Edit tour

Windows Analysis Report
7cYDC0HciP.exe

Overview

General Information

Sample name:	7cYDC0HciP.exe renamed because original name is a hash value
Original sample name:	c0046b11b67425d2a5fc835771ba13a28baf13780f21c0426b2fcdac8a6f1a3f.exe
Analysis ID:	1588183
MD5:	48e0fecb7987f8d53c38f8228dd06218
SHA1:	bd74dfd414078a5ecb66a3d90406a1f0809723dd
SHA256:	c0046b11b67425d2a5fc835771ba13a28baf13780f21c0426b2fcdac8a6f1a3f
Tags:	exeuser-adrian__luca
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Found potential string decryption / allocating functions

One or more processes crash

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

7cYDC0HciP.exe (PID: 7548 cmdline: "C:\Users\user\Desktop\7cYDC0HciP.exe" MD5: 48E0FECB7987F8D53C38F8228DD06218)

WerFault.exe (PID: 7664 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 564 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 7cYDC0HciP.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 7cYDC0HciP.exe	Virustotal: Detection: 58%			Perma Link
Source: 7cYDC0HciP.exe	ReversingLabs: Detection: 70%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.4% probability

Machine Learning detection for sample

Source: 7cYDC0HciP.exe

Joe Sandbox ML: detected

Source: 7cYDC0HciP.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: Amcache.hve.4.dr

String found in binary or memory: http://upx.sf.net

System Summary

Binary is likely a compiled AutoIt script file

Source: 7cYDC0HciP.exe, 00000000.00000000.1353400723.000000000060E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_88ccbc75-1
Source: 7cYDC0HciP.exe, 00000000.00000000.1353400723.000000000060E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d26d0ff3-c
Source: 7cYDC0HciP.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_430961aa-5
Source: 7cYDC0HciP.exe	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_84c0bfaf-4

Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_0059410F	0_2_0059410F
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_005802A4	0_2_005802A4
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_0056E3E3	0_2_0056E3E3
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_0059038E	0_2_0059038E
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_0059467F	0_2_0059467F
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_005806D9	0_2_005806D9
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_005CAACE	0_2_005CAACE
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00594BEF	0_2_00594BEF
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_0058CCC1	0_2_0058CCC1
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_0056AF50	0_2_0056AF50
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00566F07	0_2_00566F07
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_0058B043	0_2_0058B043
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_0057B11F	0_2_0057B11F
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_005C31BC	0_2_005C31BC
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_0058D1B9	0_2_0058D1B9
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_0059724D	0_2_0059724D
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00573200	0_2_00573200
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_0058123A	0_2_0058123A
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_005A13CA	0_2_005A13CA
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_005693F0	0_2_005693F0
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_0057F563	0_2_0057F563
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_005696C0	0_2_005696C0
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_005AB6CC	0_2_005AB6CC
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_005CF7FF	0_2_005CF7FF
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_005677B0	0_2_005677B0
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_005979C9	0_2_005979C9
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_0057FA57	0_2_0057FA57
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00573B70	0_2_00573B70
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00569B60	0_2_00569B60
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_005677B0	0_2_005677B0
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_0057FE6F	0_2_0057FE6F
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00589ED0	0_2_00589ED0
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00567FA3	0_2_00567FA3

Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: String function: 0058F8A0 appears 35 times
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: String function: 00586AC0 appears 41 times
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: String function: 00572C20 appears 33 times
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: String function: 0057F55E appears 33 times

Source: C:\Users\user\Desktop\7cYDC0HciP.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 564

Source: 7cYDC0HciP.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.winEXE@2/5@0/0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7548

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\bb4af4f6-7037-4f67-84c4-1dee713fd02b

Jump to behavior

Source: 7cYDC0HciP.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7cYDC0HciP.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7cYDC0HciP.exe	Virustotal: Detection: 58%
Source: 7cYDC0HciP.exe	ReversingLabs: Detection: 70%

Source: unknown	Process created: C:\Users\user\Desktop\7cYDC0HciP.exe "C:\Users\user\Desktop\7cYDC0HciP.exe"
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 564

Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Section loaded: wsock32.dll	Jump to behavior

Source: 7cYDC0HciP.exe

Static file information: File size 1188352 > 1048576

Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_005DC480 push ss; retn 0047h		0_2_005DC481
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00586B05 push ecx; ret		0_2_00586B18

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\7cYDC0HciP.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\7cYDC0HciP.exe

