey.ADVAPI32 ref: 00007FF6B2996FD4
RegCloseKey.ADVAPI32 ref: 00007FF6B2996FE1
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6B2996FEE
Process32FirstW.KERNEL32 ref: 00007FF6B2997029
Process32NextW.KERNEL32 ref: 00007FF6B299707E
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6B2997098
Process32FirstW.KERNEL32 ref: 00007FF6B29970D3
Process32NextW.KERNEL32 ref: 00007FF6B299712E
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6B2997148
Process32FirstW.KERNEL32 ref: 00007FF6B2997183
Process32NextW.KERNEL32 ref: 00007FF6B29971DA

Strings

VenREMARK, xrefs: 00007FF6B299684B
%d min, xrefs: 00007FF6B29964D7
WxWork.exe, xrefs: 00007FF6B2997033
%sFree%d Gb , xrefs: 00007FF6B299676E
ProductName, xrefs: 00007FF6B29965FF
INSTALLTIME, xrefs: 00007FF6B2996EF7, 00007FF6B2996F63, 00007FF6B2996FA8
Telegram.exe, xrefs: 00007FF6B299718D
B:\, xrefs: 00007FF6B29969B2
RtlGetNtVersionNumbers, xrefs: 00007FF6B299653E
VenGROUP, xrefs: 00007FF6B29967EB
Software\Tencent\Plugin\VAS, xrefs: 00007FF6B2996BD9
WeChat.exe, xrefs: 00007FF6B29970DD
FriendlyName, xrefs: 00007FF6B2996B22
X64 %s, xrefs: 00007FF6B29968EA
994fb371-6ab9-47a0-b675-d4b4b918e869, xrefs: 00007FF6B2996352
x64, xrefs: 00007FF6B29968D8
Software, xrefs: 00007FF6B29967D1
ntdll.dll, xrefs: 00007FF6B2996525
%d.%d.%d, xrefs: 00007FF6B299657D
kernel32.dll, xrefs: 00007FF6B299687B
VenNetwork, xrefs: 00007FF6B29967E0
HDD:%d, xrefs: 00007FF6B2996727
AppEvents, xrefs: 00007FF6B2996EE1
A:\, xrefs: 00007FF6B299699A
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF6B29965C5
GetNativeSystemInfo, xrefs: 00007FF6B2996897
x86, xrefs: 00007FF6B29968DF
%d.%d, xrefs: 00007FF6B299680E, 00007FF6B2996F22
Network, xrefs: 00007FF6B2996EF0

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Process32lstrlen$CloseCreateInfo$Systemwsprintf$ByteCharFirstHandleMultiNextOpenSnapshotTimeToolhelp32Wide$AddressFreeProcProcessQueryValue$Concurrency::cancel_current_taskCountCurrentDriveFileInstanceLibraryLocalModuleNativeTickWindow_invalid_parameter_noinfoinet_ntoalstrcmpi$DeleteDeviceDirectoryDiskEnumForegroundGlobalImageInitializeInputLastLoadLocaleLogicalMemoryNameProfileSpaceStatusStringStringsTextTypeUninitializegethostbynamegethostnamelstrcpy
String ID: %d min$%d.%d$%d.%d.%d$%sFree%d Gb $994fb371-6ab9-47a0-b675-d4b4b918e869$A:\$AppEvents$B:\$FriendlyName$GetNativeSystemInfo$HDD:%d$INSTALLTIME$Network$ProductName$RtlGetNtVersionNumbers$SOFTWARE\Microsoft\Windows NT\CurrentVersion$Software$Software\Tencent\Plugin\VAS$Telegram.exe$VenGROUP$VenNetwork$VenREMARK$WeChat.exe$WxWork.exe$X64 %s$kernel32.dll$ntdll.dll$x64$x86
API String ID: 4136965836-2306317373
Opcode ID: eb17342b3a26759b7952b70cf8a243a6c9ae32ccd61cc7147b7bad50c9a7a965
Instruction ID: 25117bd899134f8e2380687bb850796c51e8052958faf7008e1d5e4246d7f8f1
Opcode Fuzzy Hash: eb17342b3a26759b7952b70cf8a243a6c9ae32ccd61cc7147b7bad50c9a7a965
Instruction Fuzzy Hash: B0924432A04A8386EB25EF2AD8446E933A0FB48B5CF844136DB4D877AADF7CD555C700

Function 00007FF6B29AB500 Relevance: 103.7, APIs: 41, Strings: 18, Instructions: 406
registrylibrarysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00007FF6B29AB531
CloseHandle.KERNEL32 ref: 00007FF6B29AB56D
GetCurrentProcess.KERNEL32 ref: 00007FF6B29AB580
OpenProcessToken.ADVAPI32 ref: 00007FF6B29AB595
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6B29AB5B5
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6B29AB5E1
CloseHandle.KERNEL32 ref: 00007FF6B29AB5EE
GetModuleHandleA.KERNEL32 ref: 00007FF6B29AB5FB
GetProcAddress.KERNEL32 ref: 00007FF6B29AB60B
GetCurrentProcessId.KERNEL32 ref: 00007FF6B29AB623
OpenProcess.KERNEL32 ref: 00007FF6B29AB632
GetLocalTime.KERNEL32 ref: 00007FF6B29AB654
wsprintfW.USER32 ref: 00007FF6B29AB69A
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6B29AB6A7
CloseHandle.KERNEL32 ref: 00007FF6B29AB6CD
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF6B29AB751
CheckTokenMembership.KERNELBASE ref: 00007FF6B29AB76B

Part of subcall function 00007FF6B29B8940: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29B896B

FreeSid.ADVAPI32 ref: 00007FF6B29AB783
RegOpenKeyExW.KERNEL32 ref: 00007FF6B29AB7B5
RegDeleteValueW.KERNEL32 ref: 00007FF6B29AB7C9
RegSetValueExW.KERNEL32 ref: 00007FF6B29AB7FA
RegCloseKey.ADVAPI32 ref: 00007FF6B29AB807
SleepEx.KERNEL32 ref: 00007FF6B29AB923
CreateEventA.KERNEL32 ref: 00007FF6B29AB99F

Part of subcall function 00007FF6B29B87A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29B87C6

Part of subcall function 00007FF6B29962F0: gethostname.WS2_32 ref: 00007FF6B2996394
Part of subcall function 00007FF6B29962F0: gethostbyname.WS2_32 ref: 00007FF6B299639E
Part of subcall function 00007FF6B29962F0: inet_ntoa.WS2_32 ref: 00007FF6B29963BB
Part of subcall function 00007FF6B29962F0: inet_ntoa.WS2_32 ref: 00007FF6B299640B
Part of subcall function 00007FF6B29962F0: MultiByteToWideChar.KERNEL32 ref: 00007FF6B2996469
Part of subcall function 00007FF6B29962F0: MultiByteToWideChar.KERNEL32 ref: 00007FF6B299648D

Sleep.KERNEL32 ref: 00007FF6B29ABA41
Sleep.KERNEL32 ref: 00007FF6B29ABA77
CloseHandle.KERNEL32 ref: 00007FF6B29ABADE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B29ABAE9
IsDebuggerPresent.KERNEL32 ref: 00007FF6B29ABAFC
LoadLibraryW.KERNEL32 ref: 00007FF6B29ABB28
GetProcAddress.KERNEL32 ref: 00007FF6B29ABB52
FreeLibrary.KERNEL32 ref: 00007FF6B29ABB63

Strings

VenkernalData_info, xrefs: 00007FF6B29AB7BB, 00007FF6B29AB7EC
MiniDumpWriteDump, xrefs: 00007FF6B29ABB40
SeDebugPrivilege, xrefs: 00007FF6B29AB5AC
NtDll.dll, xrefs: 00007FF6B29AB5F4
27.124.4.60, xrefs: 00007FF6B29AB8B6
NtSetInformationProcess, xrefs: 00007FF6B29AB604
DbgHelp.dll, xrefs: 00007FF6B29ABB19
%s-%04d%02d%02d-%02d%02d%02d.dmp, xrefs: 00007FF6B29ABBD2
27.124.4.60, xrefs: 00007FF6B29AB861
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 00007FF6B29AB68C
27.124.4.60, xrefs: 00007FF6B29AB825, 00007FF6B29AB8C2, 00007FF6B29AB942, 00007FF6B29AB9D1
10443, xrefs: 00007FF6B29AB86D
27.124.4.60, xrefs: 00007FF6B29AB835
!analyze -v, xrefs: 00007FF6B29ABBDE
4433, xrefs: 00007FF6B29AB841
10443, xrefs: 00007FF6B29AB84D, 00007FF6B29AB879, 00007FF6B29AB8DA, 00007FF6B29AB933, 00007FF6B29AB967
SOFTWARE, xrefs: 00007FF6B29AB7A7
loginconfig, xrefs: 00007FF6B29AB7D7

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CloseHandle$ProcessSleep$OpenTokenValue$AddressByteCharCurrentFreeLibraryMultiProcWide_invalid_parameter_noinfoinet_ntoa$AdjustAllocateCheckCreateDebuggerDeleteEventExceptionFilterInitializeLoadLocalLookupMembershipModulePresentPrivilegePrivilegesTimeUnhandled_invalid_parameter_noinfo_noreturngethostbynamegethostnamewsprintf
String ID: !analyze -v$%4d.%2d.%2d-%2d:%2d:%2d$%s-%04d%02d%02d-%02d%02d%02d.dmp$10443$10443$27.124.4.60$27.124.4.60$27.124.4.60$27.124.4.60$4433$DbgHelp.dll$MiniDumpWriteDump$NtDll.dll$NtSetInformationProcess$SOFTWARE$SeDebugPrivilege$VenkernalData_info$loginconfig
API String ID: 905065789-1622102136
Opcode ID: af5b0ca8d781796932839bb88e6d9c06d7e346fee9f2ebf3790dbac2dd1ba735
Instruction ID: 08a666b847607170b47f987bdc11332308cb38e12070f931f9ae05a010ab8395
Opcode Fuzzy Hash: af5b0ca8d781796932839bb88e6d9c06d7e346fee9f2ebf3790dbac2dd1ba735
Instruction Fuzzy Hash: 69223671A18B83C6E721EF2AE8542A973E5FB89B58F400136DB4D876A6DFBCD145C700

Function 00007FF6B299F410 Relevance: 81.0, APIs: 35, Strings: 11, Instructions: 532
registryprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastInputInfo.USER32 ref: 00007FF6B299F45C
GetTickCount.KERNEL32 ref: 00007FF6B299F462
wsprintfW.USER32 ref: 00007FF6B299F490
GetForegroundWindow.USER32 ref: 00007FF6B299F496
GetWindowTextW.USER32 ref: 00007FF6B299F4AE
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6B299F4C3
Process32FirstW.KERNEL32 ref: 00007FF6B299F4F7
Process32NextW.KERNEL32 ref: 00007FF6B299F54B
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6B299F565
Process32FirstW.KERNEL32 ref: 00007FF6B299F59F
Process32NextW.KERNEL32 ref: 00007FF6B299F5EE
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6B299F608
Process32FirstW.KERNEL32 ref: 00007FF6B299F642
Process32NextW.KERNEL32 ref: 00007FF6B299F69E
RegOpenKeyExW.ADVAPI32 ref: 00007FF6B299F6EC
RegQueryValueExW.KERNEL32 ref: 00007FF6B299F71F
RegQueryValueExW.KERNEL32 ref: 00007FF6B299F783
RegCloseKey.ADVAPI32 ref: 00007FF6B299F90D
RegOpenKeyExW.ADVAPI32 ref: 00007FF6B299F943
RegQueryValueExW.KERNEL32 ref: 00007FF6B299F976
RegQueryValueExW.ADVAPI32 ref: 00007FF6B299F9D5
RegCloseKey.ADVAPI32 ref: 00007FF6B299F9EC
RegOpenKeyExW.ADVAPI32 ref: 00007FF6B299FA22
RegQueryValueExW.KERNEL32 ref: 00007FF6B299FA55
RegCloseKey.ADVAPI32 ref: 00007FF6B299FACB

Part of subcall function 00007FF6B29ADE98: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B29ADEC8
Part of subcall function 00007FF6B29ADE98: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B29ADECE

RegQueryValueExW.ADVAPI32 ref: 00007FF6B299FAB4
SHGetFolderPathW.SHELL32 ref: 00007FF6B299FAEF
lstrcatW.KERNEL32 ref: 00007FF6B299FB03
CreateFileW.KERNEL32 ref: 00007FF6B299FB34
lstrlenW.KERNEL32 ref: 00007FF6B299FB44
WriteFile.KERNEL32 ref: 00007FF6B299FB61
CloseHandle.KERNEL32 ref: 00007FF6B299FB6A
FindFirstFileW.KERNEL32 ref: 00007FF6B299FB7E
FindClose.KERNEL32 ref: 00007FF6B299FB94
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B299FCFE

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF6B299F935, 00007FF6B299FA14
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, xrefs: 00007FF6B299F6B1
C:\ProgramData\Mylnk, xrefs: 00007FF6B299F896
%d min, xrefs: 00007FF6B299F489
WXWork.exe, xrefs: 00007FF6B299F501
\kernelquick.sys, xrefs: 00007FF6B299FAF5
WeChat.exe, xrefs: 00007FF6B299F5A9
C:\Users, xrefs: 00007FF6B299F812
OpenAi_Service, xrefs: 00007FF6B299F96F, 00007FF6B299F9CE, 00007FF6B299FA4E, 00007FF6B299FAAD
Telegram.exe, xrefs: 00007FF6B299F64C
Startup, xrefs: 00007FF6B299F718, 00007FF6B299F77C

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Process32QueryValue$Close$CreateFirst$FileNextOpenSnapshotToolhelp32$Concurrency::cancel_current_taskFindWindow$CountFolderForegroundHandleInfoInputLastPathTextTickWrite_invalid_parameter_noinfo_noreturnlstrcatlstrlenwsprintf
String ID: %d min$C:\ProgramData\Mylnk$C:\Users$OpenAi_Service$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$Startup$Telegram.exe$WXWork.exe$WeChat.exe$\kernelquick.sys
API String ID: 3029130142-1423135667
Opcode ID: 8912b3bcebc9d13c5a361c5252454f55fd1a4697a3ef6ccaad31400a9f1ab4cf
Instruction ID: 36b9f6ac71cb98b4e38f7aff7d771ed1439a3212ff6be6218290638b303a0605
Opcode Fuzzy Hash: 8912b3bcebc9d13c5a361c5252454f55fd1a4697a3ef6ccaad31400a9f1ab4cf
Instruction Fuzzy Hash: D432C322A0868385EB61EF6AD4046BD73E0FB55B98F404136DB4D8779ADFBCE554C700

Function 00007FF6B29AAD80 Relevance: 75.8, APIs: 27, Strings: 16, Instructions: 529stringregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32 ref: 00007FF6B29AADB5
RegQueryValueExW.KERNEL32 ref: 00007FF6B29AADE6
RegQueryValueExW.ADVAPI32 ref: 00007FF6B29AAE45
lstrlenW.KERNEL32 ref: 00007FF6B29AAE52
lstrlenW.KERNEL32 ref: 00007FF6B29AAE73
lstrlenW.KERNEL32 ref: 00007FF6B29AAE86
lstrlenW.KERNEL32 ref: 00007FF6B29AAF1F
lstrlenW.KERNEL32 ref: 00007FF6B29AAF40
lstrlenW.KERNEL32 ref: 00007FF6B29AAF53
lstrlenW.KERNEL32 ref: 00007FF6B29AAFEB
lstrlenW.KERNEL32 ref: 00007FF6B29AAFFE
lstrlenW.KERNEL32 ref: 00007FF6B29AB081
lstrlenW.KERNEL32 ref: 00007FF6B29AB0A2
lstrlenW.KERNEL32 ref: 00007FF6B29AB0B5
lstrlenW.KERNEL32 ref: 00007FF6B29AB14F
lstrlenW.KERNEL32 ref: 00007FF6B29AB170
lstrlenW.KERNEL32 ref: 00007FF6B29AB183
lstrlenW.KERNEL32 ref: 00007FF6B29AB21B
lstrlenW.KERNEL32 ref: 00007FF6B29AB22E
lstrlenW.KERNEL32 ref: 00007FF6B29AB2B1
lstrlenW.KERNEL32 ref: 00007FF6B29AB2D2
lstrlenW.KERNEL32 ref: 00007FF6B29AB2E5
lstrlenW.KERNEL32 ref: 00007FF6B29AB37F
lstrlenW.KERNEL32 ref: 00007FF6B29AB3A0
lstrlenW.KERNEL32 ref: 00007FF6B29AB3B3
lstrlenW.KERNEL32 ref: 00007FF6B29AB44B
lstrlenW.KERNEL32 ref: 00007FF6B29AB45E

Strings

t1:, xrefs: 00007FF6B29AAFF1
p1:, xrefs: 00007FF6B29AAE79
p2:, xrefs: 00007FF6B29AB0A8
Vendata, xrefs: 00007FF6B29AADDF, 00007FF6B29AAE3E
27.124.4.60, xrefs: 00007FF6B29AB2AA, 00007FF6B29AB2B9, 00007FF6B29AB369
o1:, xrefs: 00007FF6B29AAF46
o3:, xrefs: 00007FF6B29AB3A6
27.124.4.60, xrefs: 00007FF6B29AB07A, 00007FF6B29AB089, 00007FF6B29AB139
o2:, xrefs: 00007FF6B29AB176
10443, xrefs: 00007FF6B29AB148, 00007FF6B29AB157, 00007FF6B29AB209
p3:, xrefs: 00007FF6B29AB2D8
27.124.4.60, xrefs: 00007FF6B29AAE4B, 00007FF6B29AAE5A, 00007FF6B29AAF09
t3:, xrefs: 00007FF6B29AB451
t2:, xrefs: 00007FF6B29AB221
4433, xrefs: 00007FF6B29AAF18, 00007FF6B29AAF27, 00007FF6B29AAFD9
Console, xrefs: 00007FF6B29AADA7

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: lstrlen$QueryValue$Open
String ID: 10443$27.124.4.60$27.124.4.60$27.124.4.60$4433$Console$Vendata$o1:$o2:$o3:$p1:$p2:$p3:$t1:$t2:$t3:
API String ID: 1772312705-3266678876
Opcode ID: c599fbb0e57935ebe8c3f9b158b0f14cad8e83e9b9ac755a95a7fb9a9d72626c
Instruction ID: 94dd86164394266501af7c0dcbf3b699a3e8d94bae0b2c689431a4084d3884e2
Opcode Fuzzy Hash: c599fbb0e57935ebe8c3f9b158b0f14cad8e83e9b9ac755a95a7fb9a9d72626c
Instruction Fuzzy Hash: 2F22B761E19667C1EB26BB1EE4646B963E1FFA5B4CF804035C74EC2997EFBCA1458300

Function 00007FF6B299FD10 Relevance: 56.3, APIs: 27, Strings: 5, Instructions: 326
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00007FF6B299FD2B
GetDesktopWindow.USER32 ref: 00007FF6B299FD8C
GetDC.USER32 ref: 00007FF6B299FD95
CreateCompatibleDC.GDI32 ref: 00007FF6B299FDA1
GetDC.USER32 ref: 00007FF6B299FDAC
GetDeviceCaps.GDI32 ref: 00007FF6B299FDBD
GetDeviceCaps.GDI32 ref: 00007FF6B299FDCD
ReleaseDC.USER32 ref: 00007FF6B299FDEA
GetSystemMetrics.USER32 ref: 00007FF6B299FE13
GetSystemMetrics.USER32 ref: 00007FF6B299FE4E
GetSystemMetrics.USER32 ref: 00007FF6B299FE82
GetSystemMetrics.USER32 ref: 00007FF6B299FE9C
GetSystemMetrics.USER32 ref: 00007FF6B299FEB6
CreateCompatibleBitmap.GDI32 ref: 00007FF6B299FED4
SelectObject.GDI32 ref: 00007FF6B299FEE8
SetStretchBltMode.GDI32 ref: 00007FF6B299FEF6
GetSystemMetrics.USER32 ref: 00007FF6B299FF01
GetSystemMetrics.USER32 ref: 00007FF6B299FF1B
StretchBlt.GDI32 ref: 00007FF6B299FF5C
GetDIBits.GDI32 ref: 00007FF6B29A0022
DeleteObject.GDI32 ref: 00007FF6B29A00E9
DeleteObject.GDI32 ref: 00007FF6B29A00F2
ReleaseDC.USER32 ref: 00007FF6B29A00FD
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B29A0290

Strings

(, xrefs: 00007FF6B299FF65
, xrefs: 00007FF6B299FF21
gfff, xrefs: 00007FF6B299FE58
6, xrefs: 00007FF6B299FFC2
gfff, xrefs: 00007FF6B299FE32

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: MetricsSystem$Object$CapsCompatibleCreateDeleteDeviceReleaseStretch$BitmapBitsDesktopModeSelectVersionWindow_invalid_parameter_noinfo_noreturn
String ID: $($6$gfff$gfff
API String ID: 3905184151-2922166585
Opcode ID: 44af3f45fffb2cfc8b3a3c13ff4cd9091bcfa2d3e8cf897ab4ce756f2f642521
Instruction ID: 773ddbe5870618551d85cb8fe5ed529dad8e8b1800cca552909443dadedfd6a5
Opcode Fuzzy Hash: 44af3f45fffb2cfc8b3a3c13ff4cd9091bcfa2d3e8cf897ab4ce756f2f642521
Instruction Fuzzy Hash: 67E18971A1878685E726AB2AE40437A73E1FB99F88F108236DB8D97756DF7CD4848700

Function 00007FF6B2997250 Relevance: 54.7, APIs: 26, Strings: 5, Instructions: 457
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6B299A300: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B299A4A0
Part of subcall function 00007FF6B299A300: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B299A4A6

MultiByteToWideChar.KERNEL32 ref: 00007FF6B29975FF
MultiByteToWideChar.KERNEL32 ref: 00007FF6B2997626

Strings

<, xrefs: 00007FF6B299795D
\DisplaySessionContainers.log, xrefs: 00007FF6B2997823
X64, xrefs: 00007FF6B2997471, 00007FF6B299748E
key, xrefs: 00007FF6B29977B2
open, xrefs: 00007FF6B29977A6

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ByteCharMultiWide$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: <$X64$\DisplaySessionContainers.log$key$open
API String ID: 143101810-941791203
Opcode ID: 84872136b42da0819a194256f274013d04c1c29aff028023f1cbf7d720f00181
Instruction ID: f90bae2e764a6975e594d4ef6d9cdce42872ba2acf940e890aaa923ba8c1dfa3
Opcode Fuzzy Hash: 84872136b42da0819a194256f274013d04c1c29aff028023f1cbf7d720f00181
Instruction Fuzzy Hash: 9822BB72A18A8396EB11EF1AE4042AD73E1FB44BA8F504232DB5D83B9ADF7CD155C740

Function 00007FF6B29979E0 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 216
stringregistrycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6B2997A6B
Process32FirstW.KERNEL32 ref: 00007FF6B2997A88
Process32NextW.KERNEL32 ref: 00007FF6B2997AC3
CloseHandle.KERNEL32 ref: 00007FF6B2997AD0
CoCreateInstance.COMBASE ref: 00007FF6B2997B1F
wsprintfW.USER32 ref: 00007FF6B2997C25
RegOpenKeyExW.ADVAPI32 ref: 00007FF6B2997C55
RegQueryValueExW.KERNEL32 ref: 00007FF6B2997CB6
lstrcatW.KERNEL32 ref: 00007FF6B2997CCA
lstrcatW.KERNEL32 ref: 00007FF6B2997CDA
RegCloseKey.ADVAPI32 ref: 00007FF6B2997CE7
lstrlenW.KERNEL32 ref: 00007FF6B2997D24
lstrcatW.KERNEL32 ref: 00007FF6B2997D38
CloseHandle.KERNEL32 ref: 00007FF6B2997D65
lstrcatW.KERNEL32 ref: 00007FF6B2997D7D
lstrcatW.KERNEL32 ref: 00007FF6B2997D8D

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 00007FF6B2997C17
Windows Defender IOfficeAntiVirus implementation , xrefs: 00007FF6B2997A04

