Edit tour

Windows Analysis Report
WN9uCxgU1T.exe

Overview

General Information

Sample name:	WN9uCxgU1T.exe renamed because original name is a hash value
Original sample name:	d88cbfff7d6a8163e124249f07e2f8434d6e5474fcda9f916f89afe50b88f413.exe
Analysis ID:	1588267
MD5:	8d1f05431e7319272bac9c427279c83c
SHA1:	5b712cf5c1706213f3eccf0538a722dc02547b93
SHA256:	d88cbfff7d6a8163e124249f07e2f8434d6e5474fcda9f916f89afe50b88f413
Tags:	exeuser-adrian__luca
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Found potential string decryption / allocating functions

One or more processes crash

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

WN9uCxgU1T.exe (PID: 3964 cmdline: "C:\Users\user\Desktop\WN9uCxgU1T.exe" MD5: 8D1F05431E7319272BAC9C427279C83C)

WerFault.exe (PID: 5412 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 532 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: WN9uCxgU1T.exe	Virustotal: Detection: 71%			Perma Link
Source: WN9uCxgU1T.exe	ReversingLabs: Detection: 91%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for sample

Source: WN9uCxgU1T.exe

Joe Sandbox ML: detected

Source: WN9uCxgU1T.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: Amcache.hve.4.dr

String found in binary or memory: http://upx.sf.net

System Summary

Binary is likely a compiled AutoIt script file

Source: WN9uCxgU1T.exe, 00000000.00000000.1348076715.0000000000E44000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_921d4967-f
Source: WN9uCxgU1T.exe, 00000000.00000000.1348076715.0000000000E44000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_ee0ab954-7
Source: WN9uCxgU1T.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_f8488cef-d
Source: WN9uCxgU1T.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_8df5a7ee-0

Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DB21C5	0_2_00DB21C5
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DC62D2	0_2_00DC62D2
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00E103DA	0_2_00E103DA
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DC242E	0_2_00DC242E
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DB25FA	0_2_00DB25FA
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DA66E1	0_2_00DA66E1
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00D9E6A0	0_2_00D9E6A0
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DEE616	0_2_00DEE616
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DC878F	0_2_00DC878F
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DF8889	0_2_00DF8889
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DC6844	0_2_00DC6844
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00E10857	0_2_00E10857
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DBCB21	0_2_00DBCB21
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DC6DB6	0_2_00DC6DB6
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DA6F9E	0_2_00DA6F9E
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DA3030	0_2_00DA3030
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DBF1D9	0_2_00DBF1D9
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DB3187	0_2_00DB3187
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00D91287	0_2_00D91287
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DB1484	0_2_00DB1484
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DA5520	0_2_00DA5520
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DB7696	0_2_00DB7696
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DA5760	0_2_00DA5760
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DB1978	0_2_00DB1978
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DBD975	0_2_00DBD975
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DC9AB5	0_2_00DC9AB5
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00D9FCE0	0_2_00D9FCE0
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00E17DDB	0_2_00E17DDB
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DB1D90	0_2_00DB1D90
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DBBDA6	0_2_00DBBDA6
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DA3FE0	0_2_00DA3FE0
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00D9DF00	0_2_00D9DF00

Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: String function: 00D998C0 appears 32 times
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: String function: 00DB8900 appears 42 times
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: String function: 00D99A98 appears 32 times

Source: C:\Users\user\Desktop\WN9uCxgU1T.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 532

Source: WN9uCxgU1T.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal60.winEXE@2/5@0/0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3964

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\7ad76f8b-9892-4c4d-9994-c9632e54678a

Jump to behavior

Source: WN9uCxgU1T.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\WN9uCxgU1T.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: WN9uCxgU1T.exe	Virustotal: Detection: 71%
Source: WN9uCxgU1T.exe	ReversingLabs: Detection: 91%

Source: unknown	Process created: C:\Users\user\Desktop\WN9uCxgU1T.exe "C:\Users\user\Desktop\WN9uCxgU1T.exe"
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 532

Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Section loaded: wsock32.dll	Jump to behavior

Source: WN9uCxgU1T.exe

Static file information: File size 1181184 > 1048576

Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00DB8945 push ecx; ret		0_2_00DB8958
Source: C:\Users\user\Desktop\WN9uCxgU1T.exe	Code function: 0_2_00D92F12 push es; retf		0_2_00D92F13

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\WN9uCxgU1T.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\WN9uCxgU1T.exe

Code function: 0_2_00DB7DCD ___security_init_cookie,LdrInitializeThunk,

0_2_00DB7DCD

Source: WN9uCxgU1T.exe

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\WN9uCxgU1T.exe

Code function: 0_2_00DB862B cpuid

0_2_00DB862B

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Process Injection	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	11 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
WN9uCxgU1T.exe	72%	Virustotal		Browse
WN9uCxgU1T.exe	91%	ReversingLabs	Win32.Trojan.AutoitInject
WN9uCxgU1T.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.4.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588267
Start date and time:	2025-01-10 23:21:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	WN9uCxgU1T.exe renamed because original name is a hash value
Original Sample Name:	d88cbfff7d6a8163e124249f07e2f8434d6e5474fcda9f916f89afe50b88f413.exe
Detection:	MAL
Classification:	mal60.winEXE@2/5@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 1 Number of non-executed functions: 61
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20, 13.107.246.45, 40.126.31.69, 172.202.163.200
Excluded domains from analysis (whitelisted): login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	Full-Ver_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.45
	Yef4EqsQha.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.45
	Qz8OEUxYuH.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	ztcrKv3zFz.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	gH3LlhcRzg.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	3j7f6Bv4FT.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	rComprobante_swift_8676534657698632.exe	Get hash	malicious	AgentTesla	Browse	13.107.246.45
	6ZoBPR3isG.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	13.107.246.45
	iRmpdWgpoF.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	7cYDC0HciP.exe	Get hash	malicious	Unknown	Browse	13.107.246.45

