Edit tour

Windows Analysis Report
yIR0BZUT2A.exe

Overview

General Information

Sample name:	yIR0BZUT2A.exe renamed because original name is a hash value
Original sample name:	d290cccbc59f0fa1d5e5d36a88785795.exe
Analysis ID:	1585729
MD5:	d290cccbc59f0fa1d5e5d36a88785795
SHA1:	426910443aec2075365cece2514801ea3254d0ca
SHA256:	061f46e583ce23f357dba77ee0f455e31304231538a6820b0948f9bddc1e9b6e
Tags:	exeValleyRATuser-abuse_ch
Infos:

Detection

GhostRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected GhostRat

AI detected suspicious sample

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Found evasive API chain (may stop execution after checking mutex)

Found stalling execution ending in API Sleep call

Sample is not signed and drops a device driver

Sigma detected: Potentially Suspicious Malware Callback Communication

Tries to detect sandboxes / dynamic malware analysis system (QueryWinSAT)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks for available system drives (often done to infect USB drives)

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Creates driver files

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain checking for process token information

Installs a global mouse hook

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Stores large binary data to the registry

Classification

Process Tree

System is w10x64

yIR0BZUT2A.exe (PID: 7056 cmdline: "C:\Users\user\Desktop\yIR0BZUT2A.exe" MD5: D290CCCBC59F0FA1D5E5D36A88785795)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
yIR0BZUT2A.exe	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: yIR0BZUT2A.exe PID: 7056	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.yIR0BZUT2A.exe.7ff62a970000.0.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security
0.0.yIR0BZUT2A.exe.7ff62a970000.0.unpack	JoeSecurity_GhostRat	Yara detected GhostRat	Joe Security

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 154.91.90.234, DestinationIsIpv6: false, DestinationPort: 4433, EventID: 3, Image: C:\Users\user\Desktop\yIR0BZUT2A.exe, Initiated: true, ProcessId: 7056, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Suricata Signatures

ET MALWARE Anonymous RAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T05:52:01.260779+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49730	154.91.90.234	4433	TCP
2025-01-08T05:53:07.512968+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49730	154.91.90.234	4433	TCP
2025-01-08T05:54:08.867603+0100	2052875	1	A Network Trojan was detected	192.168.2.4	54649	154.91.90.234	4433	TCP
2025-01-08T05:55:51.557688+0100	2052875	1	A Network Trojan was detected	192.168.2.4	54653	154.91.90.234	4433	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: yIR0BZUT2A.exe	ReversingLabs: Detection: 52%
Source: yIR0BZUT2A.exe	Virustotal: Detection: 68%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: yIR0BZUT2A.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File opened: [:	Jump to behavior

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A97F410 GetLastInputInfo,GetTickCount,wsprintfW,GetForegroundWindow,GetWindowTextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,SHGetFolderPathW,lstrcatW,CreateFileW,lstrlenW,WriteFile,CloseHandle,FindFirstFileW,FindClose,_invalid_parameter_noinfo_noreturn,		0_2_00007FF62A97F410
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A9A4190 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00007FF62A9A4190

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Code function: 0_2_00007FF62A976370 gethostname,gethostbyname,inet_ntoa,inet_ntoa,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,LoadLibraryW,GetProcAddress,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,FreeLibrary,GetSystemInfo,wsprintfW,GetDriveTypeW,GetDiskFreeSpaceExW,GlobalMemoryStatusEx,GetForegroundWindow,GetWindowTextW,lstrlenW,GetLocalTime,wsprintfW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,lstrcpyW,CloseHandle,CoInitializeEx,CoCreateInstance,SysFreeString,CoUninitialize,RegOpenKeyExW,RegQueryInfoKeyW,RegEnumKeyExW,lstrlenW,lstrlenW,RegCloseKey,lstrlenW,GetTickCount,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,lstrcpyW,lstrcatW,lstrlenW,GetLocalTime,wsprintfW,RegOpenKeyExW,RegDeleteValueW,RegCloseKey,RegCreateKeyW,lstrlenW,RegSetValueExW,RegCloseKey,RegCloseKey,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,

0_2_00007FF62A976370

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49730 -> 154.91.90.234:4433
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:54649 -> 154.91.90.234:4433
Source: Network traffic	Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:54653 -> 154.91.90.234:4433

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 154.91.90.234:4433

Source: global traffic

TCP traffic: 192.168.2.4:54380 -> 162.159.36.2:53

Source: Joe Sandbox View

ASN Name: ITACE-AS-APItaceInternationalLimitedHK ITACE-AS-APItaceInternationalLimitedHK

Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234
Source: unknown	TCP traffic detected without corresponding DNS query: 154.91.90.234

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Code function: 0_2_00007FF62A973B00 select,recv,timeGetTime,

0_2_00007FF62A973B00

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture and log keystrokes

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Code function: [esc]

0_2_00007FF62A97ADB0

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Code function: 0_2_00007FF62A980DA0 _invalid_parameter_noinfo_noreturn,lstrlenW,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,CloseClipboard,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF62A980DA0

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

0_2_00007FF62A980DA0

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

0_2_00007FF62A980DA0

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Code function: 0_2_00007FF62A97FD10 GetDesktopWindow,GetDC,CreateCompatibleDC,GetDC,GetDeviceCaps,GetDeviceCaps,ReleaseDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateCompatibleBitmap,SelectObject,SetStretchBltMode,GetSystemMetrics,GetSystemMetrics,StretchBlt,GetDIBits,DeleteObject,DeleteObject,ReleaseDC,DeleteObject,DeleteObject,ReleaseDC,_invalid_parameter_noinfo_noreturn,

0_2_00007FF62A97FD10

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Code function: 0_2_00007FF62A9772D0 MultiByteToWideChar,MultiByteToWideChar,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,CreateMutexExW,GetLastError,Sleep,CreateMutexW,GetLastError,lstrlenW,lstrcmpW,SleepEx,GetModuleHandleW,GetConsoleWindow,SHGetFolderPathW,lstrcatW,CreateMutexW,WaitForSingleObject,CreateFileW,GetFileSize,CloseHandle,DeleteFileW,ReleaseMutex,DirectInput8Create,GetTickCount,GetKeyState,

0_2_00007FF62A9772D0

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Jump to behavior

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Code function: 0_2_00007FF62A98C400: wsprintfW,CreateFileW,DeviceIoControl,DeviceIoControl,DeviceIoControl,DeviceIoControl,CloseHandle,CloseHandle,

0_2_00007FF62A98C400

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A97E3E9 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,ExitWindowsEx,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	0_2_00007FF62A97E3E9
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A97E4EE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,ExitWindowsEx,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,	0_2_00007FF62A97E4EE
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A97E46D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,ExitWindowsEx,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,	0_2_00007FF62A97E46D

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

File created: C:\ProgramData\kernelquick.sys

Jump to behavior

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A97B410	0_2_00007FF62A97B410
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A97F410	0_2_00007FF62A97F410
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A976370	0_2_00007FF62A976370
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A971500	0_2_00007FF62A971500
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A97FD10	0_2_00007FF62A97FD10
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A9772D0	0_2_00007FF62A9772D0
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A977A60	0_2_00007FF62A977A60
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A9780C0	0_2_00007FF62A9780C0
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A9A2048	0_2_00007FF62A9A2048
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A98B5E0	0_2_00007FF62A98B5E0
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A98AE60	0_2_00007FF62A98AE60
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A998EB0	0_2_00007FF62A998EB0
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A9A73EC	0_2_00007FF62A9A73EC
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A995408	0_2_00007FF62A995408
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A97D410	0_2_00007FF62A97D410
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A99F4BC	0_2_00007FF62A99F4BC
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A9964C8	0_2_00007FF62A9964C8
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A979480	0_2_00007FF62A979480
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A9A29E4	0_2_00007FF62A9A29E4
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A9971DC	0_2_00007FF62A9971DC
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A9879D0	0_2_00007FF62A9879D0
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A995A1C	0_2_00007FF62A995A1C
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A9A3A00	0_2_00007FF62A9A3A00
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A9951FC	0_2_00007FF62A9951FC
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A99F950	0_2_00007FF62A99F950
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A9A4190	0_2_00007FF62A9A4190
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A9A22C4	0_2_00007FF62A9A22C4
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A989330	0_2_00007FF62A989330
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A99C7BC	0_2_00007FF62A99C7BC
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A99FFD0	0_2_00007FF62A99FFD0
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A9A5FD4	0_2_00007FF62A9A5FD4
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A9A8824	0_2_00007FF62A9A8824
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A995818	0_2_00007FF62A995818
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A994FF8	0_2_00007FF62A994FF8
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A99A798	0_2_00007FF62A99A798
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A982FA0	0_2_00007FF62A982FA0
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A979900	0_2_00007FF62A979900
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A99684C	0_2_00007FF62A99684C
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A980880	0_2_00007FF62A980880
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A9975E0	0_2_00007FF62A9975E0
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A99B5F0	0_2_00007FF62A99B5F0
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A99D5C0	0_2_00007FF62A99D5C0
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A99560C	0_2_00007FF62A99560C
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A97CD40	0_2_00007FF62A97CD40
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A97ADB0	0_2_00007FF62A97ADB0
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A99AF20	0_2_00007FF62A99AF20
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A972E50	0_2_00007FF62A972E50
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A98A680	0_2_00007FF62A98A680

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/1@0/1

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A98B5E0 SleepEx,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,RegOpenKeyExW,RegDeleteValueW,RegSetValueExW,RegCloseKey,SleepEx,CreateEventA,Sleep,Sleep,CloseHandle,_invalid_parameter_noinfo_noreturn,IsDebuggerPresent,LoadLibraryW,GetProcAddress,FreeLibrary,GetLocalTime,wsprintfW,CreateFileW,FreeLibrary,GetCurrentThreadId,GetCurrentProcessId,GetCurrentProcess,CloseHandle,FreeLibrary,	0_2_00007FF62A98B5E0
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A97E3E9 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,ExitWindowsEx,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	0_2_00007FF62A97E3E9
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A97E4EE GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,ExitWindowsEx,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,	0_2_00007FF62A97E4EE
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A97E46D GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,ExitWindowsEx,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,	0_2_00007FF62A97E46D
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A979480 GetSystemDirectoryA,CreateProcessA,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,OpenProcess,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,GetModuleFileNameA,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,ResumeThread,	0_2_00007FF62A979480

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

0_2_00007FF62A976370

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Code function: 0_2_00007FF62A97F410 GetLastInputInfo,GetTickCount,wsprintfW,GetForegroundWindow,GetWindowTextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,SHGetFolderPathW,lstrcatW,CreateFileW,lstrlenW,WriteFile,CloseHandle,FindFirstFileW,FindClose,_invalid_parameter_noinfo_noreturn,

0_2_00007FF62A97F410

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

0_2_00007FF62A976370

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Mutant created: \Sessions\1\BaseNamedObjects\????

Source: yIR0BZUT2A.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: yIR0BZUT2A.exe	ReversingLabs: Detection: 52%
Source: yIR0BZUT2A.exe	Virustotal: Detection: 68%

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: dinput8.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62BE5D10-60EB-11d0-BD3B-00A0C911CE86}\InprocServer32

Jump to behavior

Source: yIR0BZUT2A.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: yIR0BZUT2A.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: yIR0BZUT2A.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

0_2_00007FF62A976370

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

File created: C:\ProgramData\kernelquick.sys

Jump to behavior

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Code function: 0_2_00007FF62A97E36A OpenEventLogW,ClearEventLogW,CloseEventLog,

0_2_00007FF62A97E36A

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE VenkernalData_info

Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_0-21653

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Stalling execution: Execution stalls by calling Sleep

graph_0-21131

Tries to detect sandboxes / dynamic malware analysis system (QueryWinSAT)

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{05DF8D13-C355-47F4-A11E-851B338CEFB8}

Jump to behavior

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

0_2_00007FF62A976370

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Window / User API: threadDelayed 2708	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Window / User API: threadDelayed 3336	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Window / User API: threadDelayed 3434	Jump to behavior

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-21738

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe TID: 6312	Thread sleep count: 2708 > 30	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe TID: 6312	Thread sleep time: -2708000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe TID: 6460	Thread sleep count: 3336 > 30	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe TID: 6460	Thread sleep time: -33360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe TID: 6312	Thread sleep count: 3434 > 30	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe TID: 6312	Thread sleep time: -3434000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A97F410 GetLastInputInfo,GetTickCount,wsprintfW,GetForegroundWindow,GetWindowTextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,RegCloseKey,SHGetFolderPathW,lstrcatW,CreateFileW,lstrlenW,WriteFile,CloseHandle,FindFirstFileW,FindClose,_invalid_parameter_noinfo_noreturn,		0_2_00007FF62A97F410
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A9A4190 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,		0_2_00007FF62A9A4190

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

0_2_00007FF62A976370

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

0_2_00007FF62A976370

Source: yIR0BZUT2A.exe, 00000000.00000002.4109685737.0000020F2BE3C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Code function: 0_2_00007FF62A98B5E0 SleepEx,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,RegOpenKeyExW,RegDeleteValueW,RegSetValueExW,RegCloseKey,SleepEx,CreateEventA,Sleep,Sleep,CloseHandle,_invalid_parameter_noinfo_noreturn,IsDebuggerPresent,LoadLibraryW,GetProcAddress,FreeLibrary,GetLocalTime,wsprintfW,CreateFileW,FreeLibrary,GetCurrentThreadId,GetCurrentProcessId,GetCurrentProcess,CloseHandle,FreeLibrary,

0_2_00007FF62A98B5E0

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Code function: 0_2_00007FF62A98C82C GetLastError,IsDebuggerPresent,OutputDebugStringW,

0_2_00007FF62A98C82C

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

0_2_00007FF62A976370

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

0_2_00007FF62A976370

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Code function: 0_2_00007FF62A978710 SysAllocString,SysAllocString,GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,LookupAccountSidW,GetLastError,SysAllocString,SysAllocString,GetProcessHeap,HeapFree,GetCurrentProcessId,OpenProcess,OpenProcessToken,CloseHandle,

0_2_00007FF62A978710

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A98B5E0 SleepEx,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,OpenProcess,GetLocalTime,wsprintfW,SetUnhandledExceptionFilter,CloseHandle,AllocateAndInitializeSid,CheckTokenMembership,FreeSid,RegOpenKeyExW,RegDeleteValueW,RegSetValueExW,RegCloseKey,SleepEx,CreateEventA,Sleep,Sleep,CloseHandle,_invalid_parameter_noinfo_noreturn,IsDebuggerPresent,LoadLibraryW,GetProcAddress,FreeLibrary,GetLocalTime,wsprintfW,CreateFileW,FreeLibrary,GetCurrentThreadId,GetCurrentProcessId,GetCurrentProcess,CloseHandle,FreeLibrary,	0_2_00007FF62A98B5E0
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A98BDF0 SetUnhandledExceptionFilter,GetConsoleWindow,ShowWindow,GetCurrentThreadId,PostThreadMessageA,GetInputState,CreateThread,WaitForSingleObject,CloseHandle,Sleep,	0_2_00007FF62A98BDF0
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A993D0C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF62A993D0C
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A98EA00 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF62A98EA00
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A98E814 SetUnhandledExceptionFilter,	0_2_00007FF62A98E814
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: 0_2_00007FF62A98E66C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF62A98E66C

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Code function: 0_2_00007FF62A979480 GetSystemDirectoryA,CreateProcessA,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,OpenProcess,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,GetModuleFileNameA,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,ResumeThread,

0_2_00007FF62A979480

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

0_2_00007FF62A979480

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Code function: GetSystemDirectoryA,CreateProcessA,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,OpenProcess,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetCurrentProcess,GetProcessId,GetModuleFileNameA,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,CreateRemoteThread,Sleep,VirtualProtectEx,VirtualProtectEx,ResumeThread, Windows\System32\svchost.exe

0_2_00007FF62A979480

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

0_2_00007FF62A98B5E0

Source: yIR0BZUT2A.exe, 00000000.00000003.3405277748.0000020F2BF0D000.00000004.00000020.00020000.00000000.sdmp, yIR0BZUT2A.exe, 00000000.00000003.3794875123.0000020F2BECB000.00000004.00000020.00020000.00000000.sdmp, yIR0BZUT2A.exe, 00000000.00000003.2773094836.0000020F2BEBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0 minProgram Manager
Source: yIR0BZUT2A.exe, 00000000.00000003.3419747333.0000020F2BF0A000.00000004.00000020.00020000.00000000.sdmp, yIR0BZUT2A.exe, 00000000.00000002.4109685737.0000020F2BF02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Code function: 0_2_00007FF62A9ACB60 cpuid

0_2_00007FF62A9ACB60

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: gethostname,gethostbyname,inet_ntoa,inet_ntoa,MultiByteToWideChar,MultiByteToWideChar,GetLastInputInfo,GetTickCount,wsprintfW,MultiByteToWideChar,MultiByteToWideChar,LoadLibraryW,GetProcAddress,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,FreeLibrary,GetSystemInfo,wsprintfW,GetDriveTypeW,GetDiskFreeSpaceExW,GlobalMemoryStatusEx,GetForegroundWindow,GetWindowTextW,lstrlenW,GetLocalTime,wsprintfW,lstrlenW,GetModuleHandleW,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,wsprintfW,GetCurrentProcessId,OpenProcess,K32GetProcessImageFileNameW,GetLogicalDriveStringsW,lstrcmpiW,lstrcmpiW,QueryDosDeviceW,lstrlenW,lstrcpyW,CloseHandle,CoInitializeEx,CoCreateInstance,SysFreeString,CoUninitialize,RegOpenKeyExW,RegQueryInfoKeyW,RegEnumKeyExW,lstrlenW,lstrlenW,RegCloseKey,lstrlenW,GetTickCount,wsprintfW,GetLocaleInfoW,GetSystemDirectoryW,GetCurrentHwProfileW,lstrcpyW,lstrcatW,lstrlenW,GetLocalTime,wsprintfW,RegOpenKeyExW,RegDeleteValueW,RegCloseKey,RegCreateKeyW,lstrlenW,RegSetValueExW,RegCloseKey,RegCloseKey,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,	0_2_00007FF62A976370
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF62A9A83C4
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: EnumSystemLocalesW,	0_2_00007FF62A9A7CD8
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00007FF62A9A81E0
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_00007FF62A9A797C
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: EnumSystemLocalesW,	0_2_00007FF62A9A0AD8
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: GetLocaleInfoW,	0_2_00007FF62A9A8290
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: GetLocaleInfoW,	0_2_00007FF62A9A0FB0
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: GetLocaleInfoW,	0_2_00007FF62A9A8088
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: EnumSystemLocalesW,	0_2_00007FF62A9A7DA8
Source: C:\Users\user\Desktop\yIR0BZUT2A.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00007FF62A9A7E40

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

0_2_00007FF62A976370

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Code function: 0_2_00007FF62A9A2048 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF62A9A2048

Source: C:\Users\user\Desktop\yIR0BZUT2A.exe

Code function: 0_2_00007FF62A978A40 GetCurrentProcessId,OpenProcess,OpenProcessToken,CloseHandle,SysStringLen,SysStringLen,CloseHandle,CloseHandle,SysFreeString,SysFreeString,GetCurrentProcessId,wsprintfW,GetVersionExW,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,wsprintfW,

0_2_00007FF62A978A40

Source: yIR0BZUT2A.exe, 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmp, yIR0BZUT2A.exe, 00000000.00000000.1650507673.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: KSafeTray.exe

Stealing of Sensitive Information

Yara detected GhostRat

Source: Yara match	File source: yIR0BZUT2A.exe, type: SAMPLE
Source: Yara match	File source: 0.2.yIR0BZUT2A.exe.7ff62a970000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.yIR0BZUT2A.exe.7ff62a970000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: yIR0BZUT2A.exe PID: 7056, type: MEMORYSTR

Remote Access Functionality

Yara detected GhostRat

Source: Yara match	File source: yIR0BZUT2A.exe, type: SAMPLE
Source: Yara match	File source: 0.2.yIR0BZUT2A.exe.7ff62a970000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.yIR0BZUT2A.exe.7ff62a970000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: yIR0BZUT2A.exe PID: 7056, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	12 Native API	1 Windows Service	1 Access Token Manipulation	1 Modify Registry	121 Input Capture	2 System Time Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Windows Service	1 Virtualization/Sandbox Evasion	LSASS Memory	151 Security Software Discovery	Remote Desktop Protocol	121 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	211 Process Injection	1 Access Token Manipulation	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Archive Collected Data	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	211 Process Injection	NTDS	3 Process Discovery	Distributed Component Object Model	3 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	11 Peripheral Device Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	26 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
yIR0BZUT2A.exe	53%	ReversingLabs	Win64.Trojan.SpywareX
yIR0BZUT2A.exe	68%	Virustotal		Browse

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
154.91.90.234	unknown	Seychelles		134705	ITACE-AS-APItaceInternationalLimitedHK	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585729
Start date and time:	2025-01-08 05:51:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	yIR0BZUT2A.exe renamed because original name is a hash value
Original Sample Name:	d290cccbc59f0fa1d5e5d36a88785795.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/1@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 44 Number of non-executed functions: 117
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, 7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.

Simulations

Behavior and APIs

Time	Type	Description
23:52:28	API Interceptor	5861694x Sleep call for process: yIR0BZUT2A.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ITACE-AS-APItaceInternationalLimitedHK	U02LaPwnkd.exe	Get hash	malicious	ValleyRAT	Browse	154.91.226.158
	Fantazy.i486.elf	Get hash	malicious	Unknown	Browse	156.227.127.123
	http://www.rr8844.com	Get hash	malicious	Unknown	Browse	154.91.91.54
	hoEtvOOrYH.exe	Get hash	malicious	SmokeLoader	Browse	45.118.248.184
	vcimanagement.armv4l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.237.86.202
	vcimanagement.powerpc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.235.45.173
	vcimanagement.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.227.127.146
	vcimanagement.m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.235.45.170
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	154.194.208.251
	db0fa4b8db0333367e9bda3ab68b8042.spc.elf	Get hash	malicious	Mirai, Gafgyt	Browse	156.235.45.132

Process:	C:\Users\user\Desktop\yIR0BZUT2A.exe
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	2.6616157143988106
Encrypted:	false
SSDEEP:	3:tblM6lEjln:tbhEZn
MD5:	AE50B29A0B8DCC411F24F1863B0EAFDE
SHA1:	D415A55627B1ADED8E4B2CBBA402F816B0461155
SHA-256:	6B4BBBCE480FBC50D39A8EC4B72CDB7D781B151921E063DD899FD9B736ADCF68
SHA-512:	D9A9BA42D99BE32D26667060BE1D523DCD20EAFA187A67F7919002CC6DA349FD058053C9C6F721D6FDB730EA02FBAA3013E51C0C653368BD6B3F57A4C0FCABA8
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.060232935611435
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	yIR0BZUT2A.exe
File size:	390'656 bytes
MD5:	d290cccbc59f0fa1d5e5d36a88785795
SHA1:	426910443aec2075365cece2514801ea3254d0ca
SHA256:	061f46e583ce23f357dba77ee0f455e31304231538a6820b0948f9bddc1e9b6e
SHA512:	3c431febb985275a84da02263d67b7cc2b98fd1fc7f9e7c8f1bcb442e6d790f929047670862cf6da2e450366c75cb6c4271156c27fa8e32035588dceb5e38238
SSDEEP:	6144:rvy/g/Oe2CZNHfXmv9m7tvT7DYewsPJimci9vrBP2kbLjNy:2/KlpTXmv9mpvv0iPJPBr9zNy
TLSH:	3D847E49FB9409F8E467C138C9A34916EBB27C5913A09BDF33A4466A2F237D05D3EB11
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..R............M.......M.......M.......M........O.......O.......O..S...M.......M...........3...MN......MN......Rich...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x14001e25c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6763E626 [Thu Dec 19 09:23:50 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	1db3bac59c066f9b53b8b3b6b99b874b

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F5BF4835680h
dec eax
add esp, 28h
jmp 00007F5BF4834ED7h
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F5BF4835072h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F5BF4835075h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F5BF483506Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007F5BF483507Ah
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
nop word ptr [eax+eax+00000000h]
dec eax
cmp ecx, dword ptr [00036D39h]
jne 00007F5BF4835072h
dec eax
rol ecx, 10h
test cx, FFFFh
jne 00007F5BF4835063h
ret
dec eax
ror ecx, 10h
jmp 00007F5BF483577Bh
int3
int3
dec eax
mov dword ptr [esp+00h], ebx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x52400	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x60000	0x3450	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x64000	0xc8c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4c7c0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4c980	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4c680	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3f000	0x920	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3df70	0x3e000	2b6c6c8b93239d65e2449c4cc33eda20	False	0.5452683971774194	data	6.461526088950339	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3f000	0x151e8	0x15200	0f93661560d08fd5133b1ecad98a47aa	False	0.4156804733727811	data	4.936195594835422	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x55000	0xaa9c	0x7c00	02896d874f254d4521f959657c33941d	False	0.10650831653225806	DOS executable (block device driver \377\3)	1.586961638922988	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x60000	0x3450	0x3600	b6a68cd5b1e86136baf9e34e01cfad8b	False	0.4622395833333333	data	5.530289196450094	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x64000	0xc8c	0xe00	a952b87812e4781581800f8699e0d5a4	False	0.49302455357142855	data	5.228153224182403	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	QueryDosDeviceW, WriteProcessMemory, GetCommandLineW, GetCurrentProcess, WriteFile, OutputDebugStringA, GetModuleFileNameW, GetProcessId, CreateMutexW, GetLocaleInfoW, LocalAlloc, CreateFileW, GetVersionExW, K32GetProcessImageFileNameW, GetSystemDirectoryW, ResumeThread, GetModuleHandleA, OpenProcess, GetLogicalDriveStringsW, CreateToolhelp32Snapshot, MultiByteToWideChar, Process32NextW, GetDiskFreeSpaceExW, GetSystemDirectoryA, LoadLibraryA, lstrcatW, GlobalAlloc, Process32FirstW, GlobalFree, GetSystemInfo, LoadLibraryW, GetLocalTime, VirtualProtectEx, GetThreadContext, GetProcAddress, VirtualAllocEx, LocalFree, ExitProcess, GetCurrentProcessId, GlobalMemoryStatusEx, CreateProcessW, GetModuleHandleW, FreeLibrary, GetConsoleWindow, lstrcpyW, CreateRemoteThread, CreateProcessA, SetThreadContext, GetModuleFileNameA, GetTickCount, lstrcmpW, GetDriveTypeW, GetExitCodeProcess, SetFilePointer, ReleaseMutex, GlobalSize, DeleteFileW, GlobalLock, GetFileSize, GlobalUnlock, FindFirstFileW, ExpandEnvironmentStringsW, FindClose, GetFileAttributesW, TerminateThread, VirtualProtect, IsBadReadPtr, CreateThread, IsDebuggerPresent, SetUnhandledExceptionFilter, WriteConsoleW, GetCurrentThreadId, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, SetFilePointerEx, SetStdHandle, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, GetTimeZoneInformation, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, LCMapStringW, CompareStringW, FlsFree, FlsSetValue, GetStartupInfoW, CreateWaitableTimerW, SetWaitableTimer, TryEnterCriticalSection, WideCharToMultiByte, ResetEvent, CreateEventW, lstrlenW, CancelIo, GetNativeSystemInfo, SetLastError, lstrcmpiW, CreateEventA, CloseHandle, SetEvent, Sleep, WaitForSingleObject, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, EnterCriticalSection, HeapCreate, HeapFree, GetProcessHeap, DeleteCriticalSection, HeapDestroy, DecodePointer, HeapAlloc, HeapReAlloc, GetLastError, HeapSize, InitializeCriticalSectionEx, VirtualAlloc, VirtualFree, FlsGetValue, FlsAlloc, GetFileType, GetCommandLineA, GetStdHandle, VirtualQuery, GetModuleHandleExW, FreeLibraryAndExitThread, ExitThread, LoadLibraryExW, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, RtlPcToFileHeader, RtlUnwindEx, lstrcpyA, CreateFileA, GetSystemDefaultLangID, DeviceIoControl, TerminateProcess, InitializeSListHead, GetSystemTimeAsFileTime, QueryPerformanceCounter, IsProcessorFeaturePresent, UnhandledExceptionFilter, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, SleepConditionVariableSRW, WakeAllConditionVariable, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, GetCPInfo, LCMapStringEx, EncodePointer, CompareStringEx, GetStringTypeW, RaiseException, OutputDebugStringW, SwitchToThread
USER32.dll	GetForegroundWindow, GetLastInputInfo, GetClipboardData, GetWindowTextW, GetKeyState, ReleaseDC, GetDesktopWindow, SetClipboardData, CloseClipboard, wsprintfW, ExitWindowsEx, ShowWindow, PostThreadMessageA, GetInputState, GetDC, GetSystemMetrics, EmptyClipboard, MsgWaitForMultipleObjects, DispatchMessageW, PeekMessageW, TranslateMessage, OpenClipboard
GDI32.dll	CreateCompatibleBitmap, SelectObject, CreateDIBSection, SetDIBColorTable, CreateCompatibleDC, StretchBlt, GetDIBits, GetDeviceCaps, GetObjectW, SetStretchBltMode, DeleteObject, DeleteDC
ADVAPI32.dll	RegQueryInfoKeyW, RegQueryValueExW, AllocateAndInitializeSid, FreeSid, CheckTokenMembership, ClearEventLogW, CloseEventLog, OpenEventLogW, LookupPrivilegeValueW, AdjustTokenPrivileges, GetCurrentHwProfileW, RegCloseKey, GetSidSubAuthorityCount, GetSidSubAuthority, RegEnumKeyExW, RegSetValueExW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyW, RegDeleteValueW, LookupAccountSidW, GetTokenInformation
SHELL32.dll	SHGetFolderPathW
ole32.dll	CreateStreamOnHGlobal, GetHGlobalFromStream, CoCreateInstance, CoUninitialize, CoInitialize
OLEAUT32.dll	SysFreeString, SysAllocString, SysStringLen
WS2_32.dll	select, WSAStartup, send, socket, connect, recv, htons, setsockopt, WSAIoctl, gethostbyname, WSAGetLastError, WSAEnumNetworkEvents, WSAWaitForMultipleEvents, WSAResetEvent, WSAEventSelect, WSASetLastError, WSACloseEvent, shutdown, gethostname, inet_ntoa, WSACleanup, closesocket, WSACreateEvent
WINMM.dll	timeGetTime
gdiplus.dll	GdipDisposeImage, GdipCreateBitmapFromHBITMAP, GdipGetImagePixelFormat, GdiplusShutdown, GdipDrawImageI, GdipFree, GdipSaveImageToStream, GdipGetImageWidth, GdipGetImagePalette, GdipDeleteGraphics, GdipGetImageEncodersSize, GdipGetImageGraphicsContext, GdipBitmapLockBits, GdipCreateBitmapFromScan0, GdipAlloc, GdiplusStartup, GdipGetImageHeight, GdipGetImageEncoders, GdipGetImagePaletteSize, GdipCloneImage, GdipBitmapUnlockBits, GdipCreateBitmapFromStream
dxgi.dll	CreateDXGIFactory
DINPUT8.dll	DirectInput8Create