Code function: 0_2_00585F74 ___security_init_cookie,LdrInitializeThunk,

0_2_00585F74

Source: 7cYDC0HciP.exe

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\7cYDC0HciP.exe

Code function: 0_2_005865C4 cpuid

0_2_005865C4

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Process Injection	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	11 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
7cYDC0HciP.exe	58%	Virustotal		Browse
7cYDC0HciP.exe	71%	ReversingLabs	Win32.Trojan.Nymeria
7cYDC0HciP.exe	100%	Avira	HEUR/AGEN.1319159
7cYDC0HciP.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.4.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588183
Start date and time:	2025-01-10 22:23:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7cYDC0HciP.exe renamed because original name is a hash value
Original Sample Name:	c0046b11b67425d2a5fc835771ba13a28baf13780f21c0426b2fcdac8a6f1a3f.exe
Detection:	MAL
Classification:	mal68.winEXE@2/5@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 1 Number of non-executed functions: 66
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 52.182.143.212, 13.107.246.45, 40.126.32.68, 172.202.163.200
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
16:24:59	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	28uMwHvbTD.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.45
	https://services221.com/mm/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	8qQwTWK3jx.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	https://atpscan.global.hornetsecurity.com/?d=W3rdHn1Og9hhUJnVJzqWF36wMmxswAZldvtx3E21ybg&f=v8m9AqGfgV2Ri7cjqmfsuyl2V2Mu_lVW0BRsqcFw4upagWAQ1C-MqANvN6gf4zNV&i=&k=xREg&m=b_ORYMkPffImCXbCPli-aiR7Ga6rGe55sar2xtigCL4MrowDPSzt7ABKETTGxzegakAfoZ57KD02aVix8V8TVmZ2VcxzjeybXYrPiS2SB73LCKYktj5jv2aw6VcPRslz&n=s4crRkyHC4bab6S3yrgn1E3n-VmdqgfSqNiaCJyPrf6hnyL_SE4PHEo5SUcwwsFGV6rnB35iQFM5FLsE91obvZ0HTAEiqHnB8ROLzY5JVgg&r=oMs_cp4DXIjeQhcPWsPLyR3_oxBVUN4Iok_tSVE4DNNtzqeot7ZzvdXkh4vatwpC&s=bd82eb507a358fd35f72f18b86e67f3bfc1ce64bbeab0c01d700897b1b678efb&u=https%3A%2F%2Fe.trustifi.com%2F%23%2Ffff2af%2F32054d%2F67960f%2Fee6fed%2F5d1d11%2F46c760%2Ff79190%2Fc5ec40%2Fe8666a%2Fef542d%2F85972d%2F627493%2F9a11d6%2F1f4096%2F1d247f%2F818e78%2Fc53383%2Fd59aa0%2Fedfa57%2F7914c7%2Fc38cf6%2Ff74f56%2Ff45915%2F39dbbd%2Ff48710%2F1ddf22%2F37d5f2%2F9de9f7%2F96109e%2F882355%2F854b66%2F9d606d%2F2d0447%2Fad3b01%2F637d1c%2F3c0f2b%2F606f48%2Fa6d904%2F8fefe3%2F00a4bb%2F6520c6%2F9b795c%2Fb7de1a%2Fb5dde6%2F3f5692%2F997c7d%2Fc00925%2F782cce%2F511459%2Fab5aa8%2F91722a%2Feec933%2F3f4f91%2F894088%2F43adfa%2Fb78195%2F0407d0%2F56f022%2Fddf20e%2F946567%2Faa271a%2F507b7a%2Faccd06%2F50d63c%2F485c4b%2F07ced8%2Fd0ec21%2F260ce6%2Fb5edbb%2F79a81e%2F1fd160%2Ff4da41%2F7073e0%2F8a5e9a%2Fdac829%2F521e52%2Fa1a847%2F13ea63%2Fabb5a3%2Fe1901e%2Fd876f6%2F7b0bf4%2Fbd19df%2F89bdcd%2F1874d8%2F0fb7f3%2F72f438%2Fa098c5%2F4e2214%2F4b6e54%2F0c4a8f	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	hm8dCK5P5A.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://atpscan.global.hornetsecurity.com/?d=W3rdHn1Og9hhUJnVJzqWF36wMmxswAZldvtx3E21ybg&f=v8m9AqGfgV2Ri7cjqmfsuyl2V2Mu_lVW0BRsqcFw4upagWAQ1C-MqANvN6gf4zNV&i=&k=xREg&m=b_ORYMkPffImCXbCPli-aiR7Ga6rGe55sar2xtigCL4MrowDPSzt7ABKETTGxzegakAfoZ57KD02aVix8V8TVmZ2VcxzjeybXYrPiS2SB73LCKYktj5jv2aw6VcPRslz&n=s4crRkyHC4bab6S3yrgn1E3n-VmdqgfSqNiaCJyPrf6hnyL_SE4PHEo5SUcwwsFGV6rnB35iQFM5FLsE91obvZ0HTAEiqHnB8ROLzY5JVgg&r=oMs_cp4DXIjeQhcPWsPLyR3_oxBVUN4Iok_tSVE4DNNtzqeot7ZzvdXkh4vatwpC&s=bd82eb507a358fd35f72f18b86e67f3bfc1ce64bbeab0c01d700897b1b678efb&u=https%3A%2F%2Fe.trustifi.com%2F%23%2Ffff2af%2F32054d%2F67960f%2Fee6fed%2F5d1d11%2F46c760%2Ff79190%2Fc5ec40%2Fe8666a%2Fef542d%2F85972d%2F627493%2F9a11d6%2F1f4096%2F1d247f%2F818e78%2Fc53383%2Fd59aa0%2Fedfa57%2F7914c7%2Fc38cf6%2Ff74f56%2Ff45915%2F39dbbd%2Ff48710%2F1ddf22%2F37d5f2%2F9de9f7%2F96109e%2F882355%2F854b66%2F9d606d%2F2d0447%2Fad3b01%2F637d1c%2F3c0f2b%2F606f48%2Fa6d904%2F8fefe3%2F00a4bb%2F6520c6%2F9b795c%2Fb7de1a%2Fb5dde6%2F3f5692%2F997c7d%2Fc00925%2F782cce%2F511459%2Fab5aa8%2F91722a%2Feec933%2F3f4f91%2F894088%2F43adfa%2Fb78195%2F0407d0%2F56f022%2Fddf20e%2F946567%2Faa271a%2F507b7a%2Faccd06%2F50d63c%2F485c4b%2F07ced8%2Fd0ec21%2F260ce6%2Fb5edbb%2F79a81e%2F1fd160%2Ff4da41%2F7073e0%2F8a5e9a%2Fdac829%2F521e52%2Fa1a847%2F13ea63%2Fabb5a3%2Fe1901e%2Fd876f6%2F7b0bf4%2Fbd19df%2F89bdcd%2F1874d8%2F0fb7f3%2F72f438%2Fa098c5%2F4e2214%2F4b6e54%2F0c4a8f	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.45
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7cYDC0HciP.exe_88e7f6563a585821d8c5b75d1d898bfef7d2f0_84687472_724cb7ca-85bb-4fed-ab12-e5bee7920c04\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8528488599741497
Encrypted:	false
SSDEEP:	192:1DRNYd0BU/Hb0jjtqzuiFnZ24IO8Xg1x:tYeBU/QjUzuiFnY4IO8Qr
MD5:	147E29645014DD39BD1E7F2BF95B8698
SHA1:	11E854EECE4BB88E920B729E39C2A9948F716597
SHA-256:	052CA1917B2F6EEBAE13DF6A3B53437FEC8D56E0BC7F6256D8205590F2421167
SHA-512:	6EFB6A5866DC103F0ACBD0F5FF95565177C1ECE1A9AAAFE87A4FFC8F8A7A0BADC816B76CAD9E41F3755C769CFBA4D365FDD991461E858200450F75F336BD2C83
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.1.0.1.7.8.8.3.8.3.7.8.6.7.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.1.0.1.7.8.8.4.2.2.8.4.8.4.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.2.4.c.b.7.c.a.-.8.5.b.b.-.4.f.e.d.-.a.b.1.2.-.e.5.b.e.e.7.9.2.0.c.0.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.a.5.1.0.d.9.b.-.f.7.7.8.-.4.2.2.c.-.9.8.6.6.-.2.a.2.6.1.8.8.7.5.5.0.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.c.Y.D.C.0.H.c.i.P...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.7.c.-.0.0.0.1.-.0.0.1.4.-.6.e.9.4.-.b.b.1.0.a.6.6.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.8.7.8.1.9.7.4.a.f.c.0.0.4.b.c.4.9.2.3.5.6.4.4.0.0.6.6.8.c.0.e.0.0.0.0.0.9.0.8.!.0.0.0.0.b.d.7.4.d.f.d.4.1.4.0.7.8.a.5.e.c.b.6.6.a.3.d.9.0.4.0.6.a.1.f.0.8.0.9.7.2.3.d.d.!.7.c.Y.D.C.0.H.c.i.P...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9172.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jan 10 21:24:44 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	40786
Entropy (8bit):	1.9063630154488118
Encrypted:	false
SSDEEP:	96:5n8yn+/iWaq36sJ14/0DyHb9sBqOQpJ/L2i7kwV2LclRrC4Bnsmk3y//HYUsC+xA:eymzQ9oMD/KOkMBn4y/cC+xIu4LXBMy
MD5:	45C123DDE655426E7823258B757B415C
SHA1:	3E4665FA157A55A5FF3F7EAED8B611703186FE9A
SHA-256:	65639B7987B1581D1C82CC5E87DD564A75E32C319421AD9DC491887395DB0E26
SHA-512:	C5F0E222EEF21D24AAB51E3B6E45039549F5C242B58D56F6D2243F3C90969BE7FCBD12A81B9A9106B365F9C053578A6EE8C0D914CA20202CD3F46A6B12963D63
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g.........................................'..........T.......8...........T...........h..............d...........P...............................................................................eJ..............GenuineIntel............T.......\|......g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER922E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8296
Entropy (8bit):	3.6968405866189147
Encrypted:	false
SSDEEP:	192:R6l7wVeJHC6Q6YcDnSU9QZwAgmfP6Wprj89bKAsfkAOm:R6lXJi6Q6YQSU9sNgmfPkKTfx
MD5:	308A0B1E83A680DBFA618BDC32425D42
SHA1:	B4B6E9026180F13DD1DC4F5024C039DFC00B0F4F
SHA-256:	6E665E597BB987FB02D28FC9B7804B4BBBF4D5F15C1BC3F16E31AAC18115CCAF
SHA-512:	3C78270632F068E9F257BFC6F1230EF2B869A3EA7E8A7E78E29A0C77567EC855BC011E26C2D54A0A3DB0E4C9A289D358E727F1BF6DD686272922205A9A415895
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.4.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER926E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.46832693129127
Encrypted:	false
SSDEEP:	48:cvIwWl8zsPQbiJg77aI9fNJrNKWpW8VYOYm8M4JEHZhsFz+q81X+QBhdzRznId:uIjfPOwI7JNJrNr7VmJbCxzRznId
MD5:	12E9CA33C22737E1665864E633BA65F9
SHA1:	55F6A87C2E359C374F0FA10F1AE8F6AA44CB4C26
SHA-256:	B74B7FB14C14CD5B0D0DD5377521398983F0BA0F91B815BECAE85966A9521F39
SHA-512:	C33725CE483AD80E92DC9B4D21FA95A5DD4EA8EEAFD32C6D2E0FDF724F2DE905087ECDF6492401521543638E57F20C9F3046D01B8828A20BA814C2852A07EA28
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="670347" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.39389706357466
Encrypted:	false
SSDEEP:	6144:5l4fiJoH0ncNXiUjt10q0G/gaocYGBoaUMMhA2NX4WABlBuNFROBSqa:P4vF0MYQUMM6VFYPRU
MD5:	601B18F4897E4670E815EBAA2F3A79E9
SHA1:	B9E2BCE9D34DB48D6F4424973F324495CC1F1217
SHA-256:	28730CDEAB19335583CDED0042FAFAFEEC1AABE5F511C7EEFFF564E97F7FE926
SHA-512:	FFDA14F4F4B5FF67DE45233A52AD90E47F826C3DD0A88F000910D2BA8438ED6D0B6D66385F299C4AA16755C369D44224CE456230C0B401A6A43DEAF9A6C8DFC7
Malicious:	false
Reputation:	low
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.a...c.................................................................................................................................................................................................................................................................................................................................................$........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.97514741518638
TrID:	Win32 Executable (generic) a (10002005/4) 99.70% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7cYDC0HciP.exe
File size:	1'188'352 bytes
MD5:	48e0fecb7987f8d53c38f8228dd06218
SHA1:	bd74dfd414078a5ecb66a3d90406a1f0809723dd
SHA256:	c0046b11b67425d2a5fc835771ba13a28baf13780f21c0426b2fcdac8a6f1a3f
SHA512:	c3ca438d1dde59094f2d5bcb3e3c437ef1fe7b5066cfe5d73736c5d8de0ee470990651a10e7b58b18c6fc314ba4ab5b59a3db16c3992f5c6351a48c0ac2f76cf
SSDEEP:	24576:5tb20pkaCqT5TBWgNjVYZhaJ0p2qejxgIYtX6:KVg5tjVYZi0p2BVPYt
TLSH:	F645CF1373DDC360C7726273BA25B701AE7B782506B5F86B2FD8093DA920162525EB73
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x425f74
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6757CB83 [Tue Dec 10 05:02:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	c1d258acab237961164a925272293413

Entrypoint Preview

Instruction
call 00007FF8F889440Fh
jmp 00007FF8F8887424h
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FF8F88875AAh
cmp edi, eax
jc 00007FF8F888790Eh
bt dword ptr [004C0158h], 01h
jnc 00007FF8F88875A9h
rep movsb
jmp 00007FF8F88878BCh
cmp ecx, 00000080h
jc 00007FF8F8887774h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FF8F88875B0h
bt dword ptr [004BA370h], 01h
jc 00007FF8F8887A80h
bt dword ptr [004C0158h], 00000000h
jnc 00007FF8F888774Dh
test edi, 00000003h
jne 00007FF8F888775Eh
test esi, 00000003h
jne 00007FF8F888773Dh
bt edi, 02h
jnc 00007FF8F88875AFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FF8F88875B3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FF8F8887605h
bt esi, 03h
jnc 00007FF8F8887658h
movdqa xmm1, dqword ptr [esi+00h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2012 UPD4 build 61030
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb7004	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x59098	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb2730	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8b54f	0x8b600	f437a6545e938612764dbb0a314376fc	False	0.5699499019058296	data	6.680413749210956	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8d000	0x2cc42	0x2ce00	ede9d722bf5e27d1f93aaf9e53240a22	False	0.3183049704038997	data	5.682422502790088	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xba000	0x9d54	0x6200	e0a519f8e3a35fae0d9c2cfd5a4bacfc	False	0.16402264030612246	data	2.002691099965349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc4000	0x59098	0x59200	fa21af236b261a4501ffc725221fe61a	False	0.9260195696002805	data	7.887531887084191	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11e000	0xa474	0xa600	583c8e8dd8fd50de8aa1ba67df48e8de	False	0.0015060240963855422	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xc8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xca038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xca4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xca4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcaa84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcc7b8	0x503a0	data			1.000337788489629
RT_GROUP_ICON	0x11cb58	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x11cbd0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x11cbe4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x11cbf8	0x14	data	English	Great Britain	1.25
RT_VERSION	0x11cc0c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x11cce8	0x3b0	ASCII text, with CRLF line terminators	English	Great Britain	0.5116525423728814

