Edit tour

Windows Analysis Report
7cYDC0HciP.exe

Overview

General Information

Sample name:	7cYDC0HciP.exe renamed because original name is a hash value
Original sample name:	c0046b11b67425d2a5fc835771ba13a28baf13780f21c0426b2fcdac8a6f1a3f.exe
Analysis ID:	1588183
MD5:	48e0fecb7987f8d53c38f8228dd06218
SHA1:	bd74dfd414078a5ecb66a3d90406a1f0809723dd
SHA256:	c0046b11b67425d2a5fc835771ba13a28baf13780f21c0426b2fcdac8a6f1a3f
Tags:	exeuser-adrian__luca
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Found potential string decryption / allocating functions

One or more processes crash

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

7cYDC0HciP.exe (PID: 7920 cmdline: "C:\Users\user\Desktop\7cYDC0HciP.exe" MD5: 48E0FECB7987F8D53C38F8228DD06218)

WerFault.exe (PID: 8036 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7920 -s 560 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 7cYDC0HciP.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 7cYDC0HciP.exe	Virustotal: Detection: 58%			Perma Link
Source: 7cYDC0HciP.exe	ReversingLabs: Detection: 70%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Machine Learning detection for sample

Source: 7cYDC0HciP.exe

Joe Sandbox ML: detected

Source: 7cYDC0HciP.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: Amcache.hve.4.dr

String found in binary or memory: http://upx.sf.net

System Summary

Binary is likely a compiled AutoIt script file

Source: 7cYDC0HciP.exe, 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_6d05e192-c
Source: 7cYDC0HciP.exe, 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_52724f34-a
Source: 7cYDC0HciP.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_00da4daa-4
Source: 7cYDC0HciP.exe	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_c337c0ac-4

Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AF410F	0_2_00AF410F
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AE02A4	0_2_00AE02A4
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AF038E	0_2_00AF038E
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00ACE3E3	0_2_00ACE3E3
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AE06D9	0_2_00AE06D9
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AF467F	0_2_00AF467F
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00B2AACE	0_2_00B2AACE
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AF4BEF	0_2_00AF4BEF
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AECCC1	0_2_00AECCC1
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AC6F07	0_2_00AC6F07
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00ACAF50	0_2_00ACAF50
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AEB043	0_2_00AEB043
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00B231BC	0_2_00B231BC
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AED1B9	0_2_00AED1B9
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00ADB11F	0_2_00ADB11F
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AE123A	0_2_00AE123A
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AD3200	0_2_00AD3200
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AF724D	0_2_00AF724D
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AC93F0	0_2_00AC93F0
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00B013CA	0_2_00B013CA
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00ADF563	0_2_00ADF563
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AC96C0	0_2_00AC96C0
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00B0B6CC	0_2_00B0B6CC
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AC77B0	0_2_00AC77B0
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00B2F7FF	0_2_00B2F7FF
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AF79C9	0_2_00AF79C9
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00ADFA57	0_2_00ADFA57
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AC9B60	0_2_00AC9B60
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AD3B70	0_2_00AD3B70
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AC77B0	0_2_00AC77B0
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AE9ED0	0_2_00AE9ED0
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00ADFE6F	0_2_00ADFE6F
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AC7FA3	0_2_00AC7FA3

Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: String function: 00AE6AC0 appears 42 times
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: String function: 00AEF8A0 appears 35 times
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: String function: 00ADF55E appears 33 times
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: String function: 00AD2C20 appears 33 times

Source: C:\Users\user\Desktop\7cYDC0HciP.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7920 -s 560

Source: 7cYDC0HciP.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.winEXE@2/5@0/0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7920

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\d52c7e2a-7353-4e81-bdc3-a473672dd07f

Jump to behavior

Source: 7cYDC0HciP.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7cYDC0HciP.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7cYDC0HciP.exe	Virustotal: Detection: 58%
Source: 7cYDC0HciP.exe	ReversingLabs: Detection: 70%

Source: unknown	Process created: C:\Users\user\Desktop\7cYDC0HciP.exe "C:\Users\user\Desktop\7cYDC0HciP.exe"
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7920 -s 560

Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Section loaded: wsock32.dll	Jump to behavior

Source: 7cYDC0HciP.exe

Static file information: File size 1188352 > 1048576

Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00B3C480 push ss; retn 0047h		0_2_00B3C481
Source: C:\Users\user\Desktop\7cYDC0HciP.exe	Code function: 0_2_00AE6B05 push ecx; ret		0_2_00AE6B18

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 b7 a3 1e b0 86 f3-0a fe 06 07 d0 80 07 92
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\7cYDC0HciP.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\7cYDC0HciP.exe

Code function: 0_2_00AE5F74 ___security_init_cookie,LdrInitializeThunk,

0_2_00AE5F74

Source: 7cYDC0HciP.exe

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\7cYDC0HciP.exe

Code function: 0_2_00AE65C4 cpuid

0_2_00AE65C4

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Process Injection	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	11 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
7cYDC0HciP.exe	58%	Virustotal		Browse
7cYDC0HciP.exe	71%	ReversingLabs	Win32.Trojan.Nymeria
7cYDC0HciP.exe	100%	Avira	HEUR/AGEN.1319159
7cYDC0HciP.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.4.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588183
Start date and time:	2025-01-10 22:28:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7cYDC0HciP.exe renamed because original name is a hash value
Original Sample Name:	c0046b11b67425d2a5fc835771ba13a28baf13780f21c0426b2fcdac8a6f1a3f.exe
Detection:	MAL
Classification:	mal68.winEXE@2/5@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 1 Number of non-executed functions: 64
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92, 13.107.246.45, 20.190.159.4, 52.149.20.212
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	http://@1800-web.com/new/auth/6XEcGVvsnjwXq8bbJloqbuPkeuHjc6rLcgYUe/bGVvbi5ncmF2ZXNAYXRvcy5uZXQ=	Get hash	malicious	Unknown	Browse	13.107.246.45
	28uMwHvbTD.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.45
	https://services221.com/mm/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	8qQwTWK3jx.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	https://atpscan.global.hornetsecurity.com/?d=W3rdHn1Og9hhUJnVJzqWF36wMmxswAZldvtx3E21ybg&f=v8m9AqGfgV2Ri7cjqmfsuyl2V2Mu_lVW0BRsqcFw4upagWAQ1C-MqANvN6gf4zNV&i=&k=xREg&m=b_ORYMkPffImCXbCPli-aiR7Ga6rGe55sar2xtigCL4MrowDPSzt7ABKETTGxzegakAfoZ57KD02aVix8V8TVmZ2VcxzjeybXYrPiS2SB73LCKYktj5jv2aw6VcPRslz&n=s4crRkyHC4bab6S3yrgn1E3n-VmdqgfSqNiaCJyPrf6hnyL_SE4PHEo5SUcwwsFGV6rnB35iQFM5FLsE91obvZ0HTAEiqHnB8ROLzY5JVgg&r=oMs_cp4DXIjeQhcPWsPLyR3_oxBVUN4Iok_tSVE4DNNtzqeot7ZzvdXkh4vatwpC&s=bd82eb507a358fd35f72f18b86e67f3bfc1ce64bbeab0c01d700897b1b678efb&u=https%3A%2F%2Fe.trustifi.com%2F%23%2Ffff2af%2F32054d%2F67960f%2Fee6fed%2F5d1d11%2F46c760%2Ff79190%2Fc5ec40%2Fe8666a%2Fef542d%2F85972d%2F627493%2F9a11d6%2F1f4096%2F1d247f%2F818e78%2Fc53383%2Fd59aa0%2Fedfa57%2F7914c7%2Fc38cf6%2Ff74f56%2Ff45915%2F39dbbd%2Ff48710%2F1ddf22%2F37d5f2%2F9de9f7%2F96109e%2F882355%2F854b66%2F9d606d%2F2d0447%2Fad3b01%2F637d1c%2F3c0f2b%2F606f48%2Fa6d904%2F8fefe3%2F00a4bb%2F6520c6%2F9b795c%2Fb7de1a%2Fb5dde6%2F3f5692%2F997c7d%2Fc00925%2F782cce%2F511459%2Fab5aa8%2F91722a%2Feec933%2F3f4f91%2F894088%2F43adfa%2Fb78195%2F0407d0%2F56f022%2Fddf20e%2F946567%2Faa271a%2F507b7a%2Faccd06%2F50d63c%2F485c4b%2F07ced8%2Fd0ec21%2F260ce6%2Fb5edbb%2F79a81e%2F1fd160%2Ff4da41%2F7073e0%2F8a5e9a%2Fdac829%2F521e52%2Fa1a847%2F13ea63%2Fabb5a3%2Fe1901e%2Fd876f6%2F7b0bf4%2Fbd19df%2F89bdcd%2F1874d8%2F0fb7f3%2F72f438%2Fa098c5%2F4e2214%2F4b6e54%2F0c4a8f	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	hm8dCK5P5A.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://atpscan.global.hornetsecurity.com/?d=W3rdHn1Og9hhUJnVJzqWF36wMmxswAZldvtx3E21ybg&f=v8m9AqGfgV2Ri7cjqmfsuyl2V2Mu_lVW0BRsqcFw4upagWAQ1C-MqANvN6gf4zNV&i=&k=xREg&m=b_ORYMkPffImCXbCPli-aiR7Ga6rGe55sar2xtigCL4MrowDPSzt7ABKETTGxzegakAfoZ57KD02aVix8V8TVmZ2VcxzjeybXYrPiS2SB73LCKYktj5jv2aw6VcPRslz&n=s4crRkyHC4bab6S3yrgn1E3n-VmdqgfSqNiaCJyPrf6hnyL_SE4PHEo5SUcwwsFGV6rnB35iQFM5FLsE91obvZ0HTAEiqHnB8ROLzY5JVgg&r=oMs_cp4DXIjeQhcPWsPLyR3_oxBVUN4Iok_tSVE4DNNtzqeot7ZzvdXkh4vatwpC&s=bd82eb507a358fd35f72f18b86e67f3bfc1ce64bbeab0c01d700897b1b678efb&u=https%3A%2F%2Fe.trustifi.com%2F%23%2Ffff2af%2F32054d%2F67960f%2Fee6fed%2F5d1d11%2F46c760%2Ff79190%2Fc5ec40%2Fe8666a%2Fef542d%2F85972d%2F627493%2F9a11d6%2F1f4096%2F1d247f%2F818e78%2Fc53383%2Fd59aa0%2Fedfa57%2F7914c7%2Fc38cf6%2Ff74f56%2Ff45915%2F39dbbd%2Ff48710%2F1ddf22%2F37d5f2%2F9de9f7%2F96109e%2F882355%2F854b66%2F9d606d%2F2d0447%2Fad3b01%2F637d1c%2F3c0f2b%2F606f48%2Fa6d904%2F8fefe3%2F00a4bb%2F6520c6%2F9b795c%2Fb7de1a%2Fb5dde6%2F3f5692%2F997c7d%2Fc00925%2F782cce%2F511459%2Fab5aa8%2F91722a%2Feec933%2F3f4f91%2F894088%2F43adfa%2Fb78195%2F0407d0%2F56f022%2Fddf20e%2F946567%2Faa271a%2F507b7a%2Faccd06%2F50d63c%2F485c4b%2F07ced8%2Fd0ec21%2F260ce6%2Fb5edbb%2F79a81e%2F1fd160%2Ff4da41%2F7073e0%2F8a5e9a%2Fdac829%2F521e52%2Fa1a847%2F13ea63%2Fabb5a3%2Fe1901e%2Fd876f6%2F7b0bf4%2Fbd19df%2F89bdcd%2F1874d8%2F0fb7f3%2F72f438%2Fa098c5%2F4e2214%2F4b6e54%2F0c4a8f	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	upXUt2jZ0S.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.45