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: lstrcat$Close$CreateHandleProcess32$FirstInstanceNextOpenQuerySnapshotToolhelp32Valuelstrlenwsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}$Windows Defender IOfficeAntiVirus implementation
API String ID: 582347850-1583895642
Opcode ID: 134265c9e40a9f760aa4fceb9a534aa5a21de15c77527937ae6ae4b8d1d4e22b
Instruction ID: 32703b00a4ba1414658800ab3a08016b8e4cd84e32053df5b86ea049b2532acf
Opcode Fuzzy Hash: 134265c9e40a9f760aa4fceb9a534aa5a21de15c77527937ae6ae4b8d1d4e22b
Instruction Fuzzy Hash: B9A18572A046838AE721DF2AE8402A977E1FB85B9CF444136DF4D87659DF7CD554C700

Function 00007FF6B2998690 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE ref: 00007FF6B299870B
GetLastError.KERNEL32 ref: 00007FF6B2998715
GetProcessHeap.KERNEL32 ref: 00007FF6B299872B
HeapAlloc.KERNEL32 ref: 00007FF6B299873C
GetTokenInformation.KERNELBASE ref: 00007FF6B299876E
LookupAccountSidW.ADVAPI32 ref: 00007FF6B29987B6
GetLastError.KERNEL32 ref: 00007FF6B29987C0
GetProcessHeap.KERNEL32 ref: 00007FF6B29988C4
HeapFree.KERNEL32 ref: 00007FF6B29988D2

Strings

NONE_MAPPED, xrefs: 00007FF6B29987CD

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Heap$ErrorInformationLastProcessToken$AccountAllocFreeLookup
String ID: NONE_MAPPED
API String ID: 162735656-2950899194
Opcode ID: fc7d76223dfa6cbbf8efa4015a3b0f0cb7eb74909b040ee270e83bc7d35c4934
Instruction ID: a846a9981528f59eda7317acb4ef4ae086b75073589fe0dca8915d004ca92280
Opcode Fuzzy Hash: fc7d76223dfa6cbbf8efa4015a3b0f0cb7eb74909b040ee270e83bc7d35c4934
Instruction Fuzzy Hash: A751B662A08B8386E621AF0BE4442AE63E4FB45FD8F444836CB5D83796DF7CD555C300

Function 00007FF6B29ABCD0 Relevance: 15.0, APIs: 10, Instructions: 33threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6B29ABCDB
GetConsoleWindow.KERNEL32 ref: 00007FF6B29ABCE1
ShowWindow.USER32 ref: 00007FF6B29ABCEC
GetCurrentThreadId.KERNEL32 ref: 00007FF6B29ABCF2
PostThreadMessageA.USER32 ref: 00007FF6B29ABD02
GetInputState.USER32 ref: 00007FF6B29ABD08
CreateThread.KERNEL32 ref: 00007FF6B29ABD27
WaitForSingleObject.KERNEL32 ref: 00007FF6B29ABD3C
CloseHandle.KERNEL32 ref: 00007FF6B29ABD49
Sleep.KERNEL32 ref: 00007FF6B29ABD54

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Thread$Window$CloseConsoleCreateCurrentExceptionFilterHandleInputMessageObjectPostShowSingleSleepStateUnhandledWait
String ID:
API String ID: 2277684705-0
Opcode ID: 6f2be5bc360ff60992bf957455bd65437668e6ddaf6ac78ef69b290b53bfb88b
Instruction ID: 0de4753014482f1ca0d704f27e70347950cc406dbfa5eb23024b168e2e2341c1
Opcode Fuzzy Hash: 6f2be5bc360ff60992bf957455bd65437668e6ddaf6ac78ef69b290b53bfb88b
Instruction Fuzzy Hash: A1012835E18A4382E716BF3AFC5817933E1FF88B59B404136C60EC2676DEBCA5498200

Function 00007FF6B29C1DA8 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6B29C1DED

Part of subcall function 00007FF6B29C1464: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29C1478

Part of subcall function 00007FF6B29BE6BC: RtlFreeHeap.NTDLL(?,?,?,00007FF6B29C65C2,?,?,?,00007FF6B29C693F,?,?,00000000,00007FF6B29C6D85,?,?,?,00007FF6B29C6CB7), ref: 00007FF6B29BE6D2
Part of subcall function 00007FF6B29BE6BC: GetLastError.KERNEL32(?,?,?,00007FF6B29C65C2,?,?,?,00007FF6B29C693F,?,?,00000000,00007FF6B29C6D85,?,?,?,00007FF6B29C6CB7), ref: 00007FF6B29BE6DC

Part of subcall function 00007FF6B29B3D88: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6B29B3D37,?,?,?,?,?,00007FF6B29B3C22), ref: 00007FF6B29B3D91
Part of subcall function 00007FF6B29B3D88: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6B29B3D37,?,?,?,?,?,00007FF6B29B3C22), ref: 00007FF6B29B3DB6

Part of subcall function 00007FF6B29C9F14: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29C9E5F

_get_daylight.LIBCMT ref: 00007FF6B29C1DDC

Part of subcall function 00007FF6B29C14C4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29C14D8

_get_daylight.LIBCMT ref: 00007FF6B29C2052
_get_daylight.LIBCMT ref: 00007FF6B29C2063
_get_daylight.LIBCMT ref: 00007FF6B29C2074
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6B29C22B4), ref: 00007FF6B29C209B

Strings

Eastern Summer Time, xrefs: 00007FF6B29C2159
Eastern Standard Time, xrefs: 00007FF6B29C2141

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: e4d215210ab8a5127c723f465f4324ebd8545cea5875ff9c0ed7522d57f15f04
Instruction ID: 8d0f87e9f268023c7be5836d6e44ad24506170c108a19d53f4d335058cb14be2
Opcode Fuzzy Hash: e4d215210ab8a5127c723f465f4324ebd8545cea5875ff9c0ed7522d57f15f04
Instruction Fuzzy Hash: 63D19E76A1824386E726BF2B94502B966E1FF84B98F444036EB4DC7A87DFBCE441C744

Function 00007FF6B2998040 Relevance: 10.9, APIs: 7, Instructions: 424COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B29AC2E0: wsprintfW.USER32 ref: 00007FF6B29AC30F
Part of subcall function 00007FF6B29AC2E0: CreateFileW.KERNEL32 ref: 00007FF6B29AC33A
Part of subcall function 00007FF6B29AC2E0: DeviceIoControl.KERNEL32 ref: 00007FF6B29AC38A
Part of subcall function 00007FF6B29AC2E0: DeviceIoControl.KERNEL32 ref: 00007FF6B29AC3F1
Part of subcall function 00007FF6B29AC2E0: DeviceIoControl.KERNEL32 ref: 00007FF6B29AC451
Part of subcall function 00007FF6B29AC2E0: DeviceIoControl.KERNEL32 ref: 00007FF6B29AC4B0

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B2998670
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B2998676
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B299867C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B2998682

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ControlDevice_invalid_parameter_noinfo_noreturn$CreateFilewsprintf
String ID:
API String ID: 3155671162-0
Opcode ID: a3f64c159e1f8c12281d3a723323b544dea2ed46356e4a2f7a8bc90ff95b8b61
Instruction ID: 90ce4c9426b34c505a14f02d652acb503f74787811c1531888f47628de0331c3
Opcode Fuzzy Hash: a3f64c159e1f8c12281d3a723323b544dea2ed46356e4a2f7a8bc90ff95b8b61
Instruction Fuzzy Hash: 17028122F18B8289EB01EB6AD4102AD23E1BB55BACF004635DF5D977DBDEBCE4558340

Function 00007FF6B29C2024 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6B29C2052

Part of subcall function 00007FF6B29C14C4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29C14D8

_get_daylight.LIBCMT ref: 00007FF6B29C2063

Part of subcall function 00007FF6B29C1464: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29C1478

_get_daylight.LIBCMT ref: 00007FF6B29C2074

Part of subcall function 00007FF6B29C1494: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29C14A8

Part of subcall function 00007FF6B29BE6BC: RtlFreeHeap.NTDLL(?,?,?,00007FF6B29C65C2,?,?,?,00007FF6B29C693F,?,?,00000000,00007FF6B29C6D85,?,?,?,00007FF6B29C6CB7), ref: 00007FF6B29BE6D2
Part of subcall function 00007FF6B29BE6BC: GetLastError.KERNEL32(?,?,?,00007FF6B29C65C2,?,?,?,00007FF6B29C693F,?,?,00000000,00007FF6B29C6D85,?,?,?,00007FF6B29C6CB7), ref: 00007FF6B29BE6DC

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6B29C22B4), ref: 00007FF6B29C209B

Strings

Eastern Summer Time, xrefs: 00007FF6B29C2159
Eastern Standard Time, xrefs: 00007FF6B29C2141

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: d39622db5b0ee5333b178c37cbbab90ca343d8bae9bfc90199294d5daa5d9118
Instruction ID: 6aa1b5d89f0463fc672d90b3ba8910fadf23b53b1a48edd3022df90f9414eca5
Opcode Fuzzy Hash: d39622db5b0ee5333b178c37cbbab90ca343d8bae9bfc90199294d5daa5d9118
Instruction Fuzzy Hash: 2D515C32E1864386E715FF2BE8815A966A0BF48B98F444136EB4DC3A97DFBCE4418744

Function 00007FF6B29991A0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6B29991BD
GetProcAddress.KERNEL32 ref: 00007FF6B29991CD
GetNativeSystemInfo.KERNEL32 ref: 00007FF6B29991DD
GetSystemInfo.KERNEL32 ref: 00007FF6B29991E1

Strings

GetNativeSystemInfo, xrefs: 00007FF6B29991C6
kernel32.dll, xrefs: 00007FF6B29991A7

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 3433367815-192647395
Opcode ID: 882c301155eb64aee104ed8b19a7cf0e71553aaaeea973eafe02328fb5bce8a2
Instruction ID: 7cd90928bbaec4b78396997377c179bc3712e39229f76de56d1bbc489d77e2b2
Opcode Fuzzy Hash: 882c301155eb64aee104ed8b19a7cf0e71553aaaeea973eafe02328fb5bce8a2
Instruction Fuzzy Hash: F7F0FC15E1868383FB22B716D80027523D0FFA8708F805336D68E8155BEF9CE2D48700

Function 00007FF6B29B8C10 Relevance: 9.2, APIs: 6, Instructions: 249COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29B8C32
_get_daylight.LIBCMT ref: 00007FF6B29B8C92
_get_daylight.LIBCMT ref: 00007FF6B29B8CA3
_get_daylight.LIBCMT ref: 00007FF6B29B8CB4
_isindst.LIBCMT ref: 00007FF6B29B8D05
_isindst.LIBCMT ref: 00007FF6B29B8D58

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: bc1b3b9caf7716422d15d8d8075c51535e8cc771750b1ef0c981aa63b125a24c
Instruction ID: 6c53f56adb53d1e94ada9bce8c7821b79935d90a284e72e06f9e4d2ac0048399
Opcode Fuzzy Hash: bc1b3b9caf7716422d15d8d8075c51535e8cc771750b1ef0c981aa63b125a24c
Instruction Fuzzy Hash: 6591B5B2B0534787EB59AF2AC9452B862D1FB5CB8CF049435DB0D8AB86EF7CE5418740

Function 00007FF6B29AC1B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF6B29AC259
DeviceIoControl.KERNEL32 ref: 00007FF6B29AC2A1

Strings

L, xrefs: 00007FF6B29AC289
\\.\, xrefs: 00007FF6B29AC1FE

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ControlCreateDeviceFile
String ID: L$\\.\
API String ID: 107608037-1891537229
Opcode ID: 0cbf31d1c7ae4fdc9b9f59bce1c389b46034841fd4249985a256846f0105b842
Instruction ID: 9512a40e1fd0233078cadf059cc98f5e7eda6e5b653e2e30163f0df62a078ac7
Opcode Fuzzy Hash: 0cbf31d1c7ae4fdc9b9f59bce1c389b46034841fd4249985a256846f0105b842
Instruction Fuzzy Hash: AF319062A0878681E7019F56B0543797BD0EB85BE8F084335EBAD477DADEBCD0018B00

Function 00007FF6B2993B00 Relevance: 4.7, APIs: 3, Instructions: 151timenetworkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 00007FF6B2993BF5
recv.WS2_32 ref: 00007FF6B2993C1B

Part of subcall function 00007FF6B2991500: VirtualAlloc.KERNEL32 ref: 00007FF6B2991575
Part of subcall function 00007FF6B2991500: VirtualFree.KERNELBASE ref: 00007FF6B29915AF

timeGetTime.WINMM ref: 00007FF6B2993D04

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Virtual$AllocFreeTimerecvselecttime
String ID:
API String ID: 1996171534-0
Opcode ID: 53c4d6481df4593ba0870d21542054a705a6c523d21be50c4b1c7e2cbff31edc
Instruction ID: 93f7299d57ac51ac5ac0769fd496db7a0ccba36055e354220caa564fb2ef1a05
Opcode Fuzzy Hash: 53c4d6481df4593ba0870d21542054a705a6c523d21be50c4b1c7e2cbff31edc
Instruction Fuzzy Hash: B5717F72A08A8285E721AF2ED4142BD33A0FB95B9CF149235DF4D83A57EF78E494C705

Function 00007FF6B2991500 Relevance: 2.6, APIs: 2, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF6B2991575
VirtualFree.KERNELBASE ref: 00007FF6B29915AF

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7adfbc43d79927e24f2f975998fe396b12a3d4926a19e200812a52629311d3ed
Instruction ID: 0f9108c91283d71621e4fc753dd586fe52280817ea3872241ff858a92b3b0909
Opcode Fuzzy Hash: 7adfbc43d79927e24f2f975998fe396b12a3d4926a19e200812a52629311d3ed
Instruction Fuzzy Hash: 2141E432B08A828AE70AEE2BE4506796795FB44F98B054139EF0EC7746EE78D851C740

Function 00007FF6B2998900 Relevance: 45.7, APIs: 22, Strings: 4, Instructions: 225
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6B2998B10), ref: 00007FF6B299891C
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6B2998B10), ref: 00007FF6B299892C
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6B2998B10), ref: 00007FF6B2998954
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6B2998B10), ref: 00007FF6B2998961
CloseHandle.KERNEL32 ref: 00007FF6B29989F0
CloseHandle.KERNEL32 ref: 00007FF6B29989F9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B2998AB5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B2998ABB
GetCurrentProcessId.KERNEL32 ref: 00007FF6B2998AEB
wsprintfW.USER32 ref: 00007FF6B2998B02
GetVersionExW.KERNEL32 ref: 00007FF6B2998B31
GetCurrentProcess.KERNEL32 ref: 00007FF6B2998B5D
OpenProcessToken.ADVAPI32 ref: 00007FF6B2998B73
GetTokenInformation.KERNELBASE ref: 00007FF6B2998BA8
GetLastError.KERNEL32 ref: 00007FF6B2998BB6
LocalAlloc.KERNEL32 ref: 00007FF6B2998BD5
GetTokenInformation.KERNELBASE ref: 00007FF6B2998C08
GetSidSubAuthorityCount.ADVAPI32 ref: 00007FF6B2998C15
GetSidSubAuthority.ADVAPI32 ref: 00007FF6B2998C23
LocalFree.KERNEL32 ref: 00007FF6B2998C2E
CloseHandle.KERNEL32 ref: 00007FF6B2998C44
wsprintfW.USER32 ref: 00007FF6B2998CA3

Strings

VenNetwork, xrefs: 00007FF6B2998AD0
-N/, xrefs: 00007FF6B2998C80
NO/, xrefs: 00007FF6B2998C89
None/%s, xrefs: 00007FF6B2998C92

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Process$CloseHandleToken$CurrentOpen$AuthorityInformationLocal_invalid_parameter_noinfo_noreturnwsprintf$AllocCountErrorFreeLastVersion
String ID: -N/$NO/$None/%s$VenNetwork
API String ID: 3589523989-819860926
Opcode ID: 0a9c1788867b4a701d7bd4d16366bb909b7284601da0f9e1282e206d5775d4bc
Instruction ID: be6dc55af5113a280204e147b604b9ff38b0dd3d9dfa7e8ed402c6759a749fba
Opcode Fuzzy Hash: 0a9c1788867b4a701d7bd4d16366bb909b7284601da0f9e1282e206d5775d4bc
Instruction Fuzzy Hash: 09A1A721A0DB8386EB22AB1AE4443B963E0FF85BA9F404535DB8D83796DFBCD545C700

Function 00007FF6B29A02A0 Relevance: 45.3, APIs: 30, Instructions: 260
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32 ref: 00007FF6B29A02D8
GlobalLock.KERNEL32 ref: 00007FF6B29A02E4
GlobalUnlock.KERNEL32 ref: 00007FF6B29A02FB
CreateStreamOnHGlobal.OLE32 ref: 00007FF6B29A0311
GlobalFree.KERNEL32 ref: 00007FF6B29A0674

Part of subcall function 00007FF6B29961E0: InitializeCriticalSectionEx.KERNEL32 ref: 00007FF6B2996231
Part of subcall function 00007FF6B29961E0: GetLastError.KERNEL32 ref: 00007FF6B299623B

EnterCriticalSection.KERNEL32 ref: 00007FF6B29A035F
LeaveCriticalSection.KERNEL32 ref: 00007FF6B29A036C
GdipCreateBitmapFromStream.GDIPLUS ref: 00007FF6B29A039A
GdipDisposeImage.GDIPLUS ref: 00007FF6B29A03B0
GdipDisposeImage.GDIPLUS ref: 00007FF6B29A03CE
CreateStreamOnHGlobal.OLE32 ref: 00007FF6B29A03EB
GetHGlobalFromStream.OLE32 ref: 00007FF6B29A0412
GlobalLock.KERNEL32 ref: 00007FF6B29A041C
GlobalFree.KERNEL32 ref: 00007FF6B29A043B
DeleteObject.GDI32 ref: 00007FF6B29A046B
EnterCriticalSection.KERNEL32 ref: 00007FF6B29A047D
EnterCriticalSection.KERNEL32 ref: 00007FF6B29A048D
GdiplusShutdown.GDIPLUS ref: 00007FF6B29A049B
LeaveCriticalSection.KERNEL32 ref: 00007FF6B29A04A8
LeaveCriticalSection.KERNEL32 ref: 00007FF6B29A04B2
DeleteObject.GDI32 ref: 00007FF6B29A0624
EnterCriticalSection.KERNEL32 ref: 00007FF6B29A0636
EnterCriticalSection.KERNEL32 ref: 00007FF6B29A0646
GdiplusShutdown.GDIPLUS ref: 00007FF6B29A0654
LeaveCriticalSection.KERNEL32 ref: 00007FF6B29A0661
LeaveCriticalSection.KERNEL32 ref: 00007FF6B29A066B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B29A0698

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CriticalSection$Global$EnterLeave$Stream$CreateGdip$DeleteDisposeFreeFromGdiplusImageLockObjectShutdown$AllocBitmapErrorInitializeLastUnlock_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 953580087-0
Opcode ID: 115e2526ca109c9e428483d497415ba78719f10449944d8e4256b42c43ed8cf6
Instruction ID: 25eaac5faa02de67057c88ff01717c8e446bf61530d4e855cd3fe449a3104726
Opcode Fuzzy Hash: 115e2526ca109c9e428483d497415ba78719f10449944d8e4256b42c43ed8cf6
Instruction Fuzzy Hash: FBC14D36F08B4289EB01EB6AE4142AD33B1FB45B9CB004136CF5E9769ADF78D459D340

Function 00007FF6B299C340 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 297
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GdipGetImagePixelFormat.GDIPLUS ref: 00007FF6B299C377
GdipGetImageHeight.GDIPLUS ref: 00007FF6B299C3F4
GdipGetImageWidth.GDIPLUS ref: 00007FF6B299C41A
GdipGetImagePaletteSize.GDIPLUS ref: 00007FF6B299C470
GdipGetImagePalette.GDIPLUS ref: 00007FF6B299C4F1
CreateCompatibleDC.GDI32 ref: 00007FF6B299C588
SelectObject.GDI32 ref: 00007FF6B299C599
SetDIBColorTable.GDI32 ref: 00007FF6B299C5B7
SelectObject.GDI32 ref: 00007FF6B299C5CC
DeleteDC.GDI32 ref: 00007FF6B299C5F6
GdipBitmapLockBits.GDIPLUS ref: 00007FF6B299C646
GdipBitmapUnlockBits.GDIPLUS ref: 00007FF6B299C6D3
GdipCreateBitmapFromScan0.GDIPLUS ref: 00007FF6B299C702
GdipGetImageGraphicsContext.GDIPLUS ref: 00007FF6B299C71D
GdipDrawImageI.GDIPLUS ref: 00007FF6B299C737
GdipDeleteGraphics.GDIPLUS ref: 00007FF6B299C740
GdipDisposeImage.GDIPLUS ref: 00007FF6B299C74D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B299C79F

Strings

&, xrefs: 00007FF6B299C3D4

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Gdip$Image$Bitmap$BitsCreateDeleteGraphicsObjectPaletteSelect$ColorCompatibleContextDisposeDrawFormatFromHeightLockPixelScan0SizeTableUnlockWidth_invalid_parameter_noinfo
String ID: &
API String ID: 4034434136-3042966939
Opcode ID: dd11024c4d0ee26c12cb960423acbe48478663fb147fae3e010d538c7f7c31a7
Instruction ID: 885c57a02b4fef552e35fdf1067c42197bcdb1dc9b905d1278abbb1709d92168
Opcode Fuzzy Hash: dd11024c4d0ee26c12cb960423acbe48478663fb147fae3e010d538c7f7c31a7
Instruction Fuzzy Hash: 25D19E726086838EEB61AF2AD8446A937E4FB48BACF014135DB2D97B46DF78E514C740

Function 00007FF6B2993820 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 157
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32 ref: 00007FF6B2993840
timeGetTime.WINMM ref: 00007FF6B299384F
socket.WS2_32 ref: 00007FF6B299387C
lstrlenW.KERNEL32 ref: 00007FF6B299389E
WideCharToMultiByte.KERNEL32 ref: 00007FF6B29938C2
lstrlenW.KERNEL32 ref: 00007FF6B29938DA
WideCharToMultiByte.KERNEL32 ref: 00007FF6B29938FD
gethostbyname.WS2_32 ref: 00007FF6B299390A
htons.WS2_32 ref: 00007FF6B2993938
connect.WS2_32 ref: 00007FF6B2993962
setsockopt.WS2_32 ref: 00007FF6B299399E
setsockopt.WS2_32 ref: 00007FF6B29939D1
setsockopt.WS2_32 ref: 00007FF6B2993A04
setsockopt.WS2_32 ref: 00007FF6B2993A2D
WSAIoctl.WS2_32 ref: 00007FF6B2993A80

Strings

0u, xrefs: 00007FF6B29939EB

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: setsockopt$ByteCharMultiWidelstrlen$EventIoctlResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 3082052849-3203441087
Opcode ID: 31de75bcb46c380d304f1bc485ab5eacb48e194165f0f16ba2058fbbb71b66c7
Instruction ID: 345fcccee196c636c46f33b0f1503f920e7d5a3bef5b1f1736702e696d28faf8
Opcode Fuzzy Hash: 31de75bcb46c380d304f1bc485ab5eacb48e194165f0f16ba2058fbbb71b66c7
Instruction Fuzzy Hash: AF71507260878286E721DF26F44476AB7A5FB84B98F00423AEB8E43B59DF7CD155CB04

Function 00007FF6B2998AD0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF6B2998AEB
wsprintfW.USER32 ref: 00007FF6B2998B02

Part of subcall function 00007FF6B2998900: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6B2998B10), ref: 00007FF6B299891C
Part of subcall function 00007FF6B2998900: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6B2998B10), ref: 00007FF6B299892C
Part of subcall function 00007FF6B2998900: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6B2998B10), ref: 00007FF6B2998954
Part of subcall function 00007FF6B2998900: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF6B2998B10), ref: 00007FF6B2998961

GetVersionExW.KERNEL32 ref: 00007FF6B2998B31
GetCurrentProcess.KERNEL32 ref: 00007FF6B2998B5D
OpenProcessToken.ADVAPI32 ref: 00007FF6B2998B73
GetTokenInformation.KERNELBASE ref: 00007FF6B2998BA8
GetLastError.KERNEL32 ref: 00007FF6B2998BB6
LocalAlloc.KERNEL32 ref: 00007FF6B2998BD5
GetTokenInformation.KERNELBASE ref: 00007FF6B2998C08
GetSidSubAuthorityCount.ADVAPI32 ref: 00007FF6B2998C15
GetSidSubAuthority.ADVAPI32 ref: 00007FF6B2998C23
LocalFree.KERNEL32 ref: 00007FF6B2998C2E
CloseHandle.KERNEL32 ref: 00007FF6B2998C44
wsprintfW.USER32 ref: 00007FF6B2998CA3