Imports

DLL	Import
KERNEL32.DLL	HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
ADVAPI32.dll	GetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
COMCTL32.dll	ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
GDI32.dll	SetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit
PSAPI.DLL	GetProcessMemoryInfo
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
USERENV.dll	UnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
WSOCK32.dll	__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:24:39.301553965 CET	1.1.1.1	192.168.2.9	0x6931	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:24:39.301553965 CET	1.1.1.1	192.168.2.9	0x6931	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 7cYDC0HciP.exePID: 7548, Parent PID: 3504

General

Target ID:	0
Start time:	16:24:43
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\7cYDC0HciP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7cYDC0HciP.exe"
Imagebase:	0x560000
File size:	1'188'352 bytes
MD5 hash:	48E0FECB7987F8D53C38F8228DD06218
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 7664, Parent PID: 7548

General

Target ID:	4
Start time:	16:24:43
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7548 -s 564
Imagebase:	0x530000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 7cYDC0HciP.exePID: 7548, Parent PID: 3504COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	66.7%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00585F74 Relevance: 1.5, APIs: 1, Instructions: 2
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___security_init_cookie.LIBCMT ref: 00585F74

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 28742cf887f87717dfdcdc37c7df994b001693991d45e4ac740532fb454b581c
Instruction ID: 5d348772e641156c45ddd991a66b79af7bb69d98ab49ad3d6d12f8b902b60fa0
Opcode Fuzzy Hash: 28742cf887f87717dfdcdc37c7df994b001693991d45e4ac740532fb454b581c
Instruction Fuzzy Hash:

Non-executed Functions

Function 00566F07 Relevance: 14.6, Strings: 11, Instructions: 883COMMON

Download Yara Rule

Strings

TMK, xrefs: 005E2EA0
JJJ J, xrefs: 00567096, 0056709C
LK, xrefs: 005E2CB0
HMK, xrefs: 005E2E7D
0MK, xrefs: 005E2E09
4MK, xrefs: 005E2E26
dMK, xrefs: 005E2EBA
@MK, xrefs: 005E2E60
J, xrefs: 00566F77
8MK, xrefs: 005E2E43
LK, xrefs: 005E2C8F

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID: J$0MK$4MK$8MK$@MK$HMK$TMK$dMK$LK$LK$JJJ J
API String ID: 0-3636012664
Opcode ID: 7396a4921f9da90dd1aae6694be548c28df0cce0295820056248e47a2d119cc0
Instruction ID: 8c56c945babda9a6d50fc6da8c0d1e72b97ce4b1eb88775245d03d6a648233d8
Opcode Fuzzy Hash: 7396a4921f9da90dd1aae6694be548c28df0cce0295820056248e47a2d119cc0
Instruction Fuzzy Hash: E772AF71E042699BDF28CF59C8847BEBBB5BF48310F10856AE845EB385DB709E41CB94

Function 00569B60 Relevance: 8.6, Strings: 6, Instructions: 1055COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00569ED4
VUUU, xrefs: 005EBE14
VUUU, xrefs: 00569E95
ERCP, xrefs: 00569C32
J, xrefs: 00569CF3
VUUU, xrefs: 00569EA7

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU$J
API String ID: 0-165364503
Opcode ID: 2ecaaabf99493e62742f510353e2728d7fc508ad6fcb74dfa7882aba823fda17
Instruction ID: 835cb49ce6691e707f822efee59033ec60d5009f78be3503e156232eb45fb7b7
Opcode Fuzzy Hash: 2ecaaabf99493e62742f510353e2728d7fc508ad6fcb74dfa7882aba823fda17
Instruction Fuzzy Hash: AB92C171E0025ACBDF28CF59C8847BDBFB1BB54310F2485AAD85AAB280D7719D81CF91

Function 00573B70 Relevance: 5.9, Strings: 4, Instructions: 903COMMON

Download Yara Rule

Strings

L, xrefs: 005740A4
@, xrefs: 00574176
L, xrefs: 005D701F
L, xrefs: 005740EC

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: @$ L$ L$ L
API String ID: 3728558374-1044802042
Opcode ID: b5964f1e026a47ba72ebc0a1536dd1620bb921c08ef00ae8d80e8d101f688ce6
Instruction ID: fbadc00048536e30f3f6a000877de31f60baeeb56da03cf810c9c4b2ee4501d0
Opcode Fuzzy Hash: b5964f1e026a47ba72ebc0a1536dd1620bb921c08ef00ae8d80e8d101f688ce6
Instruction Fuzzy Hash: 7C72BC34E042099FCB20DF98D485AAEBFB5FF88310F14C45AE909AB351D774AE45EB91

Function 005A13CA Relevance: 5.6, Strings: 4, Instructions: 560COMMON

Download Yara Rule

Strings

<2K, xrefs: 005A16FA
(, xrefs: 005A1422
,2K, xrefs: 005A16B1
|, xrefs: 005A140C

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID: ($,2K$<2K$|
API String ID: 0-2182472957
Opcode ID: 213d0035b0e57d45600f3f895b131fcd5407090fede8e37bb721a3d1f7665a0b
Instruction ID: 1fd276ad9db49ccd39bb01a1a10ed30f0e3f209f7fd6c9f96bf10d96439b9921
Opcode Fuzzy Hash: 213d0035b0e57d45600f3f895b131fcd5407090fede8e37bb721a3d1f7665a0b
Instruction Fuzzy Hash: 0F321575A00A059FCB28CF69D48096ABBF0FF49320F15C56EE59ADB3A1E770E941CB44

Function 005677B0 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1054COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00567921

Strings

\QK, xrefs: 005E1028

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _memmove
String ID: \QK
API String ID: 4104443479-3628726987
Opcode ID: 7088e9255c345c521a9c7f53495c1e6fd4ed7d15cfaa04d266909762575c54c5
Instruction ID: ad42dcb8a8bcdb9cb098e75fce5be1b3b6a0fd8d0984fd82d02824cd369f6bb8
Opcode Fuzzy Hash: 7088e9255c345c521a9c7f53495c1e6fd4ed7d15cfaa04d266909762575c54c5
Instruction Fuzzy Hash: 44A25E74E04219CFDB28CF59C4806ADBBB1FF48314F2586AAD859AB391D7349E81DF90

Function 005CF7FF Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 630COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 005CF9D2

Strings

F, xrefs: 005CFF42

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcsncpy
String ID: F
API String ID: 1735881322-1304234792
Opcode ID: 513e673a684085903af3a68e9cc20ba3dff9b5133ba034c09a2775dd4a1645ce
Instruction ID: 1c7f55530673d5628140e99e6c3da7728846cf2f73612cec2d4ebf080b491c71
Opcode Fuzzy Hash: 513e673a684085903af3a68e9cc20ba3dff9b5133ba034c09a2775dd4a1645ce
Instruction Fuzzy Hash: 4B32AA74604245AFDB20CFA8C884FAABBBAFF49354F140A2EF695972A1D731DC44CB51

Function 005CAACE Relevance: 3.6, APIs: 2, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025e21823f9f0be9693c9246f0c0fa624e52a4a58c53db3003e02b2ab783a972
Instruction ID: d00c41832c9725204ad3e41949b2d2d242864c3368594e6df17ae308e81cdd6e
Opcode Fuzzy Hash: 025e21823f9f0be9693c9246f0c0fa624e52a4a58c53db3003e02b2ab783a972
Instruction Fuzzy Hash: FD12BC71A00209AFEB258FA4CC4AFAE7FB8FF85314F14452DF919AA2D1DB748941CB11

Function 0058B043 Relevance: 3.5, APIs: 2, Instructions: 537COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 932d5e09fce22460d026d46474cb082544f819b06526096441e0640c5341d979
Instruction ID: ed2510f511bb0d05a5b305d45fbd8f43e4f66c26fd4505f25cc29cc39ecad7fb
Opcode Fuzzy Hash: 932d5e09fce22460d026d46474cb082544f819b06526096441e0640c5341d979
Instruction Fuzzy Hash: DE325075B022198FDB24AF54DC45AE9BBB9FF46310F1441D9E80AE7A91D7309E80CF52

Function 00567FA3 Relevance: 2.3, APIs: 1, Instructions: 796COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00567921

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: f30726d6958df742ada3bc9553f3ed09786250dd05e130d10e93340a3810d49a
Instruction ID: bb702fd3329c18a84daca7d84f4581e0c6df4b62f92d688bfad9840de0a031ad
Opcode Fuzzy Hash: f30726d6958df742ada3bc9553f3ed09786250dd05e130d10e93340a3810d49a
Instruction Fuzzy Hash: F9629075E00259DFCF28CF59C4806ADBBB2FF88314F25865AD895AB391D770AD81CB84

Function 00573200 Relevance: 2.2, Strings: 1, Instructions: 986COMMON

Download Yara Rule

Strings

L, xrefs: 005D933E

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-249544069
Opcode ID: 77d127117cea5bc33be22513d70d8147984e86480c07347cb84d6615beb16583
Instruction ID: aba36105046a05833215bbc56ba5671385d6a8082a8d0b30b35d5e2be7201bbf
Opcode Fuzzy Hash: 77d127117cea5bc33be22513d70d8147984e86480c07347cb84d6615beb16583
Instruction Fuzzy Hash: 37928A70608341DFD724DF18D484B6ABBE1BF88314F14886EE98A8B362D771ED45EB52