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T05:52:01.260779+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49730	154.91.90.234	4433	TCP
2025-01-08T05:53:07.512968+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49730	154.91.90.234	4433	TCP
2025-01-08T05:54:08.867603+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	54649	154.91.90.234	4433	TCP
2025-01-08T05:55:51.557688+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	54653	154.91.90.234	4433	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 05:52:00.089695930 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:52:00.094626904 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:52:00.094722033 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:52:00.863348007 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:52:00.868350029 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:52:00.868391037 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:52:00.868437052 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:52:00.868459940 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:52:01.172449112 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:52:01.215883017 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:52:01.255769968 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:52:01.260691881 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:52:01.260704994 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:52:01.260714054 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:52:01.260718107 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:52:01.260778904 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:52:01.265573025 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:52:17.028435946 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:52:17.033441067 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:52:17.367533922 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:52:17.418977976 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:52:33.622212887 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:52:33.627137899 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:52:33.928493023 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:52:33.981506109 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:52:40.301570892 CET	54380	53	192.168.2.4	162.159.36.2
Jan 8, 2025 05:52:40.306420088 CET	53	54380	162.159.36.2	192.168.2.4
Jan 8, 2025 05:52:40.306487083 CET	54380	53	192.168.2.4	162.159.36.2
Jan 8, 2025 05:52:40.311338902 CET	53	54380	162.159.36.2	192.168.2.4
Jan 8, 2025 05:52:40.770030975 CET	54380	53	192.168.2.4	162.159.36.2
Jan 8, 2025 05:52:40.775059938 CET	53	54380	162.159.36.2	192.168.2.4
Jan 8, 2025 05:52:40.775113106 CET	54380	53	192.168.2.4	162.159.36.2
Jan 8, 2025 05:52:50.325372934 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:52:50.330284119 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:52:50.631928921 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:52:50.684770107 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:53:07.512968063 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:53:07.517818928 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:53:07.819251060 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:53:07.872179031 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:53:24.794329882 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:53:24.800461054 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:53:25.112510920 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:53:25.325321913 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:53:41.309736013 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:53:41.309777975 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:53:41.314587116 CET	4433	49730	154.91.90.234	192.168.2.4
Jan 8, 2025 05:53:41.317359924 CET	49730	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:53:46.263338089 CET	54648	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:53:46.268227100 CET	10443	54648	154.91.90.234	192.168.2.4
Jan 8, 2025 05:53:46.271362066 CET	54648	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:53:47.156785965 CET	54648	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:53:47.161753893 CET	10443	54648	154.91.90.234	192.168.2.4
Jan 8, 2025 05:53:47.161766052 CET	10443	54648	154.91.90.234	192.168.2.4
Jan 8, 2025 05:53:47.161773920 CET	10443	54648	154.91.90.234	192.168.2.4
Jan 8, 2025 05:53:47.161802053 CET	10443	54648	154.91.90.234	192.168.2.4
Jan 8, 2025 05:53:47.725117922 CET	10443	54648	154.91.90.234	192.168.2.4
Jan 8, 2025 05:53:47.778529882 CET	54648	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:53:47.834391117 CET	54648	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:53:47.839265108 CET	10443	54648	154.91.90.234	192.168.2.4
Jan 8, 2025 05:53:47.839277029 CET	10443	54648	154.91.90.234	192.168.2.4
Jan 8, 2025 05:53:47.839308977 CET	10443	54648	154.91.90.234	192.168.2.4
Jan 8, 2025 05:53:47.839315891 CET	54648	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:53:47.839329004 CET	10443	54648	154.91.90.234	192.168.2.4
Jan 8, 2025 05:53:47.844156027 CET	10443	54648	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:02.122626066 CET	54648	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:02.122658968 CET	54648	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:02.127501011 CET	10443	54648	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:02.127567053 CET	54648	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:07.093420029 CET	54649	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:07.098400116 CET	4433	54649	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:07.098476887 CET	54649	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:08.421977043 CET	54649	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:08.427301884 CET	4433	54649	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:08.427405119 CET	4433	54649	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:08.427414894 CET	4433	54649	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:08.427423954 CET	4433	54649	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:08.783978939 CET	4433	54649	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:08.825350046 CET	54649	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:08.862683058 CET	54649	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:08.867554903 CET	4433	54649	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:08.867564917 CET	4433	54649	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:08.867573023 CET	4433	54649	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:08.867597103 CET	4433	54649	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:08.867603064 CET	54649	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:08.872359037 CET	4433	54649	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:23.138140917 CET	54649	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:23.138237000 CET	54649	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:23.143124104 CET	4433	54649	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:23.143186092 CET	54649	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:28.092073917 CET	54650	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:28.096945047 CET	10443	54650	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:28.097141027 CET	54650	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:29.079698086 CET	54650	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:29.084651947 CET	10443	54650	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:29.084665060 CET	10443	54650	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:29.084675074 CET	10443	54650	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:29.084882021 CET	10443	54650	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:29.635668039 CET	10443	54650	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:29.684748888 CET	54650	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:29.967488050 CET	54650	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:29.972436905 CET	10443	54650	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:29.972449064 CET	10443	54650	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:29.972460985 CET	10443	54650	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:29.972527981 CET	10443	54650	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:30.035533905 CET	54650	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:30.040626049 CET	10443	54650	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:44.528723955 CET	54650	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:44.528877020 CET	54650	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:44.533576965 CET	10443	54650	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:44.535387039 CET	54650	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:49.482064962 CET	54651	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:49.487061024 CET	4433	54651	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:49.487397909 CET	54651	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:50.411772966 CET	54651	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:50.416695118 CET	4433	54651	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:50.416717052 CET	4433	54651	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:50.416753054 CET	4433	54651	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:50.416790962 CET	4433	54651	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:50.793350935 CET	4433	54651	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:50.841021061 CET	54651	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:50.938977957 CET	54651	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:50.943788052 CET	4433	54651	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:50.943799019 CET	4433	54651	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:50.943809032 CET	4433	54651	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:50.943927050 CET	4433	54651	154.91.90.234	192.168.2.4
Jan 8, 2025 05:54:50.958345890 CET	54651	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:54:50.963279009 CET	4433	54651	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:05.966101885 CET	54651	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:05.970989943 CET	4433	54651	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:06.273088932 CET	4433	54651	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:06.372289896 CET	54651	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:23.497359037 CET	54651	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:23.497396946 CET	54651	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:23.502289057 CET	4433	54651	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:23.503403902 CET	54651	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:28.480648994 CET	54652	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:28.485526085 CET	10443	54652	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:28.485603094 CET	54652	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:29.298566103 CET	54652	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:29.303502083 CET	10443	54652	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:29.303514957 CET	10443	54652	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:29.303523064 CET	10443	54652	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:29.303742886 CET	10443	54652	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:29.865904093 CET	10443	54652	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:29.919202089 CET	54652	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:30.021357059 CET	54652	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:30.026828051 CET	10443	54652	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:30.026839972 CET	10443	54652	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:30.026850939 CET	10443	54652	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:30.026860952 CET	10443	54652	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:30.026902914 CET	54652	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:30.031788111 CET	10443	54652	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:45.122459888 CET	54652	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:45.122613907 CET	54652	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:45.127371073 CET	10443	54652	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:45.129604101 CET	54652	10443	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:50.091464043 CET	54653	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:50.096494913 CET	4433	54653	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:50.096566916 CET	54653	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:50.887164116 CET	54653	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:50.892015934 CET	4433	54653	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:50.892026901 CET	4433	54653	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:50.892041922 CET	4433	54653	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:50.892348051 CET	4433	54653	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:51.465368986 CET	4433	54653	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:51.512984991 CET	54653	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:51.551748037 CET	54653	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:51.557617903 CET	4433	54653	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:51.557687998 CET	54653	4433	192.168.2.4	154.91.90.234
Jan 8, 2025 05:55:51.557728052 CET	4433	54653	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:51.557738066 CET	4433	54653	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:51.557745934 CET	4433	54653	154.91.90.234	192.168.2.4
Jan 8, 2025 05:55:51.563563108 CET	4433	54653	154.91.90.234	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 05:52:40.301124096 CET	53	50440	162.159.36.2	192.168.2.4
Jan 8, 2025 05:52:41.058515072 CET	53	57248	1.1.1.1	192.168.2.4

Target ID:	0
Start time:	23:51:52
Start date:	07/01/2025
Path:	C:\Users\user\Desktop\yIR0BZUT2A.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\yIR0BZUT2A.exe"
Imagebase:	0x7ff62a970000
File size:	390'656 bytes
MD5 hash:	D290CCCBC59F0FA1D5E5D36A88785795
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	45%
Total number of Nodes:	1152
Total number of Limit Nodes:	47

Executed Functions

Function 00007FF62A976370 Relevance: 193.3, APIs: 81, Strings: 29, Instructions: 845
registrystringprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

gethostname.WS2_32 ref: 00007FF62A976414
gethostbyname.WS2_32 ref: 00007FF62A97641E
inet_ntoa.WS2_32 ref: 00007FF62A97643B
inet_ntoa.WS2_32 ref: 00007FF62A97648B
MultiByteToWideChar.KERNEL32 ref: 00007FF62A9764E9
MultiByteToWideChar.KERNEL32 ref: 00007FF62A97650D
GetLastInputInfo.USER32 ref: 00007FF62A976525
GetTickCount.KERNEL32 ref: 00007FF62A97652B
wsprintfW.USER32 ref: 00007FF62A97655E
MultiByteToWideChar.KERNEL32 ref: 00007FF62A97659F
LoadLibraryW.KERNEL32 ref: 00007FF62A9765AC
GetProcAddress.KERNEL32 ref: 00007FF62A9765C8
RegOpenKeyExW.KERNEL32 ref: 00007FF62A97666D
RegQueryValueExW.KERNEL32 ref: 00007FF62A976698
RegCloseKey.KERNEL32 ref: 00007FF62A9766C5
FreeLibrary.KERNEL32 ref: 00007FF62A9766D6
GetSystemInfo.KERNEL32 ref: 00007FF62A9766EF
wsprintfW.USER32 ref: 00007FF62A976707
GetDriveTypeW.KERNEL32 ref: 00007FF62A976736
GetDiskFreeSpaceExW.KERNEL32 ref: 00007FF62A976759
GlobalMemoryStatusEx.KERNEL32 ref: 00007FF62A97679D
GetForegroundWindow.USER32 ref: 00007FF62A976819
GetWindowTextW.USER32 ref: 00007FF62A976834
lstrlenW.KERNEL32 ref: 00007FF62A976844
GetLocalTime.KERNEL32 ref: 00007FF62A976883
wsprintfW.USER32 ref: 00007FF62A97689D
MultiByteToWideChar.KERNEL32 ref: 00007FF62A97657B

Part of subcall function 00007FF62A998A40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62A998A66

lstrlenW.KERNEL32 ref: 00007FF62A9768C5
GetModuleHandleW.KERNEL32 ref: 00007FF62A97690E
GetProcAddress.KERNEL32 ref: 00007FF62A97691E
GetNativeSystemInfo.KERNEL32 ref: 00007FF62A97692D
GetSystemInfo.KERNEL32 ref: 00007FF62A976931
wsprintfW.USER32 ref: 00007FF62A976978
GetCurrentProcessId.KERNEL32 ref: 00007FF62A97698D
OpenProcess.KERNEL32 ref: 00007FF62A9769AB
K32GetProcessImageFileNameW.KERNEL32 ref: 00007FF62A9769CD
GetLogicalDriveStringsW.KERNEL32 ref: 00007FF62A9769E7
lstrcmpiW.KERNEL32 ref: 00007FF62A976A28
lstrcmpiW.KERNEL32 ref: 00007FF62A976A3C
QueryDosDeviceW.KERNEL32 ref: 00007FF62A976A76

Part of subcall function 00007FF62A98DFB8: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62A98DFE8
Part of subcall function 00007FF62A98DFB8: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62A98DFEE

Part of subcall function 00007FF62A979300: GetModuleHandleW.KERNEL32 ref: 00007FF62A97931D
Part of subcall function 00007FF62A979300: GetProcAddress.KERNEL32 ref: 00007FF62A97932D
Part of subcall function 00007FF62A979300: GetNativeSystemInfo.KERNEL32 ref: 00007FF62A97933D

lstrlenW.KERNEL32 ref: 00007FF62A976A87
lstrcpyW.KERNEL32 ref: 00007FF62A976AC8
CloseHandle.KERNEL32 ref: 00007FF62A976AD1
CoInitializeEx.COMBASE ref: 00007FF62A976AE2
CoCreateInstance.COMBASE ref: 00007FF62A976B07
SysFreeString.OLEAUT32 ref: 00007FF62A976BBC
CoUninitialize.OLE32 ref: 00007FF62A976BFE
RegOpenKeyExW.KERNEL32 ref: 00007FF62A976C67
RegQueryInfoKeyW.ADVAPI32 ref: 00007FF62A976CC7
RegEnumKeyExW.ADVAPI32 ref: 00007FF62A976D5F
lstrlenW.KERNEL32 ref: 00007FF62A976D6C
lstrlenW.KERNEL32 ref: 00007FF62A976D7E
RegCloseKey.ADVAPI32 ref: 00007FF62A976DCC
lstrlenW.KERNEL32 ref: 00007FF62A976DD9

Part of subcall function 00007FF62A9994E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62A99951B

Part of subcall function 00007FF62A977A60: CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF62A977AEB
Part of subcall function 00007FF62A977A60: Process32FirstW.KERNEL32 ref: 00007FF62A977B08
Part of subcall function 00007FF62A977A60: Process32NextW.KERNEL32 ref: 00007FF62A977B43
Part of subcall function 00007FF62A977A60: CloseHandle.KERNEL32 ref: 00007FF62A977B50
Part of subcall function 00007FF62A977A60: CoCreateInstance.COMBASE ref: 00007FF62A977B9F

GetTickCount.KERNEL32 ref: 00007FF62A976E21

Part of subcall function 00007FF62A998E3C: GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF62A998E50

wsprintfW.USER32 ref: 00007FF62A976E99
GetLocaleInfoW.KERNEL32 ref: 00007FF62A976EB6
GetSystemDirectoryW.KERNEL32 ref: 00007FF62A976EC8
GetCurrentHwProfileW.ADVAPI32 ref: 00007FF62A976EDC
lstrlenW.KERNEL32 ref: 00007FF62A976F5B
GetLocalTime.KERNEL32 ref: 00007FF62A976F97
wsprintfW.USER32 ref: 00007FF62A976FB1
RegOpenKeyExW.KERNEL32 ref: 00007FF62A976FD6
RegDeleteValueW.KERNEL32 ref: 00007FF62A976FEA
RegCloseKey.ADVAPI32 ref: 00007FF62A976FF7
RegCreateKeyW.ADVAPI32 ref: 00007FF62A97700E
lstrlenW.KERNEL32 ref: 00007FF62A97701B
RegSetValueExW.KERNEL32 ref: 00007FF62A977043
RegCloseKey.ADVAPI32 ref: 00007FF62A977054
RegCloseKey.ADVAPI32 ref: 00007FF62A977061
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF62A97706E
Process32FirstW.KERNEL32 ref: 00007FF62A9770A9
Process32NextW.KERNEL32 ref: 00007FF62A9770FE
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF62A977118
Process32FirstW.KERNEL32 ref: 00007FF62A977153
Process32NextW.KERNEL32 ref: 00007FF62A9771AE
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF62A9771C8
Process32FirstW.KERNEL32 ref: 00007FF62A977203
Process32NextW.KERNEL32 ref: 00007FF62A97725A

Strings

VenNetwork, xrefs: 00007FF62A976860
FriendlyName, xrefs: 00007FF62A976BA2
GetNativeSystemInfo, xrefs: 00007FF62A976917
%sFree%d Gb , xrefs: 00007FF62A9767EE
%d.%d.%d, xrefs: 00007FF62A9765FD
INSTALLTIME, xrefs: 00007FF62A976F77, 00007FF62A976FE3, 00007FF62A977028
A:\, xrefs: 00007FF62A976A1A
ntdll.dll, xrefs: 00007FF62A9765A5
Software, xrefs: 00007FF62A976851
Software\Tencent\Plugin\VAS, xrefs: 00007FF62A976C59
WxWork.exe, xrefs: 00007FF62A9770B3
X64 %s, xrefs: 00007FF62A97696A
HDD:%d, xrefs: 00007FF62A9767A7
x64, xrefs: 00007FF62A976958
RtlGetNtVersionNumbers, xrefs: 00007FF62A9765BE
AppEvents, xrefs: 00007FF62A976F61
kernel32.dll, xrefs: 00007FF62A9768FB
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00007FF62A976645
VenREMARK, xrefs: 00007FF62A9768CB
B:\, xrefs: 00007FF62A976A32
%d.%d, xrefs: 00007FF62A97688E, 00007FF62A976FA2
VenGROUP, xrefs: 00007FF62A97686B
Network, xrefs: 00007FF62A976F70
WeChat.exe, xrefs: 00007FF62A97715D
Telegram.exe, xrefs: 00007FF62A97720D
%d min, xrefs: 00007FF62A976557
x86, xrefs: 00007FF62A97695F
53aaa05a-823a-477c-ad34-6798b901feb6, xrefs: 00007FF62A9763D2
ProductName, xrefs: 00007FF62A97667F

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Process32lstrlen$CloseCreateInfo$Systemwsprintf$ByteCharFirstHandleMultiNextOpenSnapshotTimeToolhelp32Wide$AddressFreeProcProcessQueryValue$Concurrency::cancel_current_taskCountCurrentDriveFileInstanceLibraryLocalModuleNativeTickWindow_invalid_parameter_noinfoinet_ntoalstrcmpi$DeleteDeviceDirectoryDiskEnumForegroundGlobalImageInitializeInputLastLoadLocaleLogicalMemoryNameProfileSpaceStatusStringStringsTextTypeUninitializegethostbynamegethostnamelstrcpy
String ID: %d min$%d.%d$%d.%d.%d$%sFree%d Gb $53aaa05a-823a-477c-ad34-6798b901feb6$A:\$AppEvents$B:\$FriendlyName$GetNativeSystemInfo$HDD:%d$INSTALLTIME$Network$ProductName$RtlGetNtVersionNumbers$SOFTWARE\Microsoft\Windows NT\CurrentVersion$Software$Software\Tencent\Plugin\VAS$Telegram.exe$VenGROUP$VenNetwork$VenREMARK$WeChat.exe$WxWork.exe$X64 %s$kernel32.dll$ntdll.dll$x64$x86
API String ID: 4136965836-407283210
Opcode ID: 912dcb70ba029749223a0e7e094df4f0b0117a3003a257af6be5c2466f0551a6
Instruction ID: add63b5ab90e8c06ede7cbf195fe2f5d8fa31d32d9b28225d2d719964e79ae35
Opcode Fuzzy Hash: 912dcb70ba029749223a0e7e094df4f0b0117a3003a257af6be5c2466f0551a6
Instruction Fuzzy Hash: 66926272E18A9286EF20DF26DC442E93361FB84754F844276DA4EC7AA6EF7CD545C302

Function 00007FF62A98B5E0 Relevance: 103.7, APIs: 41, Strings: 18, Instructions: 429
registrylibrarysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 00007FF62A98B611
CloseHandle.KERNEL32 ref: 00007FF62A98B64D
GetCurrentProcess.KERNEL32 ref: 00007FF62A98B660
OpenProcessToken.ADVAPI32 ref: 00007FF62A98B675
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF62A98B695
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF62A98B6C1
CloseHandle.KERNEL32 ref: 00007FF62A98B6CE
GetModuleHandleA.KERNEL32 ref: 00007FF62A98B6DB
GetProcAddress.KERNEL32 ref: 00007FF62A98B6EB
GetCurrentProcessId.KERNEL32 ref: 00007FF62A98B703
OpenProcess.KERNEL32 ref: 00007FF62A98B712
GetLocalTime.KERNEL32 ref: 00007FF62A98B734
wsprintfW.USER32 ref: 00007FF62A98B77A
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF62A98B787
CloseHandle.KERNEL32 ref: 00007FF62A98B7AD
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF62A98B850

Part of subcall function 00007FF62A998BE0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62A998C0B

CheckTokenMembership.KERNELBASE ref: 00007FF62A98B86A
FreeSid.ADVAPI32 ref: 00007FF62A98B882
RegOpenKeyExW.KERNEL32 ref: 00007FF62A98B8B4
RegDeleteValueW.KERNEL32 ref: 00007FF62A98B8C8
RegSetValueExW.KERNEL32 ref: 00007FF62A98B8F9
RegCloseKey.ADVAPI32 ref: 00007FF62A98B906
SleepEx.KERNEL32 ref: 00007FF62A98BA29
CreateEventA.KERNEL32 ref: 00007FF62A98BAA5
Sleep.KERNEL32 ref: 00007FF62A98BB4E
Sleep.KERNEL32 ref: 00007FF62A98BB84
CloseHandle.KERNEL32 ref: 00007FF62A98BBF2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A98BBFD
IsDebuggerPresent.KERNEL32 ref: 00007FF62A98BC1C
LoadLibraryW.KERNEL32 ref: 00007FF62A98BC48
GetProcAddress.KERNEL32 ref: 00007FF62A98BC72
FreeLibrary.KERNEL32 ref: 00007FF62A98BC83

Strings

4433, xrefs: 00007FF62A98B940, 00007FF62A98B96C, 00007FF62A98B9CD, 00007FF62A98BA39, 00007FF62A98BA6D
154.91.90.234, xrefs: 00007FF62A98B928
MiniDumpWriteDump, xrefs: 00007FF62A98BC60
154.91.90.234, xrefs: 00007FF62A98B954
DbgHelp.dll, xrefs: 00007FF62A98BC39
NtSetInformationProcess, xrefs: 00007FF62A98B6E4
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 00007FF62A98B76C
154.91.90.234, xrefs: 00007FF62A98B918, 00007FF62A98B9B5, 00007FF62A98BA48, 00007FF62A98BADE
154.91.90.234, xrefs: 00007FF62A98B9A9
%s-%04d%02d%02d-%02d%02d%02d.dmp, xrefs: 00007FF62A98BCF2
loginconfig, xrefs: 00007FF62A98B8D6
!analyze -v, xrefs: 00007FF62A98BCFE
VenkernalData_info, xrefs: 00007FF62A98B8BA, 00007FF62A98B8EB
SOFTWARE, xrefs: 00007FF62A98B8A6
10443, xrefs: 00007FF62A98B960
NtDll.dll, xrefs: 00007FF62A98B6D4
SeDebugPrivilege, xrefs: 00007FF62A98B68C
4433, xrefs: 00007FF62A98B934

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CloseHandle$ProcessSleep$OpenTokenValue$AddressCurrentFreeLibraryProc$AdjustAllocateCheckCreateDebuggerDeleteEventExceptionFilterInitializeLoadLocalLookupMembershipModulePresentPrivilegePrivilegesTimeUnhandled_invalid_parameter_noinfo_invalid_parameter_noinfo_noreturnwsprintf
String ID: !analyze -v$%4d.%2d.%2d-%2d:%2d:%2d$%s-%04d%02d%02d-%02d%02d%02d.dmp$10443$154.91.90.234$154.91.90.234$154.91.90.234$154.91.90.234$4433$4433$DbgHelp.dll$MiniDumpWriteDump$NtDll.dll$NtSetInformationProcess$SOFTWARE$SeDebugPrivilege$VenkernalData_info$loginconfig
API String ID: 2641691789-53643463
Opcode ID: 2f73c5c05892fff8768e9b6e0df1ba2b4b958215c4eb42bda5580e04c4d00d6f
Instruction ID: 8098664b5b8581d7a9e22816e330362c8cdbf43a79f3657c76a81ca23efda072
Opcode Fuzzy Hash: 2f73c5c05892fff8768e9b6e0df1ba2b4b958215c4eb42bda5580e04c4d00d6f
Instruction Fuzzy Hash: 90224572E28B4286EF209F26EC443A973A2FB88754F404176D94DC76A6DFBCD544C702

Function 00007FF62A97F410 Relevance: 81.0, APIs: 35, Strings: 11, Instructions: 532
registryprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastInputInfo.USER32 ref: 00007FF62A97F45C
GetTickCount.KERNEL32 ref: 00007FF62A97F462
wsprintfW.USER32 ref: 00007FF62A97F490
GetForegroundWindow.USER32 ref: 00007FF62A97F496
GetWindowTextW.USER32 ref: 00007FF62A97F4AE
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF62A97F4C3
Process32FirstW.KERNEL32 ref: 00007FF62A97F4F7
Process32NextW.KERNEL32 ref: 00007FF62A97F54B
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF62A97F565
Process32FirstW.KERNEL32 ref: 00007FF62A97F59F
Process32NextW.KERNEL32 ref: 00007FF62A97F5EE
CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF62A97F608
Process32FirstW.KERNEL32 ref: 00007FF62A97F642
Process32NextW.KERNEL32 ref: 00007FF62A97F69E
RegOpenKeyExW.ADVAPI32 ref: 00007FF62A97F6EC
RegQueryValueExW.KERNEL32 ref: 00007FF62A97F71F
RegQueryValueExW.KERNEL32 ref: 00007FF62A97F783
RegCloseKey.ADVAPI32 ref: 00007FF62A97F90D
RegOpenKeyExW.ADVAPI32 ref: 00007FF62A97F943
RegQueryValueExW.KERNEL32 ref: 00007FF62A97F976
RegQueryValueExW.ADVAPI32 ref: 00007FF62A97F9D5
RegCloseKey.ADVAPI32 ref: 00007FF62A97F9EC
RegOpenKeyExW.ADVAPI32 ref: 00007FF62A97FA22
RegQueryValueExW.KERNEL32 ref: 00007FF62A97FA55
RegCloseKey.ADVAPI32 ref: 00007FF62A97FACB

Part of subcall function 00007FF62A98DFB8: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62A98DFE8
Part of subcall function 00007FF62A98DFB8: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62A98DFEE

RegQueryValueExW.ADVAPI32 ref: 00007FF62A97FAB4
SHGetFolderPathW.SHELL32 ref: 00007FF62A97FAEF
lstrcatW.KERNEL32 ref: 00007FF62A97FB03
CreateFileW.KERNEL32 ref: 00007FF62A97FB34
lstrlenW.KERNEL32 ref: 00007FF62A97FB44
WriteFile.KERNEL32 ref: 00007FF62A97FB61
CloseHandle.KERNEL32 ref: 00007FF62A97FB6A
FindFirstFileW.KERNEL32 ref: 00007FF62A97FB7E
FindClose.KERNEL32 ref: 00007FF62A97FB94
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A97FCFE

Strings

C:\Users, xrefs: 00007FF62A97F812
OpenAi_Service, xrefs: 00007FF62A97F96F, 00007FF62A97F9CE, 00007FF62A97FA4E, 00007FF62A97FAAD
Startup, xrefs: 00007FF62A97F718, 00007FF62A97F77C
\kernelquick.sys, xrefs: 00007FF62A97FAF5
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, xrefs: 00007FF62A97F6B1
WeChat.exe, xrefs: 00007FF62A97F5A9
Telegram.exe, xrefs: 00007FF62A97F64C
%d min, xrefs: 00007FF62A97F489
C:\ProgramData\Mylnk, xrefs: 00007FF62A97F896
WXWork.exe, xrefs: 00007FF62A97F501
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 00007FF62A97F935, 00007FF62A97FA14

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Process32QueryValue$Close$CreateFirst$FileNextOpenSnapshotToolhelp32$Concurrency::cancel_current_taskFindWindow$CountFolderForegroundHandleInfoInputLastPathTextTickWrite_invalid_parameter_noinfo_noreturnlstrcatlstrlenwsprintf
String ID: %d min$C:\ProgramData\Mylnk$C:\Users$OpenAi_Service$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$Startup$Telegram.exe$WXWork.exe$WeChat.exe$\kernelquick.sys
API String ID: 3029130142-1423135667
Opcode ID: ae95ca29b607d4f2ea8f7fc560aae3042e643629e37788a7b14a35020a1b4311
Instruction ID: 1e2b18b1c4c86854ba0d3b4497b6562e15be4de0cba9688a8e05485a5ce9e7b6
Opcode Fuzzy Hash: ae95ca29b607d4f2ea8f7fc560aae3042e643629e37788a7b14a35020a1b4311
Instruction Fuzzy Hash: E732AF62F2868285EF208F2ADC047B973A1FB84B84F444176DA4DDB696DFBCE544C712

Function 00007FF62A98AE60 Relevance: 75.8, APIs: 27, Strings: 16, Instructions: 529stringregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32 ref: 00007FF62A98AE95
RegQueryValueExW.KERNEL32 ref: 00007FF62A98AEC6
RegQueryValueExW.ADVAPI32 ref: 00007FF62A98AF25
lstrlenW.KERNEL32 ref: 00007FF62A98AF32
lstrlenW.KERNEL32 ref: 00007FF62A98AF53
lstrlenW.KERNEL32 ref: 00007FF62A98AF66
lstrlenW.KERNEL32 ref: 00007FF62A98AFFF
lstrlenW.KERNEL32 ref: 00007FF62A98B020
lstrlenW.KERNEL32 ref: 00007FF62A98B033
lstrlenW.KERNEL32 ref: 00007FF62A98B0CB
lstrlenW.KERNEL32 ref: 00007FF62A98B0DE
lstrlenW.KERNEL32 ref: 00007FF62A98B161
lstrlenW.KERNEL32 ref: 00007FF62A98B182
lstrlenW.KERNEL32 ref: 00007FF62A98B195
lstrlenW.KERNEL32 ref: 00007FF62A98B22F
lstrlenW.KERNEL32 ref: 00007FF62A98B250
lstrlenW.KERNEL32 ref: 00007FF62A98B263
lstrlenW.KERNEL32 ref: 00007FF62A98B2FB
lstrlenW.KERNEL32 ref: 00007FF62A98B30E
lstrlenW.KERNEL32 ref: 00007FF62A98B391
lstrlenW.KERNEL32 ref: 00007FF62A98B3B2
lstrlenW.KERNEL32 ref: 00007FF62A98B3C5
lstrlenW.KERNEL32 ref: 00007FF62A98B45F
lstrlenW.KERNEL32 ref: 00007FF62A98B480
lstrlenW.KERNEL32 ref: 00007FF62A98B493
lstrlenW.KERNEL32 ref: 00007FF62A98B52B
lstrlenW.KERNEL32 ref: 00007FF62A98B53E