Strings

VenNetwork, xrefs: 00007FF6B2998AD0

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Process$Token$CurrentOpen$AuthorityCloseHandleInformationLocalwsprintf$AllocCountErrorFreeLastVersion
String ID: VenNetwork
API String ID: 4155081256-3057682757
Opcode ID: 098a7c2237c4f32fb2c44998094c6b0ae8eacec6811162fafead4cf2eb3aac2f
Instruction ID: 2c6efcd1953f2f97a7175527006cdb0ba52b1962b5ffef8c604124f04e8a7a48
Opcode Fuzzy Hash: 098a7c2237c4f32fb2c44998094c6b0ae8eacec6811162fafead4cf2eb3aac2f
Instruction Fuzzy Hash: 78414F31A0A68385EB62AB26E4443B923E0FB85B99F444536CB4E83796EF7DD545C700

Function 00007FF6B29ABDD0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 223
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeviceIoControl.KERNEL32 ref: 00007FF6B29ABE74
DeviceIoControl.KERNEL32 ref: 00007FF6B29ABEE3
GlobalAlloc.KERNEL32 ref: 00007FF6B29ABF12
DeviceIoControl.KERNEL32 ref: 00007FF6B29ABF5C
GlobalFree.KERNEL32 ref: 00007FF6B29ABF7E
DeviceIoControl.KERNEL32 ref: 00007FF6B29ABFCD
GlobalAlloc.KERNEL32 ref: 00007FF6B29ABFF5
DeviceIoControl.KERNEL32 ref: 00007FF6B29AC037
GlobalFree.KERNEL32 ref: 00007FF6B29AC050
GlobalFree.KERNEL32 ref: 00007FF6B29AC06F

Strings

%s-%s|, xrefs: 00007FF6B29AC0DB
- External Hub, xrefs: 00007FF6B29AC05B

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ControlDeviceGlobal$Free$Alloc
String ID: - External Hub$%s-%s|
API String ID: 3253977144-729331614
Opcode ID: 6ebde190928095b1eae62e95338309e58df42c3839912d6c9fa9ddc0bde6fb78
Instruction ID: b79c7f8b78959922fa59c737171fc270811fd71ce8bfea4cbb0971ad9e3095cb
Opcode Fuzzy Hash: 6ebde190928095b1eae62e95338309e58df42c3839912d6c9fa9ddc0bde6fb78
Instruction Fuzzy Hash: 2EB1B072A08B8285EB21DF16A4403AE77E0FB86B98F444235DB9D977A6DF7CD544C700

Function 00007FF6B299D9C0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 137
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B299DA44
GetLastInputInfo.USER32 ref: 00007FF6B299DAAB
GetTickCount.KERNEL32 ref: 00007FF6B299DAB1
wsprintfW.USER32 ref: 00007FF6B299DAE4
RegOpenKeyExW.KERNEL32 ref: 00007FF6B299DB72
RegQueryValueExW.KERNEL32 ref: 00007FF6B299DBA3

Strings

%d min, xrefs: 00007FF6B299DADD
Console, xrefs: 00007FF6B299DB64
IpDatespecial, xrefs: 00007FF6B299DB9C

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CountInfoInputLastOpenQueryTickValue_invalid_parameter_noinfo_noreturnwsprintf
String ID: %d min$Console$IpDatespecial
API String ID: 357503962-2712035571
Opcode ID: efa53836958f32f8ab0cb54a8671f626514f8aa22354df529298ed1da135f9ea
Instruction ID: 0f121d609caf87a1ca192bee026d68d287163a90d5a3341f579f580407e91e8a
Opcode Fuzzy Hash: efa53836958f32f8ab0cb54a8671f626514f8aa22354df529298ed1da135f9ea
Instruction Fuzzy Hash: DC51AE72604E8289EB62AF2AEC543A923A4FB44BADF444131DB4C8769ADF7CC595C700

Function 00007FF6B29AC2E0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 128
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfW.USER32 ref: 00007FF6B29AC30F
CreateFileW.KERNEL32 ref: 00007FF6B29AC33A
DeviceIoControl.KERNEL32 ref: 00007FF6B29AC38A
DeviceIoControl.KERNEL32 ref: 00007FF6B29AC3F1

Part of subcall function 00007FF6B29AC520: WideCharToMultiByte.KERNEL32 ref: 00007FF6B29AC555
Part of subcall function 00007FF6B29AC520: WideCharToMultiByte.KERNEL32 ref: 00007FF6B29AC590

DeviceIoControl.KERNEL32 ref: 00007FF6B29AC451
DeviceIoControl.KERNEL32 ref: 00007FF6B29AC4B0

Part of subcall function 00007FF6B29AC1B0: CreateFileA.KERNEL32 ref: 00007FF6B29AC259
Part of subcall function 00007FF6B29AC1B0: DeviceIoControl.KERNEL32 ref: 00007FF6B29AC2A1

CloseHandle.KERNEL32 ref: 00007FF6B29AC4DE
CloseHandle.KERNEL32 ref: 00007FF6B29AC503

Strings

\\.\HCD%d, xrefs: 00007FF6B29AC303

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ControlDevice$ByteCharCloseCreateFileHandleMultiWide$wsprintf
String ID: \\.\HCD%d
API String ID: 2324936672-2696249065
Opcode ID: b16b9414ff4f5bba01ca19ea586cfc01d35dadd3bdcc9ae74a2dc0319bdc3a1e
Instruction ID: 92f1c130d6ddac46c4bb642fe9e901dd089f9d063f5bbad53858f1c61fca56da
Opcode Fuzzy Hash: b16b9414ff4f5bba01ca19ea586cfc01d35dadd3bdcc9ae74a2dc0319bdc3a1e
Instruction Fuzzy Hash: 61517531A0C78286EB61AB16F44076A77D4FB86798F041135EB9E87BA6EF7CD405CB00

Function 00007FF6B299C7B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS ref: 00007FF6B299C7E4
GdipGetImageEncoders.GDIPLUS ref: 00007FF6B299C871
GdipCreateBitmapFromScan0.GDIPLUS ref: 00007FF6B299C915
GdipCreateBitmapFromHBITMAP.GDIPLUS ref: 00007FF6B299C92D
GdipSaveImageToStream.GDIPLUS ref: 00007FF6B299C944
GdipDisposeImage.GDIPLUS ref: 00007FF6B299C951
GdipDisposeImage.GDIPLUS ref: 00007FF6B299C95E

Strings

&, xrefs: 00007FF6B299C8FD

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Gdip$Image$BitmapCreateDisposeEncodersFrom$SaveScan0SizeStream
String ID: &
API String ID: 370471037-3042966939
Opcode ID: 4526caf998ada3252c84406b8f766584f007c4df05e28e230d859843c7169577
Instruction ID: c252f41f4ad1989ecdc9c4b2c08a1e3d795d22c90ac1a55201c9a5092b06fe46
Opcode Fuzzy Hash: 4526caf998ada3252c84406b8f766584f007c4df05e28e230d859843c7169577
Instruction Fuzzy Hash: 95516731A08A438AEB12AB1BD8006B863E1FB48BACF544231DF5D87797DF78E5568340

Function 00007FF6B2998CD0 Relevance: 9.1, APIs: 6, Instructions: 67registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32 ref: 00007FF6B2998D32
RegQueryValueExW.KERNEL32 ref: 00007FF6B2998D89
lstrcmpW.KERNEL32 ref: 00007FF6B2998D9F
RegCloseKey.KERNEL32 ref: 00007FF6B2998DCF
RegCloseKey.ADVAPI32 ref: 00007FF6B2998DDD

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Close$OpenQueryValuelstrcmp
String ID:
API String ID: 4288439342-0
Opcode ID: 898e3f92dd09ced9f59f1214a1bb77de0c366a7caab65dc6ea004482ae0e6425
Instruction ID: 1fffa0f37c195f40a6f3b258e905ac8ecce18b9c6ecead429cc1a9c8969b2428
Opcode Fuzzy Hash: 898e3f92dd09ced9f59f1214a1bb77de0c366a7caab65dc6ea004482ae0e6425
Instruction Fuzzy Hash: 6831C931618B8286E760DF2AE88865A73E4FF94BA4F504235DB5C837AADF7DD504C700

Function 00007FF6B2998E00 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 239COMMON

Download Yara Rule

APIs

CreateDXGIFactory.DXGI ref: 00007FF6B2998E4C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B2999191
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B2999197

Strings

%s%s %d*%d , xrefs: 00007FF6B2999094
%s%s %d %d , xrefs: 00007FF6B2998F3F

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CreateFactory
String ID: %s%s %d %d $%s%s %d*%d
API String ID: 2331002265-1924168580
Opcode ID: 14b910ee6d1905bd923c8d4c79364dee4b4ada9110bf2d8ad23789b6dab43fb2
Instruction ID: 6f467ed43e4ee15e499669aaab5d7f3d861ae73abcf05f8549bf2f03315b850e
Opcode Fuzzy Hash: 14b910ee6d1905bd923c8d4c79364dee4b4ada9110bf2d8ad23789b6dab43fb2
Instruction Fuzzy Hash: BCA1C232B04B8689EB11DF6AD4442ED77A1FB89BA8F500622DF5D97B9ACF78D441C700

Function 00007FF6B29B8940 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29B896B
CreateThread.KERNEL32 ref: 00007FF6B29B89AC
GetLastError.KERNEL32 ref: 00007FF6B29B89BA
CloseHandle.KERNEL32 ref: 00007FF6B29B89D0
FreeLibrary.KERNEL32 ref: 00007FF6B29B89DF

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: bf8243345e757f2f55ee74e3b164a4444cec9f217b6620c703edaf3e446c73ac
Instruction ID: 4f70235d4b8b399ca20b5584cdd5cb76ba72fc674199e9c2208e17d8b9f1bc7d
Opcode Fuzzy Hash: bf8243345e757f2f55ee74e3b164a4444cec9f217b6620c703edaf3e446c73ac
Instruction Fuzzy Hash: EC213025A09B8386EE16AB6BE418179A3D0BF8CFD8F044935DF4D83756DFBCE4448600

Function 00007FF6B2993E30 Relevance: 6.1, APIs: 4, Instructions: 120threadnetworkCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF6B2993E51
send.WS2_32 ref: 00007FF6B2993F43
send.WS2_32 ref: 00007FF6B2993F90
GetCurrentThreadId.KERNEL32 ref: 00007FF6B2993FBA

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CurrentThreadsend
String ID:
API String ID: 302076607-0
Opcode ID: 8fc84bb4e0a68a1d65a8e1ac48c208ce2ab72bf0ff2939eb6e9be73f1c549aff
Instruction ID: b2723552ea56cce3e4af07cde25376d06d6ac546c8f9f050cb89976d3742bb47
Opcode Fuzzy Hash: 8fc84bb4e0a68a1d65a8e1ac48c208ce2ab72bf0ff2939eb6e9be73f1c549aff
Instruction Fuzzy Hash: B1518422A04B478BE715AF2AE54436A77F0FB84B98F048035DB4D87B57DFB8E4628345

Function 00007FF6B29937A0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF6B29937DD
CancelIo.KERNEL32 ref: 00007FF6B29937EA
closesocket.WS2_32 ref: 00007FF6B29937FA
SetEvent.KERNEL32 ref: 00007FF6B2993804

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CancelEventclosesocketsetsockopt
String ID:
API String ID: 852421847-0
Opcode ID: 2fb1975f05564cd4b635324778d61c2216334fb941b2a99bb5b0bfd9df8af0fc
Instruction ID: 4eff75bcf255fa3d8c403d2422b6c42920f2169c29c3e4a82308d6f3e1978bc4
Opcode Fuzzy Hash: 2fb1975f05564cd4b635324778d61c2216334fb941b2a99bb5b0bfd9df8af0fc
Instruction Fuzzy Hash: C3F08132604A8287D7109F2AE45832AB370FB84BA8F500336CBAC476E4CF7DD065C700

Function 00007FF6B29AC5C0 Relevance: 4.6, APIs: 3, Instructions: 79stringCOMMON

Download Yara Rule

APIs

GetSystemDefaultLangID.KERNEL32 ref: 00007FF6B29AC603
DeviceIoControl.KERNEL32 ref: 00007FF6B29AC653

Part of subcall function 00007FF6B29AC520: WideCharToMultiByte.KERNEL32 ref: 00007FF6B29AC555
Part of subcall function 00007FF6B29AC520: WideCharToMultiByte.KERNEL32 ref: 00007FF6B29AC590

lstrcpyA.KERNEL32 ref: 00007FF6B29AC6D2

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ByteCharMultiWide$ControlDefaultDeviceLangSystemlstrcpy
String ID:
API String ID: 3058672631-0
Opcode ID: b93dd64b9f0b49e4cdd69b6c5962fb9da2149387bcda9f15ac00ed83222854a4
Instruction ID: a2b36c81bbc2e0648e2731cfea137b277452e259d49f4126d41a073ed62afc5e
Opcode Fuzzy Hash: b93dd64b9f0b49e4cdd69b6c5962fb9da2149387bcda9f15ac00ed83222854a4
Instruction Fuzzy Hash: 4E31A831A0C78385DB21EB1AA4443BA63E1EB86B94F544235FB9D87796DF7DD441C700

Function 00007FF6B299C9B0 Relevance: 4.5, APIs: 3, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B29961E0: InitializeCriticalSectionEx.KERNEL32 ref: 00007FF6B2996231
Part of subcall function 00007FF6B29961E0: GetLastError.KERNEL32 ref: 00007FF6B299623B

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6B299C7D4), ref: 00007FF6B299C9DA
GdiplusStartup.GDIPLUS ref: 00007FF6B299CA0F
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF6B299C7D4), ref: 00007FF6B299CA27

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CriticalSection$EnterErrorGdiplusInitializeLastLeaveStartup
String ID:
API String ID: 2723390537-0
Opcode ID: 65629aaaa719a2e99d15e3f5434e13b9281ffa3b8c64cff51ac5a9778f412de6
Instruction ID: 48c241e28d44acbc42431294f789d10a3e714c26fb9624b156953c6943c8ad91
Opcode Fuzzy Hash: 65629aaaa719a2e99d15e3f5434e13b9281ffa3b8c64cff51ac5a9778f412de6
Instruction Fuzzy Hash: 15019232908B81CAD7119F1AE40436A73E1F784B45F481025EBCE83656CF7CD065CB40

Function 00007FF6B29B8878 Relevance: 4.5, APIs: 3, Instructions: 27threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B29BEBE8: GetLastError.KERNEL32(?,?,00005315DED5DA85,00007FF6B29B8B05,?,?,?,?,00007FF6B29C2546,?,?,00000000,00007FF6B29BA3FB,?,?,?), ref: 00007FF6B29BEBF7
Part of subcall function 00007FF6B29BEBE8: SetLastError.KERNEL32(?,?,00005315DED5DA85,00007FF6B29B8B05,?,?,?,?,00007FF6B29C2546,?,?,00000000,00007FF6B29BA3FB,?,?,?), ref: 00007FF6B29BEC97

CloseHandle.KERNEL32(?,?,?,00007FF6B29B8A25,?,?,?,?,00007FF6B29B8869), ref: 00007FF6B29B88B3
FreeLibraryAndExitThread.KERNEL32(?,?,?,00007FF6B29B8A25,?,?,?,?,00007FF6B29B8869), ref: 00007FF6B29B88C9
ExitThread.KERNEL32 ref: 00007FF6B29B88D2

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: 9d899525cbf94069d0aecb2dad8b7ed7b52f5d6c34f84ba4291cfdf2ce1d2a7a
Instruction ID: 1e0478dae7c30ec8f18c14d385e3aec235bc2304348b30879bdfac47419ff3bb
Opcode Fuzzy Hash: 9d899525cbf94069d0aecb2dad8b7ed7b52f5d6c34f84ba4291cfdf2ce1d2a7a
Instruction Fuzzy Hash: 25F0F411A0898753FE167B2A944817D22E5AF48F7DF184B35D73D822D6DFBDD4458340

Function 00007FF6B2993DA0 Relevance: 3.0, APIs: 2, Instructions: 41timeCOMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 00007FF6B2993DCD
timeGetTime.WINMM ref: 00007FF6B2993DF1

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: 2becff6657bc7d5012ec94526cf32972d5272bc21be79492e35a94961d449a59
Instruction ID: 2915e837e6280e0d4abceb805b99b8a6e03be13940aa49cacb00b20932dc9e79
Opcode Fuzzy Hash: 2becff6657bc7d5012ec94526cf32972d5272bc21be79492e35a94961d449a59
Instruction Fuzzy Hash: 2901AD22B182428BE7655F6AE18833C22E0FB84B98F441234C75E876D2CFBCD4E1C705

Function 00007FF6B29B8808 Relevance: 3.0, APIs: 2, Instructions: 31threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6B29B8816
ExitThread.KERNEL32 ref: 00007FF6B29B881E

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 86e50ef011b0631a2311c12b12e79fa44030a146f353d628d3291aff0b0405bd
Instruction ID: 3f9b76f4db1fad160fe894c32d69f1c9586f11f11f5d83ba1c3fcda503d73d17
Opcode Fuzzy Hash: 86e50ef011b0631a2311c12b12e79fa44030a146f353d628d3291aff0b0405bd
Instruction Fuzzy Hash: 29F09022E0A68382EF16BBBBC41917C12E0AF5DB48F040434DB0ED33A7DEACE8458300

Function 00007FF6B29ADE98 Relevance: 3.0, APIs: 2, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B29ADEC8
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B29ADECE

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a47e5a6ac0625703f2fd5b566550f71a2f7208a7861a0071670bc6a0f9e7358f
Instruction ID: 2c3f0a8e6cfe96b1c560fa428fd29e6dca15c87eeaf0738913abed0f0197ee7e
Opcode Fuzzy Hash: a47e5a6ac0625703f2fd5b566550f71a2f7208a7861a0071670bc6a0f9e7358f
Instruction Fuzzy Hash: 22E0B610E1A30749FB2B72AB24190B810C01F6AB78F381B70EB7E842D3ADACA4918160

Function 00007FF6B29BE6BC Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF6B29C65C2,?,?,?,00007FF6B29C693F,?,?,00000000,00007FF6B29C6D85,?,?,?,00007FF6B29C6CB7), ref: 00007FF6B29BE6D2
GetLastError.KERNEL32(?,?,?,00007FF6B29C65C2,?,?,?,00007FF6B29C693F,?,?,00000000,00007FF6B29C6D85,?,?,?,00007FF6B29C6CB7), ref: 00007FF6B29BE6DC

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: a27750d6ae148c980c7c980f65ba2d3e2e52c6c92a9735542c6e0cceef461146
Instruction ID: 8fbd794e6b0aa1cd551b234b220a843dcc3815be1dc2ca20f3e973d787c9457f
Opcode Fuzzy Hash: a27750d6ae148c980c7c980f65ba2d3e2e52c6c92a9735542c6e0cceef461146
Instruction Fuzzy Hash: 93E08C10F2820382FB1A7FFB588D03822D4BF89B09F804834CB4DC6253EEBCA8464700

Function 00007FF6B2991730 Relevance: 2.6, APIs: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF6B2991796
VirtualFree.KERNELBASE ref: 00007FF6B29917CA

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 616965ea612f33b462fe03c73724eb49c1abe59c321f00a6c33259c6d796c58f
Instruction ID: 44331951c2abdc8da844ecdbd9144273b77ff17392aa1f96c130517dc8e2c3b6
Opcode Fuzzy Hash: 616965ea612f33b462fe03c73724eb49c1abe59c321f00a6c33259c6d796c58f
Instruction Fuzzy Hash: A8216521B18A4386D725DB2FF44012AB7A1FB88B84B148135EB9ED3B1ADF7DE4918744

Function 00007FF6B2991670 Relevance: 2.6, APIs: 2, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF6B29916C4
VirtualFree.KERNEL32 ref: 00007FF6B29916FE

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 0d2589c5e0cc1a94e4b3bf8f4f54a9d1287f00ffced7c8db5b8a82110618710c
Instruction ID: 017c42d57b4264c2a0d66c2d1730f0ca2c56a79a353ec0565b8eb5d90a670bf6
Opcode Fuzzy Hash: 0d2589c5e0cc1a94e4b3bf8f4f54a9d1287f00ffced7c8db5b8a82110618710c
Instruction Fuzzy Hash: AC11D631B28A4286E7169F2BE440129A3E5FF88FC8B144131EB4ED3759DE7CD8918740

Function 00007FF6B29ADFC0 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B29ADC60: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6B29ADC74

__scrt_release_startup_lock.LIBCMT ref: 00007FF6B29AE057

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 2217363868-0
Opcode ID: cbc0649b0607904615e0344cdc653858b0dfbbed05089a03dbfd93f3e9e99ab1
Instruction ID: e1e96de9940274303f3f4e34c27295575357f9b05eedae11b64ab5d453d48309
Opcode Fuzzy Hash: cbc0649b0607904615e0344cdc653858b0dfbbed05089a03dbfd93f3e9e99ab1
Instruction Fuzzy Hash: 0A311A21E0C65785FB56BB2FD4163B922D1AF8278CF844439DB8D872D7DEEDA8468210

Function 00007FF6B2991000 Relevance: 1.5, APIs: 1, Instructions: 16networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF6B2991022

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 27a40b9f3cf52b959e37d45274ab80e386b8a2eb9336faf4e796e06ae50c97e7
Instruction ID: 0d4caf0878dfdcf45eca1345592e0adab7c85f7339eec5717a0eee577334652c
Opcode Fuzzy Hash: 27a40b9f3cf52b959e37d45274ab80e386b8a2eb9336faf4e796e06ae50c97e7
Instruction Fuzzy Hash: C7E08676B19A46CAE722BF29D44506473E4F75D708F404132E68D83756DE7CD555CF00

Function 00007FF6B29BEDD0 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6B29C252D,?,?,00000000,00007FF6B29BA3FB,?,?,?,00007FF6B29BC5D3,?,?,?,00007FF6B29BC4C9), ref: 00007FF6B29BEE0E

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: c5d91307553507d7a0b65c4578cb45837d9ca66b83f15ba5a6112bdae37f71ee
Instruction ID: e58149fa15b22173c2da201ccaab2fe6196ea4a83b7ca48ee0266203179da325
Opcode Fuzzy Hash: c5d91307553507d7a0b65c4578cb45837d9ca66b83f15ba5a6112bdae37f71ee
Instruction Fuzzy Hash: FCF08C14F0924381FE677AAF584D27412C86F88BA8F880A34DF6EC62C3DEECE4824111

Non-executed Functions

Function 00007FF6B2999320 Relevance: 68.5, APIs: 29, Strings: 10, Instructions: 221libraryloaderinjectionCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 00007FF6B2999396
CreateProcessA.KERNEL32 ref: 00007FF6B29993F9
GetCurrentProcess.KERNEL32 ref: 00007FF6B2999407
OpenProcessToken.ADVAPI32 ref: 00007FF6B299941C
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6B299943A
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6B2999482
OpenProcess.KERNEL32 ref: 00007FF6B299949B
LoadLibraryA.KERNEL32 ref: 00007FF6B29994C5
GetProcAddress.KERNEL32 ref: 00007FF6B29994D5
LoadLibraryA.KERNEL32 ref: 00007FF6B29994E6
GetProcAddress.KERNEL32 ref: 00007FF6B29994F6
LoadLibraryA.KERNEL32 ref: 00007FF6B2999507
GetProcAddress.KERNEL32 ref: 00007FF6B2999517
LoadLibraryA.KERNEL32 ref: 00007FF6B2999528
GetProcAddress.KERNEL32 ref: 00007FF6B2999538
GetCurrentProcess.KERNEL32 ref: 00007FF6B2999542
GetProcessId.KERNEL32 ref: 00007FF6B299954B
GetModuleFileNameA.KERNEL32 ref: 00007FF6B299957F
VirtualAllocEx.KERNEL32 ref: 00007FF6B29995B5
WriteProcessMemory.KERNEL32 ref: 00007FF6B29995DC
VirtualProtectEx.KERNEL32 ref: 00007FF6B299960F
VirtualAllocEx.KERNEL32 ref: 00007FF6B299962E
WriteProcessMemory.KERNEL32 ref: 00007FF6B2999658
VirtualProtectEx.KERNEL32 ref: 00007FF6B2999684
CreateRemoteThread.KERNEL32 ref: 00007FF6B29996A7
Sleep.KERNEL32 ref: 00007FF6B29996BA
VirtualProtectEx.KERNEL32 ref: 00007FF6B29996DE
VirtualProtectEx.KERNEL32 ref: 00007FF6B2999702
ResumeThread.KERNEL32 ref: 00007FF6B299970B