Function 0058D1B9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c728a019a251dc71abe01092ac8050e92b83019d64a38dfaf4092ab5920baa3
Instruction ID: 0bd1d64767e23e9081128388fc7ae9603441d410198466ae170b61683c2131b3
Opcode Fuzzy Hash: 5c728a019a251dc71abe01092ac8050e92b83019d64a38dfaf4092ab5920baa3
Instruction Fuzzy Hash: 04321522D29F014DD723A634C922336A799BFB73D4F15D737EC19B59AAEB28C4834214

Function 005696C0 Relevance: 2.1, APIs: 1, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 5f7fe3ca82132ec9865668fd4424337fbc9ac292ff05e2628545d2ad5397e491
Instruction ID: 897406380ca36315da9b5e39b298c9c8d74f538a1cc5592ec348d80d69cfd99f
Opcode Fuzzy Hash: 5f7fe3ca82132ec9865668fd4424337fbc9ac292ff05e2628545d2ad5397e491
Instruction Fuzzy Hash: 7A2257716083029FD724DF18C895B6ABFE9BFC4310F14491EF99A9B291DB71E944CB82

Function 0059038E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06bbaeb1bcc534ec256dd5b5d585b6de8006006e2b3e3cdbfaef78062e17ea4a
Instruction ID: d04b3fbfc9ba624153aad40f14ec04b628d51abbf58551e212db5dbef005cbd3
Opcode Fuzzy Hash: 06bbaeb1bcc534ec256dd5b5d585b6de8006006e2b3e3cdbfaef78062e17ea4a
Instruction Fuzzy Hash: CDB1F420D2AF414DD72396398831336BB5C6FBB2D5FA1D72BFC1A74D62EB2185934284

Function 005AB6CC Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 005AB6DF

Part of subcall function 0058344A: __aulldiv.LIBCMT ref: 00583473

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: __aulldiv__time64
String ID:
API String ID: 325419493-0
Opcode ID: f8c7fdc095501e1a7362a0b4cc7a48e3a2c9a4e74b9e0d285671c9b74daca32a
Instruction ID: bf255534c4da069e96bc42e21e9ccf46651ef4e5461bf446c43909662569afb3
Opcode Fuzzy Hash: f8c7fdc095501e1a7362a0b4cc7a48e3a2c9a4e74b9e0d285671c9b74daca32a
Instruction Fuzzy Hash: 2B21D2766305108BD729CF28C881A96BBE0EB95311B248E7DE4E5CB2D1CB74B905CB98

Function 005693F0 Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a8534ed2f0a89ac6e7169b63d51ce6c08bd617fc6664a61c85acdbf4f076445
Instruction ID: 0da1c40165dd762092ce7b16884d13ee00ceb9a0ae6d00d4052564cc07effef5
Opcode Fuzzy Hash: 1a8534ed2f0a89ac6e7169b63d51ce6c08bd617fc6664a61c85acdbf4f076445
Instruction Fuzzy Hash: 6F129170A0020ADFDF14DFA9D985AAEBBF9FF58300F10456AE806E7250EB35AD11CB54

Function 0056E3E3 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ffa93417b0b4bc0b97aad7226db4dd8b30a2187279d0b979da24b40810fc03
Instruction ID: 4304591a6dc98998e395234b69f5a18fc59d667c5d2222c4e29ac914c3bc08cf
Opcode Fuzzy Hash: 41ffa93417b0b4bc0b97aad7226db4dd8b30a2187279d0b979da24b40810fc03
Instruction Fuzzy Hash: 4312CF7890121ACFDB24DF58D486AAEBFF1FF58304F14846AD84A9B351E731AD81CB91

Function 0056AF50 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID:
API String ID: 3728558374-0
Opcode ID: 6efcfca7aac5f57af79c65e8a6eed45e1d76075d1f5c80d3e59fd3841deb7b70
Instruction ID: b4009650dc4df81fb7739b5b9e051e9db10f94d7078d9b078c3cc0ccf6067382
Opcode Fuzzy Hash: 6efcfca7aac5f57af79c65e8a6eed45e1d76075d1f5c80d3e59fd3841deb7b70
Instruction Fuzzy Hash: 0402B370A00206DBDF14DF68D995AAEBFB5FF88300F10846AE806DB355EB35DA51CB91

Function 005C31BC Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 0db687a5c996a4c2d7a9b4172f84bdbd9adc5b38ad9b7c5ed605c875a3498890
Instruction ID: 7efa4718ac66db313c6b94b5f1cd1846739fe6f832f239eca2a701c5676cfe93
Opcode Fuzzy Hash: 0db687a5c996a4c2d7a9b4172f84bdbd9adc5b38ad9b7c5ed605c875a3498890
Instruction Fuzzy Hash: 19E15735604205AFCB15DF68C995E2ABFE8FF89314B04886DF44ADB2A1DB30E905CB52

Function 0057B11F Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cf0e01d325c05872215fadf7fd1876a518e877bd8c73a3ee908c1b70c179c08
Instruction ID: 3b70b0c81d74a9ae1d41bf5a01dd18ce9aa7d16e4e5c3237cdcdb353957b2370
Opcode Fuzzy Hash: 7cf0e01d325c05872215fadf7fd1876a518e877bd8c73a3ee908c1b70c179c08
Instruction Fuzzy Hash: EAA1F474115106BAFA386A6D7C8EFBF2D5DFB86344B50C91FF40ADA292DB149C01B272

Function 005802A4 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction ID: c941664ec711522c3a0343e5924e147cff3a0d8ae663b64637ea8086af946ba2
Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction Fuzzy Hash: 58C1A5322051930ADFAD8A3A943443EBEA17A917B131A577DDCB7DB4D5EF20C528D720

Function 005806D9 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction ID: 771a34b8940f7fe76b99784d98bf1121de7585424d7b2ce28815a477b8aca08a
Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction Fuzzy Hash: 81C1913220519309DFAD8639843443EBEA17AA2BB131A677DDCB7DB4D5EF20D528D720

Function 0057FE6F Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 3e8e7dc34b64763ad0dae4eeb32f1ecf04807366b9459508fc36c2f1aecca408
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: C4C1D43220519309DFAD8A39D43443EBEA57AA27B131A577DD8B7CB4D1EF20C528E710

Function 0057FA57 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: ce657831f6ed23990f4c16aa6a9e45d2bf336986c48518f425bad5c0164b0fa4
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: FAC1823221909309DB6DCA39A43443EBFA56AA17B131A877DD8BACB5D5EF10C524E720

Function 005AFA0C Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 005AFA96
_wcschr.LIBCMT ref: 005AFAA4
_wcscpy.LIBCMT ref: 005AFABB
_wcscat.LIBCMT ref: 005AFACA
_wcscat.LIBCMT ref: 005AFAE8
_wcscpy.LIBCMT ref: 005AFB09
__wsplitpath.LIBCMT ref: 005AFBE6
_wcscpy.LIBCMT ref: 005AFC0B
_wcscpy.LIBCMT ref: 005AFC1D
_wcscpy.LIBCMT ref: 005AFC32
_wcscat.LIBCMT ref: 005AFC47
_wcscat.LIBCMT ref: 005AFC59
_wcscat.LIBCMT ref: 005AFC6E

Part of subcall function 005ABFA4: _wcscmp.LIBCMT ref: 005AC03E
Part of subcall function 005ABFA4: __wsplitpath.LIBCMT ref: 005AC083
Part of subcall function 005ABFA4: _wcscpy.LIBCMT ref: 005AC096
Part of subcall function 005ABFA4: _wcscat.LIBCMT ref: 005AC0A9
Part of subcall function 005ABFA4: __wsplitpath.LIBCMT ref: 005AC0CE
Part of subcall function 005ABFA4: _wcscat.LIBCMT ref: 005AC0E4
Part of subcall function 005ABFA4: _wcscat.LIBCMT ref: 005AC0F7

Strings

t2K, xrefs: 005AFC97

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
String ID: t2K
API String ID: 2955681530-2697450999
Opcode ID: 8798d7e8ab2972a22761d006a6a6d7caa3ae8dbe39d238e9f724702d96fbc902
Instruction ID: 54eacdc1ed2c13460c07be48fe7a146c70e18fcc325eb835dc28505706330bbd
Opcode Fuzzy Hash: 8798d7e8ab2972a22761d006a6a6d7caa3ae8dbe39d238e9f724702d96fbc902
Instruction Fuzzy Hash: C4919F72604306AFDB20EF54C855E9EBBE8BF85310F044869F94997291DB31FE48CB92

Function 0056CC24 Relevance: 18.3, APIs: 12, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wcsnicmp.LIBCMT ref: 0056CC68
__wcsnicmp.LIBCMT ref: 0056CC80
__wcsnicmp.LIBCMT ref: 0056CC98
__wcsnicmp.LIBCMT ref: 0056CCB0
__wcsnicmp.LIBCMT ref: 0056CCC8
__wcsnicmp.LIBCMT ref: 0056CCE0
__wcsnicmp.LIBCMT ref: 0056CCF8
__wcsnicmp.LIBCMT ref: 0056CD0C
__wcsnicmp.LIBCMT ref: 0056CD4D
__wcsnicmp.LIBCMT ref: 0056CD61
__wcsnicmp.LIBCMT ref: 0056CD75
__wcsnicmp.LIBCMT ref: 0056CD89

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: __wcsnicmp
String ID:
API String ID: 1038674560-0
Opcode ID: 6148897f4c34d6491561c82914e9792e52891cf6fc28d7f80cc6e4f2f12dad58
Instruction ID: 37a93a99ff1c9cbe93e68af3b9eebde7c9700f84b2f1dc4dcb1b904da0c9cbfe
Opcode Fuzzy Hash: 6148897f4c34d6491561c82914e9792e52891cf6fc28d7f80cc6e4f2f12dad58
Instruction Fuzzy Hash: BB81D830640206BADB24AF68DC57FBA3F78FF64300F144536F945AB282EA61D941D7A5