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_WN9uCxgU1T.exe_a87e78bd101179c21e5cabb6292eaed3b922c0e6_95d20471_05260d53-cf84-4b07-9286-790e3bfe886c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8456398484452747
Encrypted:	false
SSDEEP:	192:rpfI47y0BU/HafjedqzuiFXZ24IO8W5t:FI475BU/wjhzuiFXY4IO8w
MD5:	1651BE29A92733319E2D43B5AA036323
SHA1:	7B28EEACE7F712BF2E0B7B5C9056FE90E2DA5CB6
SHA-256:	DB93790F16C5591FF2903EEE8F3B697CB79409D58AE215FFA73AA60DDD0BCDD9
SHA-512:	C167730AA19EFC794E470FAD32CFFADEF713C328169C616020C376286E33EB6A3FB5C82A4E962670737D59D3CC2F36201B26E3BC41AE5D7834B3A1B0B5E7C868
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.1.0.2.1.3.1.3.0.8.1.3.8.3.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.1.0.2.1.3.1.3.4.7.2.0.0.9.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.5.2.6.0.d.5.3.-.c.f.8.4.-.4.b.0.7.-.9.2.8.6.-.7.9.0.e.3.b.f.e.8.8.6.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.5.6.d.8.5.8.7.-.e.6.1.5.-.4.2.8.0.-.9.6.c.4.-.1.d.9.9.a.c.d.5.0.a.5.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.W.N.9.u.C.x.g.U.1.T...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.f.7.c.-.0.0.0.1.-.0.0.1.4.-.b.1.0.f.-.b.b.0.c.a.e.6.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.a.4.2.f.a.a.7.4.4.4.f.f.1.0.3.9.f.4.1.3.6.6.e.0.2.9.3.e.1.3.1.0.0.0.0.0.9.0.8.!.0.0.0.0.5.b.7.1.2.c.f.5.c.1.7.0.6.2.1.3.f.3.e.c.c.f.0.5.3.8.a.7.2.2.d.c.0.2.5.4.7.b.9.3.!.W.N.9.u.C.x.g.U.1.T...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6946.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jan 10 22:21:53 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	41622
Entropy (8bit):	1.8662960209826047
Encrypted:	false
SSDEEP:	192:ItLkvp9Q2MYHOYi+xdY2FQ5x5R4g1zDUsn:5vp9iYuEwpH34gZ
MD5:	0B76B8C93AC9202C49C1D3A58D0A378F
SHA1:	6CE827E03CFDD24C0D6F6225F4C13F7030ECF2ED
SHA-256:	DBFB6ABB6E4EF38BB19B8FA913809305A6B9541E5781D649DA5CC7C8BF895FF1
SHA-512:	8C496506A7310CB5BF6C8902D8FE3BEA74BAD9A5F0D7BD5B0CB73DAA300D11C55CDD1DAE6824B0D9E980AC5FB00A95C1E7C8B87CBC43BC73702698323A60385C
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ..........g........................\...............b'..........T.......8...........T...........P...F.......................................................................................................eJ......\|.......GenuineIntel............T.......\|......g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A12.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8294
Entropy (8bit):	3.7000104771248514
Encrypted:	false
SSDEEP:	192:R6l7wVeJYI6V6YcDcSUEm6gmfGZprj89bKasfwf0Om:R6lXJP6V6Y7SUEm6gmfGwK5fok
MD5:	CD20A6B6C8D06FDA9C92262EB549015D
SHA1:	85C83061A3E112B94C75CBF5DB4BBDD2C725E458
SHA-256:	03A935C6D2ED821F5CE703D5CA19593CB8BF57A301C3F49FB8F55B2503690EE8
SHA-512:	E486467341A428FD4558C865C87D14557345ABD59A6812CC93295DEAC9DE31FCB7E26E80B163D9667092DB3023852D9085C2B09F2BBE2C766B869F3AB2E9956E
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.9.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A42.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.4753286718372145
Encrypted:	false
SSDEEP:	48:cvIwWl8zsFJg77aI9zAWpW8VYOYm8M4JkVIFum+q8iniFHSuUd:uIjffI7l57VGJdqFHSuUd
MD5:	8BDF4A573850C4C61C2A65F4890A9377
SHA1:	F66400CE5BFDF3EFB3A25B289D45E4FAE8C413A7
SHA-256:	9CD32F4DDAFAA4B65BB1A1CE910AC89F97E7FCD3E40A5747566DE96114C0EFC1
SHA-512:	7F9A99B29228F9C9B4370D22CC12B03BE1DEE02B57EF82B2E07605B46EC77C6D4589501AA7A3CA226040D3F08B77CAA47C17964EEA5BD72B51699C30BF07EAD6
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="670404" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.393915259625943
Encrypted:	false
SSDEEP:	6144:Sl4fiJoH0ncNXiUjt10q0G/gaocYGBoaUMMhA2NX4WABlBuNAZOBSqa:i4vF0MYQUMM6VFYSZU
MD5:	4B1C4DA94D3610CD66AA9106481A6C2B
SHA1:	D937E8E91D0E7D7EAC16E6128269B6867ACDC776
SHA-256:	AF2D72504D82488EF0717BC46C20B8831DCC5F8890999BE1E520FC0B61F415FF
SHA-512:	A1695B6F5C51C93A7DBF4BCD2742DA13365E66BA501097BC9776278400539781946474251D9538724B1F435BC6DCCBCBF611C78B000146E317244700E1E4D93C
Malicious:	false
Reputation:	low
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm"....c..............................................................................................................................................................................................................................................................................................................................................*..8........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.015060738482099
TrID:	Win32 Executable (generic) a (10002005/4) 99.70% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	WN9uCxgU1T.exe
File size:	1'181'184 bytes
MD5:	8d1f05431e7319272bac9c427279c83c
SHA1:	5b712cf5c1706213f3eccf0538a722dc02547b93
SHA256:	d88cbfff7d6a8163e124249f07e2f8434d6e5474fcda9f916f89afe50b88f413
SHA512:	ab27c30c814452650b32e4f0c09c1ea3a7a72e45b3d349f710236d0249ffdec803d418a489b1dbc666de1449871386f2bdcb3c9021c3f7dfcb4d5caf97c76af5
SSDEEP:	24576:Fu6J33O0c+JY5UZ+XC0kGsoTCcNWHrLZw3URcfp6:Hu0c++OCvkGsECcNai3Umf
TLSH:	7745CF2273DDC360CB669173BF6AA7017E7B7C614630B95B2F980D3DA960162162C7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6756FD41 [Mon Dec 9 14:22:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	bd3825b6e0410966f0c31f64b6c7644a