Strings

@, xrefs: 00007FF6B2999617
%s%s, xrefs: 00007FF6B29993B1
SeDebugPrivilege, xrefs: 00007FF6B2999433
WinExec, xrefs: 00007FF6B2999510
Windows\System32\svchost.exe, xrefs: 00007FF6B299939C
h, xrefs: 00007FF6B299937D
Kernel32.dll, xrefs: 00007FF6B29994BE, 00007FF6B29994DB, 00007FF6B29994FC, 00007FF6B299951D
OpenProcess, xrefs: 00007FF6B29994CE
WaitForSingleObject, xrefs: 00007FF6B2999531
ExitProcess, xrefs: 00007FF6B29994EF

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Process$Virtual$AddressLibraryLoadProcProtect$AllocCreateCurrentMemoryOpenThreadTokenWrite$AdjustDirectoryFileLookupModuleNamePrivilegePrivilegesRemoteResumeSleepSystemValue
String ID: %s%s$@$ExitProcess$Kernel32.dll$OpenProcess$SeDebugPrivilege$WaitForSingleObject$WinExec$Windows\System32\svchost.exe$h
API String ID: 3040193174-4212407401
Opcode ID: 0c2d203bb3590072b2790da5483ee898493f9f682a060de060c9115ce93124ea
Instruction ID: 296e50d22feedf6552422d393e00a342d130bc6890cf88043790389ba46e43e7
Opcode Fuzzy Hash: 0c2d203bb3590072b2790da5483ee898493f9f682a060de060c9115ce93124ea
Instruction Fuzzy Hash: 6EA15131A14B8385EB22AF66E8147E963E4FB48B9CF004135DA4D57769DFBCD289C740

Function 00007FF6B299ADB0 Relevance: 63.3, APIs: 30, Strings: 6, Instructions: 286stringclipboardfileCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,00000000,00000000,00002514,00000000,00000000,00000000,00007FF6B29979D1), ref: 00007FF6B299AE08
GetTickCount.KERNEL32 ref: 00007FF6B299AE0E
GetTickCount.KERNEL32 ref: 00007FF6B299AE25
OpenClipboard.USER32 ref: 00007FF6B299AE33
GetClipboardData.USER32 ref: 00007FF6B299AE3E
GlobalSize.KERNEL32 ref: 00007FF6B299AE53
GlobalLock.KERNEL32 ref: 00007FF6B299AE63
wsprintfW.USER32 ref: 00007FF6B299AECE
WaitForSingleObject.KERNEL32 ref: 00007FF6B299AEE0
CreateFileW.KERNEL32 ref: 00007FF6B299AF14
SetFilePointer.KERNEL32 ref: 00007FF6B299AF3C
lstrlenW.KERNEL32 ref: 00007FF6B299AF47
WriteFile.KERNEL32 ref: 00007FF6B299AF6A
CloseHandle.KERNEL32 ref: 00007FF6B299AF73
ReleaseMutex.KERNEL32 ref: 00007FF6B299AF80
GlobalUnlock.KERNEL32 ref: 00007FF6B299AF9B
CloseClipboard.USER32 ref: 00007FF6B299AFA1
GetForegroundWindow.USER32 ref: 00007FF6B299AFBB
GetWindowTextW.USER32 ref: 00007FF6B299AFD8
lstrlenW.KERNEL32 ref: 00007FF6B299B00E
GetLocalTime.KERNEL32 ref: 00007FF6B299B021
wsprintfW.USER32 ref: 00007FF6B299B074
GetKeyState.USER32 ref: 00007FF6B299B153
lstrlenW.KERNEL32 ref: 00007FF6B299B1A0
lstrlenW.KERNEL32 ref: 00007FF6B299B1C1
wsprintfW.USER32 ref: 00007FF6B299B211
wsprintfW.USER32 ref: 00007FF6B299B22F
lstrlenW.KERNEL32 ref: 00007FF6B299B2A7

Strings

%s%s, xrefs: 00007FF6B299B24D
%s%s, xrefs: 00007FF6B299B207
[esc], xrefs: 00007FF6B299ADFC
[, xrefs: 00007FF6B299AEC2
%s%s, xrefs: 00007FF6B299B21B
[, xrefs: 00007FF6B299B05C

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: lstrlen$wsprintf$ClipboardFileGlobal$CloseCountTickWindow$CreateDataForegroundHandleLocalLockMutexObjectOpenPointerReleaseSingleSizeSleepStateTextTimeUnlockWaitWrite
String ID: [$[$%s%s$%s%s$%s%s$[esc]
API String ID: 3669393114-972647286
Opcode ID: d6aaf4cc0b16be0cfc139be86f6c0c07443d0355c293c4668fa737ea5698b350
Instruction ID: 1a27a18e72edd45374f11d97871fa7531853581d70632786dcf3a46713353040
Opcode Fuzzy Hash: d6aaf4cc0b16be0cfc139be86f6c0c07443d0355c293c4668fa737ea5698b350
Instruction Fuzzy Hash: 62D17E31A1864786E716FB5AE8542B933E0FF84B58F404136DB4E826AADFBCE559C700

Function 00007FF6B299D410 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 385stringtimeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00007FF6B299D437
wsprintfW.USER32 ref: 00007FF6B299D47F
lstrlenW.KERNEL32 ref: 00007FF6B299D4C5
lstrlenW.KERNEL32 ref: 00007FF6B299D4E6
lstrlenW.KERNEL32 ref: 00007FF6B299D4F9
lstrlenW.KERNEL32 ref: 00007FF6B299D58D
lstrlenW.KERNEL32 ref: 00007FF6B299D5AC
lstrlenW.KERNEL32 ref: 00007FF6B299D5BF
lstrlenW.KERNEL32 ref: 00007FF6B299D649
lstrlenW.KERNEL32 ref: 00007FF6B299D65C
CreateEventA.KERNEL32 ref: 00007FF6B299D7AD

Strings

t1:, xrefs: 00007FF6B299D652
p1:, xrefs: 00007FF6B299D4EF
o1:, xrefs: 00007FF6B299D5B5
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 00007FF6B299D471

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: lstrlen$CreateEventLocalTimewsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$o1:$p1:$t1:
API String ID: 2157945651-1225219777
Opcode ID: 4ab38958384f3d8ae6ea9e35e84b41bd479a6b61bb859707b2bd8aeb0401d26c
Instruction ID: 18c8fe5865808538b5daa0b3666987a21f8bef7e95a72fdb6e4ebce624bf4570
Opcode Fuzzy Hash: 4ab38958384f3d8ae6ea9e35e84b41bd479a6b61bb859707b2bd8aeb0401d26c
Instruction Fuzzy Hash: 56F1C762A146938AEB26BF2AD4803BD23E0FB44F98F404135DB4D97A97DFBC9551C710

Function 00007FF6B29997A0 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 118libraryloaderfileCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF6B29997D5
GetProcAddress.KERNEL32 ref: 00007FF6B29997E8
GetProcAddress.KERNEL32 ref: 00007FF6B2999816
FreeLibrary.KERNEL32 ref: 00007FF6B2999847
CreateFileW.KERNEL32 ref: 00007FF6B2999874
GetProcAddress.KERNEL32 ref: 00007FF6B29998BC
WriteFile.KERNEL32 ref: 00007FF6B2999906
CloseHandle.KERNEL32 ref: 00007FF6B299991E
Sleep.KERNEL32 ref: 00007FF6B2999931
GetProcAddress.KERNEL32 ref: 00007FF6B2999941
FreeLibrary.KERNEL32 ref: 00007FF6B299995C

Strings

wininet.dll, xrefs: 00007FF6B29997C3
InternetOpenW, xrefs: 00007FF6B29997DE
MSIE 6.0, xrefs: 00007FF6B29997F9
InternetOpenUrlW, xrefs: 00007FF6B299980C
InternetReadFile, xrefs: 00007FF6B29998B2
InternetCloseHandle, xrefs: 00007FF6B2999937

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: AddressProc$Library$FileFree$CloseCreateHandleLoadSleepWrite
String ID: InternetCloseHandle$InternetOpenUrlW$InternetOpenW$InternetReadFile$MSIE 6.0$wininet.dll
API String ID: 2977986460-1099148085
Opcode ID: b869be42eea26ef83cf2f127258845e1be2102d2018284c86f6782853b1c64bb
Instruction ID: eb66beea7fcfdf136e4d290ad66de9e0365b99b144dd67a497f2abb33d6ed6ce
Opcode Fuzzy Hash: b869be42eea26ef83cf2f127258845e1be2102d2018284c86f6782853b1c64bb
Instruction Fuzzy Hash: A641B52560964386FA22AB1BE81077A67E0FF89BE8F444135CE5E4775ADF7CD144CB40

Function 00007FF6B29A0E20 Relevance: 27.3, APIs: 18, Instructions: 322clipboardsleepmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B29AD14C: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6B29AD169
Part of subcall function 00007FF6B29AD14C: std::locale::_Setgloballocale.LIBCPMT ref: 00007FF6B29AD18C
Part of subcall function 00007FF6B29AD14C: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6B29AD221

Part of subcall function 00007FF6B29A1620: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6B29A1639
Part of subcall function 00007FF6B29A1620: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6B29A165E
Part of subcall function 00007FF6B29A1620: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6B29A1688
Part of subcall function 00007FF6B29A1620: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6B29A1722
Part of subcall function 00007FF6B29A1620: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6B29A1732
Part of subcall function 00007FF6B29A1620: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6B29A1757
Part of subcall function 00007FF6B29A1620: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6B29A1781

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B29A1062
lstrlenW.KERNEL32 ref: 00007FF6B29A1085
Sleep.KERNEL32 ref: 00007FF6B29A10E5
OpenClipboard.USER32 ref: 00007FF6B29A10FB
GetClipboardData.USER32 ref: 00007FF6B29A110A
GlobalLock.KERNEL32 ref: 00007FF6B29A111B
GlobalUnlock.KERNEL32 ref: 00007FF6B29A1136
CloseClipboard.USER32 ref: 00007FF6B29A113C
CloseClipboard.USER32 ref: 00007FF6B29A1158
OpenClipboard.USER32 ref: 00007FF6B29A1180
EmptyClipboard.USER32 ref: 00007FF6B29A118A
GlobalAlloc.KERNEL32 ref: 00007FF6B29A11A2
GlobalLock.KERNEL32 ref: 00007FF6B29A11B3
GlobalUnlock.KERNEL32 ref: 00007FF6B29A11DD
SetClipboardData.USER32 ref: 00007FF6B29A11EB
CloseClipboard.USER32 ref: 00007FF6B29A11F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B29A127E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B29A1284

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Lockitstd::_$Clipboard$GlobalLockit::_$Lockit::~_$Close_invalid_parameter_noinfo_noreturn$DataLockOpenUnlock$AllocEmptySetgloballocaleSleeplstrlenstd::locale::_
String ID:
API String ID: 1851032462-0
Opcode ID: 053006599248480e0e75eb044b7655b43ea2afb6fb7c4dc984e0c9e667b39775
Instruction ID: bb2130739c6eec51fb5ecdce3c36cacae756cda98d7a25d431ed8e5907967b56
Opcode Fuzzy Hash: 053006599248480e0e75eb044b7655b43ea2afb6fb7c4dc984e0c9e667b39775
Instruction Fuzzy Hash: C7D19362F0978782EB11AF6AE4442AD63E1FF46B98F144136EB5D8779ADE7CE4408700

Function 00007FF6B299CD40 Relevance: 26.7, APIs: 7, Strings: 8, Instructions: 406threadinjectionprocessCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 00007FF6B299CF12
CreateProcessA.KERNEL32 ref: 00007FF6B299CF6E
VirtualAllocEx.KERNEL32 ref: 00007FF6B299CF97
WriteProcessMemory.KERNEL32 ref: 00007FF6B299CFBC
GetThreadContext.KERNEL32 ref: 00007FF6B299CFE0
SetThreadContext.KERNEL32 ref: 00007FF6B299D001
ResumeThread.KERNEL32 ref: 00007FF6B299D014

Strings

@, xrefs: 00007FF6B299CF8A
%s %s, xrefs: 00007FF6B299D05B, 00007FF6B299D1EF, 00007FF6B299D2D3, 00007FF6B299D369
%s%s, xrefs: 00007FF6B299CF27
Windows\System32\svchost.exe, xrefs: 00007FF6B299CF18
h, xrefs: 00007FF6B299CEE6
994fb371-6ab9-47a0-b675-d4b4b918e869, xrefs: 00007FF6B299D262
nlyloadinmyself, xrefs: 00007FF6B299CD94
plugmark, xrefs: 00007FF6B299CE43

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Thread$ContextProcess$AllocCreateDirectoryMemoryResumeSystemVirtualWrite
String ID: %s %s$%s%s$994fb371-6ab9-47a0-b675-d4b4b918e869$@$Windows\System32\svchost.exe$h$nlyloadinmyself$plugmark
API String ID: 4033188109-1978679259
Opcode ID: 046c22b18b6f5ac0ccc3cac11c7471c69f57d2820ce8935287c8eeb1aafb36af
Instruction ID: 68087de76a85f8e4e1fea7275351914c1551d170e90e410684f3b2025e90dd2e
Opcode Fuzzy Hash: 046c22b18b6f5ac0ccc3cac11c7471c69f57d2820ce8935287c8eeb1aafb36af
Instruction Fuzzy Hash: AF12AF62B08A8286E721EF2AD4442BD67E1FB99B88F448136DB4D83B97DF7CD554C310

Function 00007FF6B299E3E9 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 64shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6B299E3E9
OpenProcessToken.ADVAPI32 ref: 00007FF6B299E3FE
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6B299E426
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6B299E44A
GetLastError.KERNEL32 ref: 00007FF6B299E450
CloseHandle.KERNEL32 ref: 00007FF6B299E45D
ExitWindowsEx.USER32 ref: 00007FF6B299E56F
GetCurrentProcess.KERNEL32 ref: 00007FF6B299E575
OpenProcessToken.ADVAPI32 ref: 00007FF6B299E58A
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6B299E5B2
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6B299E5D6
GetLastError.KERNEL32 ref: 00007FF6B299E5DC
CloseHandle.KERNEL32 ref: 00007FF6B299E5F1

Strings

SeShutdownPrivilege, xrefs: 00007FF6B299E415, 00007FF6B299E5A5

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue$ExitWindows
String ID: SeShutdownPrivilege
API String ID: 1423298842-3733053543
Opcode ID: 207f020c3be7a49f4dae7fd528dd377aaad196edefdcd6a65a6542525f0315a2
Instruction ID: 80e66701e2d224df8365a2356f4f23ab43faa0e73dc7a0cb310a33036c018801
Opcode Fuzzy Hash: 207f020c3be7a49f4dae7fd528dd377aaad196edefdcd6a65a6542525f0315a2
Instruction Fuzzy Hash: 98313235508E8385E721EF2AE8143BA67A0FB84F59F404037DB4D92666CFBDD18AC710

Function 00007FF6B29AA5A0 Relevance: 25.8, APIs: 17, Instructions: 347memoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6B299D242), ref: 00007FF6B29AA5E5
GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6B299D242), ref: 00007FF6B29AA66A
VirtualAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6B299D242), ref: 00007FF6B29AA6BF
VirtualAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6B299D242), ref: 00007FF6B29AA6DE
VirtualAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6B299D242), ref: 00007FF6B29AA741
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6B299D242), ref: 00007FF6B29AA762
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6B299D242), ref: 00007FF6B29AA776
VirtualFree.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6B299D242), ref: 00007FF6B29AA793
VirtualFree.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6B299D242), ref: 00007FF6B29AA7AF
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6B299D242), ref: 00007FF6B29AA7CC
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6B299D242), ref: 00007FF6B29AAAB2

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Virtual$Alloc$ErrorLast$FreeHeap$InfoNativeProcessSystem
String ID:
API String ID: 1282860858-0
Opcode ID: 88d7adfe9b312bdb6fdf674f549a5cc549a824bf45d913ac83d4f697423f226a
Instruction ID: 9c197ba6612529c838e08a2afdf4939395ee47ae1043f0f957f0f36ac8f0a1cc
Opcode Fuzzy Hash: 88d7adfe9b312bdb6fdf674f549a5cc549a824bf45d913ac83d4f697423f226a
Instruction Fuzzy Hash: 91D14B32F1974387EB6AAB1BD4547B962E1FB4AB88F054035CB4E87792EE7CE4418700

Function 00007FF6B299E46D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 62shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6B299E46D
OpenProcessToken.ADVAPI32 ref: 00007FF6B299E482
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6B299E4AA
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6B299E4CE
GetLastError.KERNEL32 ref: 00007FF6B299E4D4
CloseHandle.KERNEL32 ref: 00007FF6B299E4E1
ExitWindowsEx.USER32 ref: 00007FF6B299E56F
GetCurrentProcess.KERNEL32 ref: 00007FF6B299E575
OpenProcessToken.ADVAPI32 ref: 00007FF6B299E58A
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6B299E5B2
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6B299E5D6
GetLastError.KERNEL32 ref: 00007FF6B299E5DC
CloseHandle.KERNEL32 ref: 00007FF6B299E5F1

Strings

SeShutdownPrivilege, xrefs: 00007FF6B299E499, 00007FF6B299E5A5

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue$ExitWindows
String ID: SeShutdownPrivilege
API String ID: 1423298842-3733053543
Opcode ID: eb7aa2d56a82b613c27039d286a92213749df77ba304c44aa2638bc2cb38e150
Instruction ID: d820eed2a0f0b871258b18e18e6de06826e0e7220b81f63ebfdfe835cc536e34
Opcode Fuzzy Hash: eb7aa2d56a82b613c27039d286a92213749df77ba304c44aa2638bc2cb38e150
Instruction Fuzzy Hash: E5314135508E8385E721EF2AE8143BA67A0FB84F59F404037DB4D92665CFBDD19AC700

Function 00007FF6B299E4EE Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 61shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6B299E4EE
OpenProcessToken.ADVAPI32 ref: 00007FF6B299E503
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6B299E52B
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6B299E54F
GetLastError.KERNEL32 ref: 00007FF6B299E555
CloseHandle.KERNEL32 ref: 00007FF6B299E562
ExitWindowsEx.USER32 ref: 00007FF6B299E56F
GetCurrentProcess.KERNEL32 ref: 00007FF6B299E575
OpenProcessToken.ADVAPI32 ref: 00007FF6B299E58A
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF6B299E5B2
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF6B299E5D6
GetLastError.KERNEL32 ref: 00007FF6B299E5DC
CloseHandle.KERNEL32 ref: 00007FF6B299E5F1

Strings

SeShutdownPrivilege, xrefs: 00007FF6B299E51A, 00007FF6B299E5A5

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue$ExitWindows
String ID: SeShutdownPrivilege
API String ID: 1423298842-3733053543
Opcode ID: 2905a319caa5e6a93b8be62912fe952188e187deaf7a97c308075b004fe8cd81
Instruction ID: c80285f2489b602b07f5d055b110422f9c807d67484b65d5676dda725c7b0ade
Opcode Fuzzy Hash: 2905a319caa5e6a93b8be62912fe952188e187deaf7a97c308075b004fe8cd81
Instruction Fuzzy Hash: 7031FF36508E8385E721EF2AEC143AA67A0FB85F5AF404436DB4D92665DFBDD18AC700

Function 00007FF6B29C8584 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF6B29C85D2
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29C8C3E
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29C8DB4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29C9072
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29C9292
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29C94CF
memcpy_s.LIBCPMT ref: 00007FF6B29C95AA
memcpy_s.LIBCPMT ref: 00007FF6B29C9655
memcpy_s.LIBCPMT ref: 00007FF6B29C9724

Strings

1#IND, xrefs: 00007FF6B29C86BF
1#QNAN, xrefs: 00007FF6B29C86EB
1#INF, xrefs: 00007FF6B29C86FB
1#SNAN, xrefs: 00007FF6B29C86E2

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 622423286a591ad007cfa081ef015de5a4a39bf13039204cb660433145fa8b31
Instruction ID: 5a730f6528543dc74c3f7be7fc9be2f0cba8a4df4edba4c056f61ad0cb0fd496
Opcode Fuzzy Hash: 622423286a591ad007cfa081ef015de5a4a39bf13039204cb660433145fa8b31
Instruction Fuzzy Hash: 74B2D372A182938AE7269F6AD5447FC37E1FB44B8CF405535DB0D97A86DFB8A900CB40

Function 00007FF6B299B410 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 232memorytimeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 00007FF6B299B444

Part of subcall function 00007FF6B2991200: GetProcessHeap.KERNEL32 ref: 00007FF6B2991236

HeapCreate.KERNEL32 ref: 00007FF6B299B50F
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF6B299B56F
CreateEventW.KERNEL32 ref: 00007FF6B299B5A2
CreateEventW.KERNEL32 ref: 00007FF6B299B5C2
CreateEventW.KERNEL32 ref: 00007FF6B299B5E2
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF6B299B6B3
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF6B299B6C7
timeGetTime.WINMM ref: 00007FF6B299B739
CreateEventW.KERNEL32 ref: 00007FF6B299B74F
CreateEventW.KERNEL32 ref: 00007FF6B299B763

Strings

<, xrefs: 00007FF6B299B47D
<, xrefs: 00007FF6B299B484

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Create$Event$CountCriticalInitializeSectionSpin$Heap$ProcessTimetime
String ID: <$<
API String ID: 2446585644-213342407
Opcode ID: 9a1c078e3228495278893d6781b09ac20f0541c42d9d3174516128dd3c727907
Instruction ID: e5d2e84a1036d6ecb1930b09a3ac2aaf835b4e2dcf8bf815a658b6d01e62b2b7
Opcode Fuzzy Hash: 9a1c078e3228495278893d6781b09ac20f0541c42d9d3174516128dd3c727907
Instruction Fuzzy Hash: E6B14A72605B828AE745EF3AE4943A933E5FB44B08F58413CCB4D4B79ADF79A064C718

Function 00007FF6B29A0900 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 129registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF6B29A0970
RegQueryValueExW.ADVAPI32 ref: 00007FF6B29A09EF
lstrcpyW.KERNEL32 ref: 00007FF6B29A0B72
RegCloseKey.ADVAPI32 ref: 00007FF6B29A0B84
RegCloseKey.ADVAPI32 ref: 00007FF6B29A0B92

Strings

%08X, xrefs: 00007FF6B29A0B0D

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Close$OpenQueryValuelstrcpy
String ID: %08X
API String ID: 2032971926-3773563069
Opcode ID: 5daa38b5fec1510e7cc40f4dc4df9c16a8fb62c5527b438061e7080e78411b39
Instruction ID: 849c3d7b595723e30209c41d1c497a2309a2353cef6b01d49804f78b45bde32b
Opcode Fuzzy Hash: 5daa38b5fec1510e7cc40f4dc4df9c16a8fb62c5527b438061e7080e78411b39
Instruction Fuzzy Hash: 2E516272A08B8295EB71EB1AE4443ABB3E0FB85758F804135D78D83AA9DF7CD545CB04

Function 00007FF6B29C76DC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6B29BEA70: GetLastError.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEA7F
Part of subcall function 00007FF6B29BEA70: FlsGetValue.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEA94
Part of subcall function 00007FF6B29BEA70: SetLastError.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEB1F

TranslateName.LIBCMT ref: 00007FF6B29C7746
TranslateName.LIBCMT ref: 00007FF6B29C7781
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF6B29BD4D8), ref: 00007FF6B29C77C8
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF6B29BD4D8), ref: 00007FF6B29C7800
GetLocaleInfoW.KERNEL32 ref: 00007FF6B29C79BD

Strings

utf8, xrefs: 00007FF6B29C78E4

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: 8c099eda83a5c1324d953c8da46f7dcfc7382bd5fb40a4303c146f7c8692acb4
Instruction ID: c0db1d63f051833ad133387a70ca0bb2c937c5261dc281b90cd880f6cdda7b9c
Opcode Fuzzy Hash: 8c099eda83a5c1324d953c8da46f7dcfc7382bd5fb40a4303c146f7c8692acb4
Instruction Fuzzy Hash: B4917A22A0874382EB26BB2BD5416F922E8AF48F88F444531DB4DC7786DFBCE951C340