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7cYDC0HciP.exe_88e7f6563a585821d8c5b75d1d898bfef7d2f0_84687472_d4c6ee67-576a-45fe-b13e-37e4ce80f889\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8525805846050913
Encrypted:	false
SSDEEP:	96:oqFE4zNiRKsthlP7ofMQXIDcQvc6QcEVcw3cE/H+HbHg/opAnQ82MQXqOEXMbBEj:rrzNkKd0BU/Ajj1qzuiF4Z24IO841
MD5:	356AB91C4CB2CDB73B3E689043FFE760
SHA1:	4BD7B39FE9D6EFD97026B01BA6605362CA09281A
SHA-256:	45D3A1DBDA259A914D88B8CB5D368DBAE4F2D238B51B95B6C2254E1C3166C3F0
SHA-512:	F1D3320D2E141B572DE7A34DCF898F912C68607000D22C2688D2232DF36ED599F1FB77042FD42FDE3E91413057321C65D934BFA7E0AD5BF4D241D47C84CBADB2
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.1.0.1.8.2.0.6.1.7.1.4.0.6.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.1.0.1.8.2.0.6.6.7.1.3.9.9.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.4.c.6.e.e.6.7.-.5.7.6.a.-.4.5.f.e.-.b.1.3.e.-.3.7.e.4.c.e.8.0.f.8.8.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.f.9.4.a.5.7.0.-.f.b.d.0.-.4.6.0.b.-.9.9.4.6.-.5.4.f.e.5.e.6.a.f.2.0.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.7.c.Y.D.C.0.H.c.i.P...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.f.0.-.0.0.0.1.-.0.0.1.3.-.d.6.9.3.-.b.9.d.0.a.6.6.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.8.7.8.1.9.7.4.a.f.c.0.0.4.b.c.4.9.2.3.5.6.4.4.0.0.6.6.8.c.0.e.0.0.0.0.0.9.0.8.!.0.0.0.0.b.d.7.4.d.f.d.4.1.4.0.7.8.a.5.e.c.b.6.6.a.3.d.9.0.4.0.6.a.1.f.0.8.0.9.7.2.3.d.d.!.7.c.Y.D.C.0.H.c.i.P...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE7CB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jan 10 21:30:06 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	48450
Entropy (8bit):	1.7621838313275733
Encrypted:	false
SSDEEP:	192:vAaW79p9feoaIOkT80vRHyn7tvq05g7ptYcOZMSvP:bc932oaP+8cRHyn7J9g7bYc6d
MD5:	41602B64AF72902C73213786BD63FB7B
SHA1:	C6726B00E8D446C5416E117726FB4A8046073C68
SHA-256:	DE3A2E6FF7F41044483C48FD5FDE8B606F52D9B6738953731289F1A2A8643209
SHA-512:	923436F19ADB8113BC839CD268452BF2FBE2AB266E6B233802A4A6C2FF14B9FC21A197D35C80140E17E7B639D60DEDFCD4E415C0E2288C1C33C51E6CA1DFC286
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......^..g.........................................*..........T.......8...........T...........h..........................................................................................................eJ..............GenuineIntel............T...........]..g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE897.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8296
Entropy (8bit):	3.699160369930379
Encrypted:	false
SSDEEP:	192:R6l7wVeJFQ6BrK6YeSSUDkODgmfPuRprG89bhhsfhrm:R6lXJC6B26YbSUDkODgmfPuzhafQ
MD5:	426EA23DD57D562C1A3ADD134776B162
SHA1:	1B26079E2CDC3911CA79F11B0FA2167AC0BB87CD
SHA-256:	CE7DED984D7BBE342C7691CE07FB2BD2A7121A200E15E62B91E30914F6483B42
SHA-512:	DEB7C56ECDF5C539CE30F761DE51ABEF1288AF6E6C11950E51910F2D9DC0CFB504E0A7112579E50F677B35B7742978785A08AF3BDEB57A60E94DD4AE5F8D83C7
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.9.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE8F6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.469507149340855
Encrypted:	false
SSDEEP:	48:cvIwWl8zsXJg77aI97QWpW8VYLYm8M4JEHZhsF1tT+q81X+ABhdzRznnd:uIjf5I7Rp7VXJ9hqxzRznnd
MD5:	A731A8754EE74B69CDD5D0C1614FD906
SHA1:	1DD98CA80D4FF2A2BB7777292ABED27F893DA211
SHA-256:	9CFFB6622E293B7CE714548B6FFFCF4DDE2F40FCE01F18516A48E0C8CBCC6C39
SHA-512:	90945FF23914BE45B50E13935D7305C5E0C398D3DDC866B2EF265B8955BE9D946C21C11765795EC80AED2A4BACDC6731E6532738619BA3407B1D29D637D2798D
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="670352" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.298846688488598
Encrypted:	false
SSDEEP:	6144:8ECqOEmWfd+WQFZy/9026ZTyaRsCDusBqD5dooi8lkSD6VJSRpj:5CuL6seqD5StSWVARV
MD5:	AD6388F4A8E33E3C79F40B4E21EBEB22
SHA1:	D6268887F0043C5E04B0B914DFB477373E6B2B15
SHA-256:	CF2E0EEE36A9831B978E6D06F2779CB7EED86F59B198433716F30ED253C7F99E
SHA-512:	8501298F141E85B91CBD7DBAF0574E1E500173E5ECB27888F8900E2DD7890F6C7891728624011613DF9795ED8737E6EDDA2E542F36B2C28CF84DB65A592BAD86
Malicious:	false
Reputation:	low
Preview:	regfD...D....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmR...c..............................................................................................................................................................................................................................................................................................................................................R}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.97514741518638
TrID:	Win32 Executable (generic) a (10002005/4) 99.70% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	7cYDC0HciP.exe
File size:	1'188'352 bytes
MD5:	48e0fecb7987f8d53c38f8228dd06218
SHA1:	bd74dfd414078a5ecb66a3d90406a1f0809723dd
SHA256:	c0046b11b67425d2a5fc835771ba13a28baf13780f21c0426b2fcdac8a6f1a3f
SHA512:	c3ca438d1dde59094f2d5bcb3e3c437ef1fe7b5066cfe5d73736c5d8de0ee470990651a10e7b58b18c6fc314ba4ab5b59a3db16c3992f5c6351a48c0ac2f76cf
SSDEEP:	24576:5tb20pkaCqT5TBWgNjVYZhaJ0p2qejxgIYtX6:KVg5tjVYZi0p2BVPYt
TLSH:	F645CF1373DDC360C7726273BA25B701AE7B782506B5F86B2FD8093DA920162525EB73
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x425f74
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6757CB83 [Tue Dec 10 05:02:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	c1d258acab237961164a925272293413

Entrypoint Preview

Instruction
call 00007F3D408B418Fh
jmp 00007F3D408A71A4h
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F3D408A732Ah
cmp edi, eax
jc 00007F3D408A768Eh
bt dword ptr [004C0158h], 01h
jnc 00007F3D408A7329h
rep movsb
jmp 00007F3D408A763Ch
cmp ecx, 00000080h
jc 00007F3D408A74F4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F3D408A7330h
bt dword ptr [004BA370h], 01h
jc 00007F3D408A7800h
bt dword ptr [004C0158h], 00000000h
jnc 00007F3D408A74CDh
test edi, 00000003h
jne 00007F3D408A74DEh
test esi, 00000003h
jne 00007F3D408A74BDh
bt edi, 02h
jnc 00007F3D408A732Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F3D408A7333h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F3D408A7385h
bt esi, 03h
jnc 00007F3D408A73D8h
movdqa xmm1, dqword ptr [esi+00h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2012 UPD4 build 61030
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb7004	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x59098	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb2730	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8b54f	0x8b600	f437a6545e938612764dbb0a314376fc	False	0.5699499019058296	data	6.680413749210956	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8d000	0x2cc42	0x2ce00	ede9d722bf5e27d1f93aaf9e53240a22	False	0.3183049704038997	data	5.682422502790088	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xba000	0x9d54	0x6200	e0a519f8e3a35fae0d9c2cfd5a4bacfc	False	0.16402264030612246	data	2.002691099965349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc4000	0x59098	0x59200	fa21af236b261a4501ffc725221fe61a	False	0.9260195696002805	data	7.887531887084191	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11e000	0xa474	0xa600	583c8e8dd8fd50de8aa1ba67df48e8de	False	0.0015060240963855422	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xc8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xca038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xca4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xca4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcaa84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcc7b8	0x503a0	data			1.000337788489629
RT_GROUP_ICON	0x11cb58	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x11cbd0	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x11cbe4	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x11cbf8	0x14	data	English	Great Britain	1.25
RT_VERSION	0x11cc0c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x11cce8	0x3b0	ASCII text, with CRLF line terminators	English	Great Britain	0.5116525423728814