Strings

o1:, xrefs: 00007FF62A98B026
154.91.90.234, xrefs: 00007FF62A98AF2B, 00007FF62A98AF3A, 00007FF62A98AFE9
o2:, xrefs: 00007FF62A98B256
154.91.90.234, xrefs: 00007FF62A98B15A, 00007FF62A98B169, 00007FF62A98B219
p2:, xrefs: 00007FF62A98B188
154.91.90.234, xrefs: 00007FF62A98B38A, 00007FF62A98B399, 00007FF62A98B449
t2:, xrefs: 00007FF62A98B301
Vendata, xrefs: 00007FF62A98AEBF, 00007FF62A98AF1E
Console, xrefs: 00007FF62A98AE87
p1:, xrefs: 00007FF62A98AF59
t1:, xrefs: 00007FF62A98B0D1
p3:, xrefs: 00007FF62A98B3B8
10443, xrefs: 00007FF62A98B228, 00007FF62A98B237, 00007FF62A98B2E9
o3:, xrefs: 00007FF62A98B486
4433, xrefs: 00007FF62A98AFF8, 00007FF62A98B007, 00007FF62A98B0B9
t3:, xrefs: 00007FF62A98B531

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: lstrlen$QueryValue$Open
String ID: 10443$154.91.90.234$154.91.90.234$154.91.90.234$4433$Console$Vendata$o1:$o2:$o3:$p1:$p2:$p3:$t1:$t2:$t3:
API String ID: 1772312705-745102317
Opcode ID: e9763d1a573506a6c5f52fab13ecf1f8c208e4fec7a72f7b0df219955d443a2f
Instruction ID: fb0bb761157a322eab0265dbcced5a4ef150e694ea2270e33319f9065fd922ab
Opcode Fuzzy Hash: e9763d1a573506a6c5f52fab13ecf1f8c208e4fec7a72f7b0df219955d443a2f
Instruction Fuzzy Hash: A322D562E3962B85EF149B1AEC5477D23A2FF94784F855072C60EC29D3EFBCA5458302

Function 00007FF62A9772D0 Relevance: 54.7, APIs: 26, Strings: 5, Instructions: 457
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF62A97A300: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A97A4A0
Part of subcall function 00007FF62A97A300: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62A97A4A6

MultiByteToWideChar.KERNEL32 ref: 00007FF62A97767F
MultiByteToWideChar.KERNEL32 ref: 00007FF62A9776A6

Strings

open, xrefs: 00007FF62A977826
X64, xrefs: 00007FF62A9774F1, 00007FF62A97750E
key, xrefs: 00007FF62A977832
\DisplaySessionContainers.log, xrefs: 00007FF62A9778A3
<, xrefs: 00007FF62A9779DD

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ByteCharMultiWide$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID: <$X64$\DisplaySessionContainers.log$key$open
API String ID: 143101810-941791203
Opcode ID: 6fd8a70502cb876f37e01b3f442c82311147053e1733d129978e172daf7e84cf
Instruction ID: d19b94fc2fd4f29a056747da72d803ac5b7019584164cbd857ce4a2f89f04e94
Opcode Fuzzy Hash: 6fd8a70502cb876f37e01b3f442c82311147053e1733d129978e172daf7e84cf
Instruction Fuzzy Hash: E922A362E28A81D2EF10CB26EC442AE7362FB84B94F504272DA5EC7B96DF7DD144C741

Function 00007FF62A97FD10 Relevance: 54.6, APIs: 26, Strings: 5, Instructions: 318
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDesktopWindow.USER32 ref: 00007FF62A97FD3C
GetDC.USER32 ref: 00007FF62A97FD45
CreateCompatibleDC.GDI32 ref: 00007FF62A97FD51
GetDC.USER32 ref: 00007FF62A97FD5C
GetDeviceCaps.GDI32 ref: 00007FF62A97FD6D
GetDeviceCaps.GDI32 ref: 00007FF62A97FD7D
ReleaseDC.USER32 ref: 00007FF62A97FD9A
GetSystemMetrics.USER32 ref: 00007FF62A97FDC3
GetSystemMetrics.USER32 ref: 00007FF62A97FDFE
GetSystemMetrics.USER32 ref: 00007FF62A97FE4C
GetSystemMetrics.USER32 ref: 00007FF62A97FE66
CreateCompatibleBitmap.GDI32 ref: 00007FF62A97FE84
SelectObject.GDI32 ref: 00007FF62A97FE98
SetStretchBltMode.GDI32 ref: 00007FF62A97FEA6
GetSystemMetrics.USER32 ref: 00007FF62A97FEB1
GetSystemMetrics.USER32 ref: 00007FF62A97FECB
StretchBlt.GDI32 ref: 00007FF62A97FF0C
GetDIBits.GDI32 ref: 00007FF62A97FFD2

Part of subcall function 00007FF62A98DFB8: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62A98DFE8
Part of subcall function 00007FF62A98DFB8: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62A98DFEE

Part of subcall function 00007FF62A980220: GlobalAlloc.KERNEL32 ref: 00007FF62A980258
Part of subcall function 00007FF62A980220: GlobalLock.KERNEL32 ref: 00007FF62A980264
Part of subcall function 00007FF62A980220: GlobalUnlock.KERNEL32 ref: 00007FF62A98027B
Part of subcall function 00007FF62A980220: CreateStreamOnHGlobal.OLE32 ref: 00007FF62A980291
Part of subcall function 00007FF62A980220: EnterCriticalSection.KERNEL32 ref: 00007FF62A9802DF
Part of subcall function 00007FF62A980220: LeaveCriticalSection.KERNEL32 ref: 00007FF62A9802EC
Part of subcall function 00007FF62A980220: GdipCreateBitmapFromStream.GDIPLUS ref: 00007FF62A98031A
Part of subcall function 00007FF62A980220: GdipDisposeImage.GDIPLUS ref: 00007FF62A980330
Part of subcall function 00007FF62A980220: DeleteObject.GDI32 ref: 00007FF62A9805A4
Part of subcall function 00007FF62A980220: EnterCriticalSection.KERNEL32 ref: 00007FF62A9805B6
Part of subcall function 00007FF62A980220: EnterCriticalSection.KERNEL32 ref: 00007FF62A9805C6
Part of subcall function 00007FF62A980220: GdiplusShutdown.GDIPLUS ref: 00007FF62A9805D4

DeleteObject.GDI32 ref: 00007FF62A980091
DeleteObject.GDI32 ref: 00007FF62A98009A
ReleaseDC.USER32 ref: 00007FF62A9800A5
DeleteObject.GDI32 ref: 00007FF62A980165
DeleteObject.GDI32 ref: 00007FF62A98016E
ReleaseDC.USER32 ref: 00007FF62A980179
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A98020D

Strings

gfff, xrefs: 00007FF62A97FDE2
gfff, xrefs: 00007FF62A97FE08
(, xrefs: 00007FF62A97FF15
6, xrefs: 00007FF62A97FF72
, xrefs: 00007FF62A97FED1

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: MetricsObjectSystem$Delete$CreateCriticalGlobalSection$EnterRelease$BitmapCapsCompatibleConcurrency::cancel_current_taskDeviceGdipStreamStretch$AllocBitsDesktopDisposeFromGdiplusImageLeaveLockModeSelectShutdownUnlockWindow_invalid_parameter_noinfo_noreturn
String ID: $($6$gfff$gfff
API String ID: 1610826097-2922166585
Opcode ID: 71b1a06c58d9a713bc661b4cc54b325f4da7adbc8ed465da53ef13dc4a73e4cd
Instruction ID: 610db18cfc2f2ed942e88ff12f7765a59c8d1336ba46a2ca6c67f885ebf9f64f
Opcode Fuzzy Hash: 71b1a06c58d9a713bc661b4cc54b325f4da7adbc8ed465da53ef13dc4a73e4cd
Instruction Fuzzy Hash: 3AD1E972E2878586EB159F36E80437AA2A2FF89B84F004236DA4DD7756DF7CD480C702

Function 00007FF62A978A40 Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 255
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(00001334,00000000,00000000,00001334,?,00007FF62A978C70), ref: 00007FF62A978A53
OpenProcess.KERNEL32 ref: 00007FF62A978A63
OpenProcessToken.ADVAPI32 ref: 00007FF62A978A86
CloseHandle.KERNEL32 ref: 00007FF62A978A93
SysStringLen.OLEAUT32 ref: 00007FF62A978AE1
SysStringLen.OLEAUT32 ref: 00007FF62A978AF9
CloseHandle.KERNEL32 ref: 00007FF62A978B5F
CloseHandle.KERNEL32 ref: 00007FF62A978B68
SysFreeString.OLEAUT32 ref: 00007FF62A978BA1
SysFreeString.OLEAUT32 ref: 00007FF62A978BE5
GetCurrentProcessId.KERNEL32 ref: 00007FF62A978C4B
wsprintfW.USER32 ref: 00007FF62A978C62

Part of subcall function 00007FF62A978A40: GetVersionExW.KERNEL32 ref: 00007FF62A978C91
Part of subcall function 00007FF62A978A40: GetCurrentProcess.KERNEL32 ref: 00007FF62A978CBD
Part of subcall function 00007FF62A978A40: OpenProcessToken.ADVAPI32 ref: 00007FF62A978CD3
Part of subcall function 00007FF62A978A40: GetTokenInformation.KERNELBASE ref: 00007FF62A978D08
Part of subcall function 00007FF62A978A40: GetLastError.KERNEL32 ref: 00007FF62A978D16
Part of subcall function 00007FF62A978A40: LocalAlloc.KERNEL32 ref: 00007FF62A978D35
Part of subcall function 00007FF62A978A40: GetTokenInformation.KERNELBASE ref: 00007FF62A978D68
Part of subcall function 00007FF62A978A40: GetSidSubAuthorityCount.ADVAPI32 ref: 00007FF62A978D75
Part of subcall function 00007FF62A978A40: GetSidSubAuthority.ADVAPI32 ref: 00007FF62A978D83
Part of subcall function 00007FF62A978A40: LocalFree.KERNEL32 ref: 00007FF62A978D8E
Part of subcall function 00007FF62A978A40: CloseHandle.KERNEL32 ref: 00007FF62A978DA4
Part of subcall function 00007FF62A978A40: wsprintfW.USER32 ref: 00007FF62A978E03

Strings

VenNetwork, xrefs: 00007FF62A978C30
NO/, xrefs: 00007FF62A978DE9
-N/, xrefs: 00007FF62A978DE0
None/%s, xrefs: 00007FF62A978DF2

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Process$CloseHandleStringToken$CurrentFreeOpen$AuthorityInformationLocalwsprintf$AllocCountErrorLastVersion
String ID: -N/$NO/$None/%s$VenNetwork
API String ID: 166307840-819860926
Opcode ID: 00eac611e7b887442b1dbd49258f34c0a3f8b380a041ee38be825e5737044c3c
Instruction ID: 0299d4a9c23666ceb105b640b35ef9df9c89d15b8f9de921ffd2bba4ecf7e820
Opcode Fuzzy Hash: 00eac611e7b887442b1dbd49258f34c0a3f8b380a041ee38be825e5737044c3c
Instruction Fuzzy Hash: FDB18172E2864282FF119B26EC503B963A1EF84B80F048476DA4DCB796DF7CD885C712

Function 00007FF62A978710 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 244
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00007FF62A978782
SysAllocString.OLEAUT32 ref: 00007FF62A9787DF
GetTokenInformation.KERNELBASE ref: 00007FF62A978829
GetLastError.KERNEL32 ref: 00007FF62A978833
GetProcessHeap.KERNEL32 ref: 00007FF62A978849
HeapAlloc.KERNEL32 ref: 00007FF62A97885A
GetTokenInformation.KERNELBASE ref: 00007FF62A97888C
LookupAccountSidW.ADVAPI32 ref: 00007FF62A9788CA
GetLastError.KERNEL32 ref: 00007FF62A9788D4
SysAllocString.OLEAUT32 ref: 00007FF62A97895C
SysAllocString.OLEAUT32 ref: 00007FF62A9789C6
GetProcessHeap.KERNEL32 ref: 00007FF62A9789EB
HeapFree.KERNEL32 ref: 00007FF62A9789F9
GetCurrentProcessId.KERNEL32(00001334,00000000,00000000,00001334,?,00007FF62A978C70), ref: 00007FF62A978A53
OpenProcess.KERNEL32 ref: 00007FF62A978A63
OpenProcessToken.ADVAPI32 ref: 00007FF62A978A86
CloseHandle.KERNEL32 ref: 00007FF62A978A93

Strings

NONE_MAPPED, xrefs: 00007FF62A9788E1

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: AllocProcess$HeapString$Token$ErrorInformationLastOpen$AccountCloseCurrentFreeHandleLookup
String ID: NONE_MAPPED
API String ID: 1410310566-2950899194
Opcode ID: 153f7837cc86bcbbc492fb4a375331227a21e9cb239b2b2f7dd34d1ee50442fc
Instruction ID: 6df3f01ea57ace556657ed8a5c3f8f7a27b9703da89730093e06c75c9e705994
Opcode Fuzzy Hash: 153f7837cc86bcbbc492fb4a375331227a21e9cb239b2b2f7dd34d1ee50442fc
Instruction Fuzzy Hash: 9AA19672E29B4281FF559B169C1037962D5EF84B80F548476DA4DCB792EFBCE881C312

Function 00007FF62A977A60 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 216
stringregistrycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF62A977AEB
Process32FirstW.KERNEL32 ref: 00007FF62A977B08
Process32NextW.KERNEL32 ref: 00007FF62A977B43
CloseHandle.KERNEL32 ref: 00007FF62A977B50
CoCreateInstance.COMBASE ref: 00007FF62A977B9F
wsprintfW.USER32 ref: 00007FF62A977CA5
RegOpenKeyExW.ADVAPI32 ref: 00007FF62A977CD5
RegQueryValueExW.KERNEL32 ref: 00007FF62A977D36
lstrcatW.KERNEL32 ref: 00007FF62A977D4A
lstrcatW.KERNEL32 ref: 00007FF62A977D5A
RegCloseKey.ADVAPI32 ref: 00007FF62A977D67
lstrlenW.KERNEL32 ref: 00007FF62A977DA4
lstrcatW.KERNEL32 ref: 00007FF62A977DB8
CloseHandle.KERNEL32 ref: 00007FF62A977DE5
lstrcatW.KERNEL32 ref: 00007FF62A977DFD
lstrcatW.KERNEL32 ref: 00007FF62A977E0D

Strings

CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}, xrefs: 00007FF62A977C97
Windows Defender IOfficeAntiVirus implementation , xrefs: 00007FF62A977A84

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: lstrcat$Close$CreateHandleProcess32$FirstInstanceNextOpenQuerySnapshotToolhelp32Valuelstrlenwsprintf
String ID: CLSID\{%.8X-%.4X-%.4X-%.2X%.2X-%.2X%.2X%.2X%.2X%.2X%.2X}$Windows Defender IOfficeAntiVirus implementation
API String ID: 582347850-1583895642
Opcode ID: 172064aca06d7bab2ac812725ebad370c198c4fa5686a0e3f00f667ec9231332
Instruction ID: 80a9b06e38604eabf5b6ddff3fc92296816bf9f26549d42888bbb595ecb021ae
Opcode Fuzzy Hash: 172064aca06d7bab2ac812725ebad370c198c4fa5686a0e3f00f667ec9231332
Instruction Fuzzy Hash: 2EA17062F18A82C6EB60CF26EC406AA67A1FB84B88F444172DE4DC7A5ADF7DD544C701

Function 00007FF62A97B410 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 232
memorytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventW.KERNEL32 ref: 00007FF62A97B444

Part of subcall function 00007FF62A971200: GetProcessHeap.KERNEL32 ref: 00007FF62A971236

HeapCreate.KERNEL32 ref: 00007FF62A97B50F
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF62A97B56F
CreateEventW.KERNEL32 ref: 00007FF62A97B5A2
CreateEventW.KERNEL32 ref: 00007FF62A97B5C2
CreateEventW.KERNEL32 ref: 00007FF62A97B5E2
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF62A97B6B3
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF62A97B6C7
timeGetTime.WINMM ref: 00007FF62A97B739
CreateEventW.KERNEL32 ref: 00007FF62A97B74F
CreateEventW.KERNEL32 ref: 00007FF62A97B763

Strings

<, xrefs: 00007FF62A97B484
<, xrefs: 00007FF62A97B47D

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Create$Event$CountCriticalInitializeSectionSpin$Heap$ProcessTimetime
String ID: <$<
API String ID: 2446585644-213342407
Opcode ID: 17258ff49d707124ef2c9ecd2dc6df9e5499853eed48c408e16bdd678f56143d
Instruction ID: 0c08eb439e11d132588ce1f5f17fc8ba212a82baa7cd89cf889e0414ceaa51f4
Opcode Fuzzy Hash: 17258ff49d707124ef2c9ecd2dc6df9e5499853eed48c408e16bdd678f56143d
Instruction Fuzzy Hash: C5B15072A15B818BE744CF36D8843A933A5FB44B08F58413DCB4D8B79ADF78A064CB25

Function 00007FF62A98C400 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 128fileCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00007FF62A98C42F
CreateFileW.KERNEL32 ref: 00007FF62A98C45A
DeviceIoControl.KERNEL32 ref: 00007FF62A98C4AA
DeviceIoControl.KERNEL32 ref: 00007FF62A98C511

Part of subcall function 00007FF62A98C640: WideCharToMultiByte.KERNEL32 ref: 00007FF62A98C675
Part of subcall function 00007FF62A98C640: WideCharToMultiByte.KERNEL32 ref: 00007FF62A98C6B0

DeviceIoControl.KERNEL32 ref: 00007FF62A98C571
DeviceIoControl.KERNEL32 ref: 00007FF62A98C5D0

Part of subcall function 00007FF62A98C2D0: CreateFileA.KERNEL32 ref: 00007FF62A98C379
Part of subcall function 00007FF62A98C2D0: DeviceIoControl.KERNEL32 ref: 00007FF62A98C3C1

CloseHandle.KERNEL32 ref: 00007FF62A98C5FE
CloseHandle.KERNEL32 ref: 00007FF62A98C623

Strings

\\.\HCD%d, xrefs: 00007FF62A98C423

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ControlDevice$ByteCharCloseCreateFileHandleMultiWide$wsprintf
String ID: \\.\HCD%d
API String ID: 2324936672-2696249065
Opcode ID: fba3a6acf6e72ed7b72618c4283ac656f0c243164c030697ae0719591fc402df
Instruction ID: 9d7c9b5f69f8d2a046a1bc43a7f233f1fda458e3c508e040b7daa8ec8967d3f4
Opcode Fuzzy Hash: fba3a6acf6e72ed7b72618c4283ac656f0c243164c030697ae0719591fc402df
Instruction Fuzzy Hash: EC51BF32E297828AEF609F12B94076A7794EB857C4F042175DA8DC3B96DF7CD415CB01

Function 00007FF62A98BDF0 Relevance: 15.0, APIs: 10, Instructions: 33threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF62A98BDFB
GetConsoleWindow.KERNEL32 ref: 00007FF62A98BE01
ShowWindow.USER32 ref: 00007FF62A98BE0C
GetCurrentThreadId.KERNEL32 ref: 00007FF62A98BE12
PostThreadMessageA.USER32 ref: 00007FF62A98BE22
GetInputState.USER32 ref: 00007FF62A98BE28
CreateThread.KERNEL32 ref: 00007FF62A98BE47
WaitForSingleObject.KERNEL32 ref: 00007FF62A98BE5C
CloseHandle.KERNEL32 ref: 00007FF62A98BE69
Sleep.KERNEL32 ref: 00007FF62A98BE74

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Thread$Window$CloseConsoleCreateCurrentExceptionFilterHandleInputMessageObjectPostShowSingleSleepStateUnhandledWait
String ID:
API String ID: 2277684705-0
Opcode ID: 1f499c150cbe33159222533ec4b742c736879ee302e7e86ebc66b87cb5efa357
Instruction ID: 9eb038b580b4b53a637fbfa2cd7ca6bbf0a2225592df4d68adf409b376e52de3
Opcode Fuzzy Hash: 1f499c150cbe33159222533ec4b742c736879ee302e7e86ebc66b87cb5efa357
Instruction Fuzzy Hash: B3011A26E28A4282EF049B76AC5423932A3FF88B51B4441B7C51EC2672DEBC90458203

Function 00007FF62A9A2048 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF62A9A208D

Part of subcall function 00007FF62A9A1704: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62A9A1718

Part of subcall function 00007FF62A99E95C: RtlFreeHeap.NTDLL(?,?,?,00007FF62A9A6862,?,?,?,00007FF62A9A6BDF,?,?,00000000,00007FF62A9A7025,?,?,?,00007FF62A9A6F57), ref: 00007FF62A99E972
Part of subcall function 00007FF62A99E95C: GetLastError.KERNEL32(?,?,?,00007FF62A9A6862,?,?,?,00007FF62A9A6BDF,?,?,00000000,00007FF62A9A7025,?,?,?,00007FF62A9A6F57), ref: 00007FF62A99E97C

Part of subcall function 00007FF62A994028: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF62A993FD7,?,?,?,?,?,00007FF62A993EC2), ref: 00007FF62A994031
Part of subcall function 00007FF62A994028: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF62A993FD7,?,?,?,?,?,00007FF62A993EC2), ref: 00007FF62A994056

Part of subcall function 00007FF62A9AA1B4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62A9AA0FF

_get_daylight.LIBCMT ref: 00007FF62A9A207C

Part of subcall function 00007FF62A9A1764: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62A9A1778

_get_daylight.LIBCMT ref: 00007FF62A9A22F2
_get_daylight.LIBCMT ref: 00007FF62A9A2303
_get_daylight.LIBCMT ref: 00007FF62A9A2314
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF62A9A2554), ref: 00007FF62A9A233B

Strings

Eastern Standard Time, xrefs: 00007FF62A9A23E1
Eastern Summer Time, xrefs: 00007FF62A9A23F9

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 5190737fcedb8824ad4a2f5adc1dd419c442ee6d8cf329e1688e58de2abb36f5
Instruction ID: c9717bb1c734dd4bd0baeb265ac7f9d45e535bdd08799fb2d15c05d0317df724
Opcode Fuzzy Hash: 5190737fcedb8824ad4a2f5adc1dd419c442ee6d8cf329e1688e58de2abb36f5
Instruction Fuzzy Hash: A4D1D126E286528AEF249F27DC802B96752FB44784F508076DE0EC7A97DFBCE441C742

Function 00007FF62A9780C0 Relevance: 10.9, APIs: 7, Instructions: 424COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62A98C400: wsprintfW.USER32 ref: 00007FF62A98C42F
Part of subcall function 00007FF62A98C400: CreateFileW.KERNEL32 ref: 00007FF62A98C45A
Part of subcall function 00007FF62A98C400: DeviceIoControl.KERNEL32 ref: 00007FF62A98C4AA
Part of subcall function 00007FF62A98C400: DeviceIoControl.KERNEL32 ref: 00007FF62A98C511
Part of subcall function 00007FF62A98C400: DeviceIoControl.KERNEL32 ref: 00007FF62A98C571
Part of subcall function 00007FF62A98C400: DeviceIoControl.KERNEL32 ref: 00007FF62A98C5D0

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A9786F0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A9786F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A9786FC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A978702

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ControlDevice_invalid_parameter_noinfo_noreturn$CreateFilewsprintf
String ID:
API String ID: 3155671162-0
Opcode ID: 0ada5f76f23944388edcc0c31909764c5d9fb7e854cf6f7faa3115ea1d042638
Instruction ID: b314e1fcdcc2763316e2eeda507393880d170d5bccd71fad69a7e543580c5a87
Opcode Fuzzy Hash: 0ada5f76f23944388edcc0c31909764c5d9fb7e854cf6f7faa3115ea1d042638
Instruction Fuzzy Hash: 1E029162F28B8185EF00DB66DC503BD23A2AB45798F404275EE5DDBBCBDEB8D4858311

Function 00007FF62A9A22C4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF62A9A22F2

Part of subcall function 00007FF62A9A1764: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62A9A1778

_get_daylight.LIBCMT ref: 00007FF62A9A2303

Part of subcall function 00007FF62A9A1704: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62A9A1718

_get_daylight.LIBCMT ref: 00007FF62A9A2314

Part of subcall function 00007FF62A9A1734: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62A9A1748

Part of subcall function 00007FF62A99E95C: RtlFreeHeap.NTDLL(?,?,?,00007FF62A9A6862,?,?,?,00007FF62A9A6BDF,?,?,00000000,00007FF62A9A7025,?,?,?,00007FF62A9A6F57), ref: 00007FF62A99E972
Part of subcall function 00007FF62A99E95C: GetLastError.KERNEL32(?,?,?,00007FF62A9A6862,?,?,?,00007FF62A9A6BDF,?,?,00000000,00007FF62A9A7025,?,?,?,00007FF62A9A6F57), ref: 00007FF62A99E97C

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF62A9A2554), ref: 00007FF62A9A233B

Strings

Eastern Standard Time, xrefs: 00007FF62A9A23E1
Eastern Summer Time, xrefs: 00007FF62A9A23F9

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 2133f9b6c4e90f95ebb1c2c4b763d73db315d9997485f014e8f6b7b9b98ca04f
Instruction ID: 5da9417a2a1253414533a7e917da7f269ab3aba3cc09817f8495b00ba92ecd02
Opcode Fuzzy Hash: 2133f9b6c4e90f95ebb1c2c4b763d73db315d9997485f014e8f6b7b9b98ca04f
Instruction Fuzzy Hash: 4B518032E286428AEF10DF27DC901A97762FB48784F545176EA4DC36A7DFBCE4008B42

Function 00007FF62A998EB0 Relevance: 9.2, APIs: 6, Instructions: 249COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62A998ED2
_get_daylight.LIBCMT ref: 00007FF62A998F32
_get_daylight.LIBCMT ref: 00007FF62A998F43
_get_daylight.LIBCMT ref: 00007FF62A998F54
_isindst.LIBCMT ref: 00007FF62A998FA5
_isindst.LIBCMT ref: 00007FF62A998FF8

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: _get_daylight$_isindst$_invalid_parameter_noinfo
String ID:
API String ID: 1405656091-0
Opcode ID: 94003a780ed234a965d2311ace6d53ea410cbd1e40622ac1b689e0d0deb2975f
Instruction ID: 7a9c2350abf58cb5076b1a0f6d052155b6cc9f6ce1bd36ffedbb11bda5898722
Opcode Fuzzy Hash: 94003a780ed234a965d2311ace6d53ea410cbd1e40622ac1b689e0d0deb2975f
Instruction Fuzzy Hash: 1591B1B2F142478FEF588F66CE412A963A5EB54788F04D039DA0DCA79AEF7CE5418701

Function 00007FF62A973B00 Relevance: 4.7, APIs: 3, Instructions: 151timenetworkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 00007FF62A973BF5
recv.WS2_32 ref: 00007FF62A973C1B

Part of subcall function 00007FF62A971500: VirtualAlloc.KERNEL32 ref: 00007FF62A971575
Part of subcall function 00007FF62A971500: VirtualFree.KERNELBASE ref: 00007FF62A9715AF

timeGetTime.WINMM ref: 00007FF62A973D04

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Virtual$AllocFreeTimerecvselecttime
String ID:
API String ID: 1996171534-0
Opcode ID: f1a4534c36cf054a18a844d81d8b44948fc4158a34af035147a7d8a3da91c79a
Instruction ID: 338c4e4da8ba5dbd5c570afd35fb6da41c5d98d3e64b9b8848656711df5bde48
Opcode Fuzzy Hash: f1a4534c36cf054a18a844d81d8b44948fc4158a34af035147a7d8a3da91c79a
Instruction Fuzzy Hash: C47162B2E28A8581EB209F29D8043BE33A0FB95B88F149275CF4D87756DF79E584C711

Function 00007FF62A971500 Relevance: 2.6, APIs: 2, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF62A971575
VirtualFree.KERNELBASE ref: 00007FF62A9715AF

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: bdec6c309521b78e3869a161020c8be31cfe41798d2485b5db3fb8b25cd2d730
Instruction ID: 1f2540ab297bf3d760cbe19d11cbb731974a44d8c3f0ecbddbbd14e117d69161
Opcode Fuzzy Hash: bdec6c309521b78e3869a161020c8be31cfe41798d2485b5db3fb8b25cd2d730
Instruction Fuzzy Hash: 42413472B18A418AEB0DCE2BEC10669A755FB84F84B144139EE0EC775AEE78D845C741

Function 00007FF62A980220 Relevance: 45.3, APIs: 30, Instructions: 260
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32 ref: 00007FF62A980258
GlobalLock.KERNEL32 ref: 00007FF62A980264
GlobalUnlock.KERNEL32 ref: 00007FF62A98027B
CreateStreamOnHGlobal.OLE32 ref: 00007FF62A980291
GlobalFree.KERNEL32 ref: 00007FF62A9805F4

Part of subcall function 00007FF62A9761E0: InitializeCriticalSectionEx.KERNEL32 ref: 00007FF62A976231
Part of subcall function 00007FF62A9761E0: GetLastError.KERNEL32 ref: 00007FF62A97623B