Function 00007FF6B29C8124 Relevance: 10.7, APIs: 7, Instructions: 172COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6B29BEA70: GetLastError.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEA7F
Part of subcall function 00007FF6B29BEA70: FlsGetValue.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEA94
Part of subcall function 00007FF6B29BEA70: SetLastError.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEB1F

Part of subcall function 00007FF6B29BEA70: FlsSetValue.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEAB5

GetUserDefaultLCID.KERNEL32(00000000,00000092,?,?), ref: 00007FF6B29C8294

Part of subcall function 00007FF6B29BEA70: FlsSetValue.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEAE2
Part of subcall function 00007FF6B29BEA70: FlsSetValue.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEAF3
Part of subcall function 00007FF6B29BEA70: FlsSetValue.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEB04

EnumSystemLocalesW.KERNEL32(00000000,00000092,?,?,00000000,?,?,00007FF6B29BD4D1), ref: 00007FF6B29C827B
ProcessCodePage.LIBCMT ref: 00007FF6B29C82BE
IsValidCodePage.KERNEL32 ref: 00007FF6B29C82D0
IsValidLocale.KERNEL32 ref: 00007FF6B29C82E6
GetLocaleInfoW.KERNEL32 ref: 00007FF6B29C8342
GetLocaleInfoW.KERNEL32 ref: 00007FF6B29C835E

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: f1a69095846091a71a20ee3ef6c788d879191f60c9ca7d1b933c088628ba7f76
Instruction ID: e4c8c288563e79beec6289ede86d6d28f6386cf9410cc092c4b4d35f49e53f54
Opcode Fuzzy Hash: f1a69095846091a71a20ee3ef6c788d879191f60c9ca7d1b933c088628ba7f76
Instruction Fuzzy Hash: BB718E22B14603A6FB13AB6AD8546F923E4BF44B8CF444536CB0D83686DFBCE945C350

Function 00007FF6B29AE54C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6B29AE568
RtlCaptureContext.KERNEL32 ref: 00007FF6B29AE595
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6B29AE5AF
RtlVirtualUnwind.KERNEL32 ref: 00007FF6B29AE5F0
IsDebuggerPresent.KERNEL32 ref: 00007FF6B29AE644
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6B29AE661
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6B29AE66C

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 18c7dfee12948f11b2b1ef149d65aa3e1b9c7e2d1ea7ed06afb51cbb3a88d299
Instruction ID: f8f0be035f3a8b999c5d57d9dc82820006ef0ff4dea99845267f9763f934d19c
Opcode Fuzzy Hash: 18c7dfee12948f11b2b1ef149d65aa3e1b9c7e2d1ea7ed06afb51cbb3a88d299
Instruction Fuzzy Hash: 6E316572A08B8286EB61AF65E8403ED73A4FB85748F44403ADB4D87B95EF7CD548C714

Function 00007FF6B299E36A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

OpenEventLogW.ADVAPI32 ref: 00007FF6B299E397
ClearEventLogW.ADVAPI32 ref: 00007FF6B299E3AA
CloseEventLog.ADVAPI32 ref: 00007FF6B299E3B3

Strings

Application, xrefs: 00007FF6B299E36A
Security, xrefs: 00007FF6B299E376
System, xrefs: 00007FF6B299E382

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: Application$Security$System
API String ID: 1391105993-2169399579
Opcode ID: 2cf3709b3cb76df16a2a92579992847c2f846cbe0948eda6c13293e34c808135
Instruction ID: 840aa28efede09ad0d7412a73eb552838eb33fb9054b6a9c2348aa3d20145416
Opcode Fuzzy Hash: 2cf3709b3cb76df16a2a92579992847c2f846cbe0948eda6c13293e34c808135
Instruction Fuzzy Hash: B5F0E626A09F4385EA16EB1EF45026563E4FB88BA9F040436CA4D93766EE7CD0969700

Function 00007FF6B29B3A6C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6B29B3AE5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6B29B3AFD
RtlVirtualUnwind.KERNEL32 ref: 00007FF6B29B3B38
IsDebuggerPresent.KERNEL32 ref: 00007FF6B29B3B71
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6B29B3B7B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6B29B3B86

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: e6fb25ffa18b66ffda036dc74a26e2becfae59b68bb230e1827b5a608bc93c87
Instruction ID: 2541a9e4391c02fc507910317a10ce464ad8d2a030b2e145d0abc09da740f920
Opcode Fuzzy Hash: e6fb25ffa18b66ffda036dc74a26e2becfae59b68bb230e1827b5a608bc93c87
Instruction Fuzzy Hash: A4316532618F8286DB61EF2AE8442AD73A4FB85758F540136EB9D83B59DF7CC545C700

Function 00007FF6B29C3EF0 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29C3F3C
FindFirstFileExW.KERNEL32 ref: 00007FF6B29C4046

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 116a84698524b3bcd43aaaa4f2cca2c7c536e0f4c45a8280c933762a24cf8a5b
Instruction ID: e297b0a9bd2225a690cf01676d2f86d708e81c3f01e6a69b51960cdcad77e5bd
Opcode Fuzzy Hash: 116a84698524b3bcd43aaaa4f2cca2c7c536e0f4c45a8280c933762a24cf8a5b
Instruction Fuzzy Hash: 18B1C922B1869341EA62EB2B94052B963E0EB54FE8F445131EF5D97BCADFBCE4418300

Function 00007FF6B29AC70C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6B29AC76D
IsDebuggerPresent.KERNEL32 ref: 00007FF6B29AC785
OutputDebugStringW.KERNEL32 ref: 00007FF6B29AC796

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF6B29AC78F

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: efbf15865cd5c1087f73e292c5c5f3e8b2dd5a504a7ddbe30f15df4fd023cf7f
Instruction ID: 40c2a15d593c728c5fdcd634736cdd8f141c552e451b06ce20566f6ed968cc2e
Opcode Fuzzy Hash: efbf15865cd5c1087f73e292c5c5f3e8b2dd5a504a7ddbe30f15df4fd023cf7f
Instruction Fuzzy Hash: 69112832A14B83A7E716AB2BDA543B932E4FB44749F404135C74D86AA2EFBCE074C710

Function 00007FF6B29BB350 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF6B29BB3B6
memcpy_s.LIBCPMT ref: 00007FF6B29BB3E1

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: a3a34dc7f104a5757306e0e4006adbba08ef9a00a3e13a0073f806107d450ba3
Instruction ID: 3da6521487bac6b1ec987cd933cfba66c554c8f89a6bcdb344a5f4cce6c69458
Opcode Fuzzy Hash: a3a34dc7f104a5757306e0e4006adbba08ef9a00a3e13a0073f806107d450ba3
Instruction Fuzzy Hash: 81C1E672B18686C7D725DF1AA29866AB7D1F794788F448134DF4E83B89DE7CE801CB00

Function 00007FF6B29C7BA0 Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B29BEA70: GetLastError.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEA7F
Part of subcall function 00007FF6B29BEA70: FlsGetValue.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEA94
Part of subcall function 00007FF6B29BEA70: SetLastError.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEB1F

Part of subcall function 00007FF6B29BEA70: FlsSetValue.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEAB5

GetLocaleInfoW.KERNEL32 ref: 00007FF6B29C7C0C

Part of subcall function 00007FF6B29C3D2C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29C3D49

GetLocaleInfoW.KERNEL32 ref: 00007FF6B29C7C55

Part of subcall function 00007FF6B29C3D2C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29C3DA2

GetLocaleInfoW.KERNEL32 ref: 00007FF6B29C7D1D

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: 605c002cd1232363f8b97f7bb09a672fc6956a026fdc72186da3fd3d1de90a13
Instruction ID: 9de665fa8606d9aa7323ab2bd1cfe03802591346717ad746af008caab55e38eb
Opcode Fuzzy Hash: 605c002cd1232363f8b97f7bb09a672fc6956a026fdc72186da3fd3d1de90a13
Instruction Fuzzy Hash: 18618332A0864386EB75AF2AD4402B973E9FB84B48F048135DB5ED76D6DEBCE551C700

Function 00007FF6B29C0D10 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF6B29BD6AA), ref: 00007FF6B29C0D84

Strings

GetLocaleInfoEx, xrefs: 00007FF6B29C0D2C, 00007FF6B29C0D3D

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 053289818baea42516c59c341b95a57cf593464f2c81e046735848086310e6c4
Instruction ID: 4fba6aa203e3b0156358386581501a3b6f49c63344593ba468d2f4a4e0fc5de2
Opcode Fuzzy Hash: 053289818baea42516c59c341b95a57cf593464f2c81e046735848086310e6c4
Instruction Fuzzy Hash: 2D018420B08B4385F705AB5BB4000A6A6A0AF84FD4F544036EF4D87B66CEBCD5458380

Function 00007FF6B29C3760 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6B29C39AF
RaiseException.KERNEL32 ref: 00007FF6B29C39C0

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: d1d57c0b9bdf7be1867346d5e9c7cf9c26021b93baf768b42c1e913034eff148
Instruction ID: e01cfbed420c0309a43c7aaeca74054c1cef178e610c1d543ca115dab1783425
Opcode Fuzzy Hash: d1d57c0b9bdf7be1867346d5e9c7cf9c26021b93baf768b42c1e913034eff148
Instruction Fuzzy Hash: 3AB14873618B8A8AEB1A9F2EC8463683BE0F744F48F148821DB5D837A5CF79D451C705

Function 00007FF6B29B7340 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6B29B76F0
, xrefs: 00007FF6B29B74AE

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: f4d1caadcdf6a988165dfb6027386ea397a00727bebf28c93510380ffb834353
Instruction ID: 0576c9628f1cf897b5e16c4d125b24d4cb7932a32931dbb914a528f06b1d2e37
Opcode Fuzzy Hash: f4d1caadcdf6a988165dfb6027386ea397a00727bebf28c93510380ffb834353
Instruction Fuzzy Hash: 13E1A033A0864781EB6AAE2E80581BD27E1FB45B8CF145335DB4EC7696DFADE841C740

Function 00007FF6B29BF6B0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF6B29BF7BD
gfff, xrefs: 00007FF6B29BF83A

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: 7a480f9cb63785b231e93cdb4053ba6ead140b4a31814c2e6dd1f53a1ff5a9d1
Instruction ID: 74fb86eb73b5bc173547ddf113301587a1d77e0d483a2c0f5d1b7b030424b104
Opcode Fuzzy Hash: 7a480f9cb63785b231e93cdb4053ba6ead140b4a31814c2e6dd1f53a1ff5a9d1
Instruction Fuzzy Hash: 58517962B182C646E726DE3E98487697BD1E744B98F488271DBAC87AC6CEBDD0458700

Function 00007FF6B29BA4F8 Relevance: 1.9, APIs: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF6B29BA640

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 7f0259b4a75c2d79dd05197e9e3c50a83c61ba8df8d38db5a1941d1f165b01d3
Instruction ID: 76afae96498239ccd6ee3716e4a99d15ece7c4d7a19b83c9ece9ca712d792ae1
Opcode Fuzzy Hash: 7f0259b4a75c2d79dd05197e9e3c50a83c61ba8df8d38db5a1941d1f165b01d3
Instruction Fuzzy Hash: C312AC22A08BC686E756DF3995092F973E4FB59748F059235EB9C82693EF78E181C700

Function 00007FF6B29C5D34 Relevance: 1.8, APIs: 1, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2a91221a961958e25f62bfb1168308d288fd5f56a1465658bce0cb830e97a7a
Instruction ID: 4b1362363205a2165791af3d473e631d3aba12a13662f9cb38e0ab9616636937
Opcode Fuzzy Hash: a2a91221a961958e25f62bfb1168308d288fd5f56a1465658bce0cb830e97a7a
Instruction Fuzzy Hash: 3BE14336A04B8286E721EB66E4512EE77A4FB94B88F404535DF8D93757EFB8E245C300

Function 00007FF6B2992E50 Relevance: 1.8, Strings: 1, Instructions: 571COMMON

Download Yara Rule

Strings

[RO] %ld bytes, xrefs: 00007FF6B2993450, 00007FF6B29935BB

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID: [RO] %ld bytes
API String ID: 0-772938740
Opcode ID: 2a2e8e66bac2129e6156a5cab3092c46a0c869edfc0550a0c0319ad8eb13d815
Instruction ID: 5c5f350a4bc8c8d4ab0f699596ac6792327df379571c4443c5f65a412a72af47
Opcode Fuzzy Hash: 2a2e8e66bac2129e6156a5cab3092c46a0c869edfc0550a0c0319ad8eb13d815
Instruction Fuzzy Hash: E9429D336093C58FC329CF2DD44026E7BA1F795B48F448129DB8A87B46DB78E865CB51

Function 00007FF6B29C7DE8 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B29BEA70: GetLastError.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEA7F
Part of subcall function 00007FF6B29BEA70: FlsGetValue.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEA94
Part of subcall function 00007FF6B29BEA70: SetLastError.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEB1F

Part of subcall function 00007FF6B29BEA70: FlsSetValue.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEAB5

GetLocaleInfoW.KERNEL32 ref: 00007FF6B29C7E50

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: b88317f099404d3c0d10a5a24cf9ae58312b9b643a33a099b411d16474a7bbc4
Instruction ID: b6d5a671a7b1d2ae298d5aca7c67a7caa795ecab6ce23f8b80409ac5c725924d
Opcode Fuzzy Hash: b88317f099404d3c0d10a5a24cf9ae58312b9b643a33a099b411d16474a7bbc4
Instruction Fuzzy Hash: 2F317172A0868386EB65AB2BE4413EA63E5FB44B88F444035DB4DC7697DFBCE9418700

Function 00007FF6B29C7A38 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6B29BEA70: GetLastError.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEA7F
Part of subcall function 00007FF6B29BEA70: FlsGetValue.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEA94
Part of subcall function 00007FF6B29BEA70: SetLastError.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEB1F

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF6B29C8227,00000000,00000092,?,?,00000000,?,?,00007FF6B29BD4D1), ref: 00007FF6B29C7AD6

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: ddf0bcd54fee30cee3c2fa2f3cf32a3156214357c3b61558b17e74e9ba4e1d34
Instruction ID: 34e91a7017c3ebf6bf7ccca439bad61011afb48a8244e6c46f02852cc60cffc9
Opcode Fuzzy Hash: ddf0bcd54fee30cee3c2fa2f3cf32a3156214357c3b61558b17e74e9ba4e1d34
Instruction Fuzzy Hash: 8211C367A086468AEB16AF2AD4806A877E5FB40FE4F444135C72DC32C1DEACD6D1C740

Function 00007FF6B29C7FF0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B29BEA70: GetLastError.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEA7F
Part of subcall function 00007FF6B29BEA70: FlsGetValue.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEA94
Part of subcall function 00007FF6B29BEA70: SetLastError.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEB1F

GetLocaleInfoW.KERNEL32(?,?,?,00007FF6B29C7D9A), ref: 00007FF6B29C8027

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 4756a55a6f6df2e1738916ac1a71c6225747ce609875c26223506d2cfc4742c0
Instruction ID: d87a402b51041a3c123f398a658b06beed6bdfcac439a66c3f57105946e51ef2
Opcode Fuzzy Hash: 4756a55a6f6df2e1738916ac1a71c6225747ce609875c26223506d2cfc4742c0
Instruction Fuzzy Hash: 2F112B31B1855393E767E62AA0406BA62D1FB40B78F544B31D76E836C6DEAAD8818700

Function 00007FF6B29C7B08 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF6B29BEA70: GetLastError.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEA7F
Part of subcall function 00007FF6B29BEA70: FlsGetValue.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEA94
Part of subcall function 00007FF6B29BEA70: SetLastError.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEB1F

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF6B29C81E3,00000000,00000092,?,?,00000000,?,?,00007FF6B29BD4D1), ref: 00007FF6B29C7B86

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: bc703af400f14b42b20c9fcb5047461b7f50c903457c8d4997ca4285d83e45ea
Instruction ID: e9549d4f2e6e465702f357609d7352dc48ae1d1930abe47062e25eced3ce487d
Opcode Fuzzy Hash: bc703af400f14b42b20c9fcb5047461b7f50c903457c8d4997ca4285d83e45ea
Instruction Fuzzy Hash: FB01D272E0828246E7126B1AE4407B972EAEF40FA8F459236D72DC32C6DEAC94818700

Function 00007FF6B29C0838 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF6B29C0CDF,?,?,?,?,?,?,?,?,00000000,00007FF6B29C7088), ref: 00007FF6B29C0887

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 0da49028f00012ccddbac4aa6a8129618cfbebd136c027dc8325545b3ece71c8
Instruction ID: 0acb5b8f6e79fa8003aad5e9a8a770bb99e7239bc7840e235bc2bd15c0f432aa
Opcode Fuzzy Hash: 0da49028f00012ccddbac4aa6a8129618cfbebd136c027dc8325545b3ece71c8
Instruction Fuzzy Hash: 36F06D71A18A4282E605EB1AE8902A923A1FB88BC4F548035EB5DC3366CE7CD9958340

Function 00007FF6B29BF21C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF6B29BF55E

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 172941b2f1d4039ba21c6dc8853c143536a16ca8654b5df5f12dde2487208479
Instruction ID: cac8eb6cc3c29e6feb43c9cb2f883072e81ff6e202348a010fc874bf7f0dc4c1
Opcode Fuzzy Hash: 172941b2f1d4039ba21c6dc8853c143536a16ca8654b5df5f12dde2487208479
Instruction Fuzzy Hash: 30A12762A0878646EB22DF2AA4087BD77D5EB54BC8F048131EF8D87786DEBDD501C701

Function 00007FF6B29B65AC Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

, xrefs: 00007FF6B29B678E

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 6871d27396c91e0bed272bc22aae0ea20e11987830d478801ef476eeb5b70fb8
Instruction ID: 514d8d71a94d3d01542ed911a430fb81614f60df34ec2395fc6dbf911932677a
Opcode Fuzzy Hash: 6871d27396c91e0bed272bc22aae0ea20e11987830d478801ef476eeb5b70fb8
Instruction Fuzzy Hash: FEB15B7290879686EB66AF2EC09823C3BE0E749B4CF244135CB4D87796CFA9E441DB45

Function 00007FF6B29C2744 Relevance: 1.4, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6B29C27E9

Part of subcall function 00007FF6B29C0788: HeapAlloc.KERNEL32(?,?,00000000,00007FF6B29BEC4A,?,?,00005315DED5DA85,00007FF6B29B8B05,?,?,?,?,00007FF6B29C2546,?,?,00000000), ref: 00007FF6B29C07DD

Part of subcall function 00007FF6B29BE6BC: RtlFreeHeap.NTDLL(?,?,?,00007FF6B29C65C2,?,?,?,00007FF6B29C693F,?,?,00000000,00007FF6B29C6D85,?,?,?,00007FF6B29C6CB7), ref: 00007FF6B29BE6D2
Part of subcall function 00007FF6B29BE6BC: GetLastError.KERNEL32(?,?,?,00007FF6B29C65C2,?,?,?,00007FF6B29C693F,?,?,00000000,00007FF6B29C6D85,?,?,?,00007FF6B29C6CB7), ref: 00007FF6B29BE6DC

Part of subcall function 00007FF6B29C9FAC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29C9FDF

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ErrorHeapLast$AllocFree_invalid_parameter_noinfo
String ID:
API String ID: 916656526-0
Opcode ID: c069c10827176b9df77e9eacd146a24f3ebe0e1c557e8cf5116eb7accc2f9201
Instruction ID: a035f2871c589b85438ff73884e0ceb3ed1e89048af237ce6fc44099daf50948
Opcode Fuzzy Hash: c069c10827176b9df77e9eacd146a24f3ebe0e1c557e8cf5116eb7accc2f9201
Instruction Fuzzy Hash: 2841CE21F0D74342FA62BA2F68516BAA6D07F95F88F444535EF8D87787EEBCE4018600

Function 00007FF6B29A9250 Relevance: .7, Instructions: 678COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9d3e26cd520c0d7484bca21c75386a0081201fe8f2cf936fcf25e5b7a4aa551
Instruction ID: a5ab865a3540ee3158ec47449b2c85723a159fe035d8fc19690b2dc1e64cda1e
Opcode Fuzzy Hash: f9d3e26cd520c0d7484bca21c75386a0081201fe8f2cf936fcf25e5b7a4aa551
Instruction Fuzzy Hash: 1E22CEB7B3805047D36DCB1DEC52FA97692B7A5308748A02CBA07C3F45EA3DEA458A44

Function 00007FF6B29A78F0 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dbab6f601d912f7832fe87e6cb8010b159b99cec89eaaed4f22644e13967388
Instruction ID: 1b2d150ef7b717b48b68882bf9403456f580bb4c66b2db73783112dafc4714af
Opcode Fuzzy Hash: 2dbab6f601d912f7832fe87e6cb8010b159b99cec89eaaed4f22644e13967388
Instruction Fuzzy Hash: 9AC1CC73B0869287EB0ACE2AD9515BD7792BBC5BD4B55C134DB4A87B89DE3C9801CB00

Function 00007FF6B29B6F3C Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe8ec01f60584a1ee149ae2a08fff37cdae008ac808ef4f9df4273de0df04db
Instruction ID: 3ab84d2548cdc458783c0249e81b00837227122a6b652c856c4e2cd4585f6f13
Opcode Fuzzy Hash: 4fe8ec01f60584a1ee149ae2a08fff37cdae008ac808ef4f9df4273de0df04db
Instruction Fuzzy Hash: 4AD1B123A0864785EB6AAA2F84582BD27E0EB45B4CF144336DF0DC7696DFBDE845C340

Function 00007FF6B29BD320 Relevance: .3, Instructions: 310COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: 8a64524f1fb9e6959651956f91e34aa30073aa11383fd560e196b95c26644943
Instruction ID: 497a930b4a76943837158dabe66784c9083bcab6301dddb20b0f4f0dab44eb6e
Opcode Fuzzy Hash: 8a64524f1fb9e6959651956f91e34aa30073aa11383fd560e196b95c26644943
Instruction Fuzzy Hash: 5FC1D366A0868385EB65AB6B94143FA27E0FB94B8CF404035DF4DC7A8ADFBCE545C710

Function 00007FF6B29C714C Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ErrorLast$Value_invalid_parameter_noinfo
String ID:
API String ID: 1500699246-0
Opcode ID: 40463cb8fd89e5f38144c8e404f20e2a32259e43623898d7ad92a87b920fc9c4
Instruction ID: 10af15968fe523998db66456edcb90b37632e8c37666b9ec7784ff37c3f0c708
Opcode Fuzzy Hash: 40463cb8fd89e5f38144c8e404f20e2a32259e43623898d7ad92a87b920fc9c4
Instruction Fuzzy Hash: B3B1A122A1864782EB66AB2AD4116F923E5EB50F8CF504235EF5DC368ADFBCE5418740

Function 00007FF6B29B6228 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe3a20954eaf19cca18b720aca6cea66dcaf64d55a17c7986fbc43ae61592d0
Instruction ID: 5f44a8613c41acaf458fe7b1f5e5987bd8ff66735f46ac5f0dc90217d7a79690
Opcode Fuzzy Hash: 4fe3a20954eaf19cca18b720aca6cea66dcaf64d55a17c7986fbc43ae61592d0
Instruction Fuzzy Hash: 87B17F72908A4685EB669F2EC05827C3BE1F749F4CF284139CB4E8739ACFA9E451C744

Function 00007FF6B29BAC80 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7c967eb539ab6c81368948c69a9b6320c10fa2f7b73efbe3c4b6df7895ae468e
Instruction ID: d7d68ab94ed36a5957a8c27275b4886ef9341d59ae026a16ee8287179fc34879
Opcode Fuzzy Hash: 7c967eb539ab6c81368948c69a9b6320c10fa2f7b73efbe3c4b6df7895ae468e
Instruction Fuzzy Hash: 4F81A372A04A1286EB65EE2AD4853BD23A0FB84B9CF444636EF5DC7786DF7CD4418304

Function 00007FF6B29BFD30 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa2f4ae56baf169408e60df2444458542a3c73068db43e6345bf2ec4a63d4b14
Instruction ID: 5b0f2d872feba363dcc24fa4d8250cbee7632048de62ca105945bf76e5d0096b
Opcode Fuzzy Hash: aa2f4ae56baf169408e60df2444458542a3c73068db43e6345bf2ec4a63d4b14
Instruction Fuzzy Hash: 6E81B572A0878246E775EF1E944837976D1FB86798F144239EB8D87B9ADF7CD4408B00