Function 005A6CE9 Relevance: 18.2, APIs: 12, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 005A6D4F
_wcscmp.LIBCMT ref: 005A6D5A
_wcscat.LIBCMT ref: 005A6D70
_wcsstr.LIBCMT ref: 005A6D7B
_wcscat.LIBCMT ref: 005A6DE0
_wcscat.LIBCMT ref: 005A6DE7
_wcsncpy.LIBCMT ref: 005A6E12

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscat$_wcscmp_wcscpy_wcsncpy_wcsstr
String ID:
API String ID: 3576275495-0
Opcode ID: 1e8447ed9fc16e154d648348208776be1c0f899143b705094d37cd1c4ad9c9f4
Instruction ID: dd79aac712157968e4c3af5cc8905b7052987479d40e5132215182f00b328791
Opcode Fuzzy Hash: 1e8447ed9fc16e154d648348208776be1c0f899143b705094d37cd1c4ad9c9f4
Instruction Fuzzy Hash: C141E872A042027BEB00BB64DC4BEBF7F7CFF81710F14442AF905B6182EA749A059765

Function 005A690B Relevance: 18.1, APIs: 12, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcschr.LIBCMT ref: 005A6923
_wcscpy.LIBCMT ref: 005A6934
__wsplitpath.LIBCMT ref: 005A6958
__wsplitpath.LIBCMT ref: 005A6979
_wcscpy.LIBCMT ref: 005A699B
_wcscpy.LIBCMT ref: 005A69B9
_wcscpy.LIBCMT ref: 005A69C7
_wcscat.LIBCMT ref: 005A69D6
_wcscat.LIBCMT ref: 005A6A2B
_wcscat.LIBCMT ref: 005A6A61
_wcscat.LIBCMT ref: 005A6A73

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
String ID:
API String ID: 136442275-0
Opcode ID: d61e9edc43eb21dc305860e20555fab4e9811c7e7a0782106bb1dba9aa94a74c
Instruction ID: 9517e8a76ea98531fcdc265430c581f330e2085abefbd2ba351b18d3a9c5946d
Opcode Fuzzy Hash: d61e9edc43eb21dc305860e20555fab4e9811c7e7a0782106bb1dba9aa94a74c
Instruction Fuzzy Hash: BB411D7784511DAECF61EB90CC46DCFB7BCBB84300F0041A6BA59B2051EA70ABE98F54

Function 0058500E Relevance: 16.8, APIs: 11, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00585047

Part of subcall function 00587C0E: __getptd_noexit.LIBCMT ref: 00587C0E

__gmtime64_s.LIBCMT ref: 005850E0
__gmtime64_s.LIBCMT ref: 00585116
__gmtime64_s.LIBCMT ref: 00585133
__allrem.LIBCMT ref: 00585189
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005851A5
__allrem.LIBCMT ref: 005851BC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005851DA
__allrem.LIBCMT ref: 005851F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0058520F
__invoke_watson.LIBCMT ref: 00585280

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction ID: f12402aa1266a559c17e8e354b6a2f7e2877e95dafadfafeb033b2be412da9d1
Opcode Fuzzy Hash: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction Fuzzy Hash: 6271C575A01F17ABDB14BE79CC49BAA7BA8BF40364F144229ED15E6281FB70D9408BD0

Function 005AF5FA Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 278
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__swprintf.LIBCMT ref: 005AF72E
__swprintf.LIBCMT ref: 005AF767
__swprintf.LIBCMT ref: 005AF7BB

Part of subcall function 0058172B: __woutput_l.LIBCMT ref: 00581784

__swprintf.LIBCMT ref: 005AF809
__swprintf.LIBCMT ref: 005AF858
__swprintf.LIBCMT ref: 005AF8A7
__swprintf.LIBCMT ref: 005AF8F6

Strings

9K, xrefs: 005AF7B0

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: __swprintf$__woutput_l
String ID: 9K
API String ID: 1571530113-196837694
Opcode ID: 719a001bf592241279936c11551fac8019408ba57f3921e8acc488db3792300a
Instruction ID: ec0d6aa0d519e07cfe8948de3d066a28190a3877f1356666bb28ee2a9d36252c
Opcode Fuzzy Hash: 719a001bf592241279936c11551fac8019408ba57f3921e8acc488db3792300a
Instruction Fuzzy Hash: D9A10DB2408245ABC311EB94C889DAFBBECFF98704F444D2EB585C7151EB34D949CB62

Function 0056C833 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 479
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsplitpath.LIBCMT ref: 0056C93E

Part of subcall function 00581DFC: __wsplitpath_helper.LIBCMT ref: 00581E3C

_wcscpy.LIBCMT ref: 0056C953
_wcscat.LIBCMT ref: 0056C968

Part of subcall function 0056B337: _wcscpy.LIBCMT ref: 0056B36F

Strings

AU3!, xrefs: 0056C90C
EA06, xrefs: 005D30C9

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscpy$__wsplitpath__wsplitpath_helper_wcscat
String ID: AU3!$EA06
API String ID: 942958535-2658333250
Opcode ID: d91017b64214bce65a844dbd476cba1e93f93d1f7508d99289b1bb69c13c9563
Instruction ID: 6de04f1c22c0aaf32e38e05de945f71a95d183549a048e791daf03f38876cdd2
Opcode Fuzzy Hash: d91017b64214bce65a844dbd476cba1e93f93d1f7508d99289b1bb69c13c9563
Instruction Fuzzy Hash: B31269715083429FC724EF68C885AAEBFE5BFD9300F44492EF58997261DB30DA49CB52

Function 005A60DD Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005A725E: __wsplitpath.LIBCMT ref: 005A727B
Part of subcall function 005A725E: __wsplitpath.LIBCMT ref: 005A728E

_wcscat.LIBCMT ref: 005A6149
_wcscat.LIBCMT ref: 005A6167
__wsplitpath.LIBCMT ref: 005A618E
_wcscpy.LIBCMT ref: 005A6209
_wcscat.LIBCMT ref: 005A621C
_wcscat.LIBCMT ref: 005A622F

Strings

D7K, xrefs: 005A6138

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscat$__wsplitpath$_wcscpy
String ID: D7K
API String ID: 1339377152-4191929378
Opcode ID: d13f31206347c16688133b179fd0511736ac8aab39ef4f41029cc2fa49194ad5
Instruction ID: 0ebcd2217eeb3fe74821a33f120e02be40ed69e8142209d312d1cc687ae71023
Opcode Fuzzy Hash: d13f31206347c16688133b179fd0511736ac8aab39ef4f41029cc2fa49194ad5
Instruction Fuzzy Hash: A0511F76C0911D6ACB21EB91CC48EEFBBBCBF45300F0905EAE545E3141DA769B498FA4

Function 005ABFA4 Relevance: 10.8, APIs: 7, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005ABDB4: __time64.LIBCMT ref: 005ABDBE

Part of subcall function 00564517: _fseek.LIBCMT ref: 0056452F

__wsplitpath.LIBCMT ref: 005AC083

Part of subcall function 00581DFC: __wsplitpath_helper.LIBCMT ref: 00581E3C

_wcscpy.LIBCMT ref: 005AC096
_wcscat.LIBCMT ref: 005AC0A9
__wsplitpath.LIBCMT ref: 005AC0CE
_wcscat.LIBCMT ref: 005AC0E4
_wcscat.LIBCMT ref: 005AC0F7
_wcscmp.LIBCMT ref: 005AC03E

Part of subcall function 005AC56D: _wcscmp.LIBCMT ref: 005AC65D
Part of subcall function 005AC56D: _wcscmp.LIBCMT ref: 005AC670

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscat_wcscmp$__wsplitpath$__time64__wsplitpath_helper_fseek_wcscpy
String ID:
API String ID: 332469576-0
Opcode ID: 93f597808344f860e782e19f6c48d675a5439c55fe7c8b84123f1999b97c0d6d
Instruction ID: c85267fab0d4a0f2bb3e6a12b772cb901e097f1d1f59a38ecf9b862af8c2d95b
Opcode Fuzzy Hash: 93f597808344f860e782e19f6c48d675a5439c55fe7c8b84123f1999b97c0d6d
Instruction Fuzzy Hash: E3C1FBB1A00119AADF11DF95CC85EDEBFBDBF89310F1080AAA609E7151DB709A44CF65

Function 0059D8A7 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscmp.LIBCMT ref: 0059D8FC
_wcscmp.LIBCMT ref: 0059D95F
_wcsstr.LIBCMT ref: 0059D970
_wcscmp.LIBCMT ref: 0059D9B8
_wcscmp.LIBCMT ref: 0059DA38

Strings

@, xrefs: 0059D8C6

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscmp$_wcsstr
String ID: @
API String ID: 3312506106-2766056989
Opcode ID: 57eaeece17d193142035803e19f4c8271cdf4de3042e5770e13f33008b5824d2
Instruction ID: 323ab09af02ff83e3e851edaf6bee9f3b4b0b871e574cb9442b73a14201c19f3
Opcode Fuzzy Hash: 57eaeece17d193142035803e19f4c8271cdf4de3042e5770e13f33008b5824d2
Instruction Fuzzy Hash: B9818C3100830A9BDF05DF54C985BAA7FA8FF84314F04846AFD899A096EB34DD46CBB1

Function 005AD76A Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 005AD8C2

Strings

4:K, xrefs: 005AD816
@:K, xrefs: 005AD82C
:K, xrefs: 005AD800
`:K, xrefs: 005AD859
P:K, xrefs: 005AD842

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscpy
String ID: :K$4:K$@:K$P:K$`:K
API String ID: 3048848545-1244833726
Opcode ID: 27dd89965dd486c355bf12e5958c17b9eceaa65f898452980bc2b070e1fbd423
Instruction ID: 5164cdb130af65905ad2bc42fc3adff273fc5f7e23e48936d95992ffccced60e
Opcode Fuzzy Hash: 27dd89965dd486c355bf12e5958c17b9eceaa65f898452980bc2b070e1fbd423
Instruction Fuzzy Hash: 62518F35104302AFC700EF14D896AAEBFB9FF85314F20892DF59A576A2DB35DD05CA52