Imports

DLL	Import
KERNEL32.DLL	HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
ADVAPI32.dll	GetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
COMCTL32.dll	ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
GDI32.dll	SetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit
PSAPI.DLL	GetProcessMemoryInfo
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
USERENV.dll	UnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
WSOCK32.dll	__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:30:02.365999937 CET	1.1.1.1	192.168.2.11	0x534d	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:30:02.365999937 CET	1.1.1.1	192.168.2.11	0x534d	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 7cYDC0HciP.exePID: 7920, Parent PID: 2592

General

Target ID:	0
Start time:	16:30:05
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\7cYDC0HciP.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7cYDC0HciP.exe"
Imagebase:	0xac0000
File size:	1'188'352 bytes
MD5 hash:	48E0FECB7987F8D53C38F8228DD06218
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 8036, Parent PID: 7920

General

Target ID:	4
Start time:	16:30:05
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7920 -s 560
Imagebase:	0x4a0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 7cYDC0HciP.exePID: 7920, Parent PID: 2592COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	66.7%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00AE5F74 Relevance: 1.5, APIs: 1, Instructions: 2
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___security_init_cookie.LIBCMT ref: 00AE5F74

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 28742cf887f87717dfdcdc37c7df994b001693991d45e4ac740532fb454b581c
Instruction ID: 6d0467df276aee091b47ce24133983500306cb0000b3bca6743831d47460659b
Opcode Fuzzy Hash: 28742cf887f87717dfdcdc37c7df994b001693991d45e4ac740532fb454b581c
Instruction Fuzzy Hash:

Non-executed Functions

Function 00AC6F07 Relevance: 14.6, Strings: 11, Instructions: 883COMMON

Download Yara Rule

Strings

LK, xrefs: 00B42CB0
HMK, xrefs: 00B42E7D
@MK, xrefs: 00B42E60
0MK, xrefs: 00B42E09
JJJ J, xrefs: 00AC7096, 00AC709C
8MK, xrefs: 00B42E43
dMK, xrefs: 00B42EBA
LK, xrefs: 00B42C8F
TMK, xrefs: 00B42EA0
4MK, xrefs: 00B42E26
J, xrefs: 00AC6F77

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID: J$0MK$4MK$8MK$@MK$HMK$TMK$dMK$LK$LK$JJJ J
API String ID: 0-3636012664
Opcode ID: 7396a4921f9da90dd1aae6694be548c28df0cce0295820056248e47a2d119cc0
Instruction ID: 4d776809842b8c483c3564e6c679e86b7fa8854cf5f18b5802915d31ecb0a8e8
Opcode Fuzzy Hash: 7396a4921f9da90dd1aae6694be548c28df0cce0295820056248e47a2d119cc0
Instruction Fuzzy Hash: 51727E71E042299BDB14CF58C880BAEB7F5FF48710F5581AAE805EB281DB749E41EF94

Function 00AC9B60 Relevance: 8.6, Strings: 6, Instructions: 1055COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00AC9EA7
ERCP, xrefs: 00AC9C32
VUUU, xrefs: 00AC9ED4
J, xrefs: 00AC9CF3
VUUU, xrefs: 00AC9E95
VUUU, xrefs: 00B4BE14

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU$J
API String ID: 0-165364503
Opcode ID: 2ecaaabf99493e62742f510353e2728d7fc508ad6fcb74dfa7882aba823fda17
Instruction ID: 48c667caa6e97a320b420cdea16b6cea6156edaace2d278776edbb795a532393
Opcode Fuzzy Hash: 2ecaaabf99493e62742f510353e2728d7fc508ad6fcb74dfa7882aba823fda17
Instruction Fuzzy Hash: 42927D71E0121ACBDF24CF58C884BBEB7B1FB54714F1681AED816AB280D7709E81DB95

Function 00AD3B70 Relevance: 5.9, Strings: 4, Instructions: 903COMMON

Download Yara Rule

Strings

L, xrefs: 00B3701F
L, xrefs: 00AD40EC
@, xrefs: 00AD4176
L, xrefs: 00AD40A4

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: @$ L$ L$ L
API String ID: 3728558374-1044802042
Opcode ID: b5964f1e026a47ba72ebc0a1536dd1620bb921c08ef00ae8d80e8d101f688ce6
Instruction ID: 4b59fd5855da278207b8a032c3fb03750c15cbddabe4063fb29ecb8a28ab9cc1
Opcode Fuzzy Hash: b5964f1e026a47ba72ebc0a1536dd1620bb921c08ef00ae8d80e8d101f688ce6
Instruction Fuzzy Hash: 2572B175D042099FCF24DF54C981AAEB7F5FF48300F2480AAE906AB391DB75AE45CB91

Function 00B013CA Relevance: 5.6, Strings: 4, Instructions: 560COMMON

Download Yara Rule

Strings

(, xrefs: 00B01422
,2K, xrefs: 00B016B1
|, xrefs: 00B0140C
<2K, xrefs: 00B016FA

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID: ($,2K$<2K$|
API String ID: 0-2182472957
Opcode ID: 213d0035b0e57d45600f3f895b131fcd5407090fede8e37bb721a3d1f7665a0b
Instruction ID: 969e3cb0befc21e57d3940217690f0716a1b475905e31618fdcce14c1b1c1653
Opcode Fuzzy Hash: 213d0035b0e57d45600f3f895b131fcd5407090fede8e37bb721a3d1f7665a0b
Instruction Fuzzy Hash: C0321675A007059FC728CF69C490A6ABBF0FF48310B15C9AEE59ADB3A1E770E941CB44

Function 00AC77B0 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1054COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00AC7921

Strings

\QK, xrefs: 00B41028

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _memmove
String ID: \QK
API String ID: 4104443479-3628726987
Opcode ID: 7088e9255c345c521a9c7f53495c1e6fd4ed7d15cfaa04d266909762575c54c5
Instruction ID: e189f69f6f7a8c3395cb56769773c5b8b4a8f8945fb592cbe0b73e7d2a3ed04e
Opcode Fuzzy Hash: 7088e9255c345c521a9c7f53495c1e6fd4ed7d15cfaa04d266909762575c54c5
Instruction Fuzzy Hash: 1CA20675E04219DBDB24CF58C480BADBBB1FF48314F2681A9E859AB391D7349E81DF90

Function 00B2F7FF Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 630COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 00B2F9D2

Strings

F, xrefs: 00B2FF42

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcsncpy
String ID: F
API String ID: 1735881322-1304234792
Opcode ID: 513e673a684085903af3a68e9cc20ba3dff9b5133ba034c09a2775dd4a1645ce
Instruction ID: 180d345c90d909c536f4801f85228b8ab37b4743cc555785a3a58683ad6637c9
Opcode Fuzzy Hash: 513e673a684085903af3a68e9cc20ba3dff9b5133ba034c09a2775dd4a1645ce
Instruction Fuzzy Hash: 13327774A04256EFDB10CF28D984BAABBF4FF49354F140AB9F6598B2A1D730D841CB51

Function 00B2AACE Relevance: 3.6, APIs: 2, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025e21823f9f0be9693c9246f0c0fa624e52a4a58c53db3003e02b2ab783a972
Instruction ID: 64438829573870f2a669361d0d29df9724dce513ab1e760089c3ec98efca05ef
Opcode Fuzzy Hash: 025e21823f9f0be9693c9246f0c0fa624e52a4a58c53db3003e02b2ab783a972
Instruction Fuzzy Hash: 9F12FF71500229ABEB249F24EC49FAE7BF8FF45710F1046A9F91AEA2D1DB708941CB11

Function 00AEB043 Relevance: 3.5, APIs: 2, Instructions: 537COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 932d5e09fce22460d026d46474cb082544f819b06526096441e0640c5341d979
Instruction ID: 20fa74fcc09c46d735fe7ae81869886403aeb80600af6d763fc6dc7875167272
Opcode Fuzzy Hash: 932d5e09fce22460d026d46474cb082544f819b06526096441e0640c5341d979
Instruction Fuzzy Hash: D7328F75A122688FCB24CF55DD85AEAB7B5FF46310F1441E9E40AE7A81D7309E80CF62

Function 00AC7FA3 Relevance: 2.3, APIs: 1, Instructions: 796COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00AC7921

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: f30726d6958df742ada3bc9553f3ed09786250dd05e130d10e93340a3810d49a
Instruction ID: b3f551d18082a49cdec8472258f72a4b19d46bf18c908f6ca4fd88f0d09824d8
Opcode Fuzzy Hash: f30726d6958df742ada3bc9553f3ed09786250dd05e130d10e93340a3810d49a
Instruction Fuzzy Hash: 42624775E00219DFCF24CF58C480AADB7F2FF48354F2685AAD855AB251D734AE81EB90