Function 00007FF6B29A2EC0 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6f6a1a1a1cf9baf0de81f1e4df80e775a01d7d2970379cd065fadcfc056c7f6
Instruction ID: 1fc06f9b3dfa3e94764cebdcf93304a34fb8e3ac0e30fa707c974b67fce4a1f9
Opcode Fuzzy Hash: f6f6a1a1a1cf9baf0de81f1e4df80e775a01d7d2970379cd065fadcfc056c7f6
Instruction Fuzzy Hash: 90610962F14B8A82DF218F1EE4411B963A0F75A784F545231EB9C87B55EF7DE180C340

Function 00007FF6B29B536C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 15715bbdd8e5d0eb956d3e93c95e72f1355f79a7c084728d55a7b8b5b8063c15
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: 54519572A28652C6E7269B2ED05823833E1EB44F5DF249131DB4D97796CFBAE843C740

Function 00007FF6B29B4F5C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 43a7e9fc15fd525c9e960642e1836e19fed5c6d5a8fad0b7380631145e62aa9d
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: 9F518336A2865782E7259F2EC05822837E0EB45B5CF245131CF4D977A6CF7AE853D780

Function 00007FF6B29B577C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: d403bc84e49303b5c7560f50e762255abaa56136e852505e4fb3ca72d16a841b
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: 39514576A24652C6EB269B2EC05822837E1EB58B6CF244131CF4D97796CF7AE853C740

Function 00007FF6B29B5168 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6a3dccb135ddd09f63c505db29ff29986bf9dd63497299e7c799fac6b959aa4
Instruction ID: 625187136cbf02163f85c0a95e02ff70bc972f91ab6f64cc38e8d7976bc08328
Opcode Fuzzy Hash: f6a3dccb135ddd09f63c505db29ff29986bf9dd63497299e7c799fac6b959aa4
Instruction Fuzzy Hash: 6D518276A2965286E7669B2ED04823837E0EB58B5CF244131CF4D97796CFBAEC43C740

Function 00007FF6B29B4D58 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db363646d287334b7a31293e9082935613ba5dde14aee32d187fc7345eaa1eeb
Instruction ID: 421e74106888e0c0af70065e3cf36223c04f10440b62515ec375bad51138c197
Opcode Fuzzy Hash: db363646d287334b7a31293e9082935613ba5dde14aee32d187fc7345eaa1eeb
Instruction Fuzzy Hash: 8A51B736A1465686E7269B2EC05833937E0EB44F5CF246131CF4C97796CF7AE852D780

Function 00007FF6B29B5578 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e46230d8c0bb23a9b26f12389beaf27d8e9063d4bba2e4d98de2a57eaa924be5
Instruction ID: 2d77fd0261134bf2f8db9080c197fcbfc7d16a9defa84e2e98665d8d673227f4
Opcode Fuzzy Hash: e46230d8c0bb23a9b26f12389beaf27d8e9063d4bba2e4d98de2a57eaa924be5
Instruction Fuzzy Hash: 6C517276A28652C6E7269B2EC04822937E1EB44F5CF244131CF4D977A6CFBAE843C740

Function 00007FF6B29BC51C Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4d1d88932efd7b63ecfdde29945dfc17fd218d95b7e0763bafd054a92f058063
Instruction ID: 8ce5ad92a17d14d90394385194e157015fd719384cbddaf4b310bdc0a1f2c950
Opcode Fuzzy Hash: 4d1d88932efd7b63ecfdde29945dfc17fd218d95b7e0763bafd054a92f058063
Instruction Fuzzy Hash: F641E172724A5686EB04DF2BD92826973E1BB48FD4B48A032EF0D97B59DE7CC5418300

Function 00007FF6B29CC8C0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8325bb8896eb9c8ae2d46c5932a003c3c7f8bfc008283704c68a5069cd28ac66
Instruction ID: cba72152f41ce78a5e9b832c674daed4676a35a5061068dd284ae6aa649e34c2
Opcode Fuzzy Hash: 8325bb8896eb9c8ae2d46c5932a003c3c7f8bfc008283704c68a5069cd28ac66
Instruction Fuzzy Hash: 62F06871B282568ADB99AF2DA402A2977E0F708394F408539D6CDC7F05DE7C94668F04

Function 00007FF6B29AE6F4 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 174bfe62ffdb35f0a8b82215b8c446e4258c47945d5cfe3425f7157a53489505
Instruction ID: 646923c4f4139efc29af49fb64a25228d40d912ec7d2af674f14d60b99619362
Opcode Fuzzy Hash: 174bfe62ffdb35f0a8b82215b8c446e4258c47945d5cfe3425f7157a53489505
Instruction Fuzzy Hash: 86A002A1D0CD17E0EB0AAB0AE95503023B0FB51748B410032D35DC1062EFBCB901C301

Function 00007FF6B2994C50 Relevance: 33.2, APIs: 22, Instructions: 199windowthreadnetworkCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF6B2994C65
SwitchToThread.KERNEL32 ref: 00007FF6B2994C9D
SetLastError.KERNEL32 ref: 00007FF6B2994CDC
SetEvent.KERNEL32 ref: 00007FF6B2994D17
MsgWaitForMultipleObjects.USER32 ref: 00007FF6B2994D4B
PeekMessageW.USER32 ref: 00007FF6B2994D66
TranslateMessage.USER32 ref: 00007FF6B2994D75
DispatchMessageW.USER32 ref: 00007FF6B2994D80
PeekMessageW.USER32 ref: 00007FF6B2994D97
CloseHandle.KERNEL32 ref: 00007FF6B2994DC4
send.WS2_32 ref: 00007FF6B2994E01
SetEvent.KERNEL32 ref: 00007FF6B2994E18
WSACloseEvent.WS2_32 ref: 00007FF6B2994E2D
shutdown.WS2_32 ref: 00007FF6B2994E49
closesocket.WS2_32 ref: 00007FF6B2994E53
EnterCriticalSection.KERNEL32 ref: 00007FF6B2994E70
ResetEvent.KERNEL32 ref: 00007FF6B2994E7D
ResetEvent.KERNEL32 ref: 00007FF6B2994E8A
ResetEvent.KERNEL32 ref: 00007FF6B2994E97
SetEvent.KERNEL32 ref: 00007FF6B2994F2C
LeaveCriticalSection.KERNEL32 ref: 00007FF6B2994F39
SetLastError.KERNEL32 ref: 00007FF6B2994F79

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Event$Message$Reset$CloseCriticalErrorLastPeekSectionThread$CurrentDispatchEnterHandleLeaveMultipleObjectsSwitchTranslateWaitclosesocketsendshutdown
String ID:
API String ID: 4058177064-0
Opcode ID: 1d5cc57fb7fbf7527f04433d1c2939eb4b1b6e6938b0e21f75a258dbfa576023
Instruction ID: 2094812f2dca2a3118d19ae292024128771db1e20077e0a2ce8f8851a4cc3103
Opcode Fuzzy Hash: 1d5cc57fb7fbf7527f04433d1c2939eb4b1b6e6938b0e21f75a258dbfa576023
Instruction Fuzzy Hash: 12917C36B08A839BE75AAB2AD5442A973E4FB44B58F005536CB6DC3692CF7CE474C710

Function 00007FF6B29A06A0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 140stringprocessCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF6B29A0718
lstrlenW.KERNEL32 ref: 00007FF6B29A073A
wsprintfW.USER32 ref: 00007FF6B29A07A2
ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6B29A0806
lstrcatW.KERNEL32 ref: 00007FF6B29A0841
lstrcatW.KERNEL32 ref: 00007FF6B29A084E
lstrcpyW.KERNEL32 ref: 00007FF6B29A085C
CreateProcessW.KERNEL32 ref: 00007FF6B29A08DB

Strings

h, xrefs: 00007FF6B29A0865
WinSta0\Default, xrefs: 00007FF6B29A0893
"%1, xrefs: 00007FF6B29A080C
%s\shell\open\command, xrefs: 00007FF6B29A0794

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: lstrcatlstrlen$CreateEnvironmentExpandProcessStringslstrcpywsprintf
String ID: "%1$%s\shell\open\command$WinSta0\Default$h
API String ID: 1783372451-551013563
Opcode ID: 2aa4d3ebf5c45bd74505c1267e1058c2c24ed9b570e41b1434e0a24903c1c98a
Instruction ID: b71557b61de371177dbb69fe9b21de7d73455ae5248c8c4f6c9b7f926d3eac1f
Opcode Fuzzy Hash: 2aa4d3ebf5c45bd74505c1267e1058c2c24ed9b570e41b1434e0a24903c1c98a
Instruction Fuzzy Hash: 08616222E18B4395FB21EB6AD8542ED23A1FB8974CF444136DB4D83A9ADFBCD244C750

Function 00007FF6B2994270 Relevance: 21.1, APIs: 14, Instructions: 119networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF6B299429F
WSAIoctl.WS2_32 ref: 00007FF6B29942F8
setsockopt.WS2_32 ref: 00007FF6B299431D
setsockopt.WS2_32 ref: 00007FF6B2994342
WSACreateEvent.WS2_32 ref: 00007FF6B2994348
lstrlenW.KERNEL32 ref: 00007FF6B2994355
WideCharToMultiByte.KERNEL32 ref: 00007FF6B2994378
lstrlenW.KERNEL32 ref: 00007FF6B2994390
WideCharToMultiByte.KERNEL32 ref: 00007FF6B29943B3
gethostbyname.WS2_32 ref: 00007FF6B29943C0
htons.WS2_32 ref: 00007FF6B29943ED
WSAEventSelect.WS2_32 ref: 00007FF6B2994413
connect.WS2_32 ref: 00007FF6B299442D
WSAGetLastError.WS2_32 ref: 00007FF6B299443C

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ByteCharEventMultiWidelstrlensetsockopt$CreateErrorIoctlLastSelectconnectgethostbynamehtonssocket
String ID:
API String ID: 1455939504-0
Opcode ID: 4ac987161481c806979eb549acd9b2fb4a9050b8bf4fb52e0da1e9413c634ef5
Instruction ID: 05c04ed34cea952c4d2b45cc578ada9436a5b2e47f40553e30fe916b0d8156f9
Opcode Fuzzy Hash: 4ac987161481c806979eb549acd9b2fb4a9050b8bf4fb52e0da1e9413c634ef5
Instruction Fuzzy Hash: B5515332608B9286E721DF26E84426977E5FB85FA8F100236EB9D83B99CF7CD555C700

Function 00007FF6B29A1620 Relevance: 18.2, APIs: 12, Instructions: 153COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6B29A1639
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6B29A165E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6B29A1688
std::_Facet_Register.LIBCPMT ref: 00007FF6B29A1708
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6B29A1722
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6B29A1732
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6B29A1757
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6B29A1781
std::_Facet_Register.LIBCPMT ref: 00007FF6B29A17F7
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6B29A1811
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B29A182A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B29A1830

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 86a4ff4925cbc545ad5961b211c5cb2ede80d6a6447645a52bcc9b3ede11fd42
Instruction ID: cbfbbad254b51b88e3981da847553213691430b1127b2aba1316c20f853acb8f
Opcode Fuzzy Hash: 86a4ff4925cbc545ad5961b211c5cb2ede80d6a6447645a52bcc9b3ede11fd42
Instruction Fuzzy Hash: 9A512D31E18B4785EB16FB1ED44417923E1FB56B98F180232DB6E876A6DFACE446C700

Function 00007FF6B29946A0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 171networktimeCOMMON

Download Yara Rule

APIs

WSAEnumNetworkEvents.WS2_32 ref: 00007FF6B29946C7
WSAGetLastError.WS2_32 ref: 00007FF6B29946D8
WSAResetEvent.WS2_32 ref: 00007FF6B2994717
WSAEventSelect.WS2_32 ref: 00007FF6B299479C
WSAGetLastError.WS2_32 ref: 00007FF6B29947A7
timeGetTime.WINMM ref: 00007FF6B29947D2
timeGetTime.WINMM ref: 00007FF6B299481D
send.WS2_32 ref: 00007FF6B2994852
WSAGetLastError.WS2_32 ref: 00007FF6B299485D

Strings

, xrefs: 00007FF6B29948F8

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ErrorLast$EventTimetime$EnumEventsNetworkResetSelectsend
String ID:
API String ID: 957247320-3916222277
Opcode ID: 70faab5df619376ecbd789658116d1a95d03484d4b81b7d6c2cb32eb3eab3399
Instruction ID: 0d48ab2f72568117b720ffec591f90a431d480650c11294a1172a018925a4fde
Opcode Fuzzy Hash: 70faab5df619376ecbd789658116d1a95d03484d4b81b7d6c2cb32eb3eab3399
Instruction Fuzzy Hash: CA714D72A086828BE7629F2AD58436977E0FB48B6CF145035CB4DC3697CFBDE4658B40

Function 00007FF6B2995A80 Relevance: 16.7, APIs: 11, Instructions: 154networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6B2995AC4
WSASetLastError.WS2_32 ref: 00007FF6B2995C69
LeaveCriticalSection.KERNEL32 ref: 00007FF6B2995C73

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: ce0fa88aebe3efe6d4cfa5056a018ff2338e1d011f624170396f62e2d62db8ee
Instruction ID: 948d517b78a46e0401e3f0304be8f3ba3ede22d3a8bde2c91774a7a5fcd8f46e
Opcode Fuzzy Hash: ce0fa88aebe3efe6d4cfa5056a018ff2338e1d011f624170396f62e2d62db8ee
Instruction Fuzzy Hash: A961A032B186438AE756AB1AD44867E63A5FB84B99F804031CB1EC3693EF7CE465C300

Function 00007FF6B2995090 Relevance: 16.6, APIs: 11, Instructions: 87COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6B29950F5
LeaveCriticalSection.KERNEL32 ref: 00007FF6B2995107
SetLastError.KERNEL32 ref: 00007FF6B29951DB

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: b12bcef403b9db2977f705d0ecef41abbd2038a6eeb512479f31e0cb207d576e
Instruction ID: 0a4de56c420fe3e2c06225113054ddb241a53e9afba9381d1fd0fa9306bc7a0a
Opcode Fuzzy Hash: b12bcef403b9db2977f705d0ecef41abbd2038a6eeb512479f31e0cb207d576e
Instruction Fuzzy Hash: 41316221718A438BE76AAB1F948C17A22E5FF45B99F140035DB4EC6693CFACE465CB00

Function 00007FF6B29A0BC0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 52registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF6B29A0C11
RegDeleteValueW.ADVAPI32 ref: 00007FF6B29A0C1F
RegCloseKey.ADVAPI32 ref: 00007FF6B29A0C2A
RegCreateKeyW.ADVAPI32 ref: 00007FF6B29A0C4A
lstrlenW.KERNEL32 ref: 00007FF6B29A0C57
RegSetValueExW.ADVAPI32 ref: 00007FF6B29A0C79
RegCloseKey.ADVAPI32 ref: 00007FF6B29A0C84

Strings

Software, xrefs: 00007FF6B29A0BF3
VenNetwork, xrefs: 00007FF6B29A0BE9

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CloseValue$CreateDeleteOpenlstrlen
String ID: Software$VenNetwork
API String ID: 3197061591-1820303132
Opcode ID: 977d34d6a8543d540e474d7a41a606a027e4303f67bb5f64f5b8d5885a1a35b1
Instruction ID: 9522f6a6f8ef5f71867de2d1e2056e84daea1f795f76a377b84de2527101c591
Opcode Fuzzy Hash: 977d34d6a8543d540e474d7a41a606a027e4303f67bb5f64f5b8d5885a1a35b1
Instruction Fuzzy Hash: 61214F36608A8186E711EF26E844359B3A1FB98FE5F444132DE4D87B69DFBCD149CB04

Function 00007FF6B2995FC0 Relevance: 15.1, APIs: 10, Instructions: 140COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF6B2995FE4
EnterCriticalSection.KERNEL32 ref: 00007FF6B2996004
SetLastError.KERNEL32 ref: 00007FF6B2996016
LeaveCriticalSection.KERNEL32 ref: 00007FF6B299606F

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: f55aaaeb9bf5abb5e56e4c07576fdde1d1ad88dce2b004d0039bc8ed51f55d31
Instruction ID: 154b950a411a559e18c2bbafed40b6c92521117d5c15c6f7f17b5d6a02a75203
Opcode Fuzzy Hash: f55aaaeb9bf5abb5e56e4c07576fdde1d1ad88dce2b004d0039bc8ed51f55d31
Instruction Fuzzy Hash: 4751BC32A086428BE765AB1AE44467C77E5FB48B98F05413ADB4E87393DF7CE815CB40

Function 00007FF6B29B45E0 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29B4620
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29B49E8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29B4C87

Strings

f, xrefs: 00007FF6B29B486D
p, xrefs: 00007FF6B29B472A
f, xrefs: 00007FF6B29B4722
f, xrefs: 00007FF6B29B46B8
p, xrefs: 00007FF6B29B46C5

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 338c2a64cdc3021812c5b6ddca5db7159329e9a17ba8d876efc02d9e71b2fbd5
Instruction ID: 6c34db3235cfe950e5ff448e9d8afe17d0d161fae04803a50ab946daafab1308
Opcode Fuzzy Hash: 338c2a64cdc3021812c5b6ddca5db7159329e9a17ba8d876efc02d9e71b2fbd5
Instruction Fuzzy Hash: 0F12D625A0C14386FB25BE1ED06C3B972D1FB80B58F945135E78D866CADFBCE480AB15

Function 00007FF6B2994080 Relevance: 13.6, APIs: 9, Instructions: 111timenetworkCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32 ref: 00007FF6B29940C6
setsockopt.WS2_32 ref: 00007FF6B2994165
setsockopt.WS2_32 ref: 00007FF6B299418F
ResetEvent.KERNEL32 ref: 00007FF6B29941DE
SetLastError.KERNEL32 ref: 00007FF6B299420A
WSAGetLastError.WS2_32 ref: 00007FF6B2994216
SetLastError.KERNEL32 ref: 00007FF6B2994228
GetLastError.KERNEL32 ref: 00007FF6B2994241
SetLastError.KERNEL32 ref: 00007FF6B2994253

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ErrorLast$setsockopt$CreateEventResetTimerWaitable
String ID:
API String ID: 2911610646-0
Opcode ID: 38ec76155e6582f6451855719efb9cc3d848e3c7da57bc883881785bdfc9cc07
Instruction ID: 8e194fb7e094836520ceadfd59c68091a130f855381a2f30509ad550ed8064a2
Opcode Fuzzy Hash: 38ec76155e6582f6451855719efb9cc3d848e3c7da57bc883881785bdfc9cc07
Instruction Fuzzy Hash: 65515D72A05A829BE716AF2AE50436D73E0FB48759F000136DB4C97792DFBDE0758B00

Function 00007FF6B2995D10 Relevance: 13.6, APIs: 9, Instructions: 93timenetworkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,-00000004,00007FF6B29949B9), ref: 00007FF6B2995D5E
timeGetTime.WINMM(?,?,-00000004,00007FF6B29949B9), ref: 00007FF6B2995D95
LeaveCriticalSection.KERNEL32(?,?,-00000004,00007FF6B29949B9), ref: 00007FF6B2995DB5
timeGetTime.WINMM(?,?,-00000004,00007FF6B29949B9), ref: 00007FF6B2995DFA
SetEvent.KERNEL32 ref: 00007FF6B2995E27
LeaveCriticalSection.KERNEL32 ref: 00007FF6B2995E3B
WSASetLastError.WS2_32(?,?,-00000004,00007FF6B29949B9), ref: 00007FF6B2995E52
LeaveCriticalSection.KERNEL32(?,?,-00000004,00007FF6B29949B9), ref: 00007FF6B2995E61
WSASetLastError.WS2_32(?,?,-00000004,00007FF6B29949B9), ref: 00007FF6B2995E73

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CriticalSection$Leave$ErrorLastTimetime$EnterEvent
String ID:
API String ID: 3019579578-0
Opcode ID: 0f5c7540d6a6d13954bf3b0610fbdb20e4227d3d9c7ae04a05d2493569245aae
Instruction ID: 637cdd6b80dd6208882207a84e317ccfb9e61679e3e2a7a63339064c9631d077
Opcode Fuzzy Hash: 0f5c7540d6a6d13954bf3b0610fbdb20e4227d3d9c7ae04a05d2493569245aae
Instruction Fuzzy Hash: 724130329186438BE762AB1AD44823E73A5FB84B58F140135D74EC3A93DFBDF8918700

Function 00007FF6B2995E90 Relevance: 13.6, APIs: 9, Instructions: 77COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF6B2995EAA
TryEnterCriticalSection.KERNEL32 ref: 00007FF6B2995ECB
TryEnterCriticalSection.KERNEL32 ref: 00007FF6B2995EDD
SetLastError.KERNEL32 ref: 00007FF6B2995EF6
LeaveCriticalSection.KERNEL32 ref: 00007FF6B2995F00
LeaveCriticalSection.KERNEL32 ref: 00007FF6B2995F0A

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 67fb679d431cd07a0a75245ad9faae6b58536de87acf8e54a525854fe2ab2b98
Instruction ID: 767746adf16e24533f143b7a4f3ad2b36d2e9e685c36265dd508a14fb45f2410
Opcode Fuzzy Hash: 67fb679d431cd07a0a75245ad9faae6b58536de87acf8e54a525854fe2ab2b98
Instruction Fuzzy Hash: 2731F932A289838AE791AB2AD44826933E4FB44B5DF440031DB0EC6696DFBDD869C701

Function 00007FF6B29B0C08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6B29B0C65

Part of subcall function 00007FF6B29B2FC8: __GetUnwindTryBlock.LIBCMT ref: 00007FF6B29B300B
Part of subcall function 00007FF6B29B2FC8: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6B29B3030

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6B29B0D3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6B29B0F8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6B29B1098

Strings

csm, xrefs: 00007FF6B29B0C7F
csm, xrefs: 00007FF6B29B0CE6
csm, xrefs: 00007FF6B29B0D60

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 2b2ef099c7c498c1f83d83cf8365c45f4a2add1e44776cae4b3bb5ec5925f551
Instruction ID: 56c0701d7f2eb6a2055bf671a97ace91e2efb3e551ea3efe2ba9bf91197b356c
Opcode Fuzzy Hash: 2b2ef099c7c498c1f83d83cf8365c45f4a2add1e44776cae4b3bb5ec5925f551
Instruction Fuzzy Hash: 8ED16F22A087428AEB21AB6A94893AD77E0FB4578CF100135EF8D97796DF78E181C740

Function 00007FF6B29C08B4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FF6B29C0A30
GetProcAddress.KERNEL32 ref: 00007FF6B29C0A3C

Strings

api-ms-, xrefs: 00007FF6B29C097A
ext-ms-, xrefs: 00007FF6B29C098D

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 7440c042807cac739352953deb803b73dd017de38a4217708bea05fa604c5186
Instruction ID: 8b6f3688860991290be1d0eec153f371c0680022553644b5cb1dcec4179caef4
Opcode Fuzzy Hash: 7440c042807cac739352953deb803b73dd017de38a4217708bea05fa604c5186
Instruction Fuzzy Hash: 8741E521B19A0385FA2BEB1BD81427622D5BF44FA8F484136DF0DD7796EEBCE4458300

Function 00007FF6B299E01F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 94filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF6B299E0E9
WriteFile.KERNEL32 ref: 00007FF6B299E119
CloseHandle.KERNEL32 ref: 00007FF6B299E12A
lstrlenW.KERNEL32 ref: 00007FF6B299E135
wsprintfW.USER32 ref: 00007FF6B299E159
lstrcpyW.KERNEL32 ref: 00007FF6B299E168

Part of subcall function 00007FF6B29A06A0: lstrlenW.KERNEL32 ref: 00007FF6B29A0718
Part of subcall function 00007FF6B29A06A0: wsprintfW.USER32 ref: 00007FF6B29A07A2
Part of subcall function 00007FF6B29A06A0: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6B29A0806
Part of subcall function 00007FF6B29A06A0: lstrcatW.KERNEL32 ref: 00007FF6B29A0841
Part of subcall function 00007FF6B29A06A0: lstrcatW.KERNEL32 ref: 00007FF6B29A084E

Strings

%s %s, xrefs: 00007FF6B299E152

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Filelstrcatlstrlenwsprintf$CloseCreateEnvironmentExpandHandleStringsWritelstrcpy
String ID: %s %s
API String ID: 958574092-2939940506
Opcode ID: eceb82c3cd3af4ca55499d5fe9bd5fadc0488819e054981a88d383308b1fa06d
Instruction ID: 57fec25729c6b4d4955641e3a7dba262d78f2e0ad07448c0b29684dcdab6fd85
Opcode Fuzzy Hash: eceb82c3cd3af4ca55499d5fe9bd5fadc0488819e054981a88d383308b1fa06d
Instruction Fuzzy Hash: D4415122A18BC686E7219F2DD9042FC2360F795B5CF51A322DB8C56653EF79E2D6C700