EnterCriticalSection.KERNEL32 ref: 00007FF62A9802DF
LeaveCriticalSection.KERNEL32 ref: 00007FF62A9802EC
GdipCreateBitmapFromStream.GDIPLUS ref: 00007FF62A98031A
GdipDisposeImage.GDIPLUS ref: 00007FF62A980330
GdipDisposeImage.GDIPLUS ref: 00007FF62A98034E
CreateStreamOnHGlobal.OLE32 ref: 00007FF62A98036B
GetHGlobalFromStream.OLE32 ref: 00007FF62A980392
GlobalLock.KERNEL32 ref: 00007FF62A98039C
GlobalFree.KERNEL32 ref: 00007FF62A9803BB
DeleteObject.GDI32 ref: 00007FF62A9803EB
EnterCriticalSection.KERNEL32 ref: 00007FF62A9803FD
EnterCriticalSection.KERNEL32 ref: 00007FF62A98040D
GdiplusShutdown.GDIPLUS ref: 00007FF62A98041B
LeaveCriticalSection.KERNEL32 ref: 00007FF62A980428
LeaveCriticalSection.KERNEL32 ref: 00007FF62A980432
DeleteObject.GDI32 ref: 00007FF62A9805A4
EnterCriticalSection.KERNEL32 ref: 00007FF62A9805B6
EnterCriticalSection.KERNEL32 ref: 00007FF62A9805C6
GdiplusShutdown.GDIPLUS ref: 00007FF62A9805D4
LeaveCriticalSection.KERNEL32 ref: 00007FF62A9805E1
LeaveCriticalSection.KERNEL32 ref: 00007FF62A9805EB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A980618

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CriticalSection$Global$EnterLeave$Stream$CreateGdip$DeleteDisposeFreeFromGdiplusImageLockObjectShutdown$AllocBitmapErrorInitializeLastUnlock_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 953580087-0
Opcode ID: 4e2688a34863f7da8a77a74cbafa365050bfc00cb69e51c511cedc38c4e5153f
Instruction ID: 07905df6680fadf5ce658e7cc324a2079e1e63a3d4fe044ec5def4a3d271fa80
Opcode Fuzzy Hash: 4e2688a34863f7da8a77a74cbafa365050bfc00cb69e51c511cedc38c4e5153f
Instruction Fuzzy Hash: 9BC14E36F14B4289EF00DF76E8442AD2372FB44B98B004276CE5E9769ADF78D449C342

Function 00007FF62A97C340 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 297
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GdipGetImagePixelFormat.GDIPLUS ref: 00007FF62A97C377
GdipGetImageHeight.GDIPLUS ref: 00007FF62A97C3F4
GdipGetImageWidth.GDIPLUS ref: 00007FF62A97C41A
GdipGetImagePaletteSize.GDIPLUS ref: 00007FF62A97C470
GdipGetImagePalette.GDIPLUS ref: 00007FF62A97C4F1
CreateCompatibleDC.GDI32 ref: 00007FF62A97C588
SelectObject.GDI32 ref: 00007FF62A97C599
SetDIBColorTable.GDI32 ref: 00007FF62A97C5B7
SelectObject.GDI32 ref: 00007FF62A97C5CC
DeleteDC.GDI32 ref: 00007FF62A97C5F6
GdipBitmapLockBits.GDIPLUS ref: 00007FF62A97C646
GdipBitmapUnlockBits.GDIPLUS ref: 00007FF62A97C6D3
GdipCreateBitmapFromScan0.GDIPLUS ref: 00007FF62A97C702
GdipGetImageGraphicsContext.GDIPLUS ref: 00007FF62A97C71D
GdipDrawImageI.GDIPLUS ref: 00007FF62A97C737
GdipDeleteGraphics.GDIPLUS ref: 00007FF62A97C740
GdipDisposeImage.GDIPLUS ref: 00007FF62A97C74D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62A97C79F

Strings

&, xrefs: 00007FF62A97C3D4

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Gdip$Image$Bitmap$BitsCreateDeleteGraphicsObjectPaletteSelect$ColorCompatibleContextDisposeDrawFormatFromHeightLockPixelScan0SizeTableUnlockWidth_invalid_parameter_noinfo
String ID: &
API String ID: 4034434136-3042966939
Opcode ID: 239e805813e04336424a29340b1b3b4cd56234119952a51b41bc6ad9426f54d6
Instruction ID: fe80d74ac32a3961de365c93d1537cfea71885ee699f62be58794c765b9ea8d5
Opcode Fuzzy Hash: 239e805813e04336424a29340b1b3b4cd56234119952a51b41bc6ad9426f54d6
Instruction Fuzzy Hash: 32D1A0B2E146828AEF608F26DC446A933A5FB44B98F014076DB1DDBB46DF78E904C751

Function 00007FF62A973820 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 157
networkstringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResetEvent.KERNEL32 ref: 00007FF62A973840
timeGetTime.WINMM ref: 00007FF62A97384F
socket.WS2_32 ref: 00007FF62A97387C
lstrlenW.KERNEL32 ref: 00007FF62A97389E
WideCharToMultiByte.KERNEL32 ref: 00007FF62A9738C2
lstrlenW.KERNEL32 ref: 00007FF62A9738DA
WideCharToMultiByte.KERNEL32 ref: 00007FF62A9738FD
gethostbyname.WS2_32 ref: 00007FF62A97390A
htons.WS2_32 ref: 00007FF62A973938
connect.WS2_32 ref: 00007FF62A973962
setsockopt.WS2_32 ref: 00007FF62A97399E
setsockopt.WS2_32 ref: 00007FF62A9739D1
setsockopt.WS2_32 ref: 00007FF62A973A04
setsockopt.WS2_32 ref: 00007FF62A973A2D
WSAIoctl.WS2_32 ref: 00007FF62A973A80

Strings

0u, xrefs: 00007FF62A9739EB

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: setsockopt$ByteCharMultiWidelstrlen$EventIoctlResetTimeconnectgethostbynamehtonssockettime
String ID: 0u
API String ID: 3082052849-3203441087
Opcode ID: 1990aa51c6850a6fa6aed845b7300e6f7a8d76aaa35b37c668ddb493afcd0b97
Instruction ID: f4ca84dcec69b2633e0bbd92bd6cefd8983a7707ed83bd5846586466081a6c2b
Opcode Fuzzy Hash: 1990aa51c6850a6fa6aed845b7300e6f7a8d76aaa35b37c668ddb493afcd0b97
Instruction Fuzzy Hash: 18717272A1878186DB24CF26F84476BB7A5FB84794F00423AEA8D87B55CF7DD109CB05

Function 00007FF62A978C30 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 101
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF62A978C4B
wsprintfW.USER32 ref: 00007FF62A978C62

Part of subcall function 00007FF62A978A40: GetCurrentProcessId.KERNEL32(00001334,00000000,00000000,00001334,?,00007FF62A978C70), ref: 00007FF62A978A53
Part of subcall function 00007FF62A978A40: OpenProcess.KERNEL32 ref: 00007FF62A978A63
Part of subcall function 00007FF62A978A40: OpenProcessToken.ADVAPI32 ref: 00007FF62A978A86
Part of subcall function 00007FF62A978A40: CloseHandle.KERNEL32 ref: 00007FF62A978A93

GetVersionExW.KERNEL32 ref: 00007FF62A978C91
GetCurrentProcess.KERNEL32 ref: 00007FF62A978CBD
OpenProcessToken.ADVAPI32 ref: 00007FF62A978CD3
GetTokenInformation.KERNELBASE ref: 00007FF62A978D08
GetLastError.KERNEL32 ref: 00007FF62A978D16
LocalAlloc.KERNEL32 ref: 00007FF62A978D35
GetTokenInformation.KERNELBASE ref: 00007FF62A978D68
GetSidSubAuthorityCount.ADVAPI32 ref: 00007FF62A978D75
GetSidSubAuthority.ADVAPI32 ref: 00007FF62A978D83
LocalFree.KERNEL32 ref: 00007FF62A978D8E
CloseHandle.KERNEL32 ref: 00007FF62A978DA4
wsprintfW.USER32 ref: 00007FF62A978E03

Strings

VenNetwork, xrefs: 00007FF62A978C30

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Process$Token$CurrentOpen$AuthorityCloseHandleInformationLocalwsprintf$AllocCountErrorFreeLastVersion
String ID: VenNetwork
API String ID: 4155081256-3057682757
Opcode ID: 3407132e92e1848e0e772f1293874a2b7f30e1d7fa5e71b4aaa2eaae724ad61b
Instruction ID: c5c64db31619c6f03cd75d1b37fcb136163e4168563c9c09204692c8bc94c5de
Opcode Fuzzy Hash: 3407132e92e1848e0e772f1293874a2b7f30e1d7fa5e71b4aaa2eaae724ad61b
Instruction Fuzzy Hash: 68415372E2C68282EF61DB22EC443B923A1FF95B41F444076CA4EC6696DF7CD485C712

Function 00007FF62A98BEF0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 223
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeviceIoControl.KERNEL32 ref: 00007FF62A98BF94
DeviceIoControl.KERNEL32 ref: 00007FF62A98C003
GlobalAlloc.KERNEL32 ref: 00007FF62A98C032
DeviceIoControl.KERNEL32 ref: 00007FF62A98C07C
GlobalFree.KERNEL32 ref: 00007FF62A98C09E
DeviceIoControl.KERNEL32 ref: 00007FF62A98C0ED
GlobalAlloc.KERNEL32 ref: 00007FF62A98C115
DeviceIoControl.KERNEL32 ref: 00007FF62A98C157
GlobalFree.KERNEL32 ref: 00007FF62A98C170
GlobalFree.KERNEL32 ref: 00007FF62A98C18F

Strings

%s-%s|, xrefs: 00007FF62A98C1FB
- External Hub, xrefs: 00007FF62A98C17B

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ControlDeviceGlobal$Free$Alloc
String ID: - External Hub$%s-%s|
API String ID: 3253977144-729331614
Opcode ID: a64a8a154bc7d147da862556ab1e51a765a2c970b97e8182b802ad51ffa46e8a
Instruction ID: 085e553b8a8462dce1d2586b91019d541290dc65252fc360ee08f755647de72e
Opcode Fuzzy Hash: a64a8a154bc7d147da862556ab1e51a765a2c970b97e8182b802ad51ffa46e8a
Instruction Fuzzy Hash: F1B1DF32E28B8289EB20CF22E8403AA77A1FB84794F444136DB8D97B96DF7CD545C701

Function 00007FF62A97D9C0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 137
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A97DA44
GetLastInputInfo.USER32 ref: 00007FF62A97DAAB
GetTickCount.KERNEL32 ref: 00007FF62A97DAB1
wsprintfW.USER32 ref: 00007FF62A97DAE4
RegOpenKeyExW.KERNEL32 ref: 00007FF62A97DB72
RegQueryValueExW.KERNEL32 ref: 00007FF62A97DBA3

Strings

Console, xrefs: 00007FF62A97DB64
IpDatespecial, xrefs: 00007FF62A97DB9C
%d min, xrefs: 00007FF62A97DADD

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CountInfoInputLastOpenQueryTickValue_invalid_parameter_noinfo_noreturnwsprintf
String ID: %d min$Console$IpDatespecial
API String ID: 357503962-2712035571
Opcode ID: f10f92fbc072fe067106cb54d6c34107b9c6c4e7fb02d7e9705fa94ab09b83a4
Instruction ID: 3ca1b7bfaa5dc2138b0e06a829ab0337ffb861fa68f278c0127cb669e3566e41
Opcode Fuzzy Hash: f10f92fbc072fe067106cb54d6c34107b9c6c4e7fb02d7e9705fa94ab09b83a4
Instruction Fuzzy Hash: 3151BC73A18E8585EF208F2AEC443B927A1EB44B99F444172CA4CCB79ADF78D589C701

Function 00007FF62A97C7B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS ref: 00007FF62A97C7E4
GdipGetImageEncoders.GDIPLUS ref: 00007FF62A97C871
GdipCreateBitmapFromScan0.GDIPLUS ref: 00007FF62A97C915
GdipCreateBitmapFromHBITMAP.GDIPLUS ref: 00007FF62A97C92D
GdipSaveImageToStream.GDIPLUS ref: 00007FF62A97C944
GdipDisposeImage.GDIPLUS ref: 00007FF62A97C951
GdipDisposeImage.GDIPLUS ref: 00007FF62A97C95E

Strings

&, xrefs: 00007FF62A97C8FD

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Gdip$Image$BitmapCreateDisposeEncodersFrom$SaveScan0SizeStream
String ID: &
API String ID: 370471037-3042966939
Opcode ID: 28b2eeaec2d98f14f4e8f3b60e7ba4f1bea8e24f035ccc537625c12df49cfb7a
Instruction ID: 74835a29be86670b6e73416e46f3da30d71bf4d62c0767fc3cde536f4ebca556
Opcode Fuzzy Hash: 28b2eeaec2d98f14f4e8f3b60e7ba4f1bea8e24f035ccc537625c12df49cfb7a
Instruction Fuzzy Hash: 73518472E24A4286FF508F269C005B823A1FB44B94F0542B2DE1DDB796DFB8E546C352

Function 00007FF62A979300 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF62A97931D
GetProcAddress.KERNEL32 ref: 00007FF62A97932D
GetNativeSystemInfo.KERNEL32 ref: 00007FF62A97933D
GetSystemInfo.KERNEL32 ref: 00007FF62A979341

Strings

GetNativeSystemInfo, xrefs: 00007FF62A979326
kernel32.dll, xrefs: 00007FF62A979307

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 3433367815-192647395
Opcode ID: 06b04ae401ee5d5c7cc9b92bd00cef418c8d008ef26561d2b8b72a7f6fbba0c7
Instruction ID: 5e17a319c46b2ca7cf2c5ad3377e550dc304de84340ac85b051cbd9ec039f431
Opcode Fuzzy Hash: 06b04ae401ee5d5c7cc9b92bd00cef418c8d008ef26561d2b8b72a7f6fbba0c7
Instruction Fuzzy Hash: CAF06816D38686C7EF50E711DC403B52251FF98701F905776D98EC1696EF9CE2D48612

Function 00007FF62A978E30 Relevance: 9.1, APIs: 6, Instructions: 67registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32 ref: 00007FF62A978E92
RegQueryValueExW.KERNEL32 ref: 00007FF62A978EE9
lstrcmpW.KERNEL32 ref: 00007FF62A978EFF
RegCloseKey.KERNEL32 ref: 00007FF62A978F2F
RegCloseKey.ADVAPI32 ref: 00007FF62A978F3D

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Close$OpenQueryValuelstrcmp
String ID:
API String ID: 4288439342-0
Opcode ID: 9757e75af8232627abeb9f8389a1c3797a9351f61d8f1bccc733d4b1246574e8
Instruction ID: 92e56a3aba40ae0943849ae744604ce126113bc5e1719822c46ef1f0923d8a8e
Opcode Fuzzy Hash: 9757e75af8232627abeb9f8389a1c3797a9351f61d8f1bccc733d4b1246574e8
Instruction Fuzzy Hash: 04317732F28B9182DB608B26EC8476A7365FB84B90F504272DA5DC3796DF7DD844C741

Function 00007FF62A978F60 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 239COMMON

Download Yara Rule

APIs

CreateDXGIFactory.DXGI ref: 00007FF62A978FAC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A9792F1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A9792F7

Strings

%s%s %d %d , xrefs: 00007FF62A97909F
%s%s %d*%d , xrefs: 00007FF62A9791F4

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CreateFactory
String ID: %s%s %d %d $%s%s %d*%d
API String ID: 2331002265-1924168580
Opcode ID: 4dd4e38c66fe8330648a6e6cd5bc444f9eea7f3f2f2ef59c603d5b89239446f8
Instruction ID: 0ce6fd37a04f9b14beed6927dedcc6060bfa1703c6526082ada3e6cc37cf1d75
Opcode Fuzzy Hash: 4dd4e38c66fe8330648a6e6cd5bc444f9eea7f3f2f2ef59c603d5b89239446f8
Instruction Fuzzy Hash: ABA1B472F24B8189EB10DF6AD8442EE7761FB89B98F500222DE5D9BB99CF78D441C701

Function 00007FF62A998BE0 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62A998C0B
CreateThread.KERNEL32 ref: 00007FF62A998C4C
GetLastError.KERNEL32 ref: 00007FF62A998C5A
CloseHandle.KERNEL32 ref: 00007FF62A998C70
FreeLibrary.KERNEL32 ref: 00007FF62A998C7F

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: 2bf2d8e4056023ef3a5b5264bbcf8491965b7124c54493676a6e58e8f064e49f
Instruction ID: b12614fe71236675f34ac5c59603eb2829d084b1889c203e5cb44e94e58dd1c8
Opcode Fuzzy Hash: 2bf2d8e4056023ef3a5b5264bbcf8491965b7124c54493676a6e58e8f064e49f
Instruction Fuzzy Hash: 52213126E2A742A9EF149B579D1017973A0AF88B90F04C579DE4DC3756EEBCE4408602

Function 00007FF62A98C2D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF62A98C379
DeviceIoControl.KERNEL32 ref: 00007FF62A98C3C1

Strings

L, xrefs: 00007FF62A98C3A9
\\.\, xrefs: 00007FF62A98C31E

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ControlCreateDeviceFile
String ID: L$\\.\
API String ID: 107608037-1891537229
Opcode ID: 21bc0f6301598303c13827e0319026f3a4049949566ec9a53abc1aeea47cf04e
Instruction ID: be7c0acea7dcbff8e4cff41e9e97f122729fa90aa18e14cc4ab6b3d38d7c7f59
Opcode Fuzzy Hash: 21bc0f6301598303c13827e0319026f3a4049949566ec9a53abc1aeea47cf04e
Instruction Fuzzy Hash: E8318162A1968186EF448F12B95037A7B90EB85BE4F084275EBA987BC6CF7CD416C701

Function 00007FF62A973E30 Relevance: 6.1, APIs: 4, Instructions: 120threadnetworkCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF62A973E51
send.WS2_32 ref: 00007FF62A973F43
send.WS2_32 ref: 00007FF62A973F90
GetCurrentThreadId.KERNEL32 ref: 00007FF62A973FBA

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CurrentThreadsend
String ID:
API String ID: 302076607-0
Opcode ID: 1d5fac0907bdd9d84bc34d83d8396e4accfe818cb4c73ff339665f4c5f5d32ef
Instruction ID: 0438cc3ca1109d0673457ff11ac7d00dbae36a2468b4ebe1508d98c354240358
Opcode Fuzzy Hash: 1d5fac0907bdd9d84bc34d83d8396e4accfe818cb4c73ff339665f4c5f5d32ef
Instruction Fuzzy Hash: 6551B162E14B5287EB148F26EC4436A73B0FB84B84F0480B5CB49CBB16DFB8E4528312

Function 00007FF62A9737A0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF62A9737DD
CancelIo.KERNEL32 ref: 00007FF62A9737EA
closesocket.WS2_32 ref: 00007FF62A9737FA
SetEvent.KERNEL32 ref: 00007FF62A973804

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CancelEventclosesocketsetsockopt
String ID:
API String ID: 852421847-0
Opcode ID: 3e6bea74e94700dfcc8d9d47a61c466b5b5c0e1f507d80d6be11655914b66227
Instruction ID: 842a7e2beb81bd6033f6a5cf79ec81ac15f860514901b624e37bd071bc9a96b2
Opcode Fuzzy Hash: 3e6bea74e94700dfcc8d9d47a61c466b5b5c0e1f507d80d6be11655914b66227
Instruction Fuzzy Hash: 96F08136A1468187DB149F26E85836AB371FB84BA4F104336CBAD8B6E5CF7DD065C702

Function 00007FF62A98C6E0 Relevance: 4.6, APIs: 3, Instructions: 79stringCOMMON

Download Yara Rule

APIs

GetSystemDefaultLangID.KERNEL32 ref: 00007FF62A98C723
DeviceIoControl.KERNEL32 ref: 00007FF62A98C773

Part of subcall function 00007FF62A98C640: WideCharToMultiByte.KERNEL32 ref: 00007FF62A98C675
Part of subcall function 00007FF62A98C640: WideCharToMultiByte.KERNEL32 ref: 00007FF62A98C6B0

lstrcpyA.KERNEL32 ref: 00007FF62A98C7F2

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ByteCharMultiWide$ControlDefaultDeviceLangSystemlstrcpy
String ID:
API String ID: 3058672631-0
Opcode ID: 58814fa69bae84aefcd15b406166047d4f2e763b33bcfce0eb46db666086691b
Instruction ID: 65674353cd2f79e3331365c9e1caa122ac52bb5478c02af11607b28d33b75ebd
Opcode Fuzzy Hash: 58814fa69bae84aefcd15b406166047d4f2e763b33bcfce0eb46db666086691b
Instruction Fuzzy Hash: D031A632E2CB8289EF20DB12E8443AAA3A1EB857D0F544176EA9DC7786DF7DD401C701

Function 00007FF62A97C9B0 Relevance: 4.5, APIs: 3, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62A9761E0: InitializeCriticalSectionEx.KERNEL32 ref: 00007FF62A976231
Part of subcall function 00007FF62A9761E0: GetLastError.KERNEL32 ref: 00007FF62A97623B

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF62A97C7D4), ref: 00007FF62A97C9DA
GdiplusStartup.GDIPLUS ref: 00007FF62A97CA0F
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF62A97C7D4), ref: 00007FF62A97CA27

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CriticalSection$EnterErrorGdiplusInitializeLastLeaveStartup
String ID:
API String ID: 2723390537-0
Opcode ID: c1fce392dff7f0e0a1fd8d320c51b28cecfe9cf3d04554c50c1a4421144027e9
Instruction ID: 37333395270e0441477827f976dbe2167eb56130c8602aea438e7ac319fc7869
Opcode Fuzzy Hash: c1fce392dff7f0e0a1fd8d320c51b28cecfe9cf3d04554c50c1a4421144027e9
Instruction Fuzzy Hash: CF019233E18B81C6EB509F16E84436A77E1F784B41F481025EB8A87656CF7CD055CB41

Function 00007FF62A998B18 Relevance: 4.5, APIs: 3, Instructions: 27threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62A99EE88: GetLastError.KERNEL32(?,?,0000E12CD978A873,00007FF62A998DA5,?,?,?,?,00007FF62A9A27E6,?,?,00000000,00007FF62A99A69B,?,?,?), ref: 00007FF62A99EE97
Part of subcall function 00007FF62A99EE88: SetLastError.KERNEL32(?,?,0000E12CD978A873,00007FF62A998DA5,?,?,?,?,00007FF62A9A27E6,?,?,00000000,00007FF62A99A69B,?,?,?), ref: 00007FF62A99EF37

CloseHandle.KERNEL32(?,?,?,00007FF62A998CC5,?,?,?,?,00007FF62A998B09), ref: 00007FF62A998B53
FreeLibraryAndExitThread.KERNEL32(?,?,?,00007FF62A998CC5,?,?,?,?,00007FF62A998B09), ref: 00007FF62A998B69
ExitThread.KERNEL32 ref: 00007FF62A998B72

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: a30104ba4f4f868018fa850f0c9dce139a3884833968d360b0db499d9868783c
Instruction ID: 1a1edda737ff15743fb3575b67618fde35bf24526d0d792d0edc88615738d709
Opcode Fuzzy Hash: a30104ba4f4f868018fa850f0c9dce139a3884833968d360b0db499d9868783c
Instruction Fuzzy Hash: 08F0AF22E28A8765FF149B22994423C2399AF40B74F1C877AC63CC26D7DFACD8058342

Function 00007FF62A973DA0 Relevance: 3.0, APIs: 2, Instructions: 41timeCOMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 00007FF62A973DCD
timeGetTime.WINMM ref: 00007FF62A973DF1

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: SleepTimetime
String ID:
API String ID: 346578373-0
Opcode ID: a07444b426276808b022deff05d84a514b99e0a0f66664c5b3036afdf0babcf4
Instruction ID: 0bcfed90fe42e32d40020c175a1cba6631e925f197ba4110a7d35dd4f9360011
Opcode Fuzzy Hash: a07444b426276808b022deff05d84a514b99e0a0f66664c5b3036afdf0babcf4
Instruction Fuzzy Hash: FE018062F2864187EB648B7AE98833D26A0FB44784F4412B5C75ACB6D1CFBCD4E5C702

Function 00007FF62A998AA8 Relevance: 3.0, APIs: 2, Instructions: 31threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF62A998AB6
ExitThread.KERNEL32 ref: 00007FF62A998ABE

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 41641528019013f9ff929c92362d335c34901b889fac2650327ddb4de509bf94
Instruction ID: 47ff28fcff82c1414dc8a9af07f3481a95346210a21467a183362b528b81c016
Opcode Fuzzy Hash: 41641528019013f9ff929c92362d335c34901b889fac2650327ddb4de509bf94
Instruction Fuzzy Hash: 48F09616E2AA0349EF04BB729D0917D1295AF54B50F18D4B9D90DC3393DE6C94458703

Function 00007FF62A98DFB8 Relevance: 3.0, APIs: 2, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62A98DFE8
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62A98DFEE

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8afa6a4327cd587ea362fe0c4f5b4bf1e5e9001c34c8a508c9f4177e13cca725
Instruction ID: fb996942f14ea607cfbbc16c12c2c60faf743415f7b0adef397b8e841160ecc3
Opcode Fuzzy Hash: 8afa6a4327cd587ea362fe0c4f5b4bf1e5e9001c34c8a508c9f4177e13cca725
Instruction Fuzzy Hash: D1E0B650E7D2175DFF69226B2D0567810401F493F0E281BB0E97DC82C3BD9CA465E553

Function 00007FF62A99E95C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF62A9A6862,?,?,?,00007FF62A9A6BDF,?,?,00000000,00007FF62A9A7025,?,?,?,00007FF62A9A6F57), ref: 00007FF62A99E972
GetLastError.KERNEL32(?,?,?,00007FF62A9A6862,?,?,?,00007FF62A9A6BDF,?,?,00000000,00007FF62A9A7025,?,?,?,00007FF62A9A6F57), ref: 00007FF62A99E97C

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: a2b1b4d253dc9b48524949a201526306b0bcc39bf10aa9e0b1341fdbb23a067c
Instruction ID: 7ff78d75fb3cb8c8db7279a9dc416b6e62c8a1c3a90431b75e4f87edd7b1b665
Opcode Fuzzy Hash: a2b1b4d253dc9b48524949a201526306b0bcc39bf10aa9e0b1341fdbb23a067c
Instruction Fuzzy Hash: EAE08C12F2960357FF586BB3AD4823826969F88B01F00D8B9C90DC7393EEACA8414712

Function 00007FF62A971730 Relevance: 2.6, APIs: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF62A971796
VirtualFree.KERNELBASE ref: 00007FF62A9717CA

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 17a02dcf2f47f10d7a08db77411b6b44ca6662cc7d290d042544fe107c4b0b33
Instruction ID: 08c7476e7c6b382f7ab64863352d5711e19aed20cdd1967637a21fae74de44b1
Opcode Fuzzy Hash: 17a02dcf2f47f10d7a08db77411b6b44ca6662cc7d290d042544fe107c4b0b33
Instruction Fuzzy Hash: E1219A21F18A4187DB24CB2BF84012AB7A1FB84784F144135EB9ED7B19DF3CE5818B44

Function 00007FF62A971670 Relevance: 2.6, APIs: 2, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF62A9716C4
VirtualFree.KERNEL32 ref: 00007FF62A9716FE

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 4c8156205564e744c18fa944b02d568327434d479cf77dfe2f9176b33a9ea29c
Instruction ID: 6bfe4d5450a46909b5ff46cfb640433d69769b883b2a102dc4f574038fb3460c
Opcode Fuzzy Hash: 4c8156205564e744c18fa944b02d568327434d479cf77dfe2f9176b33a9ea29c
Instruction Fuzzy Hash: F311D671F38A4182DF048B27A940529A3A6FB88BC4B149132EA4ED7759DE7CD881CB41

Function 00007FF62A98E0E0 Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62A98DD80: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF62A98DD94

__scrt_release_startup_lock.LIBCMT ref: 00007FF62A98E177

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 2217363868-0
Opcode ID: df8c2cae6130cff53013dc258be4a77fac826802f49534194485c90f58f48bf0
Instruction ID: b9924b2e46576930a75344a219e2110a77315c576cc6653b87569ef4ae90baf0
Opcode Fuzzy Hash: df8c2cae6130cff53013dc258be4a77fac826802f49534194485c90f58f48bf0
Instruction Fuzzy Hash: 49312C22E296435AFF10AB679D613B91296AF857C4F4440B5DA0EC72E7CEEDE844C703

Function 00007FF62A971000 Relevance: 1.5, APIs: 1, Instructions: 16networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF62A971022

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 2276b2cfde0ec166953e0ec75e850ce31f8cbc4b3846b0cdc97fb7f8133b5954
Instruction ID: 91938ab763aab5cf42af805af76d3224b1c034ab58c5da1b6f32b2b9d75637bf
Opcode Fuzzy Hash: 2276b2cfde0ec166953e0ec75e850ce31f8cbc4b3846b0cdc97fb7f8133b5954
Instruction Fuzzy Hash: DFE04F36F25A45CAEB11AB25E8491A473A5FB58740F408172E58CC3796DF6CD1158F02

Function 00007FF62A99F070 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF62A9A27CD,?,?,00000000,00007FF62A99A69B,?,?,?,00007FF62A99C873,?,?,?,00007FF62A99C769), ref: 00007FF62A99F0AE

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 016c47a342e12657c725cebeaa7b4028c5a2c41f1cbc7a3001cbfc12b323d78a
Instruction ID: ef7cb0ae8ded371f8127a7d079c5222cf052ef955f3f436c6acc73ca1a24139e
Opcode Fuzzy Hash: 016c47a342e12657c725cebeaa7b4028c5a2c41f1cbc7a3001cbfc12b323d78a
Instruction Fuzzy Hash: 90F05E41F296036AFF6416635E4137592884F44761F0886B2D92EC63C3EDACA8408513

Non-executed Functions

Function 00007FF62A979480 Relevance: 68.5, APIs: 29, Strings: 10, Instructions: 221libraryloaderinjectionCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 00007FF62A9794F6
CreateProcessA.KERNEL32 ref: 00007FF62A979559
GetCurrentProcess.KERNEL32 ref: 00007FF62A979567
OpenProcessToken.ADVAPI32 ref: 00007FF62A97957C
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF62A97959A
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF62A9795E2
OpenProcess.KERNEL32 ref: 00007FF62A9795FB
LoadLibraryA.KERNEL32 ref: 00007FF62A979625
GetProcAddress.KERNEL32 ref: 00007FF62A979635
LoadLibraryA.KERNEL32 ref: 00007FF62A979646
GetProcAddress.KERNEL32 ref: 00007FF62A979656
LoadLibraryA.KERNEL32 ref: 00007FF62A979667
GetProcAddress.KERNEL32 ref: 00007FF62A979677
LoadLibraryA.KERNEL32 ref: 00007FF62A979688
GetProcAddress.KERNEL32 ref: 00007FF62A979698
GetCurrentProcess.KERNEL32 ref: 00007FF62A9796A2
GetProcessId.KERNEL32 ref: 00007FF62A9796AB
GetModuleFileNameA.KERNEL32 ref: 00007FF62A9796DF
VirtualAllocEx.KERNEL32 ref: 00007FF62A979715
WriteProcessMemory.KERNEL32 ref: 00007FF62A97973C
VirtualProtectEx.KERNEL32 ref: 00007FF62A97976F
VirtualAllocEx.KERNEL32 ref: 00007FF62A97978E
WriteProcessMemory.KERNEL32 ref: 00007FF62A9797B8
VirtualProtectEx.KERNEL32 ref: 00007FF62A9797E4
CreateRemoteThread.KERNEL32 ref: 00007FF62A979807
Sleep.KERNEL32 ref: 00007FF62A97981A
VirtualProtectEx.KERNEL32 ref: 00007FF62A97983E
VirtualProtectEx.KERNEL32 ref: 00007FF62A979862
ResumeThread.KERNEL32 ref: 00007FF62A97986B