Function 00AD3200 Relevance: 2.2, Strings: 1, Instructions: 986COMMON

Download Yara Rule

Strings

L, xrefs: 00B3933E

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID: L
API String ID: 0-249544069
Opcode ID: 77d127117cea5bc33be22513d70d8147984e86480c07347cb84d6615beb16583
Instruction ID: 690d28537f573d3f6acc67420ba78eaa1f38073931de3e68575636d46712a9dc
Opcode Fuzzy Hash: 77d127117cea5bc33be22513d70d8147984e86480c07347cb84d6615beb16583
Instruction Fuzzy Hash: 289269716083419FDB24DF18C584B6ABBE1FF88304F14885EE99A8B362D771ED45CB92

Function 00AED1B9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c728a019a251dc71abe01092ac8050e92b83019d64a38dfaf4092ab5920baa3
Instruction ID: dc1f55fef4351ef532d552b0a560ac28b0e973e5de75f5a25621aab1d7ce7f50
Opcode Fuzzy Hash: 5c728a019a251dc71abe01092ac8050e92b83019d64a38dfaf4092ab5920baa3
Instruction Fuzzy Hash: AC321532D29F414DD7239636CD22336A298AFB73D4F15D737E819B5EAAEB29C4834104

Function 00AC96C0 Relevance: 2.1, APIs: 1, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 5f7fe3ca82132ec9865668fd4424337fbc9ac292ff05e2628545d2ad5397e491
Instruction ID: 7f47f1e83b13a378e8681046bb9d6d942246fe856d4aae418fca075188c1b581
Opcode Fuzzy Hash: 5f7fe3ca82132ec9865668fd4424337fbc9ac292ff05e2628545d2ad5397e491
Instruction Fuzzy Hash: F52298716083019FD724DF64C895B6BBBE4FF84310F12492EF89A9B291DB71E945CB82

Function 00AF038E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06bbaeb1bcc534ec256dd5b5d585b6de8006006e2b3e3cdbfaef78062e17ea4a
Instruction ID: ea80ff88339f01cdc66d9f650201e9205970b67d92442d4968f512c50ee2b11a
Opcode Fuzzy Hash: 06bbaeb1bcc534ec256dd5b5d585b6de8006006e2b3e3cdbfaef78062e17ea4a
Instruction Fuzzy Hash: 64B1E320D2AF414DD72396398831336B75CAFBB2D5FA1D72BFC1A74D62EB2185934284

Function 00B0B6CC Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00B0B6DF

Part of subcall function 00AE344A: __aulldiv.LIBCMT ref: 00AE3473

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: __aulldiv__time64
String ID:
API String ID: 325419493-0
Opcode ID: f8c7fdc095501e1a7362a0b4cc7a48e3a2c9a4e74b9e0d285671c9b74daca32a
Instruction ID: 7f8dbd7042bed7615195880be0b96d977b404170da9d60c00ce5582cc1846871
Opcode Fuzzy Hash: f8c7fdc095501e1a7362a0b4cc7a48e3a2c9a4e74b9e0d285671c9b74daca32a
Instruction Fuzzy Hash: 3C2160766345108BC729CF28C881E92B7E5EB95311B248E7DE4E5CB2D0CB74AD05DB54

Function 00AC93F0 Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a8534ed2f0a89ac6e7169b63d51ce6c08bd617fc6664a61c85acdbf4f076445
Instruction ID: 128ec638b23ceb789bb8b1dc356d141524dfaa95e10e661839b066d05426e6ec
Opcode Fuzzy Hash: 1a8534ed2f0a89ac6e7169b63d51ce6c08bd617fc6664a61c85acdbf4f076445
Instruction Fuzzy Hash: FA126B70A00609EFDF04DFA5DA85AAEB7F5FF48300F218569E806E7290EB35AD15CB54

Function 00ACE3E3 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ffa93417b0b4bc0b97aad7226db4dd8b30a2187279d0b979da24b40810fc03
Instruction ID: eec3d28ea1546ea9ae8c38c33fe11e44e1a0b0723848a730ec6e05b8126cfa3a
Opcode Fuzzy Hash: 41ffa93417b0b4bc0b97aad7226db4dd8b30a2187279d0b979da24b40810fc03
Instruction Fuzzy Hash: A8128BB4A042068FDB24DF58C590FAAB7F1FF14304F25816EE94AAB351E735AD81CB91

Function 00ACAF50 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID:
API String ID: 3728558374-0
Opcode ID: 6efcfca7aac5f57af79c65e8a6eed45e1d76075d1f5c80d3e59fd3841deb7b70
Instruction ID: fb2a776bc1f6d09bfdb98ce8e6fedfdcbd59ab1c1b6139220b206152d9b064e7
Opcode Fuzzy Hash: 6efcfca7aac5f57af79c65e8a6eed45e1d76075d1f5c80d3e59fd3841deb7b70
Instruction Fuzzy Hash: 0E0291B0A00109DFCF04DF68D992BAEB7F5EF44300F2580A9E806EB255EB35D915CB95

Function 00B231BC Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 0db687a5c996a4c2d7a9b4172f84bdbd9adc5b38ad9b7c5ed605c875a3498890
Instruction ID: 40816ad4bf965cd61242701aaa79c636eac307301afd90b94c2feef70218b938
Opcode Fuzzy Hash: 0db687a5c996a4c2d7a9b4172f84bdbd9adc5b38ad9b7c5ed605c875a3498890
Instruction Fuzzy Hash: 95E17C71604210AFCB15DF28D995E2ABBE8FF89714F0489ADF44ADB2A1CB35ED05CB41

Function 00ADB11F Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cf0e01d325c05872215fadf7fd1876a518e877bd8c73a3ee908c1b70c179c08
Instruction ID: 04f55540963b1d32919599fe650e604ba3b612d5f82566c45c806717a3c91444
Opcode Fuzzy Hash: 7cf0e01d325c05872215fadf7fd1876a518e877bd8c73a3ee908c1b70c179c08
Instruction Fuzzy Hash: 1FA1F171124105FADA286B6A5C99EFF39BCEB66340F22416FF407D67D2DB24DC01A272

Function 00AE02A4 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction ID: b7b66d5f3aa02bacfa5e6598c1907757a66c7d7384de05b2069c38079cc9a2fb
Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction Fuzzy Hash: 0EC1B2322051E30EDF2D473A883493FBBA15AA27B131A176ED8B3CB5D5EF60C564D620

Function 00AE06D9 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction ID: 51d17fabc4e1a099018a7e6029d7a4637d51252e740f79423b4690b7cff7ae35
Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction Fuzzy Hash: 1EC1B2322051E30DDF2D473A983483FBBA15AA2BB131A076ED4B3CB5D6EF60C564D620

Function 00ADFE6F Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: fe95e36ad5ad9222fc078fc7dded4d43b00bb3239fd88f65560b8f6c0299fb06
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: EEC172322051E30EDF2D473A983493FBBA15AA27B131A076ED4B3CB6D5EF20C564D620

Function 00ADFA57 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 3713d14542429c4bef4176f25476b6bc845ecf009a17778428ae9504ffa5a2de
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 5FC16F322051A30DDF2D4739987443FBBA15AA2BB531A077FD8B3CB6D5EE20D564D620

Function 00B0FA0C Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 00B0FA96
_wcschr.LIBCMT ref: 00B0FAA4
_wcscpy.LIBCMT ref: 00B0FABB
_wcscat.LIBCMT ref: 00B0FACA
_wcscat.LIBCMT ref: 00B0FAE8
_wcscpy.LIBCMT ref: 00B0FB09
__wsplitpath.LIBCMT ref: 00B0FBE6
_wcscpy.LIBCMT ref: 00B0FC0B
_wcscpy.LIBCMT ref: 00B0FC1D
_wcscpy.LIBCMT ref: 00B0FC32
_wcscat.LIBCMT ref: 00B0FC47
_wcscat.LIBCMT ref: 00B0FC59
_wcscat.LIBCMT ref: 00B0FC6E

Part of subcall function 00B0BFA4: _wcscmp.LIBCMT ref: 00B0C03E
Part of subcall function 00B0BFA4: __wsplitpath.LIBCMT ref: 00B0C083
Part of subcall function 00B0BFA4: _wcscpy.LIBCMT ref: 00B0C096
Part of subcall function 00B0BFA4: _wcscat.LIBCMT ref: 00B0C0A9
Part of subcall function 00B0BFA4: __wsplitpath.LIBCMT ref: 00B0C0CE
Part of subcall function 00B0BFA4: _wcscat.LIBCMT ref: 00B0C0E4
Part of subcall function 00B0BFA4: _wcscat.LIBCMT ref: 00B0C0F7

Strings

t2K, xrefs: 00B0FC97

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
String ID: t2K
API String ID: 2955681530-2697450999
Opcode ID: 8798d7e8ab2972a22761d006a6a6d7caa3ae8dbe39d238e9f724702d96fbc902
Instruction ID: af06923b1bb79301ed6033fa576d08b0988f25b293202263770980c0d6346e77
Opcode Fuzzy Hash: 8798d7e8ab2972a22761d006a6a6d7caa3ae8dbe39d238e9f724702d96fbc902
Instruction Fuzzy Hash: 4791B172604345AFDB20EB54C991FABB7E8FF84300F04486DF9499B291DB74EA44CB92

Function 00ACCC24 Relevance: 18.3, APIs: 12, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wcsnicmp.LIBCMT ref: 00ACCC68
__wcsnicmp.LIBCMT ref: 00ACCC80
__wcsnicmp.LIBCMT ref: 00ACCC98
__wcsnicmp.LIBCMT ref: 00ACCCB0
__wcsnicmp.LIBCMT ref: 00ACCCC8
__wcsnicmp.LIBCMT ref: 00ACCCE0
__wcsnicmp.LIBCMT ref: 00ACCCF8
__wcsnicmp.LIBCMT ref: 00ACCD0C
__wcsnicmp.LIBCMT ref: 00ACCD4D
__wcsnicmp.LIBCMT ref: 00ACCD61
__wcsnicmp.LIBCMT ref: 00ACCD75
__wcsnicmp.LIBCMT ref: 00ACCD89