Function 00007FF6B2994A90 Relevance: 12.1, APIs: 8, Instructions: 104networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6B2994AD0
LeaveCriticalSection.KERNEL32 ref: 00007FF6B2994B20
send.WS2_32 ref: 00007FF6B2994B49
EnterCriticalSection.KERNEL32 ref: 00007FF6B2994B58
LeaveCriticalSection.KERNEL32 ref: 00007FF6B2994B6F
WSAGetLastError.WS2_32 ref: 00007FF6B2994BA9
EnterCriticalSection.KERNEL32 ref: 00007FF6B2994BB9
LeaveCriticalSection.KERNEL32 ref: 00007FF6B2994BFB

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ErrorLastsend
String ID:
API String ID: 3480985631-0
Opcode ID: dcbfb0b2159904ea6d1c624c1834ef820b2325ccb56d393d0a5f1f6bb36a758c
Instruction ID: 7d5bde7f496a979f338799e928bf1bd7738b9a3b2cee8a5f9b0fd5c66ff1a16a
Opcode Fuzzy Hash: dcbfb0b2159904ea6d1c624c1834ef820b2325ccb56d393d0a5f1f6bb36a758c
Instruction Fuzzy Hash: 90416A36608B8286E756AF2AE5442AC73E4FB04F98F041136CF0D87B5ADFB8E561C750

Function 00007FF6B29B9480 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29B94C3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29B98B0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29B9B4C

Strings

f, xrefs: 00007FF6B29B95E5
p, xrefs: 00007FF6B29B95ED
p, xrefs: 00007FF6B29B9575

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 42fb3e65d0f17d18353857ebdda260012259b146ac6ef5ada1715a4ca3ec7708
Instruction ID: 8e581385e99d2eb6226cf30b9851a8438b4f67446c5977ca12b55a4b9ce485a0
Opcode Fuzzy Hash: 42fb3e65d0f17d18353857ebdda260012259b146ac6ef5ada1715a4ca3ec7708
Instruction Fuzzy Hash: 1C12A161E2C25386FB627A1ED0582BA72D1FB80758F944035E79D866C6DFBCE5808F14

Function 00007FF6B2994470 Relevance: 10.6, APIs: 7, Instructions: 143threadnetworktimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF6B299448E
SetWaitableTimer.KERNEL32 ref: 00007FF6B29944C3
WSAWaitForMultipleEvents.WS2_32 ref: 00007FF6B299456D
GetCurrentThreadId.KERNEL32 ref: 00007FF6B2994676

Part of subcall function 00007FF6B2994A90: EnterCriticalSection.KERNEL32 ref: 00007FF6B2994AD0
Part of subcall function 00007FF6B2994A90: LeaveCriticalSection.KERNEL32 ref: 00007FF6B2994B20
Part of subcall function 00007FF6B2994A90: send.WS2_32 ref: 00007FF6B2994B49
Part of subcall function 00007FF6B2994A90: EnterCriticalSection.KERNEL32 ref: 00007FF6B2994B58
Part of subcall function 00007FF6B2994A90: LeaveCriticalSection.KERNEL32 ref: 00007FF6B2994B6F
Part of subcall function 00007FF6B2994A90: WSAGetLastError.WS2_32 ref: 00007FF6B2994BA9
Part of subcall function 00007FF6B2994A90: EnterCriticalSection.KERNEL32 ref: 00007FF6B2994BB9
Part of subcall function 00007FF6B2994A90: LeaveCriticalSection.KERNEL32 ref: 00007FF6B2994BFB

SetLastError.KERNEL32 ref: 00007FF6B2994616

Part of subcall function 00007FF6B2995FC0: SetLastError.KERNEL32 ref: 00007FF6B2995FE4

GetLastError.KERNEL32 ref: 00007FF6B299461C
WSAGetLastError.WS2_32 ref: 00007FF6B2994641

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CriticalSection$ErrorLast$EnterLeave$CurrentThread$EventsMultipleTimerWaitWaitablesend
String ID:
API String ID: 2807917265-0
Opcode ID: 495490e7d3477735b75ad2edb0a11b0efccf73ea01b4538bcbeaf1220e2ab4c3
Instruction ID: 975e86c8abfd0052774e6accc3cadaceb06c113fa5e441d18481d815325c5898
Opcode Fuzzy Hash: 495490e7d3477735b75ad2edb0a11b0efccf73ea01b4538bcbeaf1220e2ab4c3
Instruction Fuzzy Hash: 60516F71A086438AEB62AF2A945427D23E4FB08B6CF146635DB5DC6797EFBCE4508700

Function 00007FF6B299B9E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6B299BA4B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF6B299BA93
_Getctype.LIBCPMT ref: 00007FF6B299BAAB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6B299BB63
_Getwctype.LIBCPMT ref: 00007FF6B299BBB1

Strings

bad locale name, xrefs: 00007FF6B299BB86

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: std::_$Lockit$GetctypeGetwctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1386471777-1405518554
Opcode ID: 1e5e98c9536fad76aa215f10c33411828afcd6fe37bfa1046ea3f08e32c02a87
Instruction ID: ece2e2a306f5ae8edbb75ca09112d0edc1aa71eaed5b72cf02bc1184dc3fa4c1
Opcode Fuzzy Hash: 1e5e98c9536fad76aa215f10c33411828afcd6fe37bfa1046ea3f08e32c02a87
Instruction Fuzzy Hash: 18518D22F09B42CAFB16EBA6D4502BC33A0EF55758F444138DF8D66A9BDF78E5568300

Function 00007FF6B29A1D30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF6B29A1DA0
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF6B29A1DE8
_Getcoll.LIBCPMT ref: 00007FF6B29A1E00
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF6B29A1E8F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B29A1EE9

Strings

bad locale name, xrefs: 00007FF6B29A1EEF

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: std::_$Lockit$GetcollLocinfo::_Locinfo_ctorLockit::_Lockit::~__invalid_parameter_noinfo_noreturn
String ID: bad locale name
API String ID: 3908275632-1405518554
Opcode ID: b631740363b0e831fde9baf712990589db3f9d8b5b5567fa3c7a7b01eb85b2e8
Instruction ID: 8dd2593e5fc436cd4fce1be8b4c800f2bc246c12f4f31e1db2d8c6461eaff23b
Opcode Fuzzy Hash: b631740363b0e831fde9baf712990589db3f9d8b5b5567fa3c7a7b01eb85b2e8
Instruction Fuzzy Hash: 7F516C22F09B4289FB12EBBAD4503AC33A1AF4574CF544135DF4DA7A9ADFB8A4469304

Function 00007FF6B29B352C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6B29B37DE,?,?,?,00007FF6B29B34D0,?,?,?,00007FF6B29B0109), ref: 00007FF6B29B35B1
GetLastError.KERNEL32(?,?,?,00007FF6B29B37DE,?,?,?,00007FF6B29B34D0,?,?,?,00007FF6B29B0109), ref: 00007FF6B29B35BF
LoadLibraryExW.KERNEL32(?,?,?,00007FF6B29B37DE,?,?,?,00007FF6B29B34D0,?,?,?,00007FF6B29B0109), ref: 00007FF6B29B35E9
FreeLibrary.KERNEL32(?,?,?,00007FF6B29B37DE,?,?,?,00007FF6B29B34D0,?,?,?,00007FF6B29B0109), ref: 00007FF6B29B3657
GetProcAddress.KERNEL32(?,?,?,00007FF6B29B37DE,?,?,?,00007FF6B29B34D0,?,?,?,00007FF6B29B0109), ref: 00007FF6B29B3663

Strings

api-ms-, xrefs: 00007FF6B29B35D1

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 79f1708f0d73a3895a2fe6d32fc30880b345232a89ca131bb8ab1f3b75cbd6b1
Instruction ID: 2af9cfc25decc88a5df79aa8b3c51d6036ee8afc4b9c97515130bd16f3b7104c
Opcode Fuzzy Hash: 79f1708f0d73a3895a2fe6d32fc30880b345232a89ca131bb8ab1f3b75cbd6b1
Instruction Fuzzy Hash: 2531A121A1AA43D1EE23FB1B980957923D4BF48BA8F590536DF1D86392EFBCE4458305

Function 00007FF6B29A0CA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 82processstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF6B29A0CB0
GetFileAttributesW.KERNEL32 ref: 00007FF6B29A0D3D
GetLastError.KERNEL32 ref: 00007FF6B29A0D4C
CreateProcessW.KERNEL32 ref: 00007FF6B29A0DD9

Strings

h, xrefs: 00007FF6B29A0DB9
WinSta0\Default, xrefs: 00007FF6B29A0D6B

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: AttributesCreateErrorFileLastProcesslstrlen
String ID: WinSta0\Default$h
API String ID: 591566999-1620045033
Opcode ID: a60264ea15cd282e93fead91a259f625f489fd1ea87d5066e0c8bc18fc457f1c
Instruction ID: 607e13baddb687d1f9f7a5036997510b311bd4a37e62ad36b0970cd0ba287987
Opcode Fuzzy Hash: a60264ea15cd282e93fead91a259f625f489fd1ea87d5066e0c8bc18fc457f1c
Instruction Fuzzy Hash: AF316422E087C346E761AB1AB51037A63D1EB96798F105335E69D83B9AEF7CD0948700

Function 00007FF6B29BEA70 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEA7F
FlsGetValue.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEA94
FlsSetValue.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEAB5
FlsSetValue.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEAE2
FlsSetValue.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEAF3
FlsSetValue.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEB04
SetLastError.KERNEL32(?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F,?,?,?,00007FF6B29B6443), ref: 00007FF6B29BEB1F

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 0e252fc1aa08c509f0e93816402eca9f1f65028cc0729f634b753678d4cd798a
Instruction ID: 7820afaeeb74f104f851e1b2c5e9154ed789337632f90c0a96a15bc15034023b
Opcode Fuzzy Hash: 0e252fc1aa08c509f0e93816402eca9f1f65028cc0729f634b753678d4cd798a
Instruction Fuzzy Hash: 6C217C20B0D60341FA5B773F954A13961CA6F44BBCF944638EBBEC66C7DEACB4428200

Function 00007FF6B29CCC80 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6B29CCCB1
GetLastError.KERNEL32 ref: 00007FF6B29CCCBD
CloseHandle.KERNEL32 ref: 00007FF6B29CCCD5
CreateFileW.KERNEL32 ref: 00007FF6B29CCD00
WriteConsoleW.KERNEL32 ref: 00007FF6B29CCD1F

Strings

CONOUT$, xrefs: 00007FF6B29CCCE1

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: c477bea2d07ef44c7e07df60decfd2619db83e7f0bc9226f08f6201d8069434b
Instruction ID: 433e540581fa909d63b60b47b8639ffcef3457d3faabeca20ca53b8dafb6f6c3
Opcode Fuzzy Hash: c477bea2d07ef44c7e07df60decfd2619db83e7f0bc9226f08f6201d8069434b
Instruction Fuzzy Hash: ED117231A18B4282E751AB1BE85432566E1BF48FE8F400235DB5DC77A6DFBCD4448740

Function 00007FF6B299ACF0 Relevance: 10.5, APIs: 7, Instructions: 40filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF6B299AD09
CreateFileW.KERNEL32 ref: 00007FF6B299AD3D
SetFilePointer.KERNEL32 ref: 00007FF6B299AD62
lstrlenW.KERNEL32 ref: 00007FF6B299AD6B
WriteFile.KERNEL32 ref: 00007FF6B299AD89
CloseHandle.KERNEL32 ref: 00007FF6B299AD92
ReleaseMutex.KERNEL32 ref: 00007FF6B299AD9F

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID:
API String ID: 4202892810-0
Opcode ID: 6d311e261bfe59e5949d3104aa2c883e73ffb96b44e413d4cc9c1204dacd56c9
Instruction ID: 625e952ad4ed599ed472c1cae6fe4e580448b4e216e9d50066082290774b7eeb
Opcode Fuzzy Hash: 6d311e261bfe59e5949d3104aa2c883e73ffb96b44e413d4cc9c1204dacd56c9
Instruction Fuzzy Hash: 62111F7561864382E711AB1AF91876577A0FB84BF8F104232DB5E47BA5CFBCD4498700

Function 00007FF6B299EF25 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF6B299EF4F
RegDeleteValueW.ADVAPI32 ref: 00007FF6B299EF63
RegSetValueExW.ADVAPI32 ref: 00007FF6B299EF8D
RegCloseKey.ADVAPI32 ref: 00007FF6B299EF9A

Strings

Console, xrefs: 00007FF6B299EF41
IpDatespecial, xrefs: 00007FF6B299EF5C, 00007FF6B299EF70

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Value$CloseDeleteOpen
String ID: Console$IpDatespecial
API String ID: 3183427449-1840232981
Opcode ID: f23957102dd5c337703c86b23f0909451c31f6d4053b1f337106711f9d04a52f
Instruction ID: a1076f11d5467ef882a9b886227538659c6a07dc0a0faeed71ae479c8a08e09e
Opcode Fuzzy Hash: f23957102dd5c337703c86b23f0909451c31f6d4053b1f337106711f9d04a52f
Instruction Fuzzy Hash: 81015E36608E8286E722DF29EC207693760FB84BA9F044126CB4D8365ADF7CD199CB04

Function 00007FF6B2999220 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 26processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF6B2999239
GetCommandLineW.KERNEL32 ref: 00007FF6B299923F
GetStartupInfoW.KERNEL32 ref: 00007FF6B299924D
CreateProcessW.KERNEL32 ref: 00007FF6B2999290
ExitProcess.KERNEL32 ref: 00007FF6B299929B

Strings

, xrefs: 00007FF6B2999284

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Process$CommandCreateExitFileInfoLineModuleNameStartup
String ID:
API String ID: 3421218197-3916222277
Opcode ID: 190dd20226834de6593c2658ef490eeec5e65b5d977b517c4b94419b13326a92
Instruction ID: ba25a01f4cc6454f4a942975f560a66ddc539af69e7a874c9a453c2da056aed5
Opcode Fuzzy Hash: 190dd20226834de6593c2658ef490eeec5e65b5d977b517c4b94419b13326a92
Instruction Fuzzy Hash: 3CF01D32618A8286DB609F25F85875AB7E0FB88758F500236E78E86B69DF7CC145CB40

Function 00007FF6B2994940 Relevance: 9.1, APIs: 6, Instructions: 80networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF6B2994964
SetLastError.KERNEL32 ref: 00007FF6B2994977
WSAGetLastError.WS2_32 ref: 00007FF6B29949C8
SetLastError.KERNEL32 ref: 00007FF6B2994A32
WSASetLastError.WS2_32 ref: 00007FF6B2994A3D
GetLastError.KERNEL32 ref: 00007FF6B2994A43

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: 4d768c99772465553fa61935876ff201d4a32ce5a3f2b2de379ff66690b2a509
Instruction ID: 99cbc46e04d213e1314bf3fe116effaf0e6abf1ddb1ce569e7f8f3b6cc91fda0
Opcode Fuzzy Hash: 4d768c99772465553fa61935876ff201d4a32ce5a3f2b2de379ff66690b2a509
Instruction Fuzzy Hash: AD316E32A086438AEB62AF2EE44437D23E1FB45B5CF541436CB0DC2297DEBDD8549701

Function 00007FF6B29B10D8 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 320COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6B29B1276
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6B29B159F

Strings

csm, xrefs: 00007FF6B29B11BD
csm, xrefs: 00007FF6B29B121F
csm, xrefs: 00007FF6B29B129D

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 89a7cbb458af1ec799ed0823309e47d85c371afd6e512bd69dcc86c67ccd7e4c
Instruction ID: 4b7710ecb5a0f30c34406b4eda2d4f87d1023f08b7ac7466f1f6743b7e9cef09
Opcode Fuzzy Hash: 89a7cbb458af1ec799ed0823309e47d85c371afd6e512bd69dcc86c67ccd7e4c
Instruction Fuzzy Hash: 7BE1AF72D087838AE752AF6AD4893AD37E0FB4578CF100135EB8D87696DEB8E585C700

Function 00007FF6B2995300 Relevance: 9.1, APIs: 6, Instructions: 63synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32 ref: 00007FF6B299531C
ResetEvent.KERNEL32 ref: 00007FF6B2995329
timeGetTime.WINMM ref: 00007FF6B299532F
WaitForSingleObject.KERNEL32 ref: 00007FF6B2995379
ResetEvent.KERNEL32 ref: 00007FF6B2995396

Part of subcall function 00007FF6B2994C50: GetCurrentThreadId.KERNEL32 ref: 00007FF6B2994C65
Part of subcall function 00007FF6B2994C50: SwitchToThread.KERNEL32 ref: 00007FF6B2994C9D
Part of subcall function 00007FF6B2994C50: SetLastError.KERNEL32 ref: 00007FF6B2994CDC

ResetEvent.KERNEL32 ref: 00007FF6B29953BD

Part of subcall function 00007FF6B29B8940: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29B896B

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: EventReset$Thread$CurrentErrorLastObjectSingleSwitchTimeWait_invalid_parameter_noinfotime
String ID:
API String ID: 2235205178-0
Opcode ID: dd32348ce441aaf97619a2f265975deae253349b76a9a1e61c24f21497cea129
Instruction ID: d1a9ba3568ddb1d87991a3a1ad5cc871418e5eb3e9cb23813468e5e20d74f5af
Opcode Fuzzy Hash: dd32348ce441aaf97619a2f265975deae253349b76a9a1e61c24f21497cea129
Instruction Fuzzy Hash: E5217131608A4286E742DF2AE84816973A0FB48F9CF184132DF4DD776ACF78D591C750

Function 00007FF6B29BEBE8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00005315DED5DA85,00007FF6B29B8B05,?,?,?,?,00007FF6B29C2546,?,?,00000000,00007FF6B29BA3FB,?,?,?), ref: 00007FF6B29BEBF7
FlsSetValue.KERNEL32(?,?,00005315DED5DA85,00007FF6B29B8B05,?,?,?,?,00007FF6B29C2546,?,?,00000000,00007FF6B29BA3FB,?,?,?), ref: 00007FF6B29BEC2D
FlsSetValue.KERNEL32(?,?,00005315DED5DA85,00007FF6B29B8B05,?,?,?,?,00007FF6B29C2546,?,?,00000000,00007FF6B29BA3FB,?,?,?), ref: 00007FF6B29BEC5A
FlsSetValue.KERNEL32(?,?,00005315DED5DA85,00007FF6B29B8B05,?,?,?,?,00007FF6B29C2546,?,?,00000000,00007FF6B29BA3FB,?,?,?), ref: 00007FF6B29BEC6B
FlsSetValue.KERNEL32(?,?,00005315DED5DA85,00007FF6B29B8B05,?,?,?,?,00007FF6B29C2546,?,?,00000000,00007FF6B29BA3FB,?,?,?), ref: 00007FF6B29BEC7C
SetLastError.KERNEL32(?,?,00005315DED5DA85,00007FF6B29B8B05,?,?,?,?,00007FF6B29C2546,?,?,00000000,00007FF6B29BA3FB,?,?,?), ref: 00007FF6B29BEC97

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: c7396dbfbcb47cfb6cfc33ed0fb29296ace80fe16ba5d506c85f3ecfa09c6d8f
Instruction ID: 994ed1270198ec085fc6e059d02c47a319900580f416624a2e29169c56c48133
Opcode Fuzzy Hash: c7396dbfbcb47cfb6cfc33ed0fb29296ace80fe16ba5d506c85f3ecfa09c6d8f
Instruction Fuzzy Hash: 68115E21A0964342FA5B773F955903962C66F48BBDF940734DBAEC66C7DEACB4428200

Function 00007FF6B29BBC90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6B29BBCB5
GetProcAddress.KERNEL32 ref: 00007FF6B29BBCCB
FreeLibrary.KERNEL32 ref: 00007FF6B29BBCF2

Strings

mscoree.dll, xrefs: 00007FF6B29BBCAC
CorExitProcess, xrefs: 00007FF6B29BBCC4

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 4e200ac4912f663bf200d97a0492af6b570e41165da9f834e6f0b0fe5145a0ad
Instruction ID: 0bb501ec297ab0d4112cb647762736e01391f3885c27f3a9aba493217c3125ee
Opcode Fuzzy Hash: 4e200ac4912f663bf200d97a0492af6b570e41165da9f834e6f0b0fe5145a0ad
Instruction Fuzzy Hash: 50F0686171960381EE15AB1EE45437963A0EF49B6AF540236CB5D855F9CFACD049C700

Function 00007FF6B299EFA3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF6B299EFC9
RegDeleteValueW.ADVAPI32 ref: 00007FF6B299EFDD
RegCloseKey.ADVAPI32 ref: 00007FF6B299EFEA

Strings

Console, xrefs: 00007FF6B299EFBB
IpDatespecial, xrefs: 00007FF6B299EFD6

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Console$IpDatespecial
API String ID: 849931509-1840232981
Opcode ID: 6e7d2c7a670a32b5de56c4a84771261a6cdbf4bc2880aa7204407435697e958c
Instruction ID: 504c1f729412bead3cb74b6f9c1e93373012a11f5b7caf9bfb866dbbcbbc20f7
Opcode Fuzzy Hash: 6e7d2c7a670a32b5de56c4a84771261a6cdbf4bc2880aa7204407435697e958c
Instruction Fuzzy Hash: 4FF01236604DC285E721DF19EC107A97360FB84B6EF000132CE4D57669DE7DD1DA8B04

Function 00007FF6B29B04D8 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF6B29B05FB
__AdjustPointer.LIBCMT ref: 00007FF6B29B0646

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: f957c6767cf5b81622e8ff6fae34e0b794288dc4cc0809d74a0a7b197e878a35
Instruction ID: c00948e3ec2b6ce65c767eb67ad11e14296b431bb6a7f0e1acbc83816ab68f23
Opcode Fuzzy Hash: f957c6767cf5b81622e8ff6fae34e0b794288dc4cc0809d74a0a7b197e878a35
Instruction Fuzzy Hash: 01B1C222E0A75781FA67BA2F94C823D62D0AF44B8CF088535DB4D87B97DEACE4418740

Function 00007FF6B29CC6BC Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6B29CC6E4
_set_statfp.LIBCMT ref: 00007FF6B29CC6FF
_set_statfp.LIBCMT ref: 00007FF6B29CC71B
_set_statfp.LIBCMT ref: 00007FF6B29CC757

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 3a9c703ea5aaac55ee3dcba71a43574e980d604707a0521e319b1fc91c9c8b59
Instruction ID: 4e19926065f17e8a1d871b06e26d0e3a912de24aa48380fedd516f97e40eb4ab
Opcode Fuzzy Hash: 3a9c703ea5aaac55ee3dcba71a43574e980d604707a0521e319b1fc91c9c8b59
Instruction Fuzzy Hash: 35119132E1CA5301F6E6312EE54237958C1AF58B78E090739EB7EC62DB9FDCAC414219

Function 00007FF6B29BECB0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6B29B39FB,?,?,00000000,00007FF6B29B3C96,?,?,?,?,?,00007FF6B29B3C22), ref: 00007FF6B29BECCF
FlsSetValue.KERNEL32(?,?,?,00007FF6B29B39FB,?,?,00000000,00007FF6B29B3C96,?,?,?,?,?,00007FF6B29B3C22), ref: 00007FF6B29BECEE
FlsSetValue.KERNEL32(?,?,?,00007FF6B29B39FB,?,?,00000000,00007FF6B29B3C96,?,?,?,?,?,00007FF6B29B3C22), ref: 00007FF6B29BED16
FlsSetValue.KERNEL32(?,?,?,00007FF6B29B39FB,?,?,00000000,00007FF6B29B3C96,?,?,?,?,?,00007FF6B29B3C22), ref: 00007FF6B29BED27
FlsSetValue.KERNEL32(?,?,?,00007FF6B29B39FB,?,?,00000000,00007FF6B29B3C96,?,?,?,?,?,00007FF6B29B3C22), ref: 00007FF6B29BED38

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 8e80255def71e26e38969c6b9ad95fb919b46607e2d80395ee43e046c775e245
Instruction ID: ab161ccc502188c764a7590f87bdf823ade831a47c5550ac4988cb5675e52234
Opcode Fuzzy Hash: 8e80255def71e26e38969c6b9ad95fb919b46607e2d80395ee43e046c775e245
Instruction Fuzzy Hash: 4C114C20A0960381FA9A772FA55917961C96F847ACF944334EABE866D7DEECF4428600