Strings

%s%s, xrefs: 00007FF62A979511
WinExec, xrefs: 00007FF62A979670
Windows\System32\svchost.exe, xrefs: 00007FF62A9794FC
OpenProcess, xrefs: 00007FF62A97962E
h, xrefs: 00007FF62A9794DD
ExitProcess, xrefs: 00007FF62A97964F
SeDebugPrivilege, xrefs: 00007FF62A979593
WaitForSingleObject, xrefs: 00007FF62A979691
Kernel32.dll, xrefs: 00007FF62A97961E, 00007FF62A97963B, 00007FF62A97965C, 00007FF62A97967D
@, xrefs: 00007FF62A979777

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Process$Virtual$AddressLibraryLoadProcProtect$AllocCreateCurrentMemoryOpenThreadTokenWrite$AdjustDirectoryFileLookupModuleNamePrivilegePrivilegesRemoteResumeSleepSystemValue
String ID: %s%s$@$ExitProcess$Kernel32.dll$OpenProcess$SeDebugPrivilege$WaitForSingleObject$WinExec$Windows\System32\svchost.exe$h
API String ID: 3040193174-4212407401
Opcode ID: 6fd3f4fde48d0361eb2d5c202ab323ad8a247f6fe0c7ba3ad29a459755052d7c
Instruction ID: d2bfd24c3f9ad1e835b29eacb4293304f7bed936976f7a16056baf485d61d15d
Opcode Fuzzy Hash: 6fd3f4fde48d0361eb2d5c202ab323ad8a247f6fe0c7ba3ad29a459755052d7c
Instruction Fuzzy Hash: 11A15F72F24B8285EB20CF22EC547E923A5FB88788F404176DA4D9BA56DFBCD245C701

Function 00007FF62A97ADB0 Relevance: 63.3, APIs: 30, Strings: 6, Instructions: 286stringclipboardfileCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,00000000,00000000,00002514,00000000,00000000,00000000,00007FF62A977A51), ref: 00007FF62A97AE08
GetTickCount.KERNEL32 ref: 00007FF62A97AE0E
GetTickCount.KERNEL32 ref: 00007FF62A97AE25
OpenClipboard.USER32 ref: 00007FF62A97AE33
GetClipboardData.USER32 ref: 00007FF62A97AE3E
GlobalSize.KERNEL32 ref: 00007FF62A97AE53
GlobalLock.KERNEL32 ref: 00007FF62A97AE63
wsprintfW.USER32 ref: 00007FF62A97AECE
WaitForSingleObject.KERNEL32 ref: 00007FF62A97AEE0
CreateFileW.KERNEL32 ref: 00007FF62A97AF14
SetFilePointer.KERNEL32 ref: 00007FF62A97AF3C
lstrlenW.KERNEL32 ref: 00007FF62A97AF47
WriteFile.KERNEL32 ref: 00007FF62A97AF6A
CloseHandle.KERNEL32 ref: 00007FF62A97AF73
ReleaseMutex.KERNEL32 ref: 00007FF62A97AF80
GlobalUnlock.KERNEL32 ref: 00007FF62A97AF9B
CloseClipboard.USER32 ref: 00007FF62A97AFA1
GetForegroundWindow.USER32 ref: 00007FF62A97AFBB
GetWindowTextW.USER32 ref: 00007FF62A97AFD8
lstrlenW.KERNEL32 ref: 00007FF62A97B00E
GetLocalTime.KERNEL32 ref: 00007FF62A97B021
wsprintfW.USER32 ref: 00007FF62A97B074
GetKeyState.USER32 ref: 00007FF62A97B153
lstrlenW.KERNEL32 ref: 00007FF62A97B1A0
lstrlenW.KERNEL32 ref: 00007FF62A97B1C1
wsprintfW.USER32 ref: 00007FF62A97B211
wsprintfW.USER32 ref: 00007FF62A97B22F
lstrlenW.KERNEL32 ref: 00007FF62A97B2A7

Strings

%s%s, xrefs: 00007FF62A97B21B
[, xrefs: 00007FF62A97AEC2
%s%s, xrefs: 00007FF62A97B24D
[esc], xrefs: 00007FF62A97ADFC
[, xrefs: 00007FF62A97B05C
%s%s, xrefs: 00007FF62A97B207

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: lstrlen$wsprintf$ClipboardFileGlobal$CloseCountTickWindow$CreateDataForegroundHandleLocalLockMutexObjectOpenPointerReleaseSingleSizeSleepStateTextTimeUnlockWaitWrite
String ID: [$[$%s%s$%s%s$%s%s$[esc]
API String ID: 3669393114-972647286
Opcode ID: 0ba4a650500777e326fb2fa0ba1ce122045bb19d315cab67db3075d848846471
Instruction ID: ba07f507b35906f4ee8144fd0feb0adb1d71c77883401bdfa5f26881d26283d8
Opcode Fuzzy Hash: 0ba4a650500777e326fb2fa0ba1ce122045bb19d315cab67db3075d848846471
Instruction Fuzzy Hash: F2D16F66E28A4686FF109B17EC442B933A2FF88744F404176DA4EC66A6DFBCE544C713

Function 00007FF62A97D410 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 385stringtimeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00007FF62A97D437
wsprintfW.USER32 ref: 00007FF62A97D47F
lstrlenW.KERNEL32 ref: 00007FF62A97D4C5
lstrlenW.KERNEL32 ref: 00007FF62A97D4E6
lstrlenW.KERNEL32 ref: 00007FF62A97D4F9
lstrlenW.KERNEL32 ref: 00007FF62A97D58D
lstrlenW.KERNEL32 ref: 00007FF62A97D5AC
lstrlenW.KERNEL32 ref: 00007FF62A97D5BF
lstrlenW.KERNEL32 ref: 00007FF62A97D649
lstrlenW.KERNEL32 ref: 00007FF62A97D65C
CreateEventA.KERNEL32 ref: 00007FF62A97D7AD

Strings

o1:, xrefs: 00007FF62A97D5B5
p1:, xrefs: 00007FF62A97D4EF
t1:, xrefs: 00007FF62A97D652
%4d.%2d.%2d-%2d:%2d:%2d, xrefs: 00007FF62A97D471

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: lstrlen$CreateEventLocalTimewsprintf
String ID: %4d.%2d.%2d-%2d:%2d:%2d$o1:$p1:$t1:
API String ID: 2157945651-1225219777
Opcode ID: ffa54dc6aacd8b7c489ab2f030bdae777e95d9fe9fee655a7fecff1d3dc8717e
Instruction ID: d7f1d2df83069f3298a4bf58fd7be61a5ee17ef86b63a816bdd91fa6a246b950
Opcode Fuzzy Hash: ffa54dc6aacd8b7c489ab2f030bdae777e95d9fe9fee655a7fecff1d3dc8717e
Instruction Fuzzy Hash: 0DF1B7A2E2479286EF209F2ADC407BD23A1FB44794F404276DA4DDBAD6DFBC9541C702

Function 00007FF62A979900 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 118libraryloaderfileCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 00007FF62A979935
GetProcAddress.KERNEL32 ref: 00007FF62A979948
GetProcAddress.KERNEL32 ref: 00007FF62A979976
FreeLibrary.KERNEL32 ref: 00007FF62A9799A7
CreateFileW.KERNEL32 ref: 00007FF62A9799D4
GetProcAddress.KERNEL32 ref: 00007FF62A979A1C
WriteFile.KERNEL32 ref: 00007FF62A979A66
CloseHandle.KERNEL32 ref: 00007FF62A979A7E
Sleep.KERNEL32 ref: 00007FF62A979A91
GetProcAddress.KERNEL32 ref: 00007FF62A979AA1
FreeLibrary.KERNEL32 ref: 00007FF62A979ABC

Strings

InternetCloseHandle, xrefs: 00007FF62A979A97
InternetReadFile, xrefs: 00007FF62A979A12
InternetOpenW, xrefs: 00007FF62A97993E
wininet.dll, xrefs: 00007FF62A979923
MSIE 6.0, xrefs: 00007FF62A979959
InternetOpenUrlW, xrefs: 00007FF62A97996C

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: AddressProc$Library$FileFree$CloseCreateHandleLoadSleepWrite
String ID: InternetCloseHandle$InternetOpenUrlW$InternetOpenW$InternetReadFile$MSIE 6.0$wininet.dll
API String ID: 2977986460-1099148085
Opcode ID: 067ce2f794736821cf202725aa30ed0aa3c92a2ab4f8812fc9fc05c1c4d827d7
Instruction ID: 8062599c693791a4dac400ab8024559d46c06c5139917d5de44bae299ecd496d
Opcode Fuzzy Hash: 067ce2f794736821cf202725aa30ed0aa3c92a2ab4f8812fc9fc05c1c4d827d7
Instruction Fuzzy Hash: 8A411766E2964285EF64DB13AC0077A67A1FB89BD4F444171CD4E87796EF7CD004CB02

Function 00007FF62A980DA0 Relevance: 27.3, APIs: 18, Instructions: 322clipboardsleepmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62A98D26C: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF62A98D289
Part of subcall function 00007FF62A98D26C: std::locale::_Setgloballocale.LIBCPMT ref: 00007FF62A98D2AC
Part of subcall function 00007FF62A98D26C: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF62A98D341

Part of subcall function 00007FF62A9815A0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF62A9815B9
Part of subcall function 00007FF62A9815A0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF62A9815DE
Part of subcall function 00007FF62A9815A0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF62A981608
Part of subcall function 00007FF62A9815A0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF62A9816A2
Part of subcall function 00007FF62A9815A0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF62A9816B2
Part of subcall function 00007FF62A9815A0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF62A9816D7
Part of subcall function 00007FF62A9815A0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF62A981701

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A980FE2
lstrlenW.KERNEL32 ref: 00007FF62A981005
Sleep.KERNEL32 ref: 00007FF62A981065
OpenClipboard.USER32 ref: 00007FF62A98107B
GetClipboardData.USER32 ref: 00007FF62A98108A
GlobalLock.KERNEL32 ref: 00007FF62A98109B
GlobalUnlock.KERNEL32 ref: 00007FF62A9810B6
CloseClipboard.USER32 ref: 00007FF62A9810BC
CloseClipboard.USER32 ref: 00007FF62A9810D8
OpenClipboard.USER32 ref: 00007FF62A981100
EmptyClipboard.USER32 ref: 00007FF62A98110A
GlobalAlloc.KERNEL32 ref: 00007FF62A981122
GlobalLock.KERNEL32 ref: 00007FF62A981133
GlobalUnlock.KERNEL32 ref: 00007FF62A98115D
SetClipboardData.USER32 ref: 00007FF62A98116B
CloseClipboard.USER32 ref: 00007FF62A981171
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A9811FE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A981204

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Lockitstd::_$Clipboard$GlobalLockit::_$Lockit::~_$Close_invalid_parameter_noinfo_noreturn$DataLockOpenUnlock$AllocEmptySetgloballocaleSleeplstrlenstd::locale::_
String ID:
API String ID: 1851032462-0
Opcode ID: 146533d8503bd32a6b03074daf5edfdeef99d1c15a2255993bca1309a5dea7e0
Instruction ID: 7a2d1b4fd528762870f78714c7438cfcf6eeda9c92747da3de5121300b19ef22
Opcode Fuzzy Hash: 146533d8503bd32a6b03074daf5edfdeef99d1c15a2255993bca1309a5dea7e0
Instruction Fuzzy Hash: 60D1B262F29B4286EF109F26E8442AD63A1FF84BD4F104276EA5DC779ADF7CE4448701

Function 00007FF62A97CD40 Relevance: 26.7, APIs: 7, Strings: 8, Instructions: 406threadinjectionprocessCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32 ref: 00007FF62A97CF12
CreateProcessA.KERNEL32 ref: 00007FF62A97CF6E
VirtualAllocEx.KERNEL32 ref: 00007FF62A97CF97
WriteProcessMemory.KERNEL32 ref: 00007FF62A97CFBC
GetThreadContext.KERNEL32 ref: 00007FF62A97CFE0
SetThreadContext.KERNEL32 ref: 00007FF62A97D001
ResumeThread.KERNEL32 ref: 00007FF62A97D014

Strings

%s%s, xrefs: 00007FF62A97CF27
@, xrefs: 00007FF62A97CF8A
%s %s, xrefs: 00007FF62A97D05B, 00007FF62A97D1EF, 00007FF62A97D2D3, 00007FF62A97D369
Windows\System32\svchost.exe, xrefs: 00007FF62A97CF18
plugmark, xrefs: 00007FF62A97CE43
nlyloadinmyself, xrefs: 00007FF62A97CD94
h, xrefs: 00007FF62A97CEE6
53aaa05a-823a-477c-ad34-6798b901feb6, xrefs: 00007FF62A97D262

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Thread$ContextProcess$AllocCreateDirectoryMemoryResumeSystemVirtualWrite
String ID: %s %s$%s%s$53aaa05a-823a-477c-ad34-6798b901feb6$@$Windows\System32\svchost.exe$h$nlyloadinmyself$plugmark
API String ID: 4033188109-1883610551
Opcode ID: 39cb0ed868284d1e7928880f05503a86ba10bcdc2c17875e8f87faef0a13c5dc
Instruction ID: 4d2610d275e157710a41799c5b01080f5b4e256acb915f8dc02a9d8dab15973d
Opcode Fuzzy Hash: 39cb0ed868284d1e7928880f05503a86ba10bcdc2c17875e8f87faef0a13c5dc
Instruction Fuzzy Hash: 4D129F62F28B8282EB20CF26D8442BD67A1FB84B84F448176DB4D87B96DF7CD585C711

Function 00007FF62A97E3E9 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 64shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF62A97E3E9
OpenProcessToken.ADVAPI32 ref: 00007FF62A97E3FE
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF62A97E426
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF62A97E44A
GetLastError.KERNEL32 ref: 00007FF62A97E450
CloseHandle.KERNEL32 ref: 00007FF62A97E45D
ExitWindowsEx.USER32 ref: 00007FF62A97E56F
GetCurrentProcess.KERNEL32 ref: 00007FF62A97E575
OpenProcessToken.ADVAPI32 ref: 00007FF62A97E58A
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF62A97E5B2
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF62A97E5D6
GetLastError.KERNEL32 ref: 00007FF62A97E5DC
CloseHandle.KERNEL32 ref: 00007FF62A97E5F1

Strings

SeShutdownPrivilege, xrefs: 00007FF62A97E415, 00007FF62A97E5A5

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue$ExitWindows
String ID: SeShutdownPrivilege
API String ID: 1423298842-3733053543
Opcode ID: 40da0a47c9c7c1cc3a1aa31b778f4d13c03be2ed2b90204a7f89449c4a5765b5
Instruction ID: 4f2ffc2c088885553a2e22b13903ca4de352aeb434a90d790353d5dd645ebc0a
Opcode Fuzzy Hash: 40da0a47c9c7c1cc3a1aa31b778f4d13c03be2ed2b90204a7f89449c4a5765b5
Instruction Fuzzy Hash: 1A314376E18E9281EB208F16EC143BA7361FB84B56F104077D94DD6666CFBCD589C702

Function 00007FF62A98A680 Relevance: 25.8, APIs: 17, Instructions: 347memoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF62A97D242), ref: 00007FF62A98A6C5
GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF62A97D242), ref: 00007FF62A98A74A
VirtualAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF62A97D242), ref: 00007FF62A98A79F
VirtualAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF62A97D242), ref: 00007FF62A98A7BE
VirtualAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF62A97D242), ref: 00007FF62A98A821
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF62A97D242), ref: 00007FF62A98A842
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF62A97D242), ref: 00007FF62A98A856
VirtualFree.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF62A97D242), ref: 00007FF62A98A873
VirtualFree.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF62A97D242), ref: 00007FF62A98A88F
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF62A97D242), ref: 00007FF62A98A8AC
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF62A97D242), ref: 00007FF62A98AB92

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Virtual$Alloc$ErrorLast$FreeHeap$InfoNativeProcessSystem
String ID:
API String ID: 1282860858-0
Opcode ID: bc094b2e2349ffbc07eff65132924311638ab0ecebfd180c525b8fe56df94986
Instruction ID: f498371e99a2f9bdfada713ef0fe32f5b9fadf20c0d4725f6b204ade16c2b425
Opcode Fuzzy Hash: bc094b2e2349ffbc07eff65132924311638ab0ecebfd180c525b8fe56df94986
Instruction Fuzzy Hash: E3D16F32F29A428AEF648B17E85477963A1EF44BC4F468075CA4DC7B92EE7CE4418312

Function 00007FF62A97E46D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 62shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF62A97E46D
OpenProcessToken.ADVAPI32 ref: 00007FF62A97E482
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF62A97E4AA
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF62A97E4CE
GetLastError.KERNEL32 ref: 00007FF62A97E4D4
CloseHandle.KERNEL32 ref: 00007FF62A97E4E1
ExitWindowsEx.USER32 ref: 00007FF62A97E56F
GetCurrentProcess.KERNEL32 ref: 00007FF62A97E575
OpenProcessToken.ADVAPI32 ref: 00007FF62A97E58A
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF62A97E5B2
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF62A97E5D6
GetLastError.KERNEL32 ref: 00007FF62A97E5DC
CloseHandle.KERNEL32 ref: 00007FF62A97E5F1

Strings

SeShutdownPrivilege, xrefs: 00007FF62A97E499, 00007FF62A97E5A5

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue$ExitWindows
String ID: SeShutdownPrivilege
API String ID: 1423298842-3733053543
Opcode ID: a792fc21bd502bb1f53feba3e0ea592908ea8fd6b5dd88df7bff687d3cdc374e
Instruction ID: eb59f01a75b03f6e531f44947061bf111dbb1fc1315fddda42d56a2e624e5936
Opcode Fuzzy Hash: a792fc21bd502bb1f53feba3e0ea592908ea8fd6b5dd88df7bff687d3cdc374e
Instruction Fuzzy Hash: 83315076E18E8281EB208F16EC143AA7361FB84B56F104077D94DD7666CFBCD589CB02

Function 00007FF62A97E4EE Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 61shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF62A97E4EE
OpenProcessToken.ADVAPI32 ref: 00007FF62A97E503
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF62A97E52B
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF62A97E54F
GetLastError.KERNEL32 ref: 00007FF62A97E555
CloseHandle.KERNEL32 ref: 00007FF62A97E562
ExitWindowsEx.USER32 ref: 00007FF62A97E56F
GetCurrentProcess.KERNEL32 ref: 00007FF62A97E575
OpenProcessToken.ADVAPI32 ref: 00007FF62A97E58A
LookupPrivilegeValueW.ADVAPI32 ref: 00007FF62A97E5B2
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF62A97E5D6
GetLastError.KERNEL32 ref: 00007FF62A97E5DC
CloseHandle.KERNEL32 ref: 00007FF62A97E5F1

Strings

SeShutdownPrivilege, xrefs: 00007FF62A97E51A, 00007FF62A97E5A5

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue$ExitWindows
String ID: SeShutdownPrivilege
API String ID: 1423298842-3733053543
Opcode ID: c4512c4a51b1fe7d902806900a56825f16f8507878c75a96d79f3f5efe7084bf
Instruction ID: 084b28ad3031e3daa1be520c326cad7a5d29fd5a2c82cac9412ab6903556ab62
Opcode Fuzzy Hash: c4512c4a51b1fe7d902806900a56825f16f8507878c75a96d79f3f5efe7084bf
Instruction Fuzzy Hash: 37314176E18E8281EB208F16EC143AA7361FB84B56F104077D94DD7666CF7CD589CB02

Function 00007FF62A9A8824 Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF62A9A8872
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62A9A8EDE
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62A9A9054
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62A9A9312
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62A9A9532
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62A9A976F
memcpy_s.LIBCPMT ref: 00007FF62A9A984A
memcpy_s.LIBCPMT ref: 00007FF62A9A98F5
memcpy_s.LIBCPMT ref: 00007FF62A9A99C4

Strings

1#SNAN, xrefs: 00007FF62A9A8982
1#IND, xrefs: 00007FF62A9A895F
1#QNAN, xrefs: 00007FF62A9A898B
1#INF, xrefs: 00007FF62A9A899B

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 8a8cdf450ad9da4e3e91848c83b2fc9670f44cdb81e1e9276785e569651f6bed
Instruction ID: 0e605d808b90d7b173c042288a7e625a49ef21763530ec94bf6e0d06fdc91e6a
Opcode Fuzzy Hash: 8a8cdf450ad9da4e3e91848c83b2fc9670f44cdb81e1e9276785e569651f6bed
Instruction Fuzzy Hash: 90B2C772E282928EEB648F66D8407FD37A2FB54344F505176DA0DD7A87DFB8A500CB42

Function 00007FF62A980880 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 129registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF62A9808F0
RegQueryValueExW.ADVAPI32 ref: 00007FF62A98096F
lstrcpyW.KERNEL32 ref: 00007FF62A980AF2
RegCloseKey.ADVAPI32 ref: 00007FF62A980B04
RegCloseKey.ADVAPI32 ref: 00007FF62A980B12

Strings

%08X, xrefs: 00007FF62A980A8D

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Close$OpenQueryValuelstrcpy
String ID: %08X
API String ID: 2032971926-3773563069
Opcode ID: 32c954eb57fda164b81f0150aeb248f5c32c45763a12c98c87c6a1606aaef6c8
Instruction ID: 499d005a1d21226ac40bac4dc8d16cb5a99e4ae8076e67ba68c69985de4d926e
Opcode Fuzzy Hash: 32c954eb57fda164b81f0150aeb248f5c32c45763a12c98c87c6a1606aaef6c8
Instruction Fuzzy Hash: 3D515172A18A8185EB70CB16E8443ABB361FB85794F804236D79DC3AAADF7CD544CB05

Function 00007FF62A9A797C Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF62A99ED10: GetLastError.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED1F
Part of subcall function 00007FF62A99ED10: FlsGetValue.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED34
Part of subcall function 00007FF62A99ED10: SetLastError.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99EDBF

TranslateName.LIBCMT ref: 00007FF62A9A79E6
TranslateName.LIBCMT ref: 00007FF62A9A7A21
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF62A99D778), ref: 00007FF62A9A7A68
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF62A99D778), ref: 00007FF62A9A7AA0
GetLocaleInfoW.KERNEL32 ref: 00007FF62A9A7C5D

Strings

utf8, xrefs: 00007FF62A9A7B84

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodeInfoLocalePageValidValue
String ID: utf8
API String ID: 3069159798-905460609
Opcode ID: ed249922890c5a667d77dbf9e0f0f5ff4edc5bc12cc14daec0a02a097362d650
Instruction ID: 561c1e0bb190be4f6d851409787d745a72928d66921851db8182667b14a7ef7e
Opcode Fuzzy Hash: ed249922890c5a667d77dbf9e0f0f5ff4edc5bc12cc14daec0a02a097362d650
Instruction Fuzzy Hash: BC91B232E28742D5EF249F229D522B923A6EB44B80F4485B2DA4DC7787DFBDE5418343

Function 00007FF62A9A83C4 Relevance: 10.7, APIs: 7, Instructions: 172COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF62A99ED10: GetLastError.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED1F
Part of subcall function 00007FF62A99ED10: FlsGetValue.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED34
Part of subcall function 00007FF62A99ED10: SetLastError.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99EDBF

Part of subcall function 00007FF62A99ED10: FlsSetValue.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED55

GetUserDefaultLCID.KERNEL32(00000000,00000092,?,?), ref: 00007FF62A9A8534

Part of subcall function 00007FF62A99ED10: FlsSetValue.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED82
Part of subcall function 00007FF62A99ED10: FlsSetValue.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED93
Part of subcall function 00007FF62A99ED10: FlsSetValue.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99EDA4

EnumSystemLocalesW.KERNEL32(00000000,00000092,?,?,00000000,?,?,00007FF62A99D771), ref: 00007FF62A9A851B
ProcessCodePage.LIBCMT ref: 00007FF62A9A855E
IsValidCodePage.KERNEL32 ref: 00007FF62A9A8570
IsValidLocale.KERNEL32 ref: 00007FF62A9A8586
GetLocaleInfoW.KERNEL32 ref: 00007FF62A9A85E2
GetLocaleInfoW.KERNEL32 ref: 00007FF62A9A85FE

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: 22d8bcddac7133f8b6f7a06d5e5334a0f8ea8210c2b9d064d69f21135d6cdb9b
Instruction ID: 1f53ad2036baa1a4e93f51cca7f6fad1d84b91403e5ce83ac45132089f8b49b8
Opcode Fuzzy Hash: 22d8bcddac7133f8b6f7a06d5e5334a0f8ea8210c2b9d064d69f21135d6cdb9b
Instruction Fuzzy Hash: 0E716922F2860289FF509F62DC502B922A6BF44744F4484B6CA0DC3687EFBCE845C393

Function 00007FF62A98E66C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF62A98E688
RtlCaptureContext.KERNEL32 ref: 00007FF62A98E6B5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF62A98E6CF
RtlVirtualUnwind.KERNEL32 ref: 00007FF62A98E710
IsDebuggerPresent.KERNEL32 ref: 00007FF62A98E764
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF62A98E781
UnhandledExceptionFilter.KERNEL32 ref: 00007FF62A98E78C

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 045e81cc47e066d153aaaf5b50bd9fe289779446efb159575806e036ae1ed661
Instruction ID: c66bdf1cbfe34181070e14daa7253a216ebe8614d78dad66144e15b7cd54a7cb
Opcode Fuzzy Hash: 045e81cc47e066d153aaaf5b50bd9fe289779446efb159575806e036ae1ed661
Instruction Fuzzy Hash: 38316E72A18B818AEF608F61E8507ED3365FB84744F04407ADA4EC7B96DF78C548CB01

Function 00007FF62A97E36A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

OpenEventLogW.ADVAPI32 ref: 00007FF62A97E397
ClearEventLogW.ADVAPI32 ref: 00007FF62A97E3AA
CloseEventLog.ADVAPI32 ref: 00007FF62A97E3B3

Strings

Security, xrefs: 00007FF62A97E376
System, xrefs: 00007FF62A97E382
Application, xrefs: 00007FF62A97E36A

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Event$ClearCloseOpen
String ID: Application$Security$System
API String ID: 1391105993-2169399579
Opcode ID: 1bb91c5c2b3888595093d95bda04c9b415b5dc93057c8244563c58f3f028a90d
Instruction ID: ede2b04d47cdd649a5a56a8ecc7833a657b2b16ae604c41f10a73365269d5fa1
Opcode Fuzzy Hash: 1bb91c5c2b3888595093d95bda04c9b415b5dc93057c8244563c58f3f028a90d
Instruction Fuzzy Hash: 91F08126E19F4181EF15CB0AFC00266B3A5FF88764F040576CA4DC6766EEBCD0968702

Function 00007FF62A993D0C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF62A993D85
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF62A993D9D
RtlVirtualUnwind.KERNEL32 ref: 00007FF62A993DD8
IsDebuggerPresent.KERNEL32 ref: 00007FF62A993E11
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF62A993E1B
UnhandledExceptionFilter.KERNEL32 ref: 00007FF62A993E26

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: fa8f028e9fcd13a2b73484911b7de9c78ca1ddcb2e97266c57a75bc76a24fdd2
Instruction ID: 2788ece9c1aaba7a082e40c8a369a55235268d11a9614cb2448654ae67597066
Opcode Fuzzy Hash: fa8f028e9fcd13a2b73484911b7de9c78ca1ddcb2e97266c57a75bc76a24fdd2
Instruction Fuzzy Hash: DB318132A28B818ADB20CF26E8403AE73A5FB88754F540176EA8DC3B56DF78C545CB01

Function 00007FF62A9A4190 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62A9A41DC
FindFirstFileExW.KERNEL32 ref: 00007FF62A9A42E6

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 68b5c0f69695cefe4d2b1cac7d4572eefde3aab897b1af24f4d9a3b1cd0a2181
Instruction ID: 289baa388faffbaf79099faf401a7ef1e1179232063e8fc28b2425eb0b4729de
Opcode Fuzzy Hash: 68b5c0f69695cefe4d2b1cac7d4572eefde3aab897b1af24f4d9a3b1cd0a2181
Instruction Fuzzy Hash: 91B19126E3865241EF609B27AD002B96392EB85BD4F445172EE5EC7B87DFBCE4418703

Function 00007FF62A98C82C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF62A98C88D
IsDebuggerPresent.KERNEL32 ref: 00007FF62A98C8A5
OutputDebugStringW.KERNEL32 ref: 00007FF62A98C8B6

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF62A98C8AF

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 6ee909605b01ed677f0d258b83eb54f87cb27d04152a024ec70f484db7e8edcc
Instruction ID: 1ed80ae8d1dd36e5979eb8117da38eafb57fc82298779c030c4d58705cdee26d
Opcode Fuzzy Hash: 6ee909605b01ed677f0d258b83eb54f87cb27d04152a024ec70f484db7e8edcc
Instruction Fuzzy Hash: 84112832E24B4296FB449B26DA443B923A5FB44385F408176C64DC6A52EFBCE064C712

Function 00007FF62A99B5F0 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF62A99B656
memcpy_s.LIBCPMT ref: 00007FF62A99B681

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: a3a34dc7f104a5757306e0e4006adbba08ef9a00a3e13a0073f806107d450ba3
Instruction ID: dd7e5e5cc5b4cba1eed644e186608103e1a86f13ec0fcd8926b1e1bcac9a5e6d
Opcode Fuzzy Hash: a3a34dc7f104a5757306e0e4006adbba08ef9a00a3e13a0073f806107d450ba3
Instruction Fuzzy Hash: 1DC1E572F292869BEB248F16A5446AAB791F788B84F44C134DB4EC7B45DE7DE801CB40