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: __wcsnicmp
String ID:
API String ID: 1038674560-0
Opcode ID: 6148897f4c34d6491561c82914e9792e52891cf6fc28d7f80cc6e4f2f12dad58
Instruction ID: cece691cb9cf2b033627ee126265f69d918b6e8e1d62a131a6e577e84c86db61
Opcode Fuzzy Hash: 6148897f4c34d6491561c82914e9792e52891cf6fc28d7f80cc6e4f2f12dad58
Instruction Fuzzy Hash: DB81E630640215BACB25AF65DD83FBB3BB8EF14710F254039F90AAA1C2EB74D945C6A5

Function 00B06CE9 Relevance: 18.2, APIs: 12, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 00B06D4F
_wcscmp.LIBCMT ref: 00B06D5A
_wcscat.LIBCMT ref: 00B06D70
_wcsstr.LIBCMT ref: 00B06D7B
_wcscat.LIBCMT ref: 00B06DE0
_wcscat.LIBCMT ref: 00B06DE7
_wcsncpy.LIBCMT ref: 00B06E12

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscat$_wcscmp_wcscpy_wcsncpy_wcsstr
String ID:
API String ID: 3576275495-0
Opcode ID: 1e8447ed9fc16e154d648348208776be1c0f899143b705094d37cd1c4ad9c9f4
Instruction ID: ac0447a72c3f14b145e3569ae6d3494879feb3c2e79cb11c92163941ad7aec56
Opcode Fuzzy Hash: 1e8447ed9fc16e154d648348208776be1c0f899143b705094d37cd1c4ad9c9f4
Instruction Fuzzy Hash: 4141F571A04240BBEB10AB75CE47EBF7BBCDF41710F14006AF905A61C2EB759A1196A5

Function 00B0690B Relevance: 18.1, APIs: 12, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcschr.LIBCMT ref: 00B06923
_wcscpy.LIBCMT ref: 00B06934
__wsplitpath.LIBCMT ref: 00B06958
__wsplitpath.LIBCMT ref: 00B06979
_wcscpy.LIBCMT ref: 00B0699B
_wcscpy.LIBCMT ref: 00B069B9
_wcscpy.LIBCMT ref: 00B069C7
_wcscat.LIBCMT ref: 00B069D6
_wcscat.LIBCMT ref: 00B06A2B
_wcscat.LIBCMT ref: 00B06A61
_wcscat.LIBCMT ref: 00B06A73

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
String ID:
API String ID: 136442275-0
Opcode ID: d61e9edc43eb21dc305860e20555fab4e9811c7e7a0782106bb1dba9aa94a74c
Instruction ID: 4257a35677515df33b1d3f33217d69f868e3c91483d4134c23c8c1ea9d7f015e
Opcode Fuzzy Hash: d61e9edc43eb21dc305860e20555fab4e9811c7e7a0782106bb1dba9aa94a74c
Instruction Fuzzy Hash: 2E413E7684515CAECF61EB95CC85DCF77BCEB88300F1041E6B659A2091EA70ABE88F54

Function 00AE500E Relevance: 16.8, APIs: 11, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00AE5047

Part of subcall function 00AE7C0E: __getptd_noexit.LIBCMT ref: 00AE7C0E

__gmtime64_s.LIBCMT ref: 00AE50E0
__gmtime64_s.LIBCMT ref: 00AE5116
__gmtime64_s.LIBCMT ref: 00AE5133
__allrem.LIBCMT ref: 00AE5189
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AE51A5
__allrem.LIBCMT ref: 00AE51BC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AE51DA
__allrem.LIBCMT ref: 00AE51F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AE520F
__invoke_watson.LIBCMT ref: 00AE5280

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction ID: 8b1c29539b353f0724de61fbb82c89c9958a3dca2fe239497987436e153803f2
Opcode Fuzzy Hash: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction Fuzzy Hash: 5471D872E00B57ABD714AF7ADD81BAAB3A8AF00768F144239F614D7681E770DD408BD0

Function 00B0F5FA Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 278
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__swprintf.LIBCMT ref: 00B0F72E
__swprintf.LIBCMT ref: 00B0F767
__swprintf.LIBCMT ref: 00B0F7BB

Part of subcall function 00AE172B: __woutput_l.LIBCMT ref: 00AE1784

__swprintf.LIBCMT ref: 00B0F809
__swprintf.LIBCMT ref: 00B0F858
__swprintf.LIBCMT ref: 00B0F8A7
__swprintf.LIBCMT ref: 00B0F8F6

Strings

9K, xrefs: 00B0F7B0

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: __swprintf$__woutput_l
String ID: 9K
API String ID: 1571530113-196837694
Opcode ID: 719a001bf592241279936c11551fac8019408ba57f3921e8acc488db3792300a
Instruction ID: b44ed3afd606b64ed85b5b9137d6965d1b14bca6acfbb916de9885bdf977d6ac
Opcode Fuzzy Hash: 719a001bf592241279936c11551fac8019408ba57f3921e8acc488db3792300a
Instruction Fuzzy Hash: 72A1FFB2508344ABC310EB95C995EAFB7ECFF94704F440D2EF59682192EB34D949CB62

Function 00ACC833 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 479
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsplitpath.LIBCMT ref: 00ACC93E

Part of subcall function 00AE1DFC: __wsplitpath_helper.LIBCMT ref: 00AE1E3C

_wcscpy.LIBCMT ref: 00ACC953
_wcscat.LIBCMT ref: 00ACC968

Part of subcall function 00ACB337: _wcscpy.LIBCMT ref: 00ACB36F

Strings

EA06, xrefs: 00B330C9
AU3!, xrefs: 00ACC90C

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscpy$__wsplitpath__wsplitpath_helper_wcscat
String ID: AU3!$EA06
API String ID: 942958535-2658333250
Opcode ID: d91017b64214bce65a844dbd476cba1e93f93d1f7508d99289b1bb69c13c9563
Instruction ID: a48c35246f8f88494006169ec64c1f9b0d4ad80257be667c422355e1c4805447
Opcode Fuzzy Hash: d91017b64214bce65a844dbd476cba1e93f93d1f7508d99289b1bb69c13c9563
Instruction Fuzzy Hash: E712BB715083419FC724EF24C981EAFBBE5EF98710F50496EF48A932A1DB30DA49CB56

Function 00B060DD Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B0725E: __wsplitpath.LIBCMT ref: 00B0727B
Part of subcall function 00B0725E: __wsplitpath.LIBCMT ref: 00B0728E

_wcscat.LIBCMT ref: 00B06149
_wcscat.LIBCMT ref: 00B06167
__wsplitpath.LIBCMT ref: 00B0618E
_wcscpy.LIBCMT ref: 00B06209
_wcscat.LIBCMT ref: 00B0621C
_wcscat.LIBCMT ref: 00B0622F

Strings

D7K, xrefs: 00B06138

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscat$__wsplitpath$_wcscpy
String ID: D7K
API String ID: 1339377152-4191929378
Opcode ID: d13f31206347c16688133b179fd0511736ac8aab39ef4f41029cc2fa49194ad5
Instruction ID: e9fb705db712de46895118aa37d3e571838cd0fa7904edb782c6105c8bddce23
Opcode Fuzzy Hash: d13f31206347c16688133b179fd0511736ac8aab39ef4f41029cc2fa49194ad5
Instruction Fuzzy Hash: 2E512072C0911C6ACB21EBA5CC44DDF7BFCAF05310F0505EAE545E2181EE769B998FA8

Function 00B0BFA4 Relevance: 10.8, APIs: 7, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B0BDB4: __time64.LIBCMT ref: 00B0BDBE

Part of subcall function 00AC4517: _fseek.LIBCMT ref: 00AC452F

__wsplitpath.LIBCMT ref: 00B0C083

Part of subcall function 00AE1DFC: __wsplitpath_helper.LIBCMT ref: 00AE1E3C

_wcscpy.LIBCMT ref: 00B0C096
_wcscat.LIBCMT ref: 00B0C0A9
__wsplitpath.LIBCMT ref: 00B0C0CE
_wcscat.LIBCMT ref: 00B0C0E4
_wcscat.LIBCMT ref: 00B0C0F7
_wcscmp.LIBCMT ref: 00B0C03E

Part of subcall function 00B0C56D: _wcscmp.LIBCMT ref: 00B0C65D
Part of subcall function 00B0C56D: _wcscmp.LIBCMT ref: 00B0C670

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscat_wcscmp$__wsplitpath$__time64__wsplitpath_helper_fseek_wcscpy
String ID:
API String ID: 332469576-0
Opcode ID: 93f597808344f860e782e19f6c48d675a5439c55fe7c8b84123f1999b97c0d6d
Instruction ID: c4e17ccdec91046311657316d59524583fce2beac84957dbbe9175cef06fdc19
Opcode Fuzzy Hash: 93f597808344f860e782e19f6c48d675a5439c55fe7c8b84123f1999b97c0d6d
Instruction Fuzzy Hash: 43C11BB1D00219AFDF11DF95CD81EDEBBBCEF49310F1041AAB609E6191DB709A848F65

Function 00AFD8A7 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscmp.LIBCMT ref: 00AFD8FC
_wcscmp.LIBCMT ref: 00AFD95F
_wcsstr.LIBCMT ref: 00AFD970
_wcscmp.LIBCMT ref: 00AFD9B8
_wcscmp.LIBCMT ref: 00AFDA38

Strings

@, xrefs: 00AFD8C6

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscmp$_wcsstr
String ID: @
API String ID: 3312506106-2766056989
Opcode ID: 57eaeece17d193142035803e19f4c8271cdf4de3042e5770e13f33008b5824d2
Instruction ID: fdf58f02767c11331e641264243b05079d138ca4162a0a31f02eb4afba6571bf
Opcode Fuzzy Hash: 57eaeece17d193142035803e19f4c8271cdf4de3042e5770e13f33008b5824d2
Instruction Fuzzy Hash: A281C0310083499BDB12DF90C985FBA7BE9EF84354F04846EFE899A096DB70DD45CBA1