Entrypoint Preview

Instruction
call 00007F1CF56C868Ah
jmp 00007F1CF56BB454h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F1CF56BB5DAh
cmp edi, eax
jc 00007F1CF56BB93Eh
bt dword ptr [004C31FCh], 01h
jnc 00007F1CF56BB5D9h
rep movsb
jmp 00007F1CF56BB8ECh
cmp ecx, 00000080h
jc 00007F1CF56BB7A4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F1CF56BB5E0h
bt dword ptr [004BE324h], 01h
jc 00007F1CF56BBAB0h
bt dword ptr [004C31FCh], 00000000h
jnc 00007F1CF56BB77Dh
test edi, 00000003h
jne 00007F1CF56BB78Eh
test esi, 00000003h
jne 00007F1CF56BB76Dh
bt edi, 02h
jnc 00007F1CF56BB5DFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F1CF56BB5E3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F1CF56BB635h
bt esi, 03h
jnc 00007F1CF56BB688h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x57d28	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	fc8a5b32808697dd41c898d938b66f67	False	0.3239911500677507	data	5.674452471189642	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x57d28	0x57e00	85cd222b991fda5a325b16896fb0734f	False	0.9251255778805121	data	7.886977822355403	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11f000	0x711c	0x7200	8a46a4bc77a3f321996ff4079f834054	False	0.0017475328947368421	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x4efee	data			1.000327599315132
RT_GROUP_ICON	0x11e7a8	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x11e820	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x11e834	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x11e848	0x14	data	English	Great Britain	1.25
RT_VERSION	0x11e85c	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x11e938	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
KERNEL32.DLL	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit
PSAPI.DLL	GetProcessMemoryInfo
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:21:49.896677017 CET	1.1.1.1	192.168.2.9	0xa10	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:21:49.896677017 CET	1.1.1.1	192.168.2.9	0xa10	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: WN9uCxgU1T.exePID: 3964, Parent PID: 3504

General

Target ID:	0
Start time:	17:21:52
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\WN9uCxgU1T.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\WN9uCxgU1T.exe"
Imagebase:	0xd90000
File size:	1'181'184 bytes
MD5 hash:	8D1F05431E7319272BAC9C427279C83C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 5412, Parent PID: 3964

General

Target ID:	4
Start time:	17:21:52
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 532
Imagebase:	0x270000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: WN9uCxgU1T.exePID: 3964, Parent PID: 3504COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	66.7%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00DB7DCD Relevance: 1.5, APIs: 1, Instructions: 2
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___security_init_cookie.LIBCMT ref: 00DB7DCD

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 37d1d09d41eb5fcb3a4af465fc0fb251569986102ab4ab40f909050fe7e311e5
Instruction ID: 43efc844c85ed64d94cd6d8feb6049979aa17656c91e9cfa11b290de758670cb
Opcode Fuzzy Hash: 37d1d09d41eb5fcb3a4af465fc0fb251569986102ab4ab40f909050fe7e311e5
Instruction Fuzzy Hash:

Non-executed Functions

Function 00DA6F9E Relevance: 71.5, APIs: 19, Strings: 19, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00DA71C3
_memset.LIBCMT ref: 00DA7539
_memmove.LIBCMT ref: 00DA76AC