Function 00007FF62A9A7E40 Relevance: 4.7, APIs: 3, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62A99ED10: GetLastError.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED1F
Part of subcall function 00007FF62A99ED10: FlsGetValue.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED34
Part of subcall function 00007FF62A99ED10: SetLastError.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99EDBF

Part of subcall function 00007FF62A99ED10: FlsSetValue.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED55

GetLocaleInfoW.KERNEL32 ref: 00007FF62A9A7EAC

Part of subcall function 00007FF62A9A3FCC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62A9A3FE9

GetLocaleInfoW.KERNEL32 ref: 00007FF62A9A7EF5

Part of subcall function 00007FF62A9A3FCC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62A9A4042

GetLocaleInfoW.KERNEL32 ref: 00007FF62A9A7FBD

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: InfoLocale$ErrorLastValue_invalid_parameter_noinfo
String ID:
API String ID: 1791019856-0
Opcode ID: 47a608bb907d4de4290f427b339ca80dcd83f241fa12a378f23bb4634d50531a
Instruction ID: c8e45690fd086513df3e6652a71d758895ee87817fbae687ac280d27175d28cb
Opcode Fuzzy Hash: 47a608bb907d4de4290f427b339ca80dcd83f241fa12a378f23bb4634d50531a
Instruction Fuzzy Hash: 4E619E32E2855286EF248F22D9512B973A2FB44740F0481B6DB9EC3693DFBDE551C742

Function 00007FF62A9A0FB0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF62A99D94A), ref: 00007FF62A9A1024

Strings

GetLocaleInfoEx, xrefs: 00007FF62A9A0FCC, 00007FF62A9A0FDD

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 3b61ae466ef5758e0e9e9450f631c2e40b05ac649b5573246797acb4bca5b173
Instruction ID: c6eb0c0fa58027df91250c931a8e767c9c6bbe3133714097534f3a3fed0492dd
Opcode Fuzzy Hash: 3b61ae466ef5758e0e9e9450f631c2e40b05ac649b5573246797acb4bca5b173
Instruction Fuzzy Hash: D101DF25F18A9185EF008B47B8001AAA262AB99BC0F584076DF4DC3B5BCE7CD9458742

Function 00007FF62A9A3A00 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF62A9A3C4F
RaiseException.KERNEL32 ref: 00007FF62A9A3C60

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 122b1925bd55db41e804c5b079ebde0f01de1123b2666aa23313b6dae26d6c44
Instruction ID: 5abb73178e1478c7cc312d9321c8c35dc642f72a3fb63aeb129eebdcc9d04483
Opcode Fuzzy Hash: 122b1925bd55db41e804c5b079ebde0f01de1123b2666aa23313b6dae26d6c44
Instruction Fuzzy Hash: 82B17D77E10B888BEB15CF2AC8463693BA1F744B48F1489A2DA5DC37A6CF79D451C702

Function 00007FF62A9975E0 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF62A99774E
, xrefs: 00007FF62A997990

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: 551e646fd59d23c1ee018d61c48a67f2a52f50f5278fc9195615cae8faf456cd
Instruction ID: f52e82c17bf0ab99ee360b1de2fac94280d4351c3ac14a37927b67a3728e7f9e
Opcode Fuzzy Hash: 551e646fd59d23c1ee018d61c48a67f2a52f50f5278fc9195615cae8faf456cd
Instruction Fuzzy Hash: 26E1E732E28603DAEF688E2B8A5013D23A0FF45B48F149975CA4DC7796DF6BD841C742

Function 00007FF62A99F950 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF62A99FA5D
gfff, xrefs: 00007FF62A99FADA

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: a347cb712251c494c0ac76841d0ca458a250c6be9a7c463d0ead6691c264c289
Instruction ID: ba0110c0951284546618e067be077cae11fa3744169bfea08a5cc03490ca408d
Opcode Fuzzy Hash: a347cb712251c494c0ac76841d0ca458a250c6be9a7c463d0ead6691c264c289
Instruction Fuzzy Hash: 13515D22F286C65AEB258E369E00769B791E745B54F08C2B2CB5CC7AC7DEBDD4448702

Function 00007FF62A99A798 Relevance: 1.9, APIs: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF62A99A8E0

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 773e53d09e5455f04dc57cd524f4ca394a315c5928bf5f5768ba6214c405212f
Instruction ID: 0d5e450368b5e5570eef80885886f02fb981d93eca4cd9312ba2ef77ad38ee11
Opcode Fuzzy Hash: 773e53d09e5455f04dc57cd524f4ca394a315c5928bf5f5768ba6214c405212f
Instruction Fuzzy Hash: 68129F22E18BC28AEB51CF299A542FD73A4FB58748F059235EE9CC6653DF78E181C701

Function 00007FF62A9A5FD4 Relevance: 1.8, APIs: 1, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e22158b38decd8d90c74f2f99d25a665006446744f2e1b5a41cef00b0dd0ad41
Instruction ID: 109a0443f505c14918fc0392921637be315d4fab96d9440bf99fd97da895ab59
Opcode Fuzzy Hash: e22158b38decd8d90c74f2f99d25a665006446744f2e1b5a41cef00b0dd0ad41
Instruction Fuzzy Hash: 9EE16D32E14B8186EB20DB62E9412FA67A5F794B88F408532DF8D97757EFB8D245C301

Function 00007FF62A972E50 Relevance: 1.8, Strings: 1, Instructions: 571COMMON

Download Yara Rule

Strings

[RO] %ld bytes, xrefs: 00007FF62A973450, 00007FF62A9735BB

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID: [RO] %ld bytes
API String ID: 0-772938740
Opcode ID: 4874844c38418d14ede67d35d8ec1f57646d452b183219fb2a06a3d7a21df842
Instruction ID: 6375d429b0358b8a86b4c7413ce7b98f1e169517e9686d6dd18ad6a9645b6911
Opcode Fuzzy Hash: 4874844c38418d14ede67d35d8ec1f57646d452b183219fb2a06a3d7a21df842
Instruction Fuzzy Hash: E542AE736192C5CFC328CF29D84026E7BA0F755B44F4481A9DB8ACBB46DB78E854CB61

Function 00007FF62A9A8088 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62A99ED10: GetLastError.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED1F
Part of subcall function 00007FF62A99ED10: FlsGetValue.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED34
Part of subcall function 00007FF62A99ED10: SetLastError.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99EDBF

Part of subcall function 00007FF62A99ED10: FlsSetValue.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED55

GetLocaleInfoW.KERNEL32 ref: 00007FF62A9A80F0

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ErrorLastValue$InfoLocale
String ID:
API String ID: 673564084-0
Opcode ID: fd4313f3ed39529f0e214070d5eb9b22141959494d17c08f529f82dcba2f0cc7
Instruction ID: 132f32efac9c8227fb05ab1b98672a4beb9e1a2a034105a7c053e14f0737b760
Opcode Fuzzy Hash: fd4313f3ed39529f0e214070d5eb9b22141959494d17c08f529f82dcba2f0cc7
Instruction Fuzzy Hash: 4E318771F2864286EF648B22DC813BA73A2FB44744F448476DA8DC3247DF7CE4518782

Function 00007FF62A9A7CD8 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF62A99ED10: GetLastError.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED1F
Part of subcall function 00007FF62A99ED10: FlsGetValue.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED34
Part of subcall function 00007FF62A99ED10: SetLastError.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99EDBF

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF62A9A84C7,00000000,00000092,?,?,00000000,?,?,00007FF62A99D771), ref: 00007FF62A9A7D76

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 15ac7d5427dd9fc22c9c1f247fbd5354b0666d540418ec543f069a2b87512e20
Instruction ID: 00c22503be5b17bbcc9b9efccf59f36b28375524bde24e190e4e738033254f76
Opcode Fuzzy Hash: 15ac7d5427dd9fc22c9c1f247fbd5354b0666d540418ec543f069a2b87512e20
Instruction Fuzzy Hash: 13110563E28641CAEF148F16D4902B837E2FB40FA0F548136C619C33D2CEA9D5D1C742

Function 00007FF62A9A8290 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62A99ED10: GetLastError.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED1F
Part of subcall function 00007FF62A99ED10: FlsGetValue.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED34
Part of subcall function 00007FF62A99ED10: SetLastError.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99EDBF

GetLocaleInfoW.KERNEL32(?,?,?,00007FF62A9A803A), ref: 00007FF62A9A82C7

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ErrorLast$InfoLocaleValue
String ID:
API String ID: 3796814847-0
Opcode ID: 02c8055d8d650acd3e8a74c68ff88f338c75fb4c0e3c19cf7d436b4e0503b1ee
Instruction ID: 33957af9a15597edf79fb3c1468c00a8541ad08a57faf52212d52026f4571e8e
Opcode Fuzzy Hash: 02c8055d8d650acd3e8a74c68ff88f338c75fb4c0e3c19cf7d436b4e0503b1ee
Instruction Fuzzy Hash: 81112B32F2855383EF648727A84067E2262EB507A4F54C272D66DC36C7EFA9D4818782

Function 00007FF62A9A7DA8 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FF62A99ED10: GetLastError.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED1F
Part of subcall function 00007FF62A99ED10: FlsGetValue.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED34
Part of subcall function 00007FF62A99ED10: SetLastError.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99EDBF

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF62A9A8483,00000000,00000092,?,?,00000000,?,?,00007FF62A99D771), ref: 00007FF62A9A7E26

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 5727eb7e919169bab7f3b731904feba02bf0749f82d0e8f83876c19ff70cc26c
Instruction ID: 8a96526164eefef85b745d899c74a72ae53df0823ea29e2d423ac7359f1cc8b6
Opcode Fuzzy Hash: 5727eb7e919169bab7f3b731904feba02bf0749f82d0e8f83876c19ff70cc26c
Instruction Fuzzy Hash: 7C01F572F1824186EF244B16EC517B972E3EB40BA4F558273D228C72D7CFB998818743

Function 00007FF62A9A0AD8 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF62A9A0F7F,?,?,?,?,?,?,?,?,00000000,00007FF62A9A7328), ref: 00007FF62A9A0B27

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 0f058bcf8847595df1816a53f4d47a97cac47f7a866e7bb19b671d0c18a11263
Instruction ID: f3c6227860f58b66bb6f097cb73ef9b0fac06c44b2d610d493cdadfe75ba7b18
Opcode Fuzzy Hash: 0f058bcf8847595df1816a53f4d47a97cac47f7a866e7bb19b671d0c18a11263
Instruction Fuzzy Hash: 9BF06972F28A4183EB04CB16EC901A92366FB8C780F548076EA4DC37A6CE7CD861C701

Function 00007FF62A99F4BC Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF62A99F7FE

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: 91511e75055787009b36da5e0b5904dd2b35cdbec92fe664924b5d59d9c2ed42
Instruction ID: 6ab23a4b6d530f9f0d99c69f233064c98ec4bcae46b3ce382d38b7413d1a0237
Opcode Fuzzy Hash: 91511e75055787009b36da5e0b5904dd2b35cdbec92fe664924b5d59d9c2ed42
Instruction Fuzzy Hash: 00A13863E287875AEF21CF2AA9007A9BB90AB50784F04C172DE4DC7792DE7DD506C702

Function 00007FF62A99684C Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

, xrefs: 00007FF62A996A2E

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 5fb6afdc90124b9ccfbc1fc7428f51e6266c183c57cc2358b46b47bb293d3794
Instruction ID: 45ee97fd99dc0323c427b441c6c1bddca48e76e73fca4e8040af696b27b37e2a
Opcode Fuzzy Hash: 5fb6afdc90124b9ccfbc1fc7428f51e6266c183c57cc2358b46b47bb293d3794
Instruction Fuzzy Hash: 01B18E72D2868699EB648F2AC95027C3BB0F749B48F2481B5CB4DC7396DFB9D441D702

Function 00007FF62A9A29E4 Relevance: 1.4, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF62A9A2A89

Part of subcall function 00007FF62A9A0A28: HeapAlloc.KERNEL32(?,?,00000000,00007FF62A99EEEA,?,?,0000E12CD978A873,00007FF62A998DA5,?,?,?,?,00007FF62A9A27E6,?,?,00000000), ref: 00007FF62A9A0A7D

Part of subcall function 00007FF62A99E95C: RtlFreeHeap.NTDLL(?,?,?,00007FF62A9A6862,?,?,?,00007FF62A9A6BDF,?,?,00000000,00007FF62A9A7025,?,?,?,00007FF62A9A6F57), ref: 00007FF62A99E972
Part of subcall function 00007FF62A99E95C: GetLastError.KERNEL32(?,?,?,00007FF62A9A6862,?,?,?,00007FF62A9A6BDF,?,?,00000000,00007FF62A9A7025,?,?,?,00007FF62A9A6F57), ref: 00007FF62A99E97C

Part of subcall function 00007FF62A9AA24C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62A9AA27F

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ErrorHeapLast$AllocFree_invalid_parameter_noinfo
String ID:
API String ID: 916656526-0
Opcode ID: 211458dcc4182629a49dfa16bd233c2fd01fa5b79e8a7313d1c8d1c4e015e553
Instruction ID: 74386b225b59651b382ce5ec98d295919cad9fa3ffe92106a0b7973dac77a261
Opcode Fuzzy Hash: 211458dcc4182629a49dfa16bd233c2fd01fa5b79e8a7313d1c8d1c4e015e553
Instruction Fuzzy Hash: D941D522F2924302EF709E176C5167AE682BF9A780F544576EE4DC7B97DEBCE4008603

Function 00007FF62A989330 Relevance: .7, Instructions: 678COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9d3e26cd520c0d7484bca21c75386a0081201fe8f2cf936fcf25e5b7a4aa551
Instruction ID: cf40a703cd7279cc0487c436ce7ea6c85c2654183ee812e5e8fbd3065afe02f1
Opcode Fuzzy Hash: f9d3e26cd520c0d7484bca21c75386a0081201fe8f2cf936fcf25e5b7a4aa551
Instruction Fuzzy Hash: 7D22CEB7F3805047D36DCB1DEC52FA97692B7A5348748A02CBA07C3F45EA3DEA458A44

Function 00007FF62A9879D0 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dbab6f601d912f7832fe87e6cb8010b159b99cec89eaaed4f22644e13967388
Instruction ID: ffdf119c9a0293a45c00c3b57a9dd86a8f551e4baa4d8070b6987094d424164c
Opcode Fuzzy Hash: 2dbab6f601d912f7832fe87e6cb8010b159b99cec89eaaed4f22644e13967388
Instruction Fuzzy Hash: 7BC1EF73B296918BDB19CF26E990569B792FBC4BD0B55C134DA4A87B89DE3CD801CB00

Function 00007FF62A9971DC Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e5dc7f97a53f24eb071f4a4c5281cd4cfcae3ea760a8a1df74637965631acf6
Instruction ID: 1c206b68e20088efffffb06e7b4637287a2a8b6b9edd37fed9d33f8086a35e4b
Opcode Fuzzy Hash: 3e5dc7f97a53f24eb071f4a4c5281cd4cfcae3ea760a8a1df74637965631acf6
Instruction Fuzzy Hash: E0D1FA26E28603DAEF688E2B9A0127D27A1FB05B48F148575CE0DD76D7DFBAD441C342

Function 00007FF62A99D5C0 Relevance: .3, Instructions: 310COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: 21e64ea7c375e93a6d3691ec49e9bdd76ef4fc5f4d0d1dcdba5dc2295bd766ac
Instruction ID: 43180fb56879d43c2092d2bd1a9fd84535b7203c173e83842de9e82747473902
Opcode Fuzzy Hash: 21e64ea7c375e93a6d3691ec49e9bdd76ef4fc5f4d0d1dcdba5dc2295bd766ac
Instruction Fuzzy Hash: 4BC10A65E2878359EF609B6B9E503BA23A0FB94788F408071DE4DC7686EF7CE541C702

Function 00007FF62A9A73EC Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ErrorLast$Value_invalid_parameter_noinfo
String ID:
API String ID: 1500699246-0
Opcode ID: d774b1686d68766547d9d0affe500116b26f703ac014ee2f743871d76f2ddb8c
Instruction ID: 6ef406b3fc5ace870c2c861d90a661acab369fbe50daf81615e33263849e74ed
Opcode Fuzzy Hash: d774b1686d68766547d9d0affe500116b26f703ac014ee2f743871d76f2ddb8c
Instruction Fuzzy Hash: 36B1B822E28646C6EF649F26D9227B93392EB44B88F404172DA4DC36C7DFBDD5418743

Function 00007FF62A9964C8 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf611d711d996cef35472e7504a5935af8ed11963d98eb5a37693ba2286e55b
Instruction ID: 7b6715f583a653f28e14efe355432e273f8a804a72fea8f635557f5efc5794b6
Opcode Fuzzy Hash: 9cf611d711d996cef35472e7504a5935af8ed11963d98eb5a37693ba2286e55b
Instruction Fuzzy Hash: C6B19272D2878699EF648F2AC95017C3BA5E745B48F2881B9CB4DC7396CF79E441C702

Function 00007FF62A99AF20 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c771e48c11f0d915594974b4bba5b1cef921b70c42e7a63ac30c42f7e56c6b99
Instruction ID: 65f0c7109910f87776dcaa56529af25322a57b5eca4415dcfed1db03ca37812c
Opcode Fuzzy Hash: c771e48c11f0d915594974b4bba5b1cef921b70c42e7a63ac30c42f7e56c6b99
Instruction Fuzzy Hash: 5381B372E24A1299EF648E66C9813BD23A0FB84B98F108676EF1DC7796CF7CD4418301

Function 00007FF62A99FFD0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c06df77d5c41abf0c9103d11d2ff5cfa312f76e721c7628385afe64dabe37a34
Instruction ID: 4970398686d1b0ead3cb75e75c0bc4f125944005c1f3cf3515af59c82cf9d339
Opcode Fuzzy Hash: c06df77d5c41abf0c9103d11d2ff5cfa312f76e721c7628385afe64dabe37a34
Instruction Fuzzy Hash: 7181E872E1C78145EFB4CF1A988037A6692FB49794F144276DA8EC7B87CE7DD4408B02

Function 00007FF62A982FA0 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6f6a1a1a1cf9baf0de81f1e4df80e775a01d7d2970379cd065fadcfc056c7f6
Instruction ID: c2926b86fbdfcde4283f2acfe03d49d5b8d634ac284b51bd985de14b587ec768
Opcode Fuzzy Hash: f6f6a1a1a1cf9baf0de81f1e4df80e775a01d7d2970379cd065fadcfc056c7f6
Instruction Fuzzy Hash: 5861F862F28B8986DF208F1AE8415AAA360FB597C0F545271DB9DC7B55EFBDE180C300

Function 00007FF62A995A1C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction ID: 5084b8e836f3d2b69dd33187f70606bcb3c71ebafab4b6a1c8140cdda4ae4d90
Opcode Fuzzy Hash: 8e69dfdcc94a0aa650623f7423aa354004c1f2fa01d5c1268249020d4c21f447
Instruction Fuzzy Hash: AD51B836E256539AEF248B2AC55027A33A0EB44B58F24C171CE4DC7796CF7AE847C741

Function 00007FF62A9951FC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction ID: 17246dcd771ade6d547b8d0d80784ceddb1e2cc0715a2c40cb5e8f9edd40cf8f
Opcode Fuzzy Hash: 68a3f5aab59b2fac328bd6ba34d5b1cd1fa94c6914f84dc4a79da3b9d8ff9a98
Instruction Fuzzy Hash: A351A832E24652DAEF248B2AC55022D37A4EB45B58F24C171CE4DC77A5CFBAE847C741

Function 00007FF62A99560C Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction ID: 20c2b0929fe409e826e82b382a9b575e6a0fb8e5aaddaeec143c4ae0db3d495e
Opcode Fuzzy Hash: 27099d1c67046ba5536a5c52bb1b19252402c8bb4a5167aa336477e7b6d5f807
Instruction Fuzzy Hash: BE51AA76E246529AEF248B2AC64023A33A0EB44B58F24C171CE4DD7796CF7AED47C741

Function 00007FF62A995408 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6a3dccb135ddd09f63c505db29ff29986bf9dd63497299e7c799fac6b959aa4
Instruction ID: 1f257a88c31bfc58f29f1988844240fd092e7086cbdc3e50c732ca5e63250bd5
Opcode Fuzzy Hash: f6a3dccb135ddd09f63c505db29ff29986bf9dd63497299e7c799fac6b959aa4
Instruction Fuzzy Hash: 0051D936E346529AFB648B2EC64023A37A1EB44B58F248071CE4DC7796CF7AE846C741

Function 00007FF62A995818 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e46230d8c0bb23a9b26f12389beaf27d8e9063d4bba2e4d98de2a57eaa924be5
Instruction ID: bb795220460ac88c425f9b750268109ed4a63321445bdd69ab696e1c4751c679
Opcode Fuzzy Hash: e46230d8c0bb23a9b26f12389beaf27d8e9063d4bba2e4d98de2a57eaa924be5
Instruction Fuzzy Hash: 2451B972E286529AEF248B1BC54033937A0EB48B58F648171CE4DC7796CF7AE846C742

Function 00007FF62A994FF8 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db363646d287334b7a31293e9082935613ba5dde14aee32d187fc7345eaa1eeb
Instruction ID: faf166883ee76239bff137ecff7aa6f6c975546d07f604299256c56ed968612b
Opcode Fuzzy Hash: db363646d287334b7a31293e9082935613ba5dde14aee32d187fc7345eaa1eeb
Instruction Fuzzy Hash: BA519A36E246529AEB248F1AD94023937A0EB44B58F24C171CE4DC77A5DF7AEC46C781

Function 00007FF62A99C7BC Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 992bdeb28752ac81bb160f4e9466717d9b532df2d17ea574ae2dd87a94b6b211
Instruction ID: 2efcc57cf03576dc340115272d72717f449b7ec6eeef82431674f0d26887a937
Opcode Fuzzy Hash: 992bdeb28752ac81bb160f4e9466717d9b532df2d17ea574ae2dd87a94b6b211
Instruction Fuzzy Hash: C141C362B24A5695EF44CF2BDE2416963A2B74CFC0B499032DE0DD7B59DF7CD4428341

Function 00007FF62A9ACB60 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6db13767cb4ef8546692f7daaddc1c348767b8ea185383b737debd21f48b2f6e
Instruction ID: 996170c9feb5687e3c6c22ed7f125143a6a411ab95ea468166ddb5deb048c0e2
Opcode Fuzzy Hash: 6db13767cb4ef8546692f7daaddc1c348767b8ea185383b737debd21f48b2f6e
Instruction Fuzzy Hash: FBF06872F286958EDF948F29A802A2977D9F70C380F908479D58DC3B55DA7C9550CF05

Function 00007FF62A98E814 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9500c7797480eaac07bce270d35ebf5893055aa53205c196292c9b063e5a007a
Instruction ID: e534c8634a1e2abb2da3ab756b6e91cda7b1e98aa30a8d9c4b6431f3f94bb8b5
Opcode Fuzzy Hash: 9500c7797480eaac07bce270d35ebf5893055aa53205c196292c9b063e5a007a
Instruction Fuzzy Hash: 6AA00122D2894298EB088B02AD6023423A5AB94780F4900B2C00DC60629EADA5408653

Function 00007FF62A974C50 Relevance: 33.2, APIs: 22, Instructions: 199windowthreadnetworkCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF62A974C65
SwitchToThread.KERNEL32 ref: 00007FF62A974C9D
SetLastError.KERNEL32 ref: 00007FF62A974CDC
SetEvent.KERNEL32 ref: 00007FF62A974D17
MsgWaitForMultipleObjects.USER32 ref: 00007FF62A974D4B
PeekMessageW.USER32 ref: 00007FF62A974D66
TranslateMessage.USER32 ref: 00007FF62A974D75
DispatchMessageW.USER32 ref: 00007FF62A974D80
PeekMessageW.USER32 ref: 00007FF62A974D97
CloseHandle.KERNEL32 ref: 00007FF62A974DC4
send.WS2_32 ref: 00007FF62A974E01
SetEvent.KERNEL32 ref: 00007FF62A974E18
WSACloseEvent.WS2_32 ref: 00007FF62A974E2D
shutdown.WS2_32 ref: 00007FF62A974E49
closesocket.WS2_32 ref: 00007FF62A974E53
EnterCriticalSection.KERNEL32 ref: 00007FF62A974E70
ResetEvent.KERNEL32 ref: 00007FF62A974E7D
ResetEvent.KERNEL32 ref: 00007FF62A974E8A
ResetEvent.KERNEL32 ref: 00007FF62A974E97
SetEvent.KERNEL32 ref: 00007FF62A974F2C
LeaveCriticalSection.KERNEL32 ref: 00007FF62A974F39
SetLastError.KERNEL32 ref: 00007FF62A974F79

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Event$Message$Reset$CloseCriticalErrorLastPeekSectionThread$CurrentDispatchEnterHandleLeaveMultipleObjectsSwitchTranslateWaitclosesocketsendshutdown
String ID:
API String ID: 4058177064-0
Opcode ID: d4a00dac0fba48dd619eb6ba1b780ae101c1c81bf132304460c16c28b79e9ffb
Instruction ID: 6043b2e0073ba6da5e0374e35d72939bafb3a177759d1f537747c2ba8adab764
Opcode Fuzzy Hash: d4a00dac0fba48dd619eb6ba1b780ae101c1c81bf132304460c16c28b79e9ffb
Instruction Fuzzy Hash: CF918D72F28A8297EB589B26DD443A873A1FB85750F004176CB5DC76A3CF78E464C712

Function 00007FF62A980620 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 140stringprocessCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF62A980698
lstrlenW.KERNEL32 ref: 00007FF62A9806BA
wsprintfW.USER32 ref: 00007FF62A980722
ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF62A980786
lstrcatW.KERNEL32 ref: 00007FF62A9807C1
lstrcatW.KERNEL32 ref: 00007FF62A9807CE
lstrcpyW.KERNEL32 ref: 00007FF62A9807DC
CreateProcessW.KERNEL32 ref: 00007FF62A98085B

Strings

%s\shell\open\command, xrefs: 00007FF62A980714
WinSta0\Default, xrefs: 00007FF62A980813
h, xrefs: 00007FF62A9807E5
"%1, xrefs: 00007FF62A98078C

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: lstrcatlstrlen$CreateEnvironmentExpandProcessStringslstrcpywsprintf
String ID: "%1$%s\shell\open\command$WinSta0\Default$h
API String ID: 1783372451-551013563
Opcode ID: eac3ac33eed5e84588de99090fdd2237e456d1a0e0148cdd7090aa018ec508cf
Instruction ID: f5f1f59112c88e870daa6c5b8abd8e3370ccf0796dc25b72b2d6faa4024d29cd
Opcode Fuzzy Hash: eac3ac33eed5e84588de99090fdd2237e456d1a0e0148cdd7090aa018ec508cf
Instruction Fuzzy Hash: E9616532F28B4299FF10DB62DC402E92361FB84788F444276DA4DD6A9AEFBCD544C742

Function 00007FF62A974270 Relevance: 21.1, APIs: 14, Instructions: 119networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF62A97429F
WSAIoctl.WS2_32 ref: 00007FF62A9742F8
setsockopt.WS2_32 ref: 00007FF62A97431D
setsockopt.WS2_32 ref: 00007FF62A974342
WSACreateEvent.WS2_32 ref: 00007FF62A974348
lstrlenW.KERNEL32 ref: 00007FF62A974355
WideCharToMultiByte.KERNEL32 ref: 00007FF62A974378
lstrlenW.KERNEL32 ref: 00007FF62A974390
WideCharToMultiByte.KERNEL32 ref: 00007FF62A9743B3
gethostbyname.WS2_32 ref: 00007FF62A9743C0
htons.WS2_32 ref: 00007FF62A9743ED
WSAEventSelect.WS2_32 ref: 00007FF62A974413
connect.WS2_32 ref: 00007FF62A97442D
WSAGetLastError.WS2_32 ref: 00007FF62A97443C

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ByteCharEventMultiWidelstrlensetsockopt$CreateErrorIoctlLastSelectconnectgethostbynamehtonssocket
String ID:
API String ID: 1455939504-0
Opcode ID: 61f0279631f3a53486a16f72dab1f30556c86eabdf22f7d843a4b3cae8b7c8b3
Instruction ID: c97ccdb7f199fff100cd730c9947d1133bf29c2377d4bd98b0be592dfe45de57
Opcode Fuzzy Hash: 61f0279631f3a53486a16f72dab1f30556c86eabdf22f7d843a4b3cae8b7c8b3
Instruction Fuzzy Hash: 9A518772E18B9186DB208F26EC4436977A1FB85B94F100236EA9EC7B96CF7DD445C701

Function 00007FF62A9815A0 Relevance: 18.2, APIs: 12, Instructions: 153COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF62A9815B9
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF62A9815DE
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF62A981608
std::_Facet_Register.LIBCPMT ref: 00007FF62A981688
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF62A9816A2
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF62A9816B2
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF62A9816D7
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF62A981701
std::_Facet_Register.LIBCPMT ref: 00007FF62A981777
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF62A981791
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62A9817AA
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62A9817B0

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: abf8e540b54f698cc9b45021eb612f4fee3d5b077170ba2ec9f9a82e9aa791c4
Instruction ID: fc2a03265deb738e081823a134fa4eb53b5612bb95347427270593a35d47aa07
Opcode Fuzzy Hash: abf8e540b54f698cc9b45021eb612f4fee3d5b077170ba2ec9f9a82e9aa791c4
Instruction Fuzzy Hash: C3516F22E28B4289EF119B17EC441B973A1EF54BD0F1801B2DA5DC76A6DFACE446C702

Function 00007FF62A9746A0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 171networktimeCOMMON

Download Yara Rule

APIs

WSAEnumNetworkEvents.WS2_32 ref: 00007FF62A9746C7
WSAGetLastError.WS2_32 ref: 00007FF62A9746D8
WSAResetEvent.WS2_32 ref: 00007FF62A974717
WSAEventSelect.WS2_32 ref: 00007FF62A97479C
WSAGetLastError.WS2_32 ref: 00007FF62A9747A7
timeGetTime.WINMM ref: 00007FF62A9747D2
timeGetTime.WINMM ref: 00007FF62A97481D
send.WS2_32 ref: 00007FF62A974852
WSAGetLastError.WS2_32 ref: 00007FF62A97485D