Function 00B0D76A Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 00B0D8C2

Strings

:K, xrefs: 00B0D800
@:K, xrefs: 00B0D82C
`:K, xrefs: 00B0D859
4:K, xrefs: 00B0D816
P:K, xrefs: 00B0D842

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscpy
String ID: :K$4:K$@:K$P:K$`:K
API String ID: 3048848545-1244833726
Opcode ID: 27dd89965dd486c355bf12e5958c17b9eceaa65f898452980bc2b070e1fbd423
Instruction ID: 9b783f49ee0efb54a23869da5ea4b5c0f3b1dc5ff76bc9a6d00599151104abef
Opcode Fuzzy Hash: 27dd89965dd486c355bf12e5958c17b9eceaa65f898452980bc2b070e1fbd423
Instruction Fuzzy Hash: 89517C31114300AFC700EF54D992BAABBE5EF94314F60C96EF59A5B2E2EB31DD05CA52

Function 00AC936C Relevance: 9.1, APIs: 6, Instructions: 145COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00AC93AB
__itow.LIBCMT ref: 00AC93DF

Part of subcall function 00AE1557: _xtow@16.LIBCMT ref: 00AE1578

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: __itow__swprintf_xtow@16
String ID:
API String ID: 1502193981-0
Opcode ID: 7769c36a9f54d1984458b68226c99e882a1d25785028ffacc96b5a3d2d0ea043
Instruction ID: 10ca5b9387ccee89c3dc7fb78d291e7cee72960733de87b000ebe7710e6e798b
Opcode Fuzzy Hash: 7769c36a9f54d1984458b68226c99e882a1d25785028ffacc96b5a3d2d0ea043
Instruction Fuzzy Hash: 1941B371504204AFDB24EF78DA46F6AB7F8EF44300F3044AEE14ADB281EB75A941CB11

Function 00B07555 Relevance: 9.1, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00B075E2

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: d4c9a3347340ec2f6b292e15ccfd5db41bd16ad9e0c1aa6c8d3ee4a06672525c
Instruction ID: b0fdc696678fe9c7ab27e668fbd52a5b507ab36b7bee93a9361e1ceaad60dd05
Opcode Fuzzy Hash: d4c9a3347340ec2f6b292e15ccfd5db41bd16ad9e0c1aa6c8d3ee4a06672525c
Instruction Fuzzy Hash: ED5120B2E492295ADF60EB94DC81DDEB7FCDF48310B1044EAF605E3181EA74A6C5CB64

Function 00B07DB1 Relevance: 9.1, APIs: 6, Instructions: 137COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 00B07DF3
_wcsncpy.LIBCMT ref: 00B07E25
_wcsncpy.LIBCMT ref: 00B07E58
_wcsncpy.LIBCMT ref: 00B07E9A
_wcsncpy.LIBCMT ref: 00B07ED4
_wcsncpy.LIBCMT ref: 00B07F03

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcsncpy
String ID:
API String ID: 1735881322-0
Opcode ID: 82a3674f3e19fbdef0c818efbcbf46cd2e7acf95712a327e08f2885954205449
Instruction ID: 81b0a29710dac5e5e567960eae43b4dc230d9648aa8fae64d314dea0e58ff3db
Opcode Fuzzy Hash: 82a3674f3e19fbdef0c818efbcbf46cd2e7acf95712a327e08f2885954205449
Instruction Fuzzy Hash: 39419D66C10294B6CB10EBF5CC4AACFB7ACEF44310F5089A6E508F3161FA74E661C7A5

Function 00B116DA Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 309COMMON

Download Yara Rule

APIs

Part of subcall function 00AC936C: __swprintf.LIBCMT ref: 00AC93AB
Part of subcall function 00AC936C: __itow.LIBCMT ref: 00AC93DF

Part of subcall function 00ADC6F4: _wcscpy.LIBCMT ref: 00ADC717

_wcstok.LIBCMT ref: 00B1184E
_wcscpy.LIBCMT ref: 00B118DD
_memset.LIBCMT ref: 00B11910

Strings

p2Kl2K, xrefs: 00B11920
X, xrefs: 00B11948

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X$p2Kl2K
API String ID: 774024439-158789027
Opcode ID: 6197bbc515bfbc98f9987be406cffc171f345c4ee518ea2fe1228caf3bcba2a9
Instruction ID: 4637b5ae97572d831c157997b34a879d0f996ae57adc4d5740b87179d05292b5
Opcode Fuzzy Hash: 6197bbc515bfbc98f9987be406cffc171f345c4ee518ea2fe1228caf3bcba2a9
Instruction Fuzzy Hash: 01C16B315043409FC724EF28CA91E9AB7E4FF85350F45496DF99A9B2A2DB30EC45CB82

Function 00B0D0B8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00B0D0FA
_memset.LIBCMT ref: 00B0D17B
_wcsncpy.LIBCMT ref: 00B0D1B7

Strings

\, xrefs: 00B0D110
:, xrefs: 00B0D11B

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: __swprintf_memset_wcsncpy
String ID: :$\
API String ID: 214737766-1166558509
Opcode ID: b68ac97a0bbf8f074f79a283de7a9c19f5e6387d087e4f1df6f20452fc066d1a
Instruction ID: 4b9945fca1a83c2de78e217637900779b2348f31083ebb59b6ded4bd1b587c56
Opcode Fuzzy Hash: b68ac97a0bbf8f074f79a283de7a9c19f5e6387d087e4f1df6f20452fc066d1a
Instruction Fuzzy Hash: 903161B6900109ABDB21DFA5DC49FAF7BBCEF89740F1044BAF509D21E1EA7096458B24

Function 00AFCF50 Relevance: 7.8, APIs: 5, Instructions: 273COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00AFD032
_wcscmp.LIBCMT ref: 00AFD045
_wcscmp.LIBCMT ref: 00AFD0D6
_wcscmp.LIBCMT ref: 00AFD248
_wcscmp.LIBCMT ref: 00AFD282

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscmp$__swprintf
String ID:
API String ID: 1620681296-0
Opcode ID: 1c52813d1dd22c810bf321a69279f4fa802cf737a72b6e5702cafbb6e43a2120
Instruction ID: 87b73ff152dacf58eb689b7d43d744c1ee44741b36209afe12fe06e7ba345d49
Opcode Fuzzy Hash: 1c52813d1dd22c810bf321a69279f4fa802cf737a72b6e5702cafbb6e43a2120
Instruction Fuzzy Hash: 7FA1817160430AABD716DFA4C984FFAB7A9FF44354F004A29FA9992190DB30EA45CBD1

Function 00AEA979 Relevance: 7.6, APIs: 5, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 00AEA991

Part of subcall function 00AE7D7C: __FF_MSGBANNER.LIBCMT ref: 00AE7D91
Part of subcall function 00AE7D7C: __NMSG_WRITE.LIBCMT ref: 00AE7D98
Part of subcall function 00AE7D7C: __malloc_crt.LIBCMT ref: 00AE7DB8

__lock.LIBCMT ref: 00AEA9A4
__lock.LIBCMT ref: 00AEA9F0

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: __lock$__malloc_crt__mtinitlocknum
String ID:
API String ID: 1818312207-0
Opcode ID: 9e49298281f73815b4fa3fb984943fc94ecb06dcc50e504b9963bd177dc87d8e
Instruction ID: e5786e4c04ef995f3b7ac6c4da963bd637b2cb6a637e8609c85f66b4105ba5fc
Opcode Fuzzy Hash: 9e49298281f73815b4fa3fb984943fc94ecb06dcc50e504b9963bd177dc87d8e
Instruction Fuzzy Hash: 0B415BB1E01381DBEB14DFAADA4475CB7B0AF21375F248338E425AB2D1D774A840CB96

Function 00B063F9 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

_wcscat.LIBCMT ref: 00B06441
__wsplitpath.LIBCMT ref: 00B0645F
_wcscpy.LIBCMT ref: 00B064A3
_wcscat.LIBCMT ref: 00B064B8
_wcscat.LIBCMT ref: 00B064CA

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscat$__wsplitpath_wcscpy
String ID:
API String ID: 3240238573-0
Opcode ID: 207bf40969deb6b3d3afc2ff0a38490a33ffcbdb27faad35d926c948b6f8fdd0
Instruction ID: 912d6541aab8d1dd5bbf8d6db1f179b40462a320fb02f5f762554bafed8c3543
Opcode Fuzzy Hash: 207bf40969deb6b3d3afc2ff0a38490a33ffcbdb27faad35d926c948b6f8fdd0
Instruction Fuzzy Hash: 3431B4B28083889EC321DBA48C85DDFBBDCAF95310F40096EF5D9C3181EA35D54987A7

Function 00AE7B47 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00AE7B47

Part of subcall function 00AE123A: __initp_misc_winsig.LIBCMT ref: 00AE125E

__mtinitlocks.LIBCMT ref: 00AE7B4C
__mtterm.LIBCMT ref: 00AE7B55

Part of subcall function 00AE7BBD: _free.LIBCMT ref: 00AE7D46

__calloc_crt.LIBCMT ref: 00AE7B7A

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: __calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
String ID:
API String ID: 3525174695-0
Opcode ID: fff7101387f9233e62c941087eac264b93e49a4ba47622118098bae08e948c6b
Instruction ID: 59b3c7d215fadf57e516e4d59dafe8fee3b71a017499a9f08973e847ce44ffed
Opcode Fuzzy Hash: fff7101387f9233e62c941087eac264b93e49a4ba47622118098bae08e948c6b
Instruction Fuzzy Hash: 90F0B43251D3D21AE72577767E47A8F27C59F01730B200BA9F861C90D2FF2188424164