Strings

o, xrefs: 00DA711B
s{p, xrefs: 00DA7BCD
0, xrefs: 00DA7085
, xrefs: 00DA70E9
), xrefs: 00DA708F
', xrefs: 00DA70B7
p, xrefs: 00DA7125
P\K, xrefs: 00DE1AB8
9, xrefs: 00DA7099
{, xrefs: 00DA707B
R, xrefs: 00DA70AD
]K, xrefs: 00DE1A22
", xrefs: 00DE2E92
n, xrefs: 00DA7111
@, xrefs: 00DE3C88
<, xrefs: 00DA70A3
q, xrefs: 00DA712F
+, xrefs: 00DA7071
-, xrefs: 00DA70C1

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _memmove$_memset
String ID: $ ]K$"$'$)$+$-$0$9$<$@$P\K$R$n$o$p$q$s{p${
API String ID: 1357608183-3800155241
Opcode ID: b28a790e45669a4902d64bf1598fd7c3bcb7bf2305bb98875f8069baf6f44106
Instruction ID: 90538cc09f6e9074dda3ac3760c527690d357a5e468969659386e16db1c4696f
Opcode Fuzzy Hash: b28a790e45669a4902d64bf1598fd7c3bcb7bf2305bb98875f8069baf6f44106
Instruction Fuzzy Hash: 3A93B275E00259DBDF24DF59C881BBDB7B1FF48310F29816AE945AB281E7709E81CB60

Function 00DA3FE0 Relevance: 15.1, APIs: 1, Strings: 7, Instructions: 1132COMMON

Download Yara Rule

Strings

0DJ, xrefs: 00DA4232
ERCP, xrefs: 00DA40BF
VUUU, xrefs: 00DD76E2
VUUU, xrefs: 00DA43C0
VUUU, xrefs: 00DA438D
VUUU, xrefs: 00DA437B
0DJ, xrefs: 00DA430C

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID:
String ID: 0DJ$0DJ$ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-223423113
Opcode ID: f5ff305bdbafe341a1db575146456b4f73aa52c1d9f9d9bce80aef23edd1e421
Instruction ID: 85bd88791e16e4acff6c36224dd947d4dd087dabd1c9da34c85bb45a986710ee
Opcode Fuzzy Hash: f5ff305bdbafe341a1db575146456b4f73aa52c1d9f9d9bce80aef23edd1e421
Instruction Fuzzy Hash: 81A29270E0421ACBDF24CF58C9407ADB7B1BF95314F1885AAD859A7380E7B49E81DFA1

Function 00DA5760 Relevance: 11.0, APIs: 7, Instructions: 532
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memmove.LIBCMT ref: 00DA58A5
_memmove.LIBCMT ref: 00DA58F5
_memmove.LIBCMT ref: 00DA595B

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: bc5590fee32963866547a934e2f4481e6f2daf4eb5e9485274101ae2dbc06eb9
Instruction ID: f9948511c5b353e27e0c3f4df8646b23d374392718f0fbd803adf9bab2511f85
Opcode Fuzzy Hash: bc5590fee32963866547a934e2f4481e6f2daf4eb5e9485274101ae2dbc06eb9
Instruction Fuzzy Hash: 89127970A00609EFDF04DFA5D981AEEB7F5FF48310F104529E846A7294EB76A961CB70

Function 00DA3030 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 587
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3cA, xrefs: 00DA323F

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: __itow__swprintf
String ID: 3cA
API String ID: 674341424-2523384761
Opcode ID: bd8f269727dd203b3cd5d455fda2b58de944a4bb22d2e13bbec33b21dd907dda
Instruction ID: 34c4193b494f91ca1dbbddb3db1d4076a57b3acc945d6ffb9832bd569c68496a
Opcode Fuzzy Hash: bd8f269727dd203b3cd5d455fda2b58de944a4bb22d2e13bbec33b21dd907dda
Instruction Fuzzy Hash: 02226A716083009FCB24DF28D891B6EB7E5EF89710F14491DF89A97291DB71E904CBB2

Function 00D9FCE0 Relevance: 8.0, APIs: 3, Strings: 1, Instructions: 1040COMMON

Download Yara Rule

Strings

pbL, xrefs: 00DD49B9

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID:
String ID: pbL
API String ID: 0-2198975964
Opcode ID: f4dcd20d2bc5d81d89870ef2a695217c5eca1df5ed962e9f7e233abbde67ac23
Instruction ID: bae848136c38c95501194bec4a780c7b1e8d49aafdf220045d48661c22a83e7f
Opcode Fuzzy Hash: f4dcd20d2bc5d81d89870ef2a695217c5eca1df5ed962e9f7e233abbde67ac23
Instruction Fuzzy Hash: EE925B706083419FDB20DF14C490B6ABBE1FF86304F19896DE89A9B351D775EC45CBA2

Function 00DA5520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00DB0DB6: std::exception::exception.LIBCMT ref: 00DB0DEC
Part of subcall function 00DB0DB6: __CxxThrowException@8.LIBCMT ref: 00DB0E01

_memmove.LIBCMT ref: 00DE0258
_memmove.LIBCMT ref: 00DE036D
_memmove.LIBCMT ref: 00DE0414

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 7e59d6d005cac17bdf0d515b6185c65b2e751bd3579f41a42c57154c824fcbd6
Instruction ID: 7d76af429d06c07a3fb77d2aa38375916653b7803e27b82c1bdf5d0ee0942513
Opcode Fuzzy Hash: 7e59d6d005cac17bdf0d515b6185c65b2e751bd3579f41a42c57154c824fcbd6
Instruction Fuzzy Hash: 1D02B070A00209DFCF04EF69D981AAEBBF5EF45300F148069E84ADB295EB75D950CBB5