Function 0056936C Relevance: 9.1, APIs: 6, Instructions: 145COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 005693AB
__itow.LIBCMT ref: 005693DF

Part of subcall function 00581557: _xtow@16.LIBCMT ref: 00581578

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: __itow__swprintf_xtow@16
String ID:
API String ID: 1502193981-0
Opcode ID: 7769c36a9f54d1984458b68226c99e882a1d25785028ffacc96b5a3d2d0ea043
Instruction ID: a668359f45d10c1a0d5b29e30821a9e33d27a4e065d5abe5b6d68112d1cd13ee
Opcode Fuzzy Hash: 7769c36a9f54d1984458b68226c99e882a1d25785028ffacc96b5a3d2d0ea043
Instruction Fuzzy Hash: AD41E532611205EBDB24EF78D946EAA7FE8FF84300F20486FE54AD7291EA319D41DB11

Function 005A7555 Relevance: 9.1, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 005A75E2

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: d4c9a3347340ec2f6b292e15ccfd5db41bd16ad9e0c1aa6c8d3ee4a06672525c
Instruction ID: 4df9dc6aa867ce08904b85015c881ccf2cc1a3a234fd1bb414b7168666878813
Opcode Fuzzy Hash: d4c9a3347340ec2f6b292e15ccfd5db41bd16ad9e0c1aa6c8d3ee4a06672525c
Instruction Fuzzy Hash: 09512DB2A0921D9BDF60EB94DC459DE7BBCAF4D310B0044AAFA05E3141EA74D6C9CF64

Function 005A7DB1 Relevance: 9.1, APIs: 6, Instructions: 137COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 005A7DF3
_wcsncpy.LIBCMT ref: 005A7E25
_wcsncpy.LIBCMT ref: 005A7E58
_wcsncpy.LIBCMT ref: 005A7E9A
_wcsncpy.LIBCMT ref: 005A7ED4
_wcsncpy.LIBCMT ref: 005A7F03

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcsncpy
String ID:
API String ID: 1735881322-0
Opcode ID: 82a3674f3e19fbdef0c818efbcbf46cd2e7acf95712a327e08f2885954205449
Instruction ID: 508b327dbc0ec1aa81321ff03323d254e64e342dfa2a3c741f6b0ca356b186ab
Opcode Fuzzy Hash: 82a3674f3e19fbdef0c818efbcbf46cd2e7acf95712a327e08f2885954205449
Instruction Fuzzy Hash: 39415E66D102197ACB10BBF48C4A9CFBFACBF45310F508966E905F3161FA34E615C3A9

Function 005B16DA Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 309COMMON

Download Yara Rule

APIs

Part of subcall function 0056936C: __swprintf.LIBCMT ref: 005693AB
Part of subcall function 0056936C: __itow.LIBCMT ref: 005693DF

Part of subcall function 0057C6F4: _wcscpy.LIBCMT ref: 0057C717

_wcstok.LIBCMT ref: 005B184E
_wcscpy.LIBCMT ref: 005B18DD
_memset.LIBCMT ref: 005B1910

Strings

X, xrefs: 005B1948
p2Kl2K, xrefs: 005B1920

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X$p2Kl2K
API String ID: 774024439-158789027
Opcode ID: 6197bbc515bfbc98f9987be406cffc171f345c4ee518ea2fe1228caf3bcba2a9
Instruction ID: 2406039c698f2584324a8bbd8b53050605d7ec6e90b3757d01d82005846fe56b
Opcode Fuzzy Hash: 6197bbc515bfbc98f9987be406cffc171f345c4ee518ea2fe1228caf3bcba2a9
Instruction Fuzzy Hash: 81C19E316047429FC754EF24C999AAABFE4FF85350F40492DF889972A2DB30EC05CB96

Function 005AD0B8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 005AD0FA
_memset.LIBCMT ref: 005AD17B
_wcsncpy.LIBCMT ref: 005AD1B7

Strings

:, xrefs: 005AD11B
\, xrefs: 005AD110

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: __swprintf_memset_wcsncpy
String ID: :$\
API String ID: 214737766-1166558509
Opcode ID: b68ac97a0bbf8f074f79a283de7a9c19f5e6387d087e4f1df6f20452fc066d1a
Instruction ID: d8358708e12c8326a966ad384c8c2c1d821b547b93aa683638dafb88eecebfdb
Opcode Fuzzy Hash: b68ac97a0bbf8f074f79a283de7a9c19f5e6387d087e4f1df6f20452fc066d1a
Instruction Fuzzy Hash: AF31637690010AABDB21AFA4DC49FAF7BBCBF89740F1044B9F909D21A1E6709645CB34

Function 0059CF50 Relevance: 7.8, APIs: 5, Instructions: 273COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 0059D032
_wcscmp.LIBCMT ref: 0059D045
_wcscmp.LIBCMT ref: 0059D0D6
_wcscmp.LIBCMT ref: 0059D248
_wcscmp.LIBCMT ref: 0059D282

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscmp$__swprintf
String ID:
API String ID: 1620681296-0
Opcode ID: 1c52813d1dd22c810bf321a69279f4fa802cf737a72b6e5702cafbb6e43a2120
Instruction ID: 1d7a07a4255784bbc5f51ce1d150b52d2105acb137ec361dc3ca1c04d9a167fe
Opcode Fuzzy Hash: 1c52813d1dd22c810bf321a69279f4fa802cf737a72b6e5702cafbb6e43a2120
Instruction Fuzzy Hash: 48A1C271604706AFDF15DF64C888BAABBA8FF44354F104929F999D3190EB30E946CBA1

Function 0058A979 Relevance: 7.6, APIs: 5, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 0058A991

Part of subcall function 00587D7C: __FF_MSGBANNER.LIBCMT ref: 00587D91
Part of subcall function 00587D7C: __NMSG_WRITE.LIBCMT ref: 00587D98
Part of subcall function 00587D7C: __malloc_crt.LIBCMT ref: 00587DB8

__lock.LIBCMT ref: 0058A9A4
__lock.LIBCMT ref: 0058A9F0

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: __lock$__malloc_crt__mtinitlocknum
String ID:
API String ID: 1818312207-0
Opcode ID: 9e49298281f73815b4fa3fb984943fc94ecb06dcc50e504b9963bd177dc87d8e
Instruction ID: 8cbb7f6f0c45175973d7085317c4a5167a3102776e137c83d3f8d30451a59e53
Opcode Fuzzy Hash: 9e49298281f73815b4fa3fb984943fc94ecb06dcc50e504b9963bd177dc87d8e
Instruction Fuzzy Hash: B2413B719002069BFB18BFA8C94575CBFB0BF45335F24422AEC25BB5D1D7B49940CB96

Function 005A63F9 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

_wcscat.LIBCMT ref: 005A6441
__wsplitpath.LIBCMT ref: 005A645F
_wcscpy.LIBCMT ref: 005A64A3
_wcscat.LIBCMT ref: 005A64B8
_wcscat.LIBCMT ref: 005A64CA

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscat$__wsplitpath_wcscpy
String ID:
API String ID: 3240238573-0
Opcode ID: 207bf40969deb6b3d3afc2ff0a38490a33ffcbdb27faad35d926c948b6f8fdd0
Instruction ID: 91706c23e65b68f49d7396ad335446d7fed91299055ebdeb02e62995598abc74
Opcode Fuzzy Hash: 207bf40969deb6b3d3afc2ff0a38490a33ffcbdb27faad35d926c948b6f8fdd0
Instruction Fuzzy Hash: 743195B24083445AC721EBA488899DFBBDC7F9A310F44092EF9D4C3141EA35D50D8767

Function 00587B47 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00587B47

Part of subcall function 0058123A: __initp_misc_winsig.LIBCMT ref: 0058125E

__mtinitlocks.LIBCMT ref: 00587B4C
__mtterm.LIBCMT ref: 00587B55

Part of subcall function 00587BBD: _free.LIBCMT ref: 00587D46

__calloc_crt.LIBCMT ref: 00587B7A

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: __calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
String ID:
API String ID: 3525174695-0
Opcode ID: fff7101387f9233e62c941087eac264b93e49a4ba47622118098bae08e948c6b
Instruction ID: 656e08a1454d83a2a8cab70b1cfc2a83c139d3d86bc01bee963b40aabc5e7696
Opcode Fuzzy Hash: fff7101387f9233e62c941087eac264b93e49a4ba47622118098bae08e948c6b
Instruction Fuzzy Hash: 4CF0623251D65B1AE62476747C4AA4A2E85BF49731B3046A9FC64F50D1FB21C8414364

Function 0059ACC5 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 223COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0059AD08

Strings

, xrefs: 0059AD17
H*K, xrefs: 0059AE40

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _memset
String ID: $H*K
API String ID: 2102423945-3630131256
Opcode ID: c01634c42d0ae3b9110cd245596c32bc6af3986347a388132d2fb5226a9e64dc
Instruction ID: adce3988caeb48ef1728a7722b956b77a0ac0ada5366b5e0329b8c2d80e4e9ae
Opcode Fuzzy Hash: c01634c42d0ae3b9110cd245596c32bc6af3986347a388132d2fb5226a9e64dc
Instruction Fuzzy Hash: EE817B71801209AFDF119FA4DC49AEEBFB9FF08304F144129F814A61A1D7718E55DBB1

Function 00564A30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

_wcscat.LIBCMT ref: 005D2D80
_wcscat.LIBCMT ref: 005D2DB5

Strings

\, xrefs: 005D2DA2
8!L, xrefs: 00564B1C

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscat
String ID: 8!L$\
API String ID: 2563891980-2772976860
Opcode ID: fa8a9e684f192d5f0ec16de0341574a8dd1ab902b51a2da00cf2f8cb0f237409
Instruction ID: f223f87252204c865aa4b12226401cf04faa0b81a3352c5a734f2f9455df28c5
Opcode Fuzzy Hash: fa8a9e684f192d5f0ec16de0341574a8dd1ab902b51a2da00cf2f8cb0f237409
Instruction Fuzzy Hash: 23518F754043419FC754EF59DA85CAABBF4BE99300B44493EF68493261EFF09A08CB5A