Function 00AFACC5 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 223COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AFAD08

Strings

H*K, xrefs: 00AFAE40
, xrefs: 00AFAD17

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _memset
String ID: $H*K
API String ID: 2102423945-3630131256
Opcode ID: c01634c42d0ae3b9110cd245596c32bc6af3986347a388132d2fb5226a9e64dc
Instruction ID: 6ccfcc7ee6a32409c8dd34db428ab511feb397b8c5578a1f5bb3a8777728db05
Opcode Fuzzy Hash: c01634c42d0ae3b9110cd245596c32bc6af3986347a388132d2fb5226a9e64dc
Instruction Fuzzy Hash: 37819BB180120DAFDF119FE4CD49AFEBBB9EF18304F044129FA19A61A1D7718E54DB61

Function 00AC4A30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

_wcscat.LIBCMT ref: 00B32D80
_wcscat.LIBCMT ref: 00B32DB5

Strings

8!L, xrefs: 00AC4B1C
\, xrefs: 00B32DA2

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscat
String ID: 8!L$\
API String ID: 2563891980-2772976860
Opcode ID: fa8a9e684f192d5f0ec16de0341574a8dd1ab902b51a2da00cf2f8cb0f237409
Instruction ID: 8baaa56c168e2349b7a5d76d008b2e9cc2ae0c37da37600b4c51dfee9bf8978e
Opcode Fuzzy Hash: fa8a9e684f192d5f0ec16de0341574a8dd1ab902b51a2da00cf2f8cb0f237409
Instruction Fuzzy Hash: 4E516A754043409FC744EF69DA81DAAB7F4FE89300B59453EF28993261EFF09A48CB5A

Function 00AE34AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__getstream.LIBCMT ref: 00AE34FE

Part of subcall function 00AE7C0E: __getptd_noexit.LIBCMT ref: 00AE7C0E

@_EH4_CallFilterFunc@8.LIBCMT ref: 00AE3539
__wopenfile.LIBCMT ref: 00AE3549

Strings

<G, xrefs: 00AE34CD, 00AE34F0, 00AE34FC

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
String ID: <G
API String ID: 1820251861-2138716496
Opcode ID: e12d3699157ed522373a9c6598b4b5b430320c1e0cdd8312ea3d440cb485dafa
Instruction ID: 9223856385330c834002dc2999ccedb817730e6673576fd4f3a6a04282c51d22
Opcode Fuzzy Hash: e12d3699157ed522373a9c6598b4b5b430320c1e0cdd8312ea3d440cb485dafa
Instruction Fuzzy Hash: 6811E372A00286AEDF12BF738D4267E36F4AF45350F258825E815DB2C1EB34CA0197B1

Function 00AE7A94 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00AE7AD8

Part of subcall function 00AE7CF4: __mtinitlocknum.LIBCMT ref: 00AE7D06

__lock.LIBCMT ref: 00AE7AF9
___addlocaleref.LIBCMT ref: 00AE7B17

Strings

`H, xrefs: 00AE7AA3

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: __lock$___addlocaleref__mtinitlocknum
String ID: `H
API String ID: 3416137509-912421188
Opcode ID: 9c391c81e9dda691e28eee64fa7d0ba00185fd93005869b510abeebd1aa148ee
Instruction ID: 9ba062b357b31cd6ebb31b122eaed034b4e5a6a97cd539029b78f80b4960860c
Opcode Fuzzy Hash: 9c391c81e9dda691e28eee64fa7d0ba00185fd93005869b510abeebd1aa148ee
Instruction Fuzzy Hash: 68016D71504B40EFD720DF76DA0574AB7F0EF50325F208D0EA49A972A1CBB4A644CB55

Function 00AC1CDE Relevance: 6.2, APIs: 4, Instructions: 250COMMON

Download Yara Rule

APIs

Part of subcall function 00ADF4EA: std::exception::exception.LIBCMT ref: 00ADF51E
Part of subcall function 00ADF4EA: __CxxThrowException@8.LIBCMT ref: 00ADF533

__swprintf.LIBCMT ref: 00AC1EA6

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: Exception@8Throw__swprintfstd::exception::exception
String ID:
API String ID: 2125237772-0
Opcode ID: d502e7153788b9ec6a5d85a0eaa2272e138f0842792cb5ff207fc2e3d74af74d
Instruction ID: 3e23081212ba67780a7f91949c3ab369c2d04ff1d4bbe6dc6cfd0d033fe95c1c
Opcode Fuzzy Hash: d502e7153788b9ec6a5d85a0eaa2272e138f0842792cb5ff207fc2e3d74af74d
Instruction Fuzzy Hash: 73917E716042019FC714EF64C996E6ABBF4FF95700F16495DF886A72A2DB30ED04CB52

Function 00B105F8 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00B1076F
_wcscat.LIBCMT ref: 00B10787
_wcscat.LIBCMT ref: 00B10799

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscat$__wsplitpath
String ID:
API String ID: 1413645957-0
Opcode ID: ff5e0aed43fc8de9fb838faa9418ce3fd369cb65696d28d22a61ac5ec733e13f
Instruction ID: dcb43b98313407959703e02b2e4b3940ebd4cf3fb3cf7afc4937eb1c74a79486
Opcode Fuzzy Hash: ff5e0aed43fc8de9fb838faa9418ce3fd369cb65696d28d22a61ac5ec733e13f
Instruction Fuzzy Hash: D88180715243419FCB24EF24C9859AEB3E8FBD9304F54486EF885C7250EAB0EDC48B92

Function 00AEACB3 Relevance: 6.2, APIs: 4, Instructions: 219COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00AEACC1

Part of subcall function 00AE7CF4: __mtinitlocknum.LIBCMT ref: 00AE7D06

__calloc_crt.LIBCMT ref: 00AEACD2

Part of subcall function 00AE6986: __calloc_impl.LIBCMT ref: 00AE6995

@_EH4_CallFilterFunc@8.LIBCMT ref: 00AEACED
__calloc_crt.LIBCMT ref: 00AEAD91

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: __calloc_crt$CallFilterFunc@8__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 601758943-0
Opcode ID: d05390f3cb44285053ee2febbd5e6b81c0c775ccd2da8302e06ee6537205509f
Instruction ID: a7214054d443dee8f13f024abac3e3f392bd1a3d087e286007a3be4071721233
Opcode Fuzzy Hash: d05390f3cb44285053ee2febbd5e6b81c0c775ccd2da8302e06ee6537205509f
Instruction Fuzzy Hash: FB8106B1D053958FDB24CF69C9806ADBBF0AF25324B24466DD4A6AB3D1C734A803CB56

Function 00B1091D Relevance: 6.2, APIs: 4, Instructions: 185COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00B10A59
_wcscat.LIBCMT ref: 00B10A71
_wcscat.LIBCMT ref: 00B10A83
_wcscpy.LIBCMT ref: 00B10B0B

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscat$__wsplitpath_wcscpy
String ID:
API String ID: 3240238573-0
Opcode ID: 2d0a0b81136769988e18dfd9554f1fc92bd9ec7e6ba6f0201e502796036e3357
Instruction ID: c876457e235cad188f6905f574f50d80dd97dc4eedaca98e05889795afc281ac
Opcode Fuzzy Hash: 2d0a0b81136769988e18dfd9554f1fc92bd9ec7e6ba6f0201e502796036e3357
Instruction Fuzzy Hash: 186167B25182059FC710EF64C984EAEB3E8FF89310F44496EF989C7251DB71E985CB92

Function 00AE365B Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00AE36B7
_memcpy_s.LIBCMT ref: 00AE3729
__filbuf.LIBCMT ref: 00AE37AA
_memset.LIBCMT ref: 00AE37EE

Part of subcall function 00AE7C0E: __getptd_noexit.LIBCMT ref: 00AE7C0E

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit_memcpy_s
String ID:
API String ID: 3877424927-0
Opcode ID: bebfa5eeb54ca0c55a1007567e014ed37b2c96719a673c9bdfa0e7e305b31e35
Instruction ID: 9463e7b3f2c2d4936e0a6994a193023f630a9a7e1aef365a13611a2c42e4850f
Opcode Fuzzy Hash: bebfa5eeb54ca0c55a1007567e014ed37b2c96719a673c9bdfa0e7e305b31e35
Instruction Fuzzy Hash: 9051B6B2A00285ABDF24DF7B898866F77B5AF40320F248729F826972D0D7759F509B40

Function 00B0CC5C Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00B0CD1E
__swprintf.LIBCMT ref: 00B0CD37
_wprintf.LIBCMT ref: 00B0CDED
_wprintf.LIBCMT ref: 00B0CE0B

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: __swprintf_wprintf
String ID:
API String ID: 1937080608-0
Opcode ID: d92d2abdc2dfcafaaf643b11d63e75c5c8013503d35ff4002f6c97776b8cf86f
Instruction ID: c0823eea7b4fcaf6756738f08a49f4883a1822b8e9b222921e461033f9ce50ab
Opcode Fuzzy Hash: d92d2abdc2dfcafaaf643b11d63e75c5c8013503d35ff4002f6c97776b8cf86f
Instruction Fuzzy Hash: 42515071800109AACB15FBE1CE46FEEBBB8EF05304F11426AF505720A2EB356F59DB60

Function 00B0C396 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 00AC4517: _fseek.LIBCMT ref: 00AC452F

Part of subcall function 00B0C56D: _wcscmp.LIBCMT ref: 00B0C65D
Part of subcall function 00B0C56D: _wcscmp.LIBCMT ref: 00B0C670

_free.LIBCMT ref: 00B0C4DD
_free.LIBCMT ref: 00B0C4E4
_free.LIBCMT ref: 00B0C54F
_free.LIBCMT ref: 00B0C557