Function 00D9E6A0 Relevance: 6.0, Strings: 4, Instructions: 1004COMMON

Download Yara Rule

Strings

DdL, xrefs: 00D9EABA
DdL, xrefs: 00DD3B2E
DdL, xrefs: 00D9EAC1
DdL, xrefs: 00DD3AF5

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID:
String ID: DdL$DdL$DdL$DdL
API String ID: 0-1563988167
Opcode ID: d23c6b499de0a7fbb547df9319404598a5cece590a92a1b032f5e0038fb359f7
Instruction ID: df622dbb0c21220af1fe642a9a035b006b996d3992e0b35098c0f79728d6490a
Opcode Fuzzy Hash: d23c6b499de0a7fbb547df9319404598a5cece590a92a1b032f5e0038fb359f7
Instruction Fuzzy Hash: 1E929C75A00205CFCF24CF98C480AAEB7B1FF59314F29856AE845AB351D735ED82CBA5

Function 00E17DDB Relevance: 3.6, APIs: 2, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a1e612490df0e2fd5aff0df4db96d0646e8fd45de2b35679b98956547aaa80
Instruction ID: 93cc32113d6d84a6751fd4b64401ea76e6bf3309298803bfde1fe3d7582cd21e
Opcode Fuzzy Hash: 25a1e612490df0e2fd5aff0df4db96d0646e8fd45de2b35679b98956547aaa80
Instruction Fuzzy Hash: 0512CF71600205ABEB258F24CD49FEF7BB4EB49714F104629F916FA2E1DF749985CB20

Function 00DF8889 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00DF889B

Part of subcall function 00DB520A: __aulldiv.LIBCMT ref: 00DB5233

Strings

0eL, xrefs: 00DF8892

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: __aulldiv__time64
String ID: 0eL
API String ID: 325419493-3167399643
Opcode ID: 173a61627ebe1b4304b39b54128586dabbe463c8e4c1c1e482927ec7599268c1
Instruction ID: ecb4487547bf79ec4904c5b9ea5f82777b3f37579da573928e76747348c5b439
Opcode Fuzzy Hash: 173a61627ebe1b4304b39b54128586dabbe463c8e4c1c1e482927ec7599268c1
Instruction Fuzzy Hash: 3521A5326255108BC729CF29E441A51B3E1EBA5311B69CE6CD1F5CB2C0CA34A905DB64

Function 00D9DF00 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fedcd55ce1be01234807a739cd4bdd318ff75d00aeb43b21d4f5e2df7acffac
Instruction ID: c92fce2968f6a5071d8bb696c3f571a24fa9013cb23c092e92780f81f26de905
Opcode Fuzzy Hash: 7fedcd55ce1be01234807a739cd4bdd318ff75d00aeb43b21d4f5e2df7acffac
Instruction Fuzzy Hash: 11229DB4A00215DFDF24DF54C490AAEB7B1FF04310F18856AE896AB351E774E985CBB1

Function 00DA66E1 Relevance: 3.4, Strings: 2, Instructions: 889COMMON

Download Yara Rule

Strings

pGJ, xrefs: 00DA6751
0DJ0EJ0FJpGJ, xrefs: 00DA6881, 00DA688A

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID:
String ID: 0DJ0EJ0FJpGJ$pGJ
API String ID: 0-2520054932
Opcode ID: 6a8c43c5cd2287656802195d535ea908290b48d8ab3bfd826a36c9d68e310c78
Instruction ID: c97722a5e159a90ba96b60206b1e0755b3a0524d57f81fabe57f0405d949a70b
Opcode Fuzzy Hash: 6a8c43c5cd2287656802195d535ea908290b48d8ab3bfd826a36c9d68e310c78
Instruction Fuzzy Hash: DF727075E00259DBDB14DF59C8807AEB7B5FF49310F18816AE949EB290E734DE81CBA0

Function 00DEE616 Relevance: 3.1, Strings: 2, Instructions: 561COMMON

Download Yara Rule

Strings

(, xrefs: 00DEE66E
|, xrefs: 00DEE658

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID:
String ID: ($|
API String ID: 0-1631851259
Opcode ID: e10e0101c6e5428e3f3f3b8754e90dc55a18d34dd6833db7f52c40727a3dee7e
Instruction ID: d77700237bfc2729475b1cf22c2009788b6483295ab608e8e5abb82a614ee4f3
Opcode Fuzzy Hash: e10e0101c6e5428e3f3f3b8754e90dc55a18d34dd6833db7f52c40727a3dee7e
Instruction Fuzzy Hash: D9323675A007059FD728EF19C4819AAB7F1FF48320B15C46EE89ADB3A1D770E941CB54

Function 00DBF1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe7d9b8eee1d273b37d623b7cc6cd26b30c9621dfee01b7311cae72a06f2c816
Instruction ID: aa8540cdc928fe39af1e46a7695dadc3aadb4e1d0c4c12886fe4b91816ba81d2
Opcode Fuzzy Hash: fe7d9b8eee1d273b37d623b7cc6cd26b30c9621dfee01b7311cae72a06f2c816
Instruction Fuzzy Hash: 49320535D29F018DD7239638DC32339A289AFB73C8F15D737E81AB59A5EB28D4834214