Strings

, xrefs: 00007FF62A9748F8

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ErrorLast$EventTimetime$EnumEventsNetworkResetSelectsend
String ID:
API String ID: 957247320-3916222277
Opcode ID: 2310baa555e0df77a8bcfccd4f7fd94b27c56680d13eb448f7d2580fe2531f2f
Instruction ID: a9e2880c00cf723cf69ad302ce93238d14e440a88b286ea45955ed25c534e7a5
Opcode Fuzzy Hash: 2310baa555e0df77a8bcfccd4f7fd94b27c56680d13eb448f7d2580fe2531f2f
Instruction Fuzzy Hash: D87170B2E186818BEB508F2ADC8436977E0FB85B48F144075CB49CB693CFBDE4458B11

Function 00007FF62A975A80 Relevance: 16.7, APIs: 11, Instructions: 154networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF62A975AC4
WSASetLastError.WS2_32 ref: 00007FF62A975C69
LeaveCriticalSection.KERNEL32 ref: 00007FF62A975C73

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: cb0b3ee4ce24505bbac61aa70540e6acda4bbb341cea077ae408a959c4223429
Instruction ID: 9ceec6f02b6c164e117413d930ee0845ac4f47cf317dd21eeb5a416c51f68684
Opcode Fuzzy Hash: cb0b3ee4ce24505bbac61aa70540e6acda4bbb341cea077ae408a959c4223429
Instruction Fuzzy Hash: 6B61AD72F2864282EB989B16DD4877973A5FB84B80F848072CA1DCB696DF7CE444C712

Function 00007FF62A975090 Relevance: 16.6, APIs: 11, Instructions: 87COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF62A9750F5
LeaveCriticalSection.KERNEL32 ref: 00007FF62A975107
SetLastError.KERNEL32 ref: 00007FF62A9751DB

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: 31685a7c47cc355b0b84d769594d8f48275261b6e3cd822618b6b5c873848fb6
Instruction ID: 6c9f1d6639cd6cea3242960dc54e24a86daff813660f5322173b1335997bf440
Opcode Fuzzy Hash: 31685a7c47cc355b0b84d769594d8f48275261b6e3cd822618b6b5c873848fb6
Instruction Fuzzy Hash: B9315161F2864286EF989B179CC82792295FF45B85F5440B6DA0FCA693CFACE445C313

Function 00007FF62A980B40 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 52registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF62A980B91
RegDeleteValueW.ADVAPI32 ref: 00007FF62A980B9F
RegCloseKey.ADVAPI32 ref: 00007FF62A980BAA
RegCreateKeyW.ADVAPI32 ref: 00007FF62A980BCA
lstrlenW.KERNEL32 ref: 00007FF62A980BD7
RegSetValueExW.ADVAPI32 ref: 00007FF62A980BF9
RegCloseKey.ADVAPI32 ref: 00007FF62A980C04

Strings

VenNetwork, xrefs: 00007FF62A980B69
Software, xrefs: 00007FF62A980B73

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CloseValue$CreateDeleteOpenlstrlen
String ID: Software$VenNetwork
API String ID: 3197061591-1820303132
Opcode ID: b270a5905e67aa2bd04960c5a5af98d5e64a07028cd1629e036b508084a2e799
Instruction ID: dfbc7a572a3d0e53ff7679dae57dce9aa0d4fc32ffcd7b823955871c4590cb17
Opcode Fuzzy Hash: b270a5905e67aa2bd04960c5a5af98d5e64a07028cd1629e036b508084a2e799
Instruction Fuzzy Hash: F0215E26B18A5086EB108F26EC4435AB361FB84BA5F444132DE4DC3B6ACFBCD549CB05

Function 00007FF62A975FC0 Relevance: 15.1, APIs: 10, Instructions: 140COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF62A975FE4
EnterCriticalSection.KERNEL32 ref: 00007FF62A976004
SetLastError.KERNEL32 ref: 00007FF62A976016
LeaveCriticalSection.KERNEL32 ref: 00007FF62A97606F

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CriticalErrorLastSection$EnterLeave
String ID:
API String ID: 2124651672-0
Opcode ID: 697fcd161a9195263e262f51415204b7d3309df62e750fca3656faa330f8ca80
Instruction ID: af599ddca11a09022a61f48db5486cf4e2539c767b299642564c78cecc2667a2
Opcode Fuzzy Hash: 697fcd161a9195263e262f51415204b7d3309df62e750fca3656faa330f8ca80
Instruction Fuzzy Hash: BB51CE72E286418BEB649B16EC8467C77A5FB48B80F05417ADB0ECB353CF68E804C752

Function 00007FF62A994880 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62A9948C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62A994C88
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62A994F27

Strings

p, xrefs: 00007FF62A9949CA
f, xrefs: 00007FF62A9949C2
p, xrefs: 00007FF62A994965
f, xrefs: 00007FF62A994958
f, xrefs: 00007FF62A994B0D

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 338c2a64cdc3021812c5b6ddca5db7159329e9a17ba8d876efc02d9e71b2fbd5
Instruction ID: 4b9784c1fdc81b050406d4932deb6f4ac99e9753a5801ecb4759aaf986c3f976
Opcode Fuzzy Hash: 338c2a64cdc3021812c5b6ddca5db7159329e9a17ba8d876efc02d9e71b2fbd5
Instruction Fuzzy Hash: B112A432E2C143AEFF255E16EA442B97291FBC1750F84C171E689C66C6DFBCE5808B16

Function 00007FF62A974080 Relevance: 13.6, APIs: 9, Instructions: 111timenetworkCOMMON

Download Yara Rule

APIs

CreateWaitableTimerW.KERNEL32 ref: 00007FF62A9740C6
setsockopt.WS2_32 ref: 00007FF62A974165
setsockopt.WS2_32 ref: 00007FF62A97418F
ResetEvent.KERNEL32 ref: 00007FF62A9741DE
SetLastError.KERNEL32 ref: 00007FF62A97420A
WSAGetLastError.WS2_32 ref: 00007FF62A974216
SetLastError.KERNEL32 ref: 00007FF62A974228
GetLastError.KERNEL32 ref: 00007FF62A974241
SetLastError.KERNEL32 ref: 00007FF62A974253

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ErrorLast$setsockopt$CreateEventResetTimerWaitable
String ID:
API String ID: 2911610646-0
Opcode ID: 99686810c63a1bb6028a6172a43c66bfba7a4414762a6ea3ad2715b880425662
Instruction ID: 17f4d9ad975016168cc875c324e1361d3f697dcfe493ccb47355543ad8c18a6f
Opcode Fuzzy Hash: 99686810c63a1bb6028a6172a43c66bfba7a4414762a6ea3ad2715b880425662
Instruction Fuzzy Hash: A8518A72E14A8287EB148F2AED0436973A1FB89744F104076DB4CC7B92DFBDE4658B12

Function 00007FF62A975D10 Relevance: 13.6, APIs: 9, Instructions: 93timenetworkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,-00000004,00007FF62A9749B9), ref: 00007FF62A975D5E
timeGetTime.WINMM(?,?,-00000004,00007FF62A9749B9), ref: 00007FF62A975D95
LeaveCriticalSection.KERNEL32(?,?,-00000004,00007FF62A9749B9), ref: 00007FF62A975DB5
timeGetTime.WINMM(?,?,-00000004,00007FF62A9749B9), ref: 00007FF62A975DFA
SetEvent.KERNEL32 ref: 00007FF62A975E27
LeaveCriticalSection.KERNEL32 ref: 00007FF62A975E3B
WSASetLastError.WS2_32(?,?,-00000004,00007FF62A9749B9), ref: 00007FF62A975E52
LeaveCriticalSection.KERNEL32(?,?,-00000004,00007FF62A9749B9), ref: 00007FF62A975E61
WSASetLastError.WS2_32(?,?,-00000004,00007FF62A9749B9), ref: 00007FF62A975E73

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CriticalSection$Leave$ErrorLastTimetime$EnterEvent
String ID:
API String ID: 3019579578-0
Opcode ID: 4019db875c6352495a6e2a967cb07e89537093c69e3cddfa206385f108ce449b
Instruction ID: c8558a3a005b1dd338153fad1402a2eb0d6d140ed242ecee4a81a8b8b8f57f92
Opcode Fuzzy Hash: 4019db875c6352495a6e2a967cb07e89537093c69e3cddfa206385f108ce449b
Instruction Fuzzy Hash: B5416E72D286428BEBA08B16DC4423E73A2FB84754F544176D64EC7A92DFBCF881C712

Function 00007FF62A975E90 Relevance: 13.6, APIs: 9, Instructions: 77COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF62A975EAA
TryEnterCriticalSection.KERNEL32 ref: 00007FF62A975ECB
TryEnterCriticalSection.KERNEL32 ref: 00007FF62A975EDD
SetLastError.KERNEL32 ref: 00007FF62A975EF6
LeaveCriticalSection.KERNEL32 ref: 00007FF62A975F00
LeaveCriticalSection.KERNEL32 ref: 00007FF62A975F0A

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeave
String ID:
API String ID: 4082018349-0
Opcode ID: bf041e3c240114bd2df664f35279ad8215a3420238d0dd4b213a5f2d55893e77
Instruction ID: d7d4c02a483c492c0ad0ab4acb425d6d0c63f0cda54e01ef969272d6f5eeb0d0
Opcode Fuzzy Hash: bf041e3c240114bd2df664f35279ad8215a3420238d0dd4b213a5f2d55893e77
Instruction Fuzzy Hash: AF315D72E28952CAEB909F26DC4827C37A5FF44748F444072DA0ECA656DFBCE849C712

Function 00007FF62A990EA8 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF62A990F05

Part of subcall function 00007FF62A993268: __GetUnwindTryBlock.LIBCMT ref: 00007FF62A9932AB
Part of subcall function 00007FF62A993268: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF62A9932D0

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF62A990FDD
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF62A99122B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF62A991338

Strings

csm, xrefs: 00007FF62A991000
csm, xrefs: 00007FF62A990F86
csm, xrefs: 00007FF62A990F1F

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: cb5b3d42660800b6706ee9e5169d6ae77bc1ec10b54460efee445a81ffa0bcf3
Instruction ID: 71f4f92ba0ed1168a7a6098fce6d6fe0910dbe4a062f224b2c9d54acef8ffa74
Opcode Fuzzy Hash: cb5b3d42660800b6706ee9e5169d6ae77bc1ec10b54460efee445a81ffa0bcf3
Instruction Fuzzy Hash: 4BD1B132E287429AEF60DB6699403AD37A4FB45788F108175EE4DD7B56DF78E084C702

Function 00007FF62A9A0B54 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FF62A9A0CD0
GetProcAddress.KERNEL32 ref: 00007FF62A9A0CDC

Strings

api-ms-, xrefs: 00007FF62A9A0C1A
ext-ms-, xrefs: 00007FF62A9A0C2D

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: c5e8058506f29389ada01458bdd8bed04f407a28a220f5367f3ecbd3c22801fb
Instruction ID: cc3eedac1f48017e08c5f8b6fea0a65e1a93896ab6d55db85529664919541f98
Opcode Fuzzy Hash: c5e8058506f29389ada01458bdd8bed04f407a28a220f5367f3ecbd3c22801fb
Instruction Fuzzy Hash: 2F41B162F39A0241EF15CB17AD0427A22A2BF49BA0F085577DD0DDB797EEBCE4458302

Function 00007FF62A97E01F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 94filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF62A97E0E9
WriteFile.KERNEL32 ref: 00007FF62A97E119
CloseHandle.KERNEL32 ref: 00007FF62A97E12A
lstrlenW.KERNEL32 ref: 00007FF62A97E135
wsprintfW.USER32 ref: 00007FF62A97E159
lstrcpyW.KERNEL32 ref: 00007FF62A97E168

Part of subcall function 00007FF62A980620: lstrlenW.KERNEL32 ref: 00007FF62A980698
Part of subcall function 00007FF62A980620: wsprintfW.USER32 ref: 00007FF62A980722
Part of subcall function 00007FF62A980620: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF62A980786
Part of subcall function 00007FF62A980620: lstrcatW.KERNEL32 ref: 00007FF62A9807C1
Part of subcall function 00007FF62A980620: lstrcatW.KERNEL32 ref: 00007FF62A9807CE

Strings

%s %s, xrefs: 00007FF62A97E152

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Filelstrcatlstrlenwsprintf$CloseCreateEnvironmentExpandHandleStringsWritelstrcpy
String ID: %s %s
API String ID: 958574092-2939940506
Opcode ID: 9d4b93ecebe44ad3dcfc41bef5c72ffa3e96dd61b2b13565d963145b1ed2cd72
Instruction ID: eee52d7d7006087554c364e5d2ef3804fb3db5f36e9e5e4879cda34d7db62766
Opcode Fuzzy Hash: 9d4b93ecebe44ad3dcfc41bef5c72ffa3e96dd61b2b13565d963145b1ed2cd72
Instruction Fuzzy Hash: FA415E22E28BC681EB118F29D9043FC2320F794B48F11A326DB4C96653EF79E2C5C701

Function 00007FF62A974A90 Relevance: 12.1, APIs: 8, Instructions: 104networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF62A974AD0
LeaveCriticalSection.KERNEL32 ref: 00007FF62A974B20
send.WS2_32 ref: 00007FF62A974B49
EnterCriticalSection.KERNEL32 ref: 00007FF62A974B58
LeaveCriticalSection.KERNEL32 ref: 00007FF62A974B6F
WSAGetLastError.WS2_32 ref: 00007FF62A974BA9
EnterCriticalSection.KERNEL32 ref: 00007FF62A974BB9
LeaveCriticalSection.KERNEL32 ref: 00007FF62A974BFB

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ErrorLastsend
String ID:
API String ID: 3480985631-0
Opcode ID: 223d6e403172c637e9da5f06492e840e62a0238e832c6a19f43c9c4cbc36de86
Instruction ID: 4ec6c98c1c95d47aa4ac435b94531567923f935b087a9e4765462c413673c9a6
Opcode Fuzzy Hash: 223d6e403172c637e9da5f06492e840e62a0238e832c6a19f43c9c4cbc36de86
Instruction Fuzzy Hash: 01418D32E18B8182EB548F26ED442AC73A5FB44B88F140172CE1DCBB5ACFB8E555C712

Function 00007FF62A999720 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62A999763
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62A999B50
_invalid_parameter_noinfo.LIBCMT ref: 00007FF62A999DEC

Strings

p, xrefs: 00007FF62A999815
p, xrefs: 00007FF62A99988D
f, xrefs: 00007FF62A999885

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 42fb3e65d0f17d18353857ebdda260012259b146ac6ef5ada1715a4ca3ec7708
Instruction ID: b134343ea0bcce2fad03207905c62ac08ab92f2c5e2775ca34d56865767c3793
Opcode Fuzzy Hash: 42fb3e65d0f17d18353857ebdda260012259b146ac6ef5ada1715a4ca3ec7708
Instruction Fuzzy Hash: 5912C661E2C143AEFF245A16DA443B97696FB40750F84C075E68DC7AE6DFBCE4808B02

Function 00007FF62A974470 Relevance: 10.6, APIs: 7, Instructions: 143threadnetworktimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF62A97448E
SetWaitableTimer.KERNEL32 ref: 00007FF62A9744C3
WSAWaitForMultipleEvents.WS2_32 ref: 00007FF62A97456D
GetCurrentThreadId.KERNEL32 ref: 00007FF62A974676

Part of subcall function 00007FF62A974A90: EnterCriticalSection.KERNEL32 ref: 00007FF62A974AD0
Part of subcall function 00007FF62A974A90: LeaveCriticalSection.KERNEL32 ref: 00007FF62A974B20
Part of subcall function 00007FF62A974A90: send.WS2_32 ref: 00007FF62A974B49
Part of subcall function 00007FF62A974A90: EnterCriticalSection.KERNEL32 ref: 00007FF62A974B58
Part of subcall function 00007FF62A974A90: LeaveCriticalSection.KERNEL32 ref: 00007FF62A974B6F
Part of subcall function 00007FF62A974A90: WSAGetLastError.WS2_32 ref: 00007FF62A974BA9
Part of subcall function 00007FF62A974A90: EnterCriticalSection.KERNEL32 ref: 00007FF62A974BB9
Part of subcall function 00007FF62A974A90: LeaveCriticalSection.KERNEL32 ref: 00007FF62A974BFB

SetLastError.KERNEL32 ref: 00007FF62A974616

Part of subcall function 00007FF62A975FC0: SetLastError.KERNEL32 ref: 00007FF62A975FE4

GetLastError.KERNEL32 ref: 00007FF62A97461C
WSAGetLastError.WS2_32 ref: 00007FF62A974641

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CriticalSection$ErrorLast$EnterLeave$CurrentThread$EventsMultipleTimerWaitWaitablesend
String ID:
API String ID: 2807917265-0
Opcode ID: b86a4d89a2a610e9370193a82eb041067802b0227bafa79ad6b9f02f0420e125
Instruction ID: fd2e57ece3404e4a90d1e95153758343fc2382ed4a276db17e9a142324d3a9b7
Opcode Fuzzy Hash: b86a4d89a2a610e9370193a82eb041067802b0227bafa79ad6b9f02f0420e125
Instruction Fuzzy Hash: C751A3B6E2864286EF608F269C4467D2395FB86B58F144271DE1DCB397DF78E4408722

Function 00007FF62A97B9E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF62A97BA4B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF62A97BA93
_Getctype.LIBCPMT ref: 00007FF62A97BAAB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF62A97BB63
_Getwctype.LIBCPMT ref: 00007FF62A97BBB1

Strings

bad locale name, xrefs: 00007FF62A97BB86

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: std::_$Lockit$GetctypeGetwctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1386471777-1405518554
Opcode ID: 69cc4a8b7b19662485723bada806c81d00e2c443d81482d7207a293efd463004
Instruction ID: 03e6b83d5d5d83cd7fa297c460aadbe167619d4cb06eb5df61c4ee99dd91b4a0
Opcode Fuzzy Hash: 69cc4a8b7b19662485723bada806c81d00e2c443d81482d7207a293efd463004
Instruction Fuzzy Hash: C3518922F29B419AFF15DFB2D8502BC2360EF44748F044178DF4EAAA9ADF78E5568311

Function 00007FF62A981E10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF62A981E80
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF62A981EC8
_Getcoll.LIBCPMT ref: 00007FF62A981EE0
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF62A981F6F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A981FC9

Strings

bad locale name, xrefs: 00007FF62A981FCF

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: std::_$Lockit$GetcollLocinfo::_Locinfo_ctorLockit::_Lockit::~__invalid_parameter_noinfo_noreturn
String ID: bad locale name
API String ID: 3908275632-1405518554
Opcode ID: 547efca0749532fe16a4a51e07bad1bbee508b3b10b870f5b11536083eee9189
Instruction ID: dc7495b142064813a7b5acbb0e06e837dd7989e1face7942bb6f9ba1ad615c54
Opcode Fuzzy Hash: 547efca0749532fe16a4a51e07bad1bbee508b3b10b870f5b11536083eee9189
Instruction Fuzzy Hash: CA514922F19B519DFF10DFA2D8502BC2361EF44788F1441B5DA0DE7A9ACFB895469302

Function 00007FF62A9937CC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF62A993A7E,?,?,?,00007FF62A993770,?,?,?,00007FF62A9903A9), ref: 00007FF62A993851
GetLastError.KERNEL32(?,?,?,00007FF62A993A7E,?,?,?,00007FF62A993770,?,?,?,00007FF62A9903A9), ref: 00007FF62A99385F
LoadLibraryExW.KERNEL32(?,?,?,00007FF62A993A7E,?,?,?,00007FF62A993770,?,?,?,00007FF62A9903A9), ref: 00007FF62A993889
FreeLibrary.KERNEL32(?,?,?,00007FF62A993A7E,?,?,?,00007FF62A993770,?,?,?,00007FF62A9903A9), ref: 00007FF62A9938F7
GetProcAddress.KERNEL32(?,?,?,00007FF62A993A7E,?,?,?,00007FF62A993770,?,?,?,00007FF62A9903A9), ref: 00007FF62A993903

Strings

api-ms-, xrefs: 00007FF62A993871

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: bdcdafd802d049a58c0b09305f9ac5b25268f61174ed16779f6a01e1bd42f6da
Instruction ID: 9c312384fd3350cb396ae91d2ea7cfda5a6030adb30a5445be2dcf31f1fd4939
Opcode Fuzzy Hash: bdcdafd802d049a58c0b09305f9ac5b25268f61174ed16779f6a01e1bd42f6da
Instruction Fuzzy Hash: 80318025E2AA42A5EF519F039D001762394BF44BA0F1985BADD1DCB782EEBCE4458343

Function 00007FF62A980C20 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 82processstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 00007FF62A980C30
GetFileAttributesW.KERNEL32 ref: 00007FF62A980CBD
GetLastError.KERNEL32 ref: 00007FF62A980CCC
CreateProcessW.KERNEL32 ref: 00007FF62A980D59

Strings

h, xrefs: 00007FF62A980D39
WinSta0\Default, xrefs: 00007FF62A980CEB

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: AttributesCreateErrorFileLastProcesslstrlen
String ID: WinSta0\Default$h
API String ID: 591566999-1620045033
Opcode ID: e32d291d3ae18add421cd5930f97da2bf0bdaa83747d8569411df8fdcf1cf2f1
Instruction ID: 85ee2e93b7b2840548cf42b4aa2073a047721f15c3f32fd20e8b27492870b370
Opcode Fuzzy Hash: e32d291d3ae18add421cd5930f97da2bf0bdaa83747d8569411df8fdcf1cf2f1
Instruction Fuzzy Hash: 9E318522E187C246EB708B16B9043BE6391FB95790F004375EA9DC7B9AEF7CD0948701

Function 00007FF62A99ED10 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED1F
FlsGetValue.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED34
FlsSetValue.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED55
FlsSetValue.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED82
FlsSetValue.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99ED93
FlsSetValue.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99EDA4
SetLastError.KERNEL32(?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F,?,?,?,00007FF62A9966E3), ref: 00007FF62A99EDBF

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: f2de6421f07b29a90cfdc6310c4a09f0568ac7a9393794dea83b72160e9ddcb3
Instruction ID: 888059e937f506586af0d8f7018dca00fb94f255317ce76353ffdc1a1855febb
Opcode Fuzzy Hash: f2de6421f07b29a90cfdc6310c4a09f0568ac7a9393794dea83b72160e9ddcb3
Instruction Fuzzy Hash: 00216A20E2960356FF94A3235F4513912865F88BA0F1486B5E93EC66D7DEACB4014A03

Function 00007FF62A9ACF20 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF62A9ACF51
GetLastError.KERNEL32 ref: 00007FF62A9ACF5D
CloseHandle.KERNEL32 ref: 00007FF62A9ACF75
CreateFileW.KERNEL32 ref: 00007FF62A9ACFA0
WriteConsoleW.KERNEL32 ref: 00007FF62A9ACFBF

Strings

CONOUT$, xrefs: 00007FF62A9ACF81

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 459cac5f161fe15dedf5efeb1a5c45af724dbddd491f92cbd2d9a7ab51bbc5e3
Instruction ID: b101e70ef9821bb9abbd7132754901c1df5b79426eca7d7f25812574f23451de
Opcode Fuzzy Hash: 459cac5f161fe15dedf5efeb1a5c45af724dbddd491f92cbd2d9a7ab51bbc5e3
Instruction Fuzzy Hash: 67118422F28A4186EB508B57EC5432966A1FB48BE5F004276E95DC7796CFBCD4148742

Function 00007FF62A97ACF0 Relevance: 10.5, APIs: 7, Instructions: 40filesynchronizationstringCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF62A97AD09
CreateFileW.KERNEL32 ref: 00007FF62A97AD3D
SetFilePointer.KERNEL32 ref: 00007FF62A97AD62
lstrlenW.KERNEL32 ref: 00007FF62A97AD6B
WriteFile.KERNEL32 ref: 00007FF62A97AD89
CloseHandle.KERNEL32 ref: 00007FF62A97AD92
ReleaseMutex.KERNEL32 ref: 00007FF62A97AD9F

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: File$CloseCreateHandleMutexObjectPointerReleaseSingleWaitWritelstrlen
String ID:
API String ID: 4202892810-0
Opcode ID: 1770146ed1a2281a067c6a80d48e2834b530e15e6b9c6a9fb3f6106c2579b985
Instruction ID: 3ca425724e8779d99690f5897a6fe0cca4c6017f57c9011301a7110168eec081
Opcode Fuzzy Hash: 1770146ed1a2281a067c6a80d48e2834b530e15e6b9c6a9fb3f6106c2579b985
Instruction Fuzzy Hash: 17117775E28A4182FB10DB16FC487657761FB88BA4F004272D95E837E6CFBCD4458B02

Function 00007FF62A97EF25 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF62A97EF4F
RegDeleteValueW.ADVAPI32 ref: 00007FF62A97EF63
RegSetValueExW.ADVAPI32 ref: 00007FF62A97EF8D
RegCloseKey.ADVAPI32 ref: 00007FF62A97EF9A

Strings

Console, xrefs: 00007FF62A97EF41
IpDatespecial, xrefs: 00007FF62A97EF5C, 00007FF62A97EF70

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Value$CloseDeleteOpen
String ID: Console$IpDatespecial
API String ID: 3183427449-1840232981
Opcode ID: 227ad8f4b06cdb6b08930102bada313d7f8b98b7889bc09013c0be248a67a942
Instruction ID: 64a1ff87b047737ebcc7022bc1399d3edf211b170d1090e8070284a6733c21b1
Opcode Fuzzy Hash: 227ad8f4b06cdb6b08930102bada313d7f8b98b7889bc09013c0be248a67a942
Instruction Fuzzy Hash: 15016136A18ED186EB218F25EC1076A3721FB84B55F044263CE4D87796CF7CD599CB05

Function 00007FF62A979380 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 26processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF62A979399
GetCommandLineW.KERNEL32 ref: 00007FF62A97939F
GetStartupInfoW.KERNEL32 ref: 00007FF62A9793AD
CreateProcessW.KERNEL32 ref: 00007FF62A9793F0
ExitProcess.KERNEL32 ref: 00007FF62A9793FB

Strings

, xrefs: 00007FF62A9793E4

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Process$CommandCreateExitFileInfoLineModuleNameStartup
String ID:
API String ID: 3421218197-3916222277
Opcode ID: aa1260efbfd046cd4269c4db6a47a0747b5d48ad13e0b0b72107f694596a2f32
Instruction ID: 3ca01d9c36aba4f9459411e15ff5fa2d956f8dce91fb8ec3b26d46c485b36f4f
Opcode Fuzzy Hash: aa1260efbfd046cd4269c4db6a47a0747b5d48ad13e0b0b72107f694596a2f32
Instruction Fuzzy Hash: 7EF03632E28A8186DB608F25F84875EB3A1FB89744F500136D68E87A65DF7CC149CB01

Function 00007FF62A974940 Relevance: 9.1, APIs: 6, Instructions: 80networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF62A974964
SetLastError.KERNEL32 ref: 00007FF62A974977
WSAGetLastError.WS2_32 ref: 00007FF62A9749C8
SetLastError.KERNEL32 ref: 00007FF62A974A32
WSASetLastError.WS2_32 ref: 00007FF62A974A3D
GetLastError.KERNEL32 ref: 00007FF62A974A43

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ErrorLast$recv
String ID:
API String ID: 316788870-0
Opcode ID: 1bfb22ba95e7e7656d2d5e0fb302539e9b3bee6e0c9b932fa958a4b538105933
Instruction ID: af1afe414ec354ce540c9a6a4d4ffa7f5786bd07081ecb84bebc0898fae689db
Opcode Fuzzy Hash: 1bfb22ba95e7e7656d2d5e0fb302539e9b3bee6e0c9b932fa958a4b538105933
Instruction Fuzzy Hash: 7D314772E2864282EF948F2AEC4437D23A1EB86B44F544576CA1DC7297DFBDD4848712

Function 00007FF62A991378 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 320COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF62A991516
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF62A99183F

Strings

csm, xrefs: 00007FF62A99153D
csm, xrefs: 00007FF62A9914BF
csm, xrefs: 00007FF62A99145D

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: f0c8ce6e5c114cb55c7e972b5d7e00f12528d3fa075699b5c4d5ef1c378b05c7
Instruction ID: 735d8bb46c5d20022ddc9448457a3c2427f9b46bc9403239659de6bb9c592c66
Opcode Fuzzy Hash: f0c8ce6e5c114cb55c7e972b5d7e00f12528d3fa075699b5c4d5ef1c378b05c7
Instruction Fuzzy Hash: 72E1C172E287839EEB609F2AD9402AC77A0FB44748F248175DA5DC7657DF78E085CB02

Function 00007FF62A975300 Relevance: 9.1, APIs: 6, Instructions: 63synchronizationtimeCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32 ref: 00007FF62A97531C
ResetEvent.KERNEL32 ref: 00007FF62A975329
timeGetTime.WINMM ref: 00007FF62A97532F
WaitForSingleObject.KERNEL32 ref: 00007FF62A975379
ResetEvent.KERNEL32 ref: 00007FF62A975396

Part of subcall function 00007FF62A974C50: GetCurrentThreadId.KERNEL32 ref: 00007FF62A974C65
Part of subcall function 00007FF62A974C50: SwitchToThread.KERNEL32 ref: 00007FF62A974C9D
Part of subcall function 00007FF62A974C50: SetLastError.KERNEL32 ref: 00007FF62A974CDC

ResetEvent.KERNEL32 ref: 00007FF62A9753BD

Part of subcall function 00007FF62A998BE0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62A998C0B

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: EventReset$Thread$CurrentErrorLastObjectSingleSwitchTimeWait_invalid_parameter_noinfotime
String ID:
API String ID: 2235205178-0
Opcode ID: 0c3c5ec39e87adfa389bf838caece4e6fe7672a6e350a85bf5e893da95473e9b
Instruction ID: f3ae7886bcbd4e0a55fc8176ddfa75de9f3acb927458486a781bac69c0375e9c
Opcode Fuzzy Hash: 0c3c5ec39e87adfa389bf838caece4e6fe7672a6e350a85bf5e893da95473e9b
Instruction Fuzzy Hash: E6217E72E18A8186EB40CF2AEC4426973A4FB84B98F184172DE4DCB76ACF78D441C752