Function 005834AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__getstream.LIBCMT ref: 005834FE

Part of subcall function 00587C0E: __getptd_noexit.LIBCMT ref: 00587C0E

@_EH4_CallFilterFunc@8.LIBCMT ref: 00583539
__wopenfile.LIBCMT ref: 00583549

Strings

<G, xrefs: 005834CD, 005834F0, 005834FC

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
String ID: <G
API String ID: 1820251861-2138716496
Opcode ID: e12d3699157ed522373a9c6598b4b5b430320c1e0cdd8312ea3d440cb485dafa
Instruction ID: 4f2bbdd56b221060056c9995d1d439c7437260d4b35ce264939caa829f2e0653
Opcode Fuzzy Hash: e12d3699157ed522373a9c6598b4b5b430320c1e0cdd8312ea3d440cb485dafa
Instruction Fuzzy Hash: 8011E770A003079ADF22BF708C4666E3FA4BF85B50B148825EC15FB1A1EB74CA019BA1

Function 00587A94 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00587AD8

Part of subcall function 00587CF4: __mtinitlocknum.LIBCMT ref: 00587D06

__lock.LIBCMT ref: 00587AF9
___addlocaleref.LIBCMT ref: 00587B17

Strings

`H, xrefs: 00587AA3

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: __lock$___addlocaleref__mtinitlocknum
String ID: `H
API String ID: 3416137509-912421188
Opcode ID: 9c391c81e9dda691e28eee64fa7d0ba00185fd93005869b510abeebd1aa148ee
Instruction ID: 0727b925098d9e3123e5736693359cf2600aec56289624fc1fea6d5774e58c6b
Opcode Fuzzy Hash: 9c391c81e9dda691e28eee64fa7d0ba00185fd93005869b510abeebd1aa148ee
Instruction Fuzzy Hash: 3D01C071404B05DFD720EF75C90974ABBF0FF94321F20890EE8AAA72A0CBB4A640CB15

Function 00561CDE Relevance: 6.2, APIs: 4, Instructions: 250COMMON

Download Yara Rule

APIs

Part of subcall function 0057F4EA: std::exception::exception.LIBCMT ref: 0057F51E
Part of subcall function 0057F4EA: __CxxThrowException@8.LIBCMT ref: 0057F533

__swprintf.LIBCMT ref: 00561EA6

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: Exception@8Throw__swprintfstd::exception::exception
String ID:
API String ID: 2125237772-0
Opcode ID: d502e7153788b9ec6a5d85a0eaa2272e138f0842792cb5ff207fc2e3d74af74d
Instruction ID: 9aeb1eccae6e883da7ef657c971d2124edf7a5fcc27e8d4f0b7c8090b79f8314
Opcode Fuzzy Hash: d502e7153788b9ec6a5d85a0eaa2272e138f0842792cb5ff207fc2e3d74af74d
Instruction Fuzzy Hash: 43916C716046029FCB24EF28C899C6ABFA8FFC5700F04491EF885972A1DB71ED05CB92

Function 005B05F8 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 005B076F
_wcscat.LIBCMT ref: 005B0787
_wcscat.LIBCMT ref: 005B0799

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscat$__wsplitpath
String ID:
API String ID: 1413645957-0
Opcode ID: ff5e0aed43fc8de9fb838faa9418ce3fd369cb65696d28d22a61ac5ec733e13f
Instruction ID: 0f146d8dea2ad69f9ed3abfaa0e516674ca279a2264e4c165dd64b00621048f1
Opcode Fuzzy Hash: ff5e0aed43fc8de9fb838faa9418ce3fd369cb65696d28d22a61ac5ec733e13f
Instruction Fuzzy Hash: E3818F715043059FCB24EF64C8459AFBBE8BBD8344F149C2EF889D7291EB30E9558B92

Function 0058ACB3 Relevance: 6.2, APIs: 4, Instructions: 219COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0058ACC1

Part of subcall function 00587CF4: __mtinitlocknum.LIBCMT ref: 00587D06

__calloc_crt.LIBCMT ref: 0058ACD2

Part of subcall function 00586986: __calloc_impl.LIBCMT ref: 00586995

@_EH4_CallFilterFunc@8.LIBCMT ref: 0058ACED
__calloc_crt.LIBCMT ref: 0058AD91

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: __calloc_crt$CallFilterFunc@8__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 601758943-0
Opcode ID: d05390f3cb44285053ee2febbd5e6b81c0c775ccd2da8302e06ee6537205509f
Instruction ID: 3c49d7d6e0639d190ae1a2b3a5a5b5afb91f69b08d20ba03e8f4babf4faa61b7
Opcode Fuzzy Hash: d05390f3cb44285053ee2febbd5e6b81c0c775ccd2da8302e06ee6537205509f
Instruction Fuzzy Hash: FA81C1B09063458FEB14EF68C8845ADBFF4BF45320B24466ED8A6BB3D1D7349802CB56

Function 005B091D Relevance: 6.2, APIs: 4, Instructions: 185COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 005B0A59
_wcscat.LIBCMT ref: 005B0A71
_wcscat.LIBCMT ref: 005B0A83
_wcscpy.LIBCMT ref: 005B0B0B

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscat$__wsplitpath_wcscpy
String ID:
API String ID: 3240238573-0
Opcode ID: 2d0a0b81136769988e18dfd9554f1fc92bd9ec7e6ba6f0201e502796036e3357
Instruction ID: 8f73a53d7e5f4ceb2d0e2b6497c13de072b22577c13d31f69586a5afc4ad98ec
Opcode Fuzzy Hash: 2d0a0b81136769988e18dfd9554f1fc92bd9ec7e6ba6f0201e502796036e3357
Instruction Fuzzy Hash: C46149725043069FD710EF60C8859AFBBE8FF89310F04492EF98997291DB35E949CB92

Function 0058365B Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 005836B7
_memcpy_s.LIBCMT ref: 00583729
__filbuf.LIBCMT ref: 005837AA
_memset.LIBCMT ref: 005837EE

Part of subcall function 00587C0E: __getptd_noexit.LIBCMT ref: 00587C0E

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit_memcpy_s
String ID:
API String ID: 3877424927-0
Opcode ID: bebfa5eeb54ca0c55a1007567e014ed37b2c96719a673c9bdfa0e7e305b31e35
Instruction ID: 9cfa809ffefc0693113b31ffd85b5072cc752e893d305edf6a5958f52cc2f1d5
Opcode Fuzzy Hash: bebfa5eeb54ca0c55a1007567e014ed37b2c96719a673c9bdfa0e7e305b31e35
Instruction Fuzzy Hash: 995186B0A01206ABDB24BF69C88556E7FA5FF40B20F248629FC25E62D0E775DF549B40

Function 005ACC5C Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 005ACD1E
__swprintf.LIBCMT ref: 005ACD37
_wprintf.LIBCMT ref: 005ACDED
_wprintf.LIBCMT ref: 005ACE0B

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: __swprintf_wprintf
String ID:
API String ID: 1937080608-0
Opcode ID: d92d2abdc2dfcafaaf643b11d63e75c5c8013503d35ff4002f6c97776b8cf86f
Instruction ID: 417dff9be7384d4c080949d0f04cc00e37097790b6dcb3c7c93d75cceb813e7a
Opcode Fuzzy Hash: d92d2abdc2dfcafaaf643b11d63e75c5c8013503d35ff4002f6c97776b8cf86f
Instruction Fuzzy Hash: 94515C7190010AAACF15EBA0CD4AEEEBF78BF46300F100166F505731A2EB756E59DB61

Function 005AC396 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 00564517: _fseek.LIBCMT ref: 0056452F

Part of subcall function 005AC56D: _wcscmp.LIBCMT ref: 005AC65D
Part of subcall function 005AC56D: _wcscmp.LIBCMT ref: 005AC670

_free.LIBCMT ref: 005AC4DD
_free.LIBCMT ref: 005AC4E4
_free.LIBCMT ref: 005AC54F
_free.LIBCMT ref: 005AC557

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _free$_wcscmp$_fseek
String ID:
API String ID: 3404660211-0
Opcode ID: b2db0521c306de9859c7194269149a6dceff0050bdbfaa59955085d3035e8c28
Instruction ID: c155c13903f35de51e85a95a3bb8622efb21dc914c0a88900061e6f5d5b27a9b
Opcode Fuzzy Hash: b2db0521c306de9859c7194269149a6dceff0050bdbfaa59955085d3035e8c28
Instruction Fuzzy Hash: ED515CB1904219AFDF149F64DC85AAEBBB9FF88300F1044AEF619A7241DB715E80CF58

Function 005ACA48 Relevance: 6.2, APIs: 4, Instructions: 151COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 005ACB09
__swprintf.LIBCMT ref: 005ACB22
_wprintf.LIBCMT ref: 005ACBCD
_wprintf.LIBCMT ref: 005ACBEB

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: __swprintf_wprintf
String ID:
API String ID: 1937080608-0
Opcode ID: e4cb7c6bd82ec4711da0dd72e8170a87ce897d273d3366ac308420b0b2cc9f52
Instruction ID: 11dc0d881e8ac68cfec214528c4fdb3949aefec57d74cff4c0aadabe40427aa6
Opcode Fuzzy Hash: e4cb7c6bd82ec4711da0dd72e8170a87ce897d273d3366ac308420b0b2cc9f52
Instruction Fuzzy Hash: 6C515A7290020AAACF15EBA0CD4AEEEBF78BF45340F500166B505730A2EB756F59DF61