Function 00DC242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a83e6c9a1e03463649304356993a4cc28f03311dd18012bd76db8a2bb8b356c
Instruction ID: 51888345e1a18a8d09705ffc37ba3a9a3f254cfbe2146d3d901594d2cbbf50cb
Opcode Fuzzy Hash: 9a83e6c9a1e03463649304356993a4cc28f03311dd18012bd76db8a2bb8b356c
Instruction Fuzzy Hash: 8EB1F020E2AF414DD72396398835336BA9CAFBB2C5F51D72BFC2670D22EB2185934185

Function 00E10857 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb806d70b46a9202dd3e543ee6ca14ab650e64b5adbaddcfbe08c0bc828943e
Instruction ID: 5445ceb5629206e85a59a6e78f3504a036c611c076545666bceb64b608178fcc
Opcode Fuzzy Hash: 5eb806d70b46a9202dd3e543ee6ca14ab650e64b5adbaddcfbe08c0bc828943e
Instruction Fuzzy Hash: 52026E756006019FCB14EF28C851E6AB7E5FF89314F04895DF89A9B362DB70EC81CBA1

Function 00E103DA Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 4343597e8507452ccff4b02692f110eb0ad94be3eec77fb80de36c15d9900197
Instruction ID: 4e98a8e8f1a2efd206a6173746a4dbf913bb54998f939a5330ff2b0107d72cd1
Opcode Fuzzy Hash: 4343597e8507452ccff4b02692f110eb0ad94be3eec77fb80de36c15d9900197
Instruction Fuzzy Hash: E2E14E31604204AFCB14DF68C895E6EBBE5FF89314F04896DF44ADB261D770E985CBA2

Function 00D91287 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db6b4c7db5f97784a80f15b687025ec058e6c3025e7102d3aafc5b58ad8fc88
Instruction ID: f2ab49882c58938813d8b9a9a9c324f3096a910e20533aed382efc2d675f4ce2
Opcode Fuzzy Hash: 8db6b4c7db5f97784a80f15b687025ec058e6c3025e7102d3aafc5b58ad8fc88
Instruction Fuzzy Hash: CEA15A78106547BEEF28AB284C45FBF359DDF42351F28021EF582D6192CB20DD8296B5

Function 00DB21C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: e7fdbebdfd8ceb2ef365b891ef7f047061e79ebfac772ff705b0a1960bdc1c5d
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: D8C18F372051938ADF2D463A84740BEBAA15EA27B136E076DD8B3CB5D4EE20C965D630

Function 00DB25FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: d6a060051b74978a0b088d7686ec12249df54422a4c8928a528d2f8a607d61bd
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: D5C180372151938ADF2D463AC4341BEBBA15EA27B136E07ADD4B3DB1D4EE20C925D630

Function 00DB1D90 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 8f23e97fb83cf9df1fd33418307f931fc014d012c39d02a6f95fb52eb3638506
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 03C182372151938ADF2D463AC4340BEBAA15EA27B135E076DE8B3CB1D4EE20C925D630

Function 00DB1978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 5a48a6d29cd19a73a14b105ae45440586b0f0bd0ca0c16ed166175e4d7e7616e
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 8FC1813A21519389DF2D463AC4341BEFBA15EA27B13AE076DD4B3CB1C4EE20D925D630

Function 00D968DC Relevance: 18.3, APIs: 12, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wcsnicmp.LIBCMT ref: 00D96931
__wcsnicmp.LIBCMT ref: 00D96949
__wcsnicmp.LIBCMT ref: 00D96961
__wcsnicmp.LIBCMT ref: 00D96979
__wcsnicmp.LIBCMT ref: 00D96991
__wcsnicmp.LIBCMT ref: 00D969A9
__wcsnicmp.LIBCMT ref: 00D969C1
__wcsnicmp.LIBCMT ref: 00D969D5
__wcsnicmp.LIBCMT ref: 00D96A16
__wcsnicmp.LIBCMT ref: 00D96A2A
__wcsnicmp.LIBCMT ref: 00D96A3E
__wcsnicmp.LIBCMT ref: 00D96A52

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: __wcsnicmp
String ID:
API String ID: 1038674560-0
Opcode ID: 925611d6804fe502eb64822f337db5433ea1a7a143fe913b499dbfc23ac76dca
Instruction ID: 58a640b239ecdf9efaa4f2d15a92ea55ea76e02cec13b405d9283041bbf729aa
Opcode Fuzzy Hash: 925611d6804fe502eb64822f337db5433ea1a7a143fe913b499dbfc23ac76dca
Instruction Fuzzy Hash: 4F81F4B1640206BACF21AB64DC42FAF3768EF05700F184029F946AB196EF74EE45D7B5

Function 00DF449A Relevance: 18.2, APIs: 12, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 00DF4500
_wcscmp.LIBCMT ref: 00DF450B
_wcscat.LIBCMT ref: 00DF4521
_wcsstr.LIBCMT ref: 00DF452C
_wcscat.LIBCMT ref: 00DF4591
_wcscat.LIBCMT ref: 00DF4598
_wcsncpy.LIBCMT ref: 00DF45C3