Function 00007FF62A99EE88 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0000E12CD978A873,00007FF62A998DA5,?,?,?,?,00007FF62A9A27E6,?,?,00000000,00007FF62A99A69B,?,?,?), ref: 00007FF62A99EE97
FlsSetValue.KERNEL32(?,?,0000E12CD978A873,00007FF62A998DA5,?,?,?,?,00007FF62A9A27E6,?,?,00000000,00007FF62A99A69B,?,?,?), ref: 00007FF62A99EECD
FlsSetValue.KERNEL32(?,?,0000E12CD978A873,00007FF62A998DA5,?,?,?,?,00007FF62A9A27E6,?,?,00000000,00007FF62A99A69B,?,?,?), ref: 00007FF62A99EEFA
FlsSetValue.KERNEL32(?,?,0000E12CD978A873,00007FF62A998DA5,?,?,?,?,00007FF62A9A27E6,?,?,00000000,00007FF62A99A69B,?,?,?), ref: 00007FF62A99EF0B
FlsSetValue.KERNEL32(?,?,0000E12CD978A873,00007FF62A998DA5,?,?,?,?,00007FF62A9A27E6,?,?,00000000,00007FF62A99A69B,?,?,?), ref: 00007FF62A99EF1C
SetLastError.KERNEL32(?,?,0000E12CD978A873,00007FF62A998DA5,?,?,?,?,00007FF62A9A27E6,?,?,00000000,00007FF62A99A69B,?,?,?), ref: 00007FF62A99EF37

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 3654d854b1b7b54d09208102c236c7adbe92e0b1e90858cb6ea83a43bfdf338d
Instruction ID: 2e5fc79b442a3dc89b1a831cf85be51d534687d298bb3dfb16b47f82a1f2c367
Opcode Fuzzy Hash: 3654d854b1b7b54d09208102c236c7adbe92e0b1e90858cb6ea83a43bfdf338d
Instruction Fuzzy Hash: 5811AC20E2975356FF94A3235F4503922466F887B0F0496BAE83EC67C7DEECB4014A03

Function 00007FF62A99BF30 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF62A99BF55
GetProcAddress.KERNEL32 ref: 00007FF62A99BF6B
FreeLibrary.KERNEL32 ref: 00007FF62A99BF92

Strings

CorExitProcess, xrefs: 00007FF62A99BF64
mscoree.dll, xrefs: 00007FF62A99BF4C

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 69936be9a3c9092073ccdecace5a334f9bb4337f6d94747144cad9e03172cb9f
Instruction ID: 248c541bdc613071da4a40fb608fa02e17066b60fc3b01a0aa83228c58c23c92
Opcode Fuzzy Hash: 69936be9a3c9092073ccdecace5a334f9bb4337f6d94747144cad9e03172cb9f
Instruction Fuzzy Hash: 9CF0C866E3960251FF10CB25EC443796320AF48761F544776CA5EC55E6CFACD048C702

Function 00007FF62A97EFA3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF62A97EFC9
RegDeleteValueW.ADVAPI32 ref: 00007FF62A97EFDD
RegCloseKey.ADVAPI32 ref: 00007FF62A97EFEA

Strings

Console, xrefs: 00007FF62A97EFBB
IpDatespecial, xrefs: 00007FF62A97EFD6

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Console$IpDatespecial
API String ID: 849931509-1840232981
Opcode ID: 428edfecf080eeaca7e0c1c67ef556d191498152a1b600a56db6dc59e929ff35
Instruction ID: bbbf2857d38b889daf6434759680851878b29c10a4e56eafbad6818d9eef72cb
Opcode Fuzzy Hash: 428edfecf080eeaca7e0c1c67ef556d191498152a1b600a56db6dc59e929ff35
Instruction Fuzzy Hash: 1FF01276E18DD185EB208F15EC107AA7321E78476AF000272CD0D9766ADE7DD5DA8B05

Function 00007FF62A990778 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF62A99089B
__AdjustPointer.LIBCMT ref: 00007FF62A9908E6

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 95c273c5d9a602b1e514679a9057b242ded82a174dba946a287035d63dc3020a
Instruction ID: 431013e61d151037b78f32819ef828f7a9eb0ecccaf95445c8e12d01abf50044
Opcode Fuzzy Hash: 95c273c5d9a602b1e514679a9057b242ded82a174dba946a287035d63dc3020a
Instruction Fuzzy Hash: 52B1D922E2A643A9FF659B179E402386290EF44BC4F15C4B6DE6DC7787DEBCE4418342

Function 00007FF62A9AC95C Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF62A9AC984
_set_statfp.LIBCMT ref: 00007FF62A9AC99F
_set_statfp.LIBCMT ref: 00007FF62A9AC9BB
_set_statfp.LIBCMT ref: 00007FF62A9AC9F7

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 3a9c703ea5aaac55ee3dcba71a43574e980d604707a0521e319b1fc91c9c8b59
Instruction ID: 8ebb37fb66e7f728f9c8b35ace59458f65733adf787d2722ec6388fa87ee88f8
Opcode Fuzzy Hash: 3a9c703ea5aaac55ee3dcba71a43574e980d604707a0521e319b1fc91c9c8b59
Instruction Fuzzy Hash: 3B119426E3CB0341FF5411AADD433755493AF953B4E1886F6E66ECE2DB8E9CA841C203

Function 00007FF62A99EF50 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF62A993C9B,?,?,00000000,00007FF62A993F36,?,?,?,?,?,00007FF62A993EC2), ref: 00007FF62A99EF6F
FlsSetValue.KERNEL32(?,?,?,00007FF62A993C9B,?,?,00000000,00007FF62A993F36,?,?,?,?,?,00007FF62A993EC2), ref: 00007FF62A99EF8E
FlsSetValue.KERNEL32(?,?,?,00007FF62A993C9B,?,?,00000000,00007FF62A993F36,?,?,?,?,?,00007FF62A993EC2), ref: 00007FF62A99EFB6
FlsSetValue.KERNEL32(?,?,?,00007FF62A993C9B,?,?,00000000,00007FF62A993F36,?,?,?,?,?,00007FF62A993EC2), ref: 00007FF62A99EFC7
FlsSetValue.KERNEL32(?,?,?,00007FF62A993C9B,?,?,00000000,00007FF62A993F36,?,?,?,?,?,00007FF62A993EC2), ref: 00007FF62A99EFD8

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4047813a2c2501da88736eb8979464a470432fe091b6a2381c64cb1679d0dde5
Instruction ID: 8cc97485d5e4a74c7c919052fbc88b03673613c001db7820db9e9ff8b7d83345
Opcode Fuzzy Hash: 4047813a2c2501da88736eb8979464a470432fe091b6a2381c64cb1679d0dde5
Instruction Fuzzy Hash: 0111AF10E2976355FF9893279F4113912466F483A0F0897BAE87EC67D7DEACB4014A03

Function 00007FF62A99EDE4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F), ref: 00007FF62A99EDF5
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F), ref: 00007FF62A99EE14
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F), ref: 00007FF62A99EE3C
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F), ref: 00007FF62A99EE4D
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF62A9A7113,?,?,?,00007FF62A99F444,?,?,?,00007FF62A99843F), ref: 00007FF62A99EE5E

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f4b63a2d358e16832ea89596edc1dbf90b4b2fd2f1616095919a36d422ba38cd
Instruction ID: 2b86afef9f4dad0ad2aaeaee493d5df8c146641135ef74fa2bb8535abc4aa564
Opcode Fuzzy Hash: f4b63a2d358e16832ea89596edc1dbf90b4b2fd2f1616095919a36d422ba38cd
Instruction Fuzzy Hash: 3B112A10E293075AFF98A2635E52079124A5F49370F189BB9E93ECA2D3DDECB8414A03

Function 00007FF62A9756C0 Relevance: 7.5, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF62A9756E5
EnterCriticalSection.KERNEL32 ref: 00007FF62A9756EF
LeaveCriticalSection.KERNEL32 ref: 00007FF62A9756FF
LeaveCriticalSection.KERNEL32 ref: 00007FF62A975709

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 7d1c33e0fc199dc1a1b2b98ae86d416f77ce0655480dcc5f384a8a26f1c27f0c
Instruction ID: baac7f9bc5a80b5a9b7bf8ec55bf943534e80122e754d9b693c2818add76e3ee
Opcode Fuzzy Hash: 7d1c33e0fc199dc1a1b2b98ae86d416f77ce0655480dcc5f384a8a26f1c27f0c
Instruction Fuzzy Hash: F8111232E2454187DF909B26F8843AD63A1FB44755F445072DB8FC6A56CF7CE485C701

Function 00007FF62A97C0C0 Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

DeleteObject.GDI32 ref: 00007FF62A97C103
EnterCriticalSection.KERNEL32(?,?,?,00007FF62A97C094), ref: 00007FF62A97C115
EnterCriticalSection.KERNEL32 ref: 00007FF62A97C125
GdiplusShutdown.GDIPLUS ref: 00007FF62A97C133
LeaveCriticalSection.KERNEL32 ref: 00007FF62A97C140

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CriticalSection$Enter$DeleteGdiplusLeaveObjectShutdown
String ID:
API String ID: 1513102227-0
Opcode ID: cb3a45266a7c72afb3eef7b31d32061257325c5ad6beb33f20a6e81f88ef5b24
Instruction ID: ef59ac61f531dba50103d31180a81decd5e4b105380063c555f2b3c878f33e57
Opcode Fuzzy Hash: cb3a45266a7c72afb3eef7b31d32061257325c5ad6beb33f20a6e81f88ef5b24
Instruction Fuzzy Hash: 2A116D33D25B4281EF008F2AEC8412873B4FB08F68B248236D65D862A2DF78D953C342

Function 00007FF62A975640 Relevance: 7.5, APIs: 5, Instructions: 26synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF62A975652
WaitForSingleObject.KERNEL32 ref: 00007FF62A975664
Sleep.KERNEL32 ref: 00007FF62A97566F
CloseHandle.KERNEL32 ref: 00007FF62A97568C
CloseHandle.KERNEL32 ref: 00007FF62A975699

Part of subcall function 00007FF62A974C50: GetCurrentThreadId.KERNEL32 ref: 00007FF62A974C65
Part of subcall function 00007FF62A974C50: SwitchToThread.KERNEL32 ref: 00007FF62A974C9D
Part of subcall function 00007FF62A974C50: SetLastError.KERNEL32 ref: 00007FF62A974CDC

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CloseHandleObjectSingleThreadWait$CurrentErrorLastSleepSwitch
String ID:
API String ID: 1535946027-0
Opcode ID: 311de798c0593289d29e071e9f78a1d734eb52b4581ef33c1cbfd426072e5f36
Instruction ID: c35913732474c0145fe818ef9a1adb6f71d2e766fd9fe699fc22a40de912cb1a
Opcode Fuzzy Hash: 311de798c0593289d29e071e9f78a1d734eb52b4581ef33c1cbfd426072e5f36
Instruction Fuzzy Hash: 0CF03136E1494182EB049F2BDC582683361FB89F59F184172C92DC73A2CF78D8418352

Function 00007FF62A991AEC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF62A991B5C
_CallSETranslator.LIBVCRUNTIME ref: 00007FF62A991BA7

Strings

MOC, xrefs: 00007FF62A991B70
RCC, xrefs: 00007FF62A991B78

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 85eb8fbd3e06a99c4afa559b4d80cf249f4e954e0195537aa802c98b0a840f84
Instruction ID: cf71b79ed33c80c8530b55b55764ce1949e01e62eafcd655452262e6f7e60ae7
Opcode Fuzzy Hash: 85eb8fbd3e06a99c4afa559b4d80cf249f4e954e0195537aa802c98b0a840f84
Instruction Fuzzy Hash: 7591F173E187829AEB50CF26D8402AC77A0FB04788F14817AEA8DD7B56DF78D195CB01

Function 00007FF62A98FD28 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF62A98FD53
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF62A98FDEA
RtlUnwindEx.KERNEL32 ref: 00007FF62A98FE44

Strings

csm, xrefs: 00007FF62A98FDD1

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: c305225e0e2b3a2203a822812f960376c115b044745f784688940b7b0a399dcc
Instruction ID: 6e807a6706b54583054a0d1165fa32a3ef9487c7b580d9bb3b287c06b3c6636c
Opcode Fuzzy Hash: c305225e0e2b3a2203a822812f960376c115b044745f784688940b7b0a399dcc
Instruction Fuzzy Hash: DC519F22E2A6028EDF148A1AE844B793391EB44B88F109176EA4DC774BDFBCE841C701

Function 00007FF62A99206C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF62A992094
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF62A99217C

Strings

csm, xrefs: 00007FF62A9921CE
csm, xrefs: 00007FF62A9920B6

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: 544592ab7251effa554c0990b2f03f08321f7b0f5e6baf8f1fc1d42750b8d711
Instruction ID: 81874b708f2cce0911894b16af4f8de8165d3757a1de17ac3a439873a223e80f
Opcode Fuzzy Hash: 544592ab7251effa554c0990b2f03f08321f7b0f5e6baf8f1fc1d42750b8d711
Instruction Fuzzy Hash: 0B518032D283439EEF788A129A4436CB794EB55B94F148175DA9CC7B96CFB8E460C702

Function 00007FF62A9AAA5C Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF62A9AAADB
WriteFile.KERNEL32 ref: 00007FF62A9AADA3
WriteFile.KERNEL32 ref: 00007FF62A9AADE9
GetLastError.KERNEL32 ref: 00007FF62A9AAE9F

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: b0a5a2f5e03aa4de9bb2610dcdd396f5b9cdbd820afb8483674e8d26cbad73da
Instruction ID: edaf7321fd7702c6a319fe98d482743f5a1887aca5b625ee4998b47427d2862f
Opcode Fuzzy Hash: b0a5a2f5e03aa4de9bb2610dcdd396f5b9cdbd820afb8483674e8d26cbad73da
Instruction Fuzzy Hash: 79D1A232F286818AEB11CF66D8402AC37B2FB44799B144277DE5DD7B9ADE78D446C302

Function 00007FF62A9859A0 Relevance: 6.3, APIs: 4, Instructions: 260COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A985B15
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62A985B1B

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 9836cfd4f00772ab983df51a940828b549011ef8ebab5eaf54ddafcf2ed5cfb4
Instruction ID: 9ab95ac884260bde22b95411e4e5a528ddd715a030ea70e690e70c9fe24f6c85
Opcode Fuzzy Hash: 9836cfd4f00772ab983df51a940828b549011ef8ebab5eaf54ddafcf2ed5cfb4
Instruction Fuzzy Hash: 8C91A062F24A8249EF14CB57D9842BD6362BB04BE0F548671DB6DC7BCADFACD0858301

Function 00007FF62A987610 Relevance: 6.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A9879B6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A9879BC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A9879C2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A9879C8

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: d455572cb0b53bd605dd2c5479bbb32fa5d957f89605b264ea43e35a7a78a5b6
Instruction ID: f58b0ecf88993a830a0552fc3716c625e7962b3fc97ccaf905d58fa031959720
Opcode Fuzzy Hash: d455572cb0b53bd605dd2c5479bbb32fa5d957f89605b264ea43e35a7a78a5b6
Instruction Fuzzy Hash: CDB17E62F24B55C9FF008BA6D8447AC2372FB447D8F405265DE6CA7B9ADFB9A481C301

Function 00007FF62A9AB384 Relevance: 6.2, APIs: 4, Instructions: 219COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00007FF62A9AB36F), ref: 00007FF62A9AB4A0
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,00007FF62A9AB36F), ref: 00007FF62A9AB52B

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: c0b9c452233083e8ba344db7b85cdb6942af15e1945070f1535423c6b6b64ca2
Instruction ID: 94d3f8809492ca394f9f9afb3040c659c2bf884c8d86473633e67d2a72448a59
Opcode Fuzzy Hash: c0b9c452233083e8ba344db7b85cdb6942af15e1945070f1535423c6b6b64ca2
Instruction Fuzzy Hash: 1091D722E28A5285FF509F6698502BD2BA2BB04B88F1451B6DF0DD7687DEB8D841C703

Function 00007FF62A988830 Relevance: 6.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A988A74
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF62A988A80
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A988A86
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A988AE7

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
String ID:
API String ID: 3936042273-0
Opcode ID: 6b86777ed2056881ec85e37c8b53bc7b1ae53672222ced7e915cb6963593c230
Instruction ID: 1a6e440c8c908d03fa7884dc6736a70cd3a4fa61009dbfb7ef71e9322e8eeb73
Opcode Fuzzy Hash: 6b86777ed2056881ec85e37c8b53bc7b1ae53672222ced7e915cb6963593c230
Instruction Fuzzy Hash: D871AF62E24B9589EF04DB66D80836D6361EB84FE0F548671DE6C87BC6DFB8E581C301

Function 00007FF62A97F160 Relevance: 6.2, APIs: 4, Instructions: 190processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF62A97F1AD
Process32FirstW.KERNEL32 ref: 00007FF62A97F23F
Process32NextW.KERNEL32 ref: 00007FF62A97F333

Part of subcall function 00007FF62A998A40: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62A998A66

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF62A97F3FB

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32_invalid_parameter_noinfo_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4260596558-0
Opcode ID: be836d38096120c0cd8b151b43bf66e5befb7495844985f2fd7b9594a703298f
Instruction ID: e0978295a8a2747d73f63987274e200f1591515b27bc4e86065397ccb68669e9
Opcode Fuzzy Hash: be836d38096120c0cd8b151b43bf66e5befb7495844985f2fd7b9594a703298f
Instruction Fuzzy Hash: F071B3A2E28A4181EF249B26DC4436D6261FB847E0F444272EA6ED77D6DFBCD540C711

Function 00007FF62A9995E4 Relevance: 6.1, APIs: 4, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF62A99963B
GetSystemInfo.KERNEL32 ref: 00007FF62A999654
VirtualAlloc.KERNEL32 ref: 00007FF62A9996C2
VirtualProtect.KERNEL32 ref: 00007FF62A9996DD

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: de052ff2da3a860ebe00b2b1188a3b3a24b5d5626fd4b16e4c5629aca21b164b
Instruction ID: 8a1ee0b829d8cd0ecbe869c83a1f3b3102e094d7821c2917e92f11cdc83c94ae
Opcode Fuzzy Hash: de052ff2da3a860ebe00b2b1188a3b3a24b5d5626fd4b16e4c5629aca21b164b
Instruction Fuzzy Hash: 88314A32B24A829EDB20CF32D9547A823A5FB48788F444026EA5DC7B5ADF78E645C701

Function 00007FF62A974F90 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF62A974FAC
LeaveCriticalSection.KERNEL32 ref: 00007FF62A974FC3
LeaveCriticalSection.KERNEL32 ref: 00007FF62A97504B
SetEvent.KERNEL32 ref: 00007FF62A97506B

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEvent
String ID:
API String ID: 3394196147-0
Opcode ID: 401af7361c6d18c862ea4f071fb6758f38da9ad67756e4e78bac1cd16ae14490
Instruction ID: 0e6b23426017b03c9f1b8a63e72912b27cbba51cf01333b54b5aa969561a384c
Opcode Fuzzy Hash: 401af7361c6d18c862ea4f071fb6758f38da9ad67756e4e78bac1cd16ae14490
Instruction Fuzzy Hash: 08213E32B14B8197DB88CB2AE9842ADB3A4FB48B84F544035DB5DC7726DF78E4A1C740

Function 00007FF62A98E880 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF62A98E8AC
GetCurrentThreadId.KERNEL32 ref: 00007FF62A98E8BA
GetCurrentProcessId.KERNEL32 ref: 00007FF62A98E8C6
QueryPerformanceCounter.KERNEL32 ref: 00007FF62A98E8D6

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: e05f7aef3380f0f9b3312b24ce1aa7c1f593c40dbd43f636e11a9c4c637e2614
Instruction ID: 11e599fa5900fa63eae96cb062fe044dff3813562ac043617e7ddb98f9e1467c
Opcode Fuzzy Hash: e05f7aef3380f0f9b3312b24ce1aa7c1f593c40dbd43f636e11a9c4c637e2614
Instruction Fuzzy Hash: C1110626F25F068AEF00CF61EC542B833A4FB19758F441A32DA6DC6BA5DFB8D5548381

Function 00007FF62A973FF0 Relevance: 6.0, APIs: 4, Instructions: 22synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF62A974002
Sleep.KERNEL32 ref: 00007FF62A97400D
WaitForSingleObject.KERNEL32 ref: 00007FF62A974024
WaitForSingleObject.KERNEL32 ref: 00007FF62A974036

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ObjectSingleWait$Sleep
String ID:
API String ID: 2961732021-0
Opcode ID: 83ddd93f6670c03bec4b7f128343a3e6a6daf1263786cfff0f95db90d503808b
Instruction ID: 8186ab58c6f3c17d889c2523ecad8da8da7200ce0b63538a3757c8c90cb2be7f
Opcode Fuzzy Hash: 83ddd93f6670c03bec4b7f128343a3e6a6daf1263786cfff0f95db90d503808b
Instruction Fuzzy Hash: E3F0D072F14A4486DB409B7EDC5822432A1EB89B39F554372CA2DC73E5CF78C4858352

Function 00007FF62A9922A4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF62A9922CE

Strings

csm, xrefs: 00007FF62A992462
csm, xrefs: 00007FF62A9922F3

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: f15189d2199330c0f402dae8ecdfa2ca81426a1eff024833c44a8ddbe4b12987
Instruction ID: d1e38f3757446e4522295c53715dbdba69302c616ba83c2aa6340e1af2ae638d
Opcode Fuzzy Hash: f15189d2199330c0f402dae8ecdfa2ca81426a1eff024833c44a8ddbe4b12987
Instruction Fuzzy Hash: 6871AF729186829AEF608F269950679BBA0FB04F84F14C1B5DE4CC7A8BDF7CD591C702

Function 00007FF62A99187C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF62A9918DB

Strings

MOC, xrefs: 00007FF62A9918EF
RCC, xrefs: 00007FF62A9918F7

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: ff6c3586205ef54b92cc1381aa76c713ce5aef96bda724e5a14e442f6a8185ef
Instruction ID: 4e8f4854d33616a92fd1904fce4721f2071235c136e7244adf0e65af9beb4132
Opcode Fuzzy Hash: ff6c3586205ef54b92cc1381aa76c713ce5aef96bda724e5a14e442f6a8185ef
Instruction Fuzzy Hash: B161C432D19BC595DB608B16E9403EAB7A0FB85794F148225EB9C83B96CFBCD494CB01

Function 00007FF62A97DC4D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00007FF62A97DCA0
CloseHandle.KERNEL32 ref: 00007FF62A97DE27

Strings

%s_bin, xrefs: 00007FF62A97DC95

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CloseHandlewsprintf
String ID: %s_bin
API String ID: 3088109604-2665034546
Opcode ID: 6c4a203584ddb297e8f688e5e79792300aa0f32cdc759f08306399289e0b91f9
Instruction ID: ea3122cb8f56b46c68f3fc7a9394af49e8d0d06e48544b889bf42c3a647b2569
Opcode Fuzzy Hash: 6c4a203584ddb297e8f688e5e79792300aa0f32cdc759f08306399289e0b91f9
Instruction Fuzzy Hash: 295181A2F25BA681EF50DB1AC8147B92355EF84B84F458176DA0DCB7C2DE7CD501C712

Function 00007FF62A9A1F64 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF62A9994E8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF62A99951B

_get_daylight.LIBCMT ref: 00007FF62A9A207C
_get_daylight.LIBCMT ref: 00007FF62A9A208D

Strings

?, xrefs: 00007FF62A9A200D

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 73dd6a1d9a5ad4992f3991f8c36a8220d63358c9d054768064d2836bf5e58140
Instruction ID: bc09e6779a1e81ce590771599b1bc292aa59aa12b19a5dc2f6411dc7d76f067e
Opcode Fuzzy Hash: 73dd6a1d9a5ad4992f3991f8c36a8220d63358c9d054768064d2836bf5e58140
Instruction Fuzzy Hash: 2C412822F2839245FF208B2799013799652EB807A4F204276EE5DC6AE7DFBCD441CB03

Function 00007FF62A99293C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF62A9929E6
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF62A992A0F

Strings

csm, xrefs: 00007FF62A992B0F

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: f28967bb51a8388d528e36e8d1b9cbe39d4a27893e421944e70fc0d8e7df8c72
Instruction ID: 78764f36e95cd0a3c1b13c41575d065307456c3f8645b983ae81bd662fc34ef4
Opcode Fuzzy Hash: f28967bb51a8388d528e36e8d1b9cbe39d4a27893e421944e70fc0d8e7df8c72
Instruction Fuzzy Hash: 7F518133A287429ADB209F26E94026E77A4F788B90F105175DB8D87B57DF7CE050C702

Function 00007FF62A99C224 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF62A99C256

Part of subcall function 00007FF62A99E95C: RtlFreeHeap.NTDLL(?,?,?,00007FF62A9A6862,?,?,?,00007FF62A9A6BDF,?,?,00000000,00007FF62A9A7025,?,?,?,00007FF62A9A6F57), ref: 00007FF62A99E972
Part of subcall function 00007FF62A99E95C: GetLastError.KERNEL32(?,?,?,00007FF62A9A6862,?,?,?,00007FF62A9A6BDF,?,?,00000000,00007FF62A9A7025,?,?,?,00007FF62A9A6F57), ref: 00007FF62A99E97C

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF62A98E051), ref: 00007FF62A99C274

Strings

C:\Users\user\Desktop\yIR0BZUT2A.exe, xrefs: 00007FF62A99C262

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\yIR0BZUT2A.exe
API String ID: 3580290477-3557223276
Opcode ID: aee35bfe6285ca872dc023e0e85ec8bac6debb86297f70b490d45f268cf6f652
Instruction ID: b2c854f4137e7b5bcea0dbd34eca7e3b63a8cfd9dc5ad6609f523050f3dd96fa
Opcode Fuzzy Hash: aee35bfe6285ca872dc023e0e85ec8bac6debb86297f70b490d45f268cf6f652
Instruction Fuzzy Hash: 9C417C36E28B039DEF54DF26AE510BD23A9AF48780B448075E94DC7B87DEB8E440C302

Function 00007FF62A9AB0F4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF62A9AB20B
GetLastError.KERNEL32 ref: 00007FF62A9AB22D

Strings

U, xrefs: 00007FF62A9AB1B7

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 82c14a47abd65dfd2f18e3d0d2973b2ccc07122a063a358567b3cbc0c6ba3651
Instruction ID: 27c79b3c75c498ac6e7b6da2fe36aa990d5c670abb4bc70cf88d57aab39d0a2f
Opcode Fuzzy Hash: 82c14a47abd65dfd2f18e3d0d2973b2ccc07122a063a358567b3cbc0c6ba3651
Instruction Fuzzy Hash: 6741B432E28A8191DB608F26E8543BA77A1F798794F414032DE4DC7796DF7CD801C742

Function 00007FF62A9902F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF62A971111), ref: 00007FF62A990340
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF62A971111), ref: 00007FF62A990381

Strings

csm, xrefs: 00007FF62A99036E

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 4e14dd832fb4824443fa8c0aec862097db35212d867c479028c393dfe5930aef
Instruction ID: f3ced64e4b1a328bd47a91e2b4d2686dce8760f710fbf34dccd6925d1d1076ee
Opcode Fuzzy Hash: 4e14dd832fb4824443fa8c0aec862097db35212d867c479028c393dfe5930aef
Instruction Fuzzy Hash: A3116032A28B4182EB208F26F94026977E5FB88B84F588275DE9C8776ADF7CD551C701

Function 00007FF62A98A4B0 Relevance: 5.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32 ref: 00007FF62A98A4EE
IsBadReadPtr.KERNEL32 ref: 00007FF62A98A5C3
SetLastError.KERNEL32(?,00000000,00007FF62A98AAC9,?,?,?,?,?,?,?,?,?,00007FF62A97D242), ref: 00007FF62A98A5E5
SetLastError.KERNEL32(?,00000000,00007FF62A98AAC9,?,?,?,?,?,?,?,?,?,00007FF62A97D242), ref: 00007FF62A98A603

Memory Dump Source

Source File: 00000000.00000002.4110534894.00007FF62A971000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF62A970000, based on PE: true

Associated: 00000000.00000002.4110518816.00007FF62A970000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110561163.00007FF62A9AF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110579544.00007FF62A9C5000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110594536.00007FF62A9C8000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110611118.00007FF62A9CC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4110670974.00007FF62A9D0000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff62a970000_yIR0BZUT2A.jbxd

Similarity

API ID: ErrorLastRead
String ID:
API String ID: 4100373531-0
Opcode ID: 82ac0250d1ecd3177f83757e94cf9be5bc81ee4aab1a059e0fd8dc4cfb57a079
Instruction ID: 859e1bba504e4ce1f80b3e33709c529696d706e54b9d622c5394b0ce5da37999
Opcode Fuzzy Hash: 82ac0250d1ecd3177f83757e94cf9be5bc81ee4aab1a059e0fd8dc4cfb57a079
Instruction Fuzzy Hash: 1D413AA6F19A418AEF148B16D94422933A0FF48B91F064475CF4EC7B5ADFBCE4A1C311

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report yIR0BZUT2A.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\kernelquick.sys

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Statistics

Windows Analysis Report
yIR0BZUT2A.exe

Function 00007FF62A976370 Relevance: 193.3, APIs: 81, Strings: 29, Instructions: 845
registrystringprocessCOMMON

Function 00007FF62A98B5E0 Relevance: 103.7, APIs: 41, Strings: 18, Instructions: 429
registrylibrarysleepCOMMON

Function 00007FF62A97F410 Relevance: 81.0, APIs: 35, Strings: 11, Instructions: 532
registryprocessfileCOMMON

Function 00007FF62A9772D0 Relevance: 54.7, APIs: 26, Strings: 5, Instructions: 457
COMMON

Function 00007FF62A97FD10 Relevance: 54.6, APIs: 26, Strings: 5, Instructions: 318
windowCOMMON

Function 00007FF62A978A40 Relevance: 49.3, APIs: 24, Strings: 4, Instructions: 255
COMMON

Function 00007FF62A978710 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 244
memoryCOMMON

Function 00007FF62A977A60 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 216
stringregistrycomCOMMON

Function 00007FF62A97B410 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 232
memorytimeCOMMON

Function 00007FF62A980220 Relevance: 45.3, APIs: 30, Instructions: 260
memorywindowCOMMON

Function 00007FF62A97C340 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 297
windowCOMMON

Function 00007FF62A973820 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 157
networkstringtimeCOMMON

Function 00007FF62A978C30 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 101
memoryCOMMON

Function 00007FF62A98BEF0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 223
memoryCOMMON

Function 00007FF62A97D9C0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 137
registryCOMMON