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _free$_wcscmp$_fseek
String ID:
API String ID: 3404660211-0
Opcode ID: b2db0521c306de9859c7194269149a6dceff0050bdbfaa59955085d3035e8c28
Instruction ID: 3cc49bfaee08c28208c78095b8398cefd20ca1c8fbe12c8ae30ebfcbf9f06344
Opcode Fuzzy Hash: b2db0521c306de9859c7194269149a6dceff0050bdbfaa59955085d3035e8c28
Instruction Fuzzy Hash: 06514DB5904219AFDF159F64DC81BADBBB9EF48304F1000AEF259A3291DB715E808F59

Function 00B0CA48 Relevance: 6.2, APIs: 4, Instructions: 151COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00B0CB09
__swprintf.LIBCMT ref: 00B0CB22
_wprintf.LIBCMT ref: 00B0CBCD
_wprintf.LIBCMT ref: 00B0CBEB

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: __swprintf_wprintf
String ID:
API String ID: 1937080608-0
Opcode ID: e4cb7c6bd82ec4711da0dd72e8170a87ce897d273d3366ac308420b0b2cc9f52
Instruction ID: a4f3e93cfd85a5d2425573ac0328c70af6760ec7456ad856dcb7c33a81312aec
Opcode Fuzzy Hash: e4cb7c6bd82ec4711da0dd72e8170a87ce897d273d3366ac308420b0b2cc9f52
Instruction Fuzzy Hash: 69516171900109AADB15FBE1CE46FEEBBB8EF04340F104169F505720A2EB746F59DB61

Function 00B11B2F Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00B11B65
_wcscmp.LIBCMT ref: 00B11B7C
_wcscmp.LIBCMT ref: 00B11C0E
_wcscmp.LIBCMT ref: 00B11C25

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: 92de58b19114773358e09430fdba1132c0a7fc7ca095cb66b27fabd43ed0e6cc
Instruction ID: 380a1838e11fa5f6ef434e1a2f6694cac80562f51d124c7d1925e2fda9419b8a
Opcode Fuzzy Hash: 92de58b19114773358e09430fdba1132c0a7fc7ca095cb66b27fabd43ed0e6cc
Instruction Fuzzy Hash: 5831D6319012196FCF14AFA5DC49EDE77ECDF05320F5049A6FA11E2090EB74DA858B68

Function 00B11C8A Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00B11CC0
_wcscmp.LIBCMT ref: 00B11CD7
_wcscmp.LIBCMT ref: 00B11D54
_wcscmp.LIBCMT ref: 00B11D6B

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: 3a2c9a6aaf35be69ba26c5ff023b5ee4197996e19917fcab632a4267b80a98a0
Instruction ID: 92009c0e3459ce70cec9ab77ec0deec634a0bf14060485e163d3aae8492af92e
Opcode Fuzzy Hash: 3a2c9a6aaf35be69ba26c5ff023b5ee4197996e19917fcab632a4267b80a98a0
Instruction Fuzzy Hash: 0831F63190161A6ACF10AFA8EC49EDE77ECDF05320F5049E5F911A20D0DB74DE858B68

Function 00B06F02 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00B06F6C
_strcat.LIBCMT ref: 00B06F98
_wcscpy.LIBCMT ref: 00B06FAF
_wcscpy.LIBCMT ref: 00B06FCB

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _wcscpy$_strcat
String ID:
API String ID: 2292115017-0
Opcode ID: d95e556309437f2d4b01627dc1c32f846f8ca4c31db75ee937686d82ca629b62
Instruction ID: 69147e56f3343112cbab395617190eb8678cd7a71006c2ded3b9508e6cc748c0
Opcode Fuzzy Hash: d95e556309437f2d4b01627dc1c32f846f8ca4c31db75ee937686d82ca629b62
Instruction Fuzzy Hash: 1411E771904115AFDB24AB65AD49EDE7BACDF40710F0000B9F505960C1EFB4AE918764

Function 00AF4DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00AF4E16

Part of subcall function 00AF54F5: __fltout2.LIBCMT ref: 00AF551E

__cftog_l.LIBCMT ref: 00AF4E3C
__cftoe_l.LIBCMT ref: 00AF4E6E

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: 28432366e201013e0da9203bf9894bc274ee72c7081728e0f42684e960993220
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: 0901273644014EAB8F125ED4DD118EE3F62BB1C390B588555FB2859021D336CAB1AB81

Function 00B1BB08 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B1BB5C

Strings

|?K, xrefs: 00B1BB34
h?K, xrefs: 00B1BB2D

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _memset
String ID: h?K$|?K
API String ID: 2102423945-877730469
Opcode ID: be98c460f347eb5342f9ddba19df1a8e7ff92f4e08695fb90ae1c05138579d3b
Instruction ID: 1a8b139cd105704e63fe5ff232fcd0c0b1030e99536dbb0d4a2feb343c5a8edd
Opcode Fuzzy Hash: be98c460f347eb5342f9ddba19df1a8e7ff92f4e08695fb90ae1c05138579d3b
Instruction Fuzzy Hash: 71918271A00215ABDF24DFA5D884FEEB7F8EF45710F5085AAF515AB290D7709980CBA0

Function 00B22230 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B2225A
_memset.LIBCMT ref: 00B22323

Part of subcall function 00AC936C: __swprintf.LIBCMT ref: 00AC93AB
Part of subcall function 00AC936C: __itow.LIBCMT ref: 00AC93DF

Part of subcall function 00ADC6F4: _wcscpy.LIBCMT ref: 00ADC717

Strings

@, xrefs: 00B22334

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _memset$__itow__swprintf_wcscpy
String ID: @
API String ID: 2523036003-2766056989
Opcode ID: 9b6f1a054f74875a438f1efdd3d3d791c853387bcbe02570d37d45342aca0f8c
Instruction ID: 3d3a8e64550109b66f0eba8d8903e91e12cc89f96389c762b83c447fd73981c8
Opcode Fuzzy Hash: 9b6f1a054f74875a438f1efdd3d3d791c853387bcbe02570d37d45342aca0f8c
Instruction Fuzzy Hash: 1E715F74A00629EFCF04EFA4D995A9EB7F5FF48310F118459E85AAB351CB34AD40CB94

Function 00B067E9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00B067FD
__swprintf.LIBCMT ref: 00B0680A

Part of subcall function 00AE172B: __woutput_l.LIBCMT ref: 00AE1784

Strings

5K, xrefs: 00B067F6

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: __swprintf$__woutput_l
String ID: 5K
API String ID: 1571530113-2802765362
Opcode ID: 6872b4b3d6b3d34319df9a50e78a3afd508431f81b654905c2b9f4d6c5d1579e
Instruction ID: 21c494afba79a71a1c440f3d6dc694c9e276d5952ae95d5cf3f40997d4d5fe18
Opcode Fuzzy Hash: 6872b4b3d6b3d34319df9a50e78a3afd508431f81b654905c2b9f4d6c5d1579e
Instruction Fuzzy Hash: EE316EB190125AAFDB119FA1DD55EBEBFA8FF08341B008866F902D2190E734D961DB74

Function 00AC40E5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B33725

Strings

t3K, xrefs: 00B33745
X, xrefs: 00B3373E

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _memset
String ID: X$t3K
API String ID: 2102423945-2811000538
Opcode ID: b93b0c1c5738115443a6aa44457fd713ed33a969696249c1967a6bebbd69b3da
Instruction ID: 323be14b5f221247546ac9431c269fec6c373ebc1f8efc4b50f885f3cf28dabb
Opcode Fuzzy Hash: b93b0c1c5738115443a6aa44457fd713ed33a969696249c1967a6bebbd69b3da
Instruction Fuzzy Hash: 8C21D571A102989FCB01DFD8CC45FDE7BF89F49304F00805EE405A7241DBB89A898F69

Function 00B2E32E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B2E33D
_memset.LIBCMT ref: 00B2E34C

Strings

D=L, xrefs: 00B2E346

Memory Dump Source

Source File: 00000000.00000002.1857816130.0000000000AC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000000.00000002.1857800660.0000000000AC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B4D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857863486.0000000000B6E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857908761.0000000000B7F000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1857967154.0000000000B84000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ac0000_7cYDC0HciP.jbxd

Similarity

API ID: _memset
String ID: D=L
API String ID: 2102423945-2639313163
Opcode ID: 9cdb3eb17ab4b92b591a418dd0827165d4bfee49c7ed39e47b44089da6596004
Instruction ID: b7b3fefa1db557df1147c01e7d937dbf1d8e9bcfd36aaf95d3da7bbf0b98ad92
Opcode Fuzzy Hash: 9cdb3eb17ab4b92b591a418dd0827165d4bfee49c7ed39e47b44089da6596004
Instruction Fuzzy Hash: BDF05EF1540314BBE2506F61AC45FBB7E6CDB04756F008435BE0AD61A2D3759E0087AC

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7cYDC0HciP.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_7cYDC0HciP.exe_88e7f6563a585821d8c5b75d1d898bfef7d2f0_84687472_d4c6ee67-576a-45fe-b13e-37e4ce80f889\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE7CB.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE897.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE8F6.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
7cYDC0HciP.exe

Function 00AE5F74 Relevance: 1.5, APIs: 1, Instructions: 2
COMMON

Function 00B0FA0C Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238
COMMON

Function 00ACCC24 Relevance: 18.3, APIs: 12, Instructions: 267
COMMON

Function 00B06CE9 Relevance: 18.2, APIs: 12, Instructions: 178
COMMON

Function 00B0690B Relevance: 18.1, APIs: 12, Instructions: 113
COMMON

Function 00AE500E Relevance: 16.8, APIs: 11, Instructions: 257
COMMON

Function 00B0F5FA Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 278
COMMON

Function 00ACC833 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 479
COMMON

Function 00B060DD Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 174
COMMON

Function 00B0BFA4 Relevance: 10.8, APIs: 7, Instructions: 316
COMMON

Function 00AFD8A7 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 249
COMMON

Function 00B0D76A Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 180
COMMON