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _wcscat$_wcscmp_wcscpy_wcsncpy_wcsstr
String ID:
API String ID: 3576275495-0
Opcode ID: f2dd82df36c9484ed452d294227e50002af446f68463c0679fc1068f518ba4c5
Instruction ID: 6ca8cd1a5ad7bc9c92754d3aeaa8d514714b0c3c123fa15db22d22a22e2855d2
Opcode Fuzzy Hash: f2dd82df36c9484ed452d294227e50002af446f68463c0679fc1068f518ba4c5
Instruction Fuzzy Hash: 3741B532900204BBEB14BB749C47EFF77ACDF45720F14456AFA06E6182EA34DA0196B9

Function 00DB6E03 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00DB6E3E

Part of subcall function 00DB8B28: __getptd_noexit.LIBCMT ref: 00DB8B28

__gmtime64_s.LIBCMT ref: 00DB6ED7
__gmtime64_s.LIBCMT ref: 00DB6F0D
__gmtime64_s.LIBCMT ref: 00DB6F2A
__allrem.LIBCMT ref: 00DB6F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DB6F9C
__allrem.LIBCMT ref: 00DB6FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DB6FD1
__allrem.LIBCMT ref: 00DB6FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DB7006
__invoke_watson.LIBCMT ref: 00DB7077

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: 2abb3a54acef0b3b7a6ec6881d66efb5a087eba76defb84914f91734a11a7de9
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: F971E676A00717EBD714AE68DC41BEAB7B8EF44764F14822EF516D7281E774DA008BB0

Function 00DF9155 Relevance: 12.3, APIs: 8, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DF8F5F: __time64.LIBCMT ref: 00DF8F69

Part of subcall function 00D94EE5: _fseek.LIBCMT ref: 00D94EFD

__wsplitpath.LIBCMT ref: 00DF9234

Part of subcall function 00DB40FB: __wsplitpath_helper.LIBCMT ref: 00DB413B

_wcscpy.LIBCMT ref: 00DF9247
_wcscat.LIBCMT ref: 00DF925A
__wsplitpath.LIBCMT ref: 00DF927F
_wcscat.LIBCMT ref: 00DF9295
_wcscat.LIBCMT ref: 00DF92A8

Part of subcall function 00DF8FA5: _memmove.LIBCMT ref: 00DF8FDE
Part of subcall function 00DF8FA5: _memmove.LIBCMT ref: 00DF8FED

_wcscmp.LIBCMT ref: 00DF91EF

Part of subcall function 00DF9734: _wcscmp.LIBCMT ref: 00DF9824
Part of subcall function 00DF9734: _wcscmp.LIBCMT ref: 00DF9837

_wcsncpy.LIBCMT ref: 00DF94C5

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _wcscat_wcscmp$__wsplitpath_memmove$__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 2744720387-0
Opcode ID: 399d582de9c20c8765367d64c56b1fa89cf83462de3145a455e9ac53565308cb
Instruction ID: 3970a86cde8d8ad5b222edacd4ff649989dfd117e6f9f24600bf10b75e6d7c9b
Opcode Fuzzy Hash: 399d582de9c20c8765367d64c56b1fa89cf83462de3145a455e9ac53565308cb
Instruction Fuzzy Hash: 12C12AB1D0021DAADF21DF95CC95EEEB7B9EF45310F0080AAF609E6251DB309A858F75

Function 00DEBBAF Relevance: 12.1, APIs: 8, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memcmp.LIBCMT ref: 00DEBBC4
_memcmp.LIBCMT ref: 00DEBBE6
_memcmp.LIBCMT ref: 00DEBBFE
_memcmp.LIBCMT ref: 00DEBC11
_memcmp.LIBCMT ref: 00DEBC2B
_memcmp.LIBCMT ref: 00DEBC3E
_memcmp.LIBCMT ref: 00DEBC56
_memcmp.LIBCMT ref: 00DEBC71

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 69f4a9ee4471d3b742fe204232521a94e9e3c838df7205ae948ccdb36eb6070b
Instruction ID: 43ac01f0fdc610d247de0b92dfb5e8177b84c506352d3d3655d7c2e504657c01
Opcode Fuzzy Hash: 69f4a9ee4471d3b742fe204232521a94e9e3c838df7205ae948ccdb36eb6070b
Instruction Fuzzy Hash: E9212661604246BBE60476229E52FFB7B5CDE10368F284423FD0596247EB78FE1081B5

Function 00DFC75C Relevance: 10.8, APIs: 7, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__swprintf.LIBCMT ref: 00DFC890
__swprintf.LIBCMT ref: 00DFC8D3

Part of subcall function 00D97DE1: _memmove.LIBCMT ref: 00D97E22

__swprintf.LIBCMT ref: 00DFC927

Part of subcall function 00DB3698: __woutput_l.LIBCMT ref: 00DB36F1

__swprintf.LIBCMT ref: 00DFC975

Part of subcall function 00DB3698: __flsbuf.LIBCMT ref: 00DB3713
Part of subcall function 00DB3698: __flsbuf.LIBCMT ref: 00DB372B

__swprintf.LIBCMT ref: 00DFC9C4
__swprintf.LIBCMT ref: 00DFCA13
__swprintf.LIBCMT ref: 00DFCA62

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: __swprintf$__flsbuf$__woutput_l_memmove
String ID:
API String ID: 1085135966-0
Opcode ID: 08cbf9ea8a07e00e0847f29702dfc94e1c29246ef4a4e0b45be8a7287cd81770
Instruction ID: b7bdefa47bfb27274a9095e90b46fb31e98f3d8febe255f697cfec66e61f61a4
Opcode Fuzzy Hash: 08cbf9ea8a07e00e0847f29702dfc94e1c29246ef4a4e0b45be8a7287cd81770
Instruction Fuzzy Hash: 7FA12DB1414304ABDB00EFA4C995DAFB7ECEF99704F40492DF595C6191EA35EA08CB72