Function 00007FF6B29BEB44 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F), ref: 00007FF6B29BEB55
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F), ref: 00007FF6B29BEB74
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F), ref: 00007FF6B29BEB9C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F), ref: 00007FF6B29BEBAD
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF6B29C6E73,?,?,?,00007FF6B29BF1A4,?,?,?,00007FF6B29B819F), ref: 00007FF6B29BEBBE

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: be4a96ff5b18d49a05f4adbf766956ae433ebef540c65d26a29db4b7139a2023
Instruction ID: f6ad3e3d47cc4d9ab398508d2bde083ceef5e0e132150483d62bbad5647e7b48
Opcode Fuzzy Hash: be4a96ff5b18d49a05f4adbf766956ae433ebef540c65d26a29db4b7139a2023
Instruction Fuzzy Hash: 4311E864A0D61741FD9AB63F941A17921C55F5576CF940B38EBBF8A2C3DDACB4528200

Function 00007FF6B29956C0 Relevance: 7.5, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6B29956E5
EnterCriticalSection.KERNEL32 ref: 00007FF6B29956EF
LeaveCriticalSection.KERNEL32 ref: 00007FF6B29956FF
LeaveCriticalSection.KERNEL32 ref: 00007FF6B2995709

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: ec8515e0b6118a22be018e0c36bf8043355ac570717b599eb6440d7a0495df03
Instruction ID: 5366f5c580037ef7ebdad70716526a7f52a414760f0ce9e1bd2e7e8f8c57fd1d
Opcode Fuzzy Hash: ec8515e0b6118a22be018e0c36bf8043355ac570717b599eb6440d7a0495df03
Instruction Fuzzy Hash: 4F110632624946C7DB51AB2AF4543AD63A0FB44B5DF441031DB8F83A56CF7CE595C700

Function 00007FF6B299C0C0 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF6B299C103
EnterCriticalSection.KERNEL32(?,?,?,00007FF6B299C094), ref: 00007FF6B299C115
EnterCriticalSection.KERNEL32 ref: 00007FF6B299C125
GdiplusShutdown.GDIPLUS ref: 00007FF6B299C133
LeaveCriticalSection.KERNEL32 ref: 00007FF6B299C140

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CriticalSection$Enter$DeleteGdiplusLeaveObjectShutdown
String ID:
API String ID: 1513102227-0
Opcode ID: cdd56314798a8dc9bb9b375cd871b4762f9b413abb23fcd634828e7dcd198d12
Instruction ID: 373447289f374c7950bd4f17e4a262c99a2db579ec747371ce4cf1323356876b
Opcode Fuzzy Hash: cdd56314798a8dc9bb9b375cd871b4762f9b413abb23fcd634828e7dcd198d12
Instruction Fuzzy Hash: D1113D32505B4381EB11AF2EE84406873B4FB58FADB244236D76D827A6DF78D552C744

Function 00007FF6B2995640 Relevance: 7.5, APIs: 5, Instructions: 26synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF6B2995652
WaitForSingleObject.KERNEL32 ref: 00007FF6B2995664
Sleep.KERNEL32 ref: 00007FF6B299566F
CloseHandle.KERNEL32 ref: 00007FF6B299568C
CloseHandle.KERNEL32 ref: 00007FF6B2995699

Part of subcall function 00007FF6B2994C50: GetCurrentThreadId.KERNEL32 ref: 00007FF6B2994C65
Part of subcall function 00007FF6B2994C50: SwitchToThread.KERNEL32 ref: 00007FF6B2994C9D
Part of subcall function 00007FF6B2994C50: SetLastError.KERNEL32 ref: 00007FF6B2994CDC

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CloseHandleObjectSingleThreadWait$CurrentErrorLastSleepSwitch
String ID:
API String ID: 1535946027-0
Opcode ID: 6bee8a0a4dea1eafbbaf25a2cc800b23e58b43f259c7b6e2f946ecae76c8c5a2
Instruction ID: 94ee944c712f122dfa4d2e6c84d6c3271abd534aa69606426fcc06b5362b9636
Opcode Fuzzy Hash: 6bee8a0a4dea1eafbbaf25a2cc800b23e58b43f259c7b6e2f946ecae76c8c5a2
Instruction Fuzzy Hash: CCF0E13560494686E706AF2AD8581683360FB89F69F144131DB2DC73A5CF78D9858360

Function 00007FF6B29B184C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6B29B18BC
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6B29B1907

Strings

RCC, xrefs: 00007FF6B29B18D8
MOC, xrefs: 00007FF6B29B18D0

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: a53d2363c14758023286afc4a6ab41b9c25c1dd74b553e4400a7d45858c9584b
Instruction ID: 1ff5254d1e95d66f238ca7b4b1fcabb9639ca6a1e5fb5c22a54a9059fbd2d960
Opcode Fuzzy Hash: a53d2363c14758023286afc4a6ab41b9c25c1dd74b553e4400a7d45858c9584b
Instruction Fuzzy Hash: B591A073A087928AE711EB6AE4443AC77E0FB45788F10412AEB8C97756DF78D1A5C700

Function 00007FF6B29AFA80 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6B29AFAAB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6B29AFB42
RtlUnwindEx.KERNEL32 ref: 00007FF6B29AFB9C

Strings

csm, xrefs: 00007FF6B29AFB29

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 97e6136df740a7f50eb7a5892aa497e90dc07242db7e08e9cb4e882c62b2f360
Instruction ID: c98e1f7fab6b66df4e719422c017bf5864cbb815b33634a48eaca81b8b4a2ede
Opcode Fuzzy Hash: 97e6136df740a7f50eb7a5892aa497e90dc07242db7e08e9cb4e882c62b2f360
Instruction Fuzzy Hash: A7519F32A1A7038ADB55EB1BE454A7863E1EB45B8CF104135DB4E8778ADFBEE841C700

Function 00007FF6B29B15DC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6B29B163B
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6B29B1687

Strings

RCC, xrefs: 00007FF6B29B1657
MOC, xrefs: 00007FF6B29B164F

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: b953805b3f16366bb71475c1063139944ec3feeea47b818f87e78a0e56bad00b
Instruction ID: e8f3c1d3244679eec9331111245fab2a72e531753f74c43533c4e79a0559504c
Opcode Fuzzy Hash: b953805b3f16366bb71475c1063139944ec3feeea47b818f87e78a0e56bad00b
Instruction Fuzzy Hash: B7619832908BC685DB619F1AE4447AAB7E0FB95B98F044235EB9C47B56DFBCD190CB00

Function 00007FF6B29B1DCC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6B29B1DF4
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6B29B1EDC

Strings

csm, xrefs: 00007FF6B29B1E16
csm, xrefs: 00007FF6B29B1F2E

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 1c7f32590a0a5e31803e0cd6c6efa8edac5466215bfbb7b2d07330e269dc0479
Instruction ID: dec3396b001db5f20dc3870fd66b85b6d92234ecb36aa66c9c3eb8f40e09273e
Opcode Fuzzy Hash: 1c7f32590a0a5e31803e0cd6c6efa8edac5466215bfbb7b2d07330e269dc0479
Instruction Fuzzy Hash: AD516C36A0828386EB66AE1B944C36877E0EB55B98F144135EB9CC7BD6CFBCE450C701

Function 00007FF6B29CA7BC Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6B29CA83B
WriteFile.KERNEL32 ref: 00007FF6B29CAB03
WriteFile.KERNEL32 ref: 00007FF6B29CAB49
GetLastError.KERNEL32 ref: 00007FF6B29CABFF

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 77dd5d4aa20de0d79966c3f830593b01910af74af4cc21fda2ecf357b99f0be0
Instruction ID: b0180c8bfe2e0019d785e386eee1c816bd10e43da762716b4d60d2af8a0d46c3
Opcode Fuzzy Hash: 77dd5d4aa20de0d79966c3f830593b01910af74af4cc21fda2ecf357b99f0be0
Instruction Fuzzy Hash: 61D1B032B08A828AE716DF6AD4401EC37B2FB44B9CF544226DF5D97B9ADE78D456C300

Function 00007FF6B29A7530 Relevance: 6.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B29A78D6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B29A78DC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B29A78E2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B29A78E8

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 7d7153dc9ae7d5b3424c28ff14d58aef55a80775f13d9447e24f61463487f32c
Instruction ID: 89ec53f7ae162a5c8d9e9e968f8ab48d2a3dab07842dae3b6bb796413158744c
Opcode Fuzzy Hash: 7d7153dc9ae7d5b3424c28ff14d58aef55a80775f13d9447e24f61463487f32c
Instruction Fuzzy Hash: BAB1A062F14B5685FB01DBAAC4457EC23B1FB45B9CF405225DF6CA7A9ADFB8A481C300

Function 00007FF6B29CB0E4 Relevance: 6.2, APIs: 4, Instructions: 219COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00007FF6B29CB0CF), ref: 00007FF6B29CB200
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00007FF6B29CB0CF), ref: 00007FF6B29CB28B

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 8d852cd364b953300601feb318994bc5f66eb9b85f3205e0d4ed1d6cdd918134
Instruction ID: a4d1f368e9a8094d59a937474f92b3ffc724b002e834bf68d70041d34fc0813a
Opcode Fuzzy Hash: 8d852cd364b953300601feb318994bc5f66eb9b85f3205e0d4ed1d6cdd918134
Instruction Fuzzy Hash: 2791AF32E18653C5F752AB6A94602BD3BE4BB15F8CF144139DF0E9768ADEB8D485C700

Function 00007FF6B29A8750 Relevance: 6.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B29A8994
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6B29A89A0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B29A89A6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B29A8A07

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID:
API String ID: 3936042273-0
Opcode ID: aa83a4776d611bfa6910a88996202f0a13839e5925797b86addcbd2790bd8b35
Instruction ID: 922952f0d5452c713e1b3f68cd1dd0661575c124c44ef1ce5dfafd2b4dbbdd0a
Opcode Fuzzy Hash: aa83a4776d611bfa6910a88996202f0a13839e5925797b86addcbd2790bd8b35
Instruction Fuzzy Hash: 89717162F14B8685EA05EB1AD40836C63A1FB85FD8F558A31DF6C57B96DFB8E481C300

Function 00007FF6B299F160 Relevance: 6.2, APIs: 4, Instructions: 190processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF6B299F1AD
Process32FirstW.KERNEL32 ref: 00007FF6B299F23F
Process32NextW.KERNEL32 ref: 00007FF6B299F333

Part of subcall function 00007FF6B29B87A0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29B87C6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B299F3FB

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32_invalid_parameter_noinfo_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4260596558-0
Opcode ID: 7762ce93aa6985307a259bfb251e473b870e7df6f058cf487220d00444a178a1
Instruction ID: 1401c81396461cd9d653be5d449cfa29faf6292985233cf7489fe27e3a97e655
Opcode Fuzzy Hash: 7762ce93aa6985307a259bfb251e473b870e7df6f058cf487220d00444a178a1
Instruction Fuzzy Hash: 2071E362B1868385EA21AB6AD44426DA3E1FB85BF8F408231DB6D837C6DFBCD540C700

Function 00007FF6B29B9344 Relevance: 6.1, APIs: 4, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF6B29B939B
GetSystemInfo.KERNEL32 ref: 00007FF6B29B93B4
VirtualAlloc.KERNEL32 ref: 00007FF6B29B9422
VirtualProtect.KERNEL32 ref: 00007FF6B29B943D

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 8276b17d3f0086b027f55cc71dd443fed715192864dd3a3d0b6a65bee2902499
Instruction ID: f3f9e40ba938407150608720aec2be6aecc0650f83b45bdaf41a91ec8f2b7c49
Opcode Fuzzy Hash: 8276b17d3f0086b027f55cc71dd443fed715192864dd3a3d0b6a65bee2902499
Instruction Fuzzy Hash: C4314C32714A929EEB20DF36D8547E923A5FB48B88F444036EA4D87B49DF78E645C700

Function 00007FF6B2994F90 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF6B2994FAC
LeaveCriticalSection.KERNEL32 ref: 00007FF6B2994FC3
LeaveCriticalSection.KERNEL32 ref: 00007FF6B299504B
SetEvent.KERNEL32 ref: 00007FF6B299506B

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: ee59a16ddcb61b2f30476306e2c70f7e991c931b41d410101ed0a7d795a74e2b
Instruction ID: fbe85f1c18b1d3fa817a9693767c034f44a19add28019d66059e4e68e21f4c01
Opcode Fuzzy Hash: ee59a16ddcb61b2f30476306e2c70f7e991c931b41d410101ed0a7d795a74e2b
Instruction Fuzzy Hash: B0213732704B8297D749DB2AE5842ADB3A4FB48B98F144035DB6D83766DF78E4B1C740

Function 00007FF6B29AE760 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6B29AE78C
GetCurrentThreadId.KERNEL32 ref: 00007FF6B29AE79A
GetCurrentProcessId.KERNEL32 ref: 00007FF6B29AE7A6
QueryPerformanceCounter.KERNEL32 ref: 00007FF6B29AE7B6

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: cc56691cd60568e6146a7dde9c83608ec099c6c6a56f3e0ff612a8b3836fe06a
Instruction ID: 4fdc8d47e19c39aef56fe7ff84ef2de554903839a8f8ea7f5bf65825b330e316
Opcode Fuzzy Hash: cc56691cd60568e6146a7dde9c83608ec099c6c6a56f3e0ff612a8b3836fe06a
Instruction Fuzzy Hash: 81113336B24F0289EB00EF65E8542B833A4FB19B58F440E31EB5D867A5DF7CD5548340

Function 00007FF6B2993FF0 Relevance: 6.0, APIs: 4, Instructions: 22synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF6B2994002
Sleep.KERNEL32 ref: 00007FF6B299400D
WaitForSingleObject.KERNEL32 ref: 00007FF6B2994024
WaitForSingleObject.KERNEL32 ref: 00007FF6B2994036

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ObjectSingleWait$Sleep
String ID:
API String ID: 2961732021-0
Opcode ID: 4ede45267323656183b3c0ec57ef8ecec2c46d3b5a24cc8965c2015fc5653a59
Instruction ID: cc54ef8d259f48877f59abe6d7da5f196e118953032a1b3bf167d574c3b8498e
Opcode Fuzzy Hash: 4ede45267323656183b3c0ec57ef8ecec2c46d3b5a24cc8965c2015fc5653a59
Instruction Fuzzy Hash: A7F0DA72604A4686D741AB3AD85822832A1FF89F39F150331CB2D873E5CF78C5868350

Function 00007FF6B29A1840 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B29A1A68
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6B29A1AD7

Strings

^(T[A-Za-z0-9]*|0x[A-Za-z0-9]*)$, xrefs: 00007FF6B29A1868

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: ^(T[A-Za-z0-9]*|0x[A-Za-z0-9]*)$
API String ID: 3668304517-660079095
Opcode ID: 1a7bd3f9ad1e2be3bb215426da79a080b2b48fcb5330e2929561e3c4d22847e3
Instruction ID: e6c55fac188d6e1614c1c92a19c1c13230469c40a17bbd4888505a4166bca03f
Opcode Fuzzy Hash: 1a7bd3f9ad1e2be3bb215426da79a080b2b48fcb5330e2929561e3c4d22847e3
Instruction Fuzzy Hash: F3819D72E15B4689EB51EF6AE4403AC33E5FB89B98F044235EB5D83B9ADE78D550C300

Function 00007FF6B29B2004 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6B29B202E

Strings

csm, xrefs: 00007FF6B29B2053
csm, xrefs: 00007FF6B29B21C2

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 2e13650262a6f61ea207b4025eb27adbf5cb157b43e28d55221f4b040b54e9a1
Instruction ID: 021dda013af5e021a980fc742a7d9bd163a8bcd4ada41df5d1c178ff8b6f1314
Opcode Fuzzy Hash: 2e13650262a6f61ea207b4025eb27adbf5cb157b43e28d55221f4b040b54e9a1
Instruction Fuzzy Hash: 0F71C272D0868286DB66AF2A94487797BE0FB05B88F148135DF8C87A9ACF7CD552C740

Function 00007FF6B299DC4D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00007FF6B299DCA0
CloseHandle.KERNEL32 ref: 00007FF6B299DE27

Strings

%s_bin, xrefs: 00007FF6B299DC95

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CloseHandlewsprintf
String ID: %s_bin
API String ID: 3088109604-2665034546
Opcode ID: 24dfbce03fa251961b6e58b78a80fa440e1697bf0a0f73e4a5768ea3ed20b2a8
Instruction ID: 75031d494b9ca8313ede069c464cf8d1a87b8e5a7e72a5179f9ed7042af38bb9
Opcode Fuzzy Hash: 24dfbce03fa251961b6e58b78a80fa440e1697bf0a0f73e4a5768ea3ed20b2a8
Instruction Fuzzy Hash: F951AE62A09A9785EB12FB2AC0546B92394EF85F58F558136DB0D837C3EE7CD401C321

Function 00007FF6B29C1CC4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6B29B9248: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29B927B

_get_daylight.LIBCMT ref: 00007FF6B29C1DDC
_get_daylight.LIBCMT ref: 00007FF6B29C1DED

Strings

?, xrefs: 00007FF6B29C1D6D

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 0b7c1d742c13ddddedbe4d6e2c5e7ad1023c035335ca7369220edd5dde904ae5
Instruction ID: e4bc56416e86b5ccfab665549ed25925f8a576e5678109ee26d9a558a39b5245
Opcode Fuzzy Hash: 0b7c1d742c13ddddedbe4d6e2c5e7ad1023c035335ca7369220edd5dde904ae5
Instruction Fuzzy Hash: 6B41C522A1868341FB66AB2A945537A66E0EF80FA8F144235EF5C87AD7DFBCD441C704

Function 00007FF6B29B269C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6B29B2746
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF6B29B276F

Strings

csm, xrefs: 00007FF6B29B286F

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 503767daf86984436527780b72ab736630531d0d6d2b9058069c45c3b2766ca2
Instruction ID: 33b224754f2c9755433c037fd1a2f2246f993f6f7f02aa51066fed004c4f801a
Opcode Fuzzy Hash: 503767daf86984436527780b72ab736630531d0d6d2b9058069c45c3b2766ca2
Instruction Fuzzy Hash: 12517E32A1874686E621FB2AE48526D77E4FB89B94F140134EF8D87B96CF7CE451CB01

Function 00007FF6B29BBF84 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6B29BBFB6

Part of subcall function 00007FF6B29BE6BC: RtlFreeHeap.NTDLL(?,?,?,00007FF6B29C65C2,?,?,?,00007FF6B29C693F,?,?,00000000,00007FF6B29C6D85,?,?,?,00007FF6B29C6CB7), ref: 00007FF6B29BE6D2
Part of subcall function 00007FF6B29BE6BC: GetLastError.KERNEL32(?,?,?,00007FF6B29C65C2,?,?,?,00007FF6B29C693F,?,?,00000000,00007FF6B29C6D85,?,?,?,00007FF6B29C6CB7), ref: 00007FF6B29BE6DC

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6B29ADF31), ref: 00007FF6B29BBFD4

Strings

C:\Users\user\Desktop\vYeaC4s9zP.exe, xrefs: 00007FF6B29BBFC2

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\vYeaC4s9zP.exe
API String ID: 3580290477-1601645339
Opcode ID: 3a5b6248115956fb8c5867fcb2c099a73d6e8c573ad95eb16c3a51b61da9d299
Instruction ID: ff1bf0d5607282cf32189ee11e9f65f7f088497aa2c4f1ab1308372da68937fa
Opcode Fuzzy Hash: 3a5b6248115956fb8c5867fcb2c099a73d6e8c573ad95eb16c3a51b61da9d299
Instruction Fuzzy Hash: CD414A76A08A1389EB16BF2B95550B936E4FB44B98B444035EB4E83B86DEBCE4858340

Function 00007FF6B29CAE54 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6B29CAF6B
GetLastError.KERNEL32 ref: 00007FF6B29CAF8D

Strings

U, xrefs: 00007FF6B29CAF17

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 54112263acd02f42df0a8cef6501b04abbfb211da2f70ad802a6942ee1910395
Instruction ID: bbd29deb8829676ac24e417cc3dcdee94b2935f1d95f6949039a4246f1622a01
Opcode Fuzzy Hash: 54112263acd02f42df0a8cef6501b04abbfb211da2f70ad802a6942ee1910395
Instruction Fuzzy Hash: 0B41B372A18A4285DB21AF2AE4543A967A0FB88B98F404031EF4DC7799DF7CD441C750

Function 00007FF6B29B0050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6B2991111), ref: 00007FF6B29B00A0
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6B2991111), ref: 00007FF6B29B00E1

Strings

csm, xrefs: 00007FF6B29B00CE

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 3c98ac448948905eff4ad47a47963f754950c65019d46630b15deedf807f34ab
Instruction ID: 393ea2f6d572d40f73899da830d386ba7d9fa2383c5337011414876a81c6116a
Opcode Fuzzy Hash: 3c98ac448948905eff4ad47a47963f754950c65019d46630b15deedf807f34ab
Instruction Fuzzy Hash: 5F116D32609B8282EB229F1AF44426977E1FB88B98F584231DF8C47B5ADF7CC551CB00

Function 00007FF6B29AA3D0 Relevance: 5.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32 ref: 00007FF6B29AA40E
IsBadReadPtr.KERNEL32 ref: 00007FF6B29AA4E3
SetLastError.KERNEL32(?,00000000,00007FF6B29AA9E9,?,?,?,?,?,?,?,?,?,00007FF6B299D242), ref: 00007FF6B29AA505
SetLastError.KERNEL32(?,00000000,00007FF6B29AA9E9,?,?,?,?,?,?,?,?,?,00007FF6B299D242), ref: 00007FF6B29AA523

Memory Dump Source

Source File: 00000000.00000002.4457821352.00007FF6B2991000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6B2990000, based on PE: true

Associated: 00000000.00000002.4457804138.00007FF6B2990000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457850898.00007FF6B29CF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457872657.00007FF6B29E5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457889926.00007FF6B29E8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457905765.00007FF6B29EC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4457921458.00007FF6B29F0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff6b2990000_vYeaC4s9zP.jbxd

Similarity

API ID: ErrorLastRead
String ID:
API String ID: 4100373531-0
Opcode ID: e0e517c51036cec7b570afbeb596ed896a79d3929b09d4426d0e27ecdcf8b3b8
Instruction ID: 3179f1487561307ad3b2bc7f7bd5fd6c9f8f06b3f99d58362df23cc4d2a531c2
Opcode Fuzzy Hash: e0e517c51036cec7b570afbeb596ed896a79d3929b09d4426d0e27ecdcf8b3b8
Instruction Fuzzy Hash: 44415A62A09B4287EB199B2AE04426937F0FB49B98F055431DF4E83756DFBCE4A1C710

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report vYeaC4s9zP.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\kernelquick.sys

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Windows Analysis Report
vYeaC4s9zP.exe

Function 00007FF6B29962F0 Relevance: 193.3, APIs: 81, Strings: 29, Instructions: 845
registrystringprocessCOMMON

Function 00007FF6B29AB500 Relevance: 103.7, APIs: 41, Strings: 18, Instructions: 406
registrylibrarysleepCOMMON

Function 00007FF6B299F410 Relevance: 81.0, APIs: 35, Strings: 11, Instructions: 532
registryprocessfileCOMMON

Function 00007FF6B299FD10 Relevance: 56.3, APIs: 27, Strings: 5, Instructions: 326
windowCOMMON

Function 00007FF6B2997250 Relevance: 54.7, APIs: 26, Strings: 5, Instructions: 457
COMMON

Function 00007FF6B29979E0 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 216
stringregistrycomCOMMON

Function 00007FF6B2998690 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149
memoryCOMMON

Function 00007FF6B2998900 Relevance: 45.7, APIs: 22, Strings: 4, Instructions: 225
memoryCOMMON

Function 00007FF6B29A02A0 Relevance: 45.3, APIs: 30, Instructions: 260
memorywindowCOMMON

Function 00007FF6B299C340 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 297
windowCOMMON

Function 00007FF6B2993820 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 157
networkstringtimeCOMMON

Function 00007FF6B2998AD0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 101
memoryCOMMON

Function 00007FF6B29ABDD0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 223
memoryCOMMON

Function 00007FF6B299D9C0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 137
registryCOMMON

Function 00007FF6B29AC2E0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 128
fileCOMMON