Function 005B1B2F Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 005B1B65
_wcscmp.LIBCMT ref: 005B1B7C
_wcscmp.LIBCMT ref: 005B1C0E
_wcscmp.LIBCMT ref: 005B1C25

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: 92de58b19114773358e09430fdba1132c0a7fc7ca095cb66b27fabd43ed0e6cc
Instruction ID: e15333f6c21c11f316a9ce9768f801326634804751f7ab17799857d678bfe53d
Opcode Fuzzy Hash: 92de58b19114773358e09430fdba1132c0a7fc7ca095cb66b27fabd43ed0e6cc
Instruction Fuzzy Hash: FF31C7319016196ACF54AFA0DC5DADE7FACBF45320F504566F811E3090EB74EE458B6C

Function 005B1C8A Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 005B1CC0
_wcscmp.LIBCMT ref: 005B1CD7
_wcscmp.LIBCMT ref: 005B1D54
_wcscmp.LIBCMT ref: 005B1D6B

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: 3a2c9a6aaf35be69ba26c5ff023b5ee4197996e19917fcab632a4267b80a98a0
Instruction ID: c62a38a77b03a04eb5f6a2c6d32dfb57ba465bc60dea88039fd1ef5167a870e6
Opcode Fuzzy Hash: 3a2c9a6aaf35be69ba26c5ff023b5ee4197996e19917fcab632a4267b80a98a0
Instruction Fuzzy Hash: F431D631901A1A6ECF54AFA0DC59ADE7FACAF45320F640965FC11A20D0DB74EE458B6C

Function 005A6F02 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 005A6F6C
_strcat.LIBCMT ref: 005A6F98
_wcscpy.LIBCMT ref: 005A6FAF
_wcscpy.LIBCMT ref: 005A6FCB

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscpy$_strcat
String ID:
API String ID: 2292115017-0
Opcode ID: d95e556309437f2d4b01627dc1c32f846f8ca4c31db75ee937686d82ca629b62
Instruction ID: 153fbc77690611922181fd3eeff90b82656760c3f2ca0ae749e26071f2a22a77
Opcode Fuzzy Hash: d95e556309437f2d4b01627dc1c32f846f8ca4c31db75ee937686d82ca629b62
Instruction Fuzzy Hash: 8211D272904215AFDB24BB60AC4EEDE7FACFB81710F0404A9F505A6081EE70AA858B64

Function 00594DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00594E16

Part of subcall function 005954F5: __fltout2.LIBCMT ref: 0059551E

__cftog_l.LIBCMT ref: 00594E3C
__cftoe_l.LIBCMT ref: 00594E6E

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: 9fb538decaa159acb9e0f92f081c5ceda346d8c82defcb5b3f45741bc72388dd
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: 5C01483200014EBBCF135E88DC15CEE3F2ABB58354B598855FE2859031D336CAB2AF82

Function 005BBB08 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005BBB5C

Strings

h?K, xrefs: 005BBB2D
|?K, xrefs: 005BBB34

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _memset
String ID: h?K$|?K
API String ID: 2102423945-877730469
Opcode ID: be98c460f347eb5342f9ddba19df1a8e7ff92f4e08695fb90ae1c05138579d3b
Instruction ID: 512eab7f36cd8afc2ab3261ebe784eee80f638f388405f394bc0bb3e22888ad5
Opcode Fuzzy Hash: be98c460f347eb5342f9ddba19df1a8e7ff92f4e08695fb90ae1c05138579d3b
Instruction Fuzzy Hash: 5F915E71A00215AFEF24DF95C848FEEBFB8FF85714F10855AE515AB180D7B4A944CBA0

Function 005C2230 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005C225A
_memset.LIBCMT ref: 005C2323

Part of subcall function 0056936C: __swprintf.LIBCMT ref: 005693AB
Part of subcall function 0056936C: __itow.LIBCMT ref: 005693DF

Part of subcall function 0057C6F4: _wcscpy.LIBCMT ref: 0057C717

Strings

@, xrefs: 005C2334

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _memset$__itow__swprintf_wcscpy
String ID: @
API String ID: 2523036003-2766056989
Opcode ID: 9b6f1a054f74875a438f1efdd3d3d791c853387bcbe02570d37d45342aca0f8c
Instruction ID: a5f5481c7b1d493678ac61ebc41da804dbca0627a9cb90fb71eef7c95b23106c
Opcode Fuzzy Hash: 9b6f1a054f74875a438f1efdd3d3d791c853387bcbe02570d37d45342aca0f8c
Instruction Fuzzy Hash: AD715D74A0061A9FCF05EFA4D885A9EBFF5FF88710F108459E859AB391DB34AD40CB94

Function 005A290D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 005A2A72

Strings

I/], xrefs: 005A297F
I/], xrefs: 005A29FC, 005A2A64, 005A2A12

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscpy
String ID: I/]$I/]
API String ID: 3048848545-760989775
Opcode ID: 216820cd40ab9a3a1cd61449237ac12a5d4ff903a3d3ad20296fe9ad0a067895
Instruction ID: 1d54bb914ba3a678007683ae5dc47a5352f94e200499666c7596cad1546231a6
Opcode Fuzzy Hash: 216820cd40ab9a3a1cd61449237ac12a5d4ff903a3d3ad20296fe9ad0a067895
Instruction Fuzzy Hash: 8A41F635900216AECF25EF9CD4429FDBFB0FF4A710F54905AE881A7191EB709E82D7A0

Function 005A67E9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 005A67FD
__swprintf.LIBCMT ref: 005A680A

Part of subcall function 0058172B: __woutput_l.LIBCMT ref: 00581784

Strings

5K, xrefs: 005A67F6

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: __swprintf$__woutput_l
String ID: 5K
API String ID: 1571530113-2802765362
Opcode ID: 6872b4b3d6b3d34319df9a50e78a3afd508431f81b654905c2b9f4d6c5d1579e
Instruction ID: c3958dc55ea5b5b08be3d446fb1d4c07202d162920350a3c3b62a46471b3aed0
Opcode Fuzzy Hash: 6872b4b3d6b3d34319df9a50e78a3afd508431f81b654905c2b9f4d6c5d1579e
Instruction Fuzzy Hash: 33318F7190121BABDB10AF61DD59EBF7FACFF09340B048829F912E2150E738D9119B74

Function 005B5180 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005B5190

Strings

D[, xrefs: 005B522E
|, xrefs: 005B51B5

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _memset
String ID: |$D[
API String ID: 2102423945-1613120509
Opcode ID: cb3efb7376b2ee8b3b9d292cd61c4e768093f9ed3e25bdc4c130753edd66b9fc
Instruction ID: 40e80e055b1c2a157585b8dd3953878207b5499012752d80a1668a0c0218a1e5
Opcode Fuzzy Hash: cb3efb7376b2ee8b3b9d292cd61c4e768093f9ed3e25bdc4c130753edd66b9fc
Instruction Fuzzy Hash: A0312A75C0111AABCF05EFA4CC85AEEBFB9FF54700F004159F855A6166EB31A906CBA0

Function 005640E5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005D3725

Strings

X, xrefs: 005D373E
t3K, xrefs: 005D3745

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _memset
String ID: X$t3K
API String ID: 2102423945-2811000538
Opcode ID: b93b0c1c5738115443a6aa44457fd713ed33a969696249c1967a6bebbd69b3da
Instruction ID: 331d505e47d06ee277c7deb272f03085be61e61398c505255094c912d487f627
Opcode Fuzzy Hash: b93b0c1c5738115443a6aa44457fd713ed33a969696249c1967a6bebbd69b3da
Instruction Fuzzy Hash: 7721A571A101989BCB51EFD8D849BEE7FF8AF89304F00805AE405A7241DFB45A89CF66

Function 005CE32E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 005CE33D
_memset.LIBCMT ref: 005CE34C

Strings

D=L, xrefs: 005CE346

Memory Dump Source

Source File: 00000000.00000002.1516428606.0000000000561000.00000020.00000001.01000000.00000003.sdmp, Offset: 00560000, based on PE: true

Associated: 00000000.00000002.1516401102.0000000000560000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.00000000005ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516485816.000000000060E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516538339.000000000061F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1516606488.0000000000624000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_7cYDC0HciP.jbxd

Similarity

API ID: _memset
String ID: D=L
API String ID: 2102423945-2639313163
Opcode ID: 9cdb3eb17ab4b92b591a418dd0827165d4bfee49c7ed39e47b44089da6596004
Instruction ID: 3e44baa25e08fbc5f12e8f0384d4dcafdcc2b3d7f9d1970a9e3a236f0ecd5393
Opcode Fuzzy Hash: 9cdb3eb17ab4b92b591a418dd0827165d4bfee49c7ed39e47b44089da6596004
Instruction Fuzzy Hash: 0FF054F1541304BEE2906F60AC45FB77E5CE704756F008435BE05E61E2D3755D0047AC

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7cYDC0HciP.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7cYDC0HciP.exe_88e7f6563a585821d8c5b75d1d898bfef7d2f0_84687472_724cb7ca-85bb-4fed-ab12-e5bee7920c04\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9172.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER922E.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER926E.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
7cYDC0HciP.exe

Function 00585F74 Relevance: 1.5, APIs: 1, Instructions: 2
COMMON

Function 005AFA0C Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238
COMMON

Function 0056CC24 Relevance: 18.3, APIs: 12, Instructions: 267
COMMON

Function 005A6CE9 Relevance: 18.2, APIs: 12, Instructions: 178
COMMON

Function 005A690B Relevance: 18.1, APIs: 12, Instructions: 113
COMMON

Function 0058500E Relevance: 16.8, APIs: 11, Instructions: 257
COMMON

Function 005AF5FA Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 278
COMMON

Function 0056C833 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 479
COMMON

Function 005A60DD Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 174
COMMON

Function 005ABFA4 Relevance: 10.8, APIs: 7, Instructions: 316
COMMON

Function 0059D8A7 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 249
COMMON

Function 005AD76A Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 180
COMMON