Function 00DEAED4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscmp.LIBCMT ref: 00DEAF29
_wcscmp.LIBCMT ref: 00DEAF8C
_wcsstr.LIBCMT ref: 00DEAF9D
_wcscmp.LIBCMT ref: 00DEAFE5
_wcscmp.LIBCMT ref: 00DEB065

Strings

@, xrefs: 00DEAEF9

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _wcscmp$_wcsstr
String ID: @
API String ID: 3312506106-2766056989
Opcode ID: 525916a8bc504fa4b13b14d336d007f5d6dda10833d5cc4250fb434a5272fc3c
Instruction ID: c5be2290a4cf5a5d056c1d1a95dfafc244479ce29e38a8629d3c2bc15c57069a
Opcode Fuzzy Hash: 525916a8bc504fa4b13b14d336d007f5d6dda10833d5cc4250fb434a5272fc3c
Instruction Fuzzy Hash: 0D81C0711083869FDB05EF16C881BAB77D8EF84324F08856AFD858A095DB34ED49CB71

Function 00DF64B8 Relevance: 9.2, APIs: 6, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memmove.LIBCMT ref: 00DF660B
_memmove.LIBCMT ref: 00DF6546

Part of subcall function 00D99837: __itow.LIBCMT ref: 00D99862
Part of subcall function 00D99837: __swprintf.LIBCMT ref: 00D998AC

_memmove.LIBCMT ref: 00DF65B9
_memmove.LIBCMT ref: 00DF66A0
_memmove.LIBCMT ref: 00DF66B9
_memmove.LIBCMT ref: 00DF66D5

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 7737c114a36851362f9cff69a5865d84050081a44473ada8722d867349a6da20
Instruction ID: bb9f22e4602da0b21eb41a5bf5ba44f870ce526eb5861b05737af7677ad288a2
Opcode Fuzzy Hash: 7737c114a36851362f9cff69a5865d84050081a44473ada8722d867349a6da20
Instruction Fuzzy Hash: B8617C3050025A9BCF01EF64CC92AFE7BA9EF05308F058559FA566B292EB35ED05CB70

Function 00DF4CC1 Relevance: 9.2, APIs: 6, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscmp.LIBCMT ref: 00DF4D5A

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: 9f483328b87e2f9089392b2207326b9a11b8e00c1f4561b81bc0a43578ca8f4b
Instruction ID: 8a0366697a664874c90f612b39d04149309e1426a5fb20d76d00bad3b2c323f5
Opcode Fuzzy Hash: 9f483328b87e2f9089392b2207326b9a11b8e00c1f4561b81bc0a43578ca8f4b
Instruction Fuzzy Hash: 4B5142B24083499BC725DB64DC819EFB3ECEF84350F04492EB689D3151EE34A688C776

Function 00D99837 Relevance: 9.1, APIs: 6, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__itow.LIBCMT ref: 00D99862
__swprintf.LIBCMT ref: 00D998AC
__i64tow.LIBCMT ref: 00DCF5E6

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID:
API String ID: 421087845-0
Opcode ID: 7bcafa12e8cb9d546087ae0c13376f8b73a3c8d299bf9db3645951ad734d3080
Instruction ID: ea95bc68726668a4ba1084161e41aab3ffb57cf0e6f2fe2f476ca7dd9f78c772
Opcode Fuzzy Hash: 7bcafa12e8cb9d546087ae0c13376f8b73a3c8d299bf9db3645951ad734d3080
Instruction Fuzzy Hash: 9841B471510206EFDF249F78D852FB6B7E9EF05310F24446EE58AD7291EA31D9418B30

Function 00DF55FD Relevance: 9.1, APIs: 6, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcsncpy.LIBCMT ref: 00DF563F
_wcsncpy.LIBCMT ref: 00DF5671
_wcsncpy.LIBCMT ref: 00DF56A4
_wcsncpy.LIBCMT ref: 00DF56E6
_wcsncpy.LIBCMT ref: 00DF5720
_wcsncpy.LIBCMT ref: 00DF574F

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _wcsncpy
String ID:
API String ID: 1735881322-0
Opcode ID: 07e0947fe95a8180eaf0aa6e348e8d9897622cda980e67335bb2af8a3bf9752e
Instruction ID: 291d575bfcb8801493f7f1253dfd8000abf31a0297881e1bf73d6e45de3fd2d0
Opcode Fuzzy Hash: 07e0947fe95a8180eaf0aa6e348e8d9897622cda980e67335bb2af8a3bf9752e
Instruction Fuzzy Hash: F841A466C10618B6CB11FBB49C869DFB7B8DF04310F508966E619E3221EB34E245C7FA

Function 00DB9AE6 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00DB9AE6

Part of subcall function 00DB3187: __initp_misc_winsig.LIBCMT ref: 00DB31A5

__mtinitlocks.LIBCMT ref: 00DB9AEB
__mtterm.LIBCMT ref: 00DB9AF4

Part of subcall function 00DB9B5C: _free.LIBCMT ref: 00DB9C5D

__calloc_crt.LIBCMT ref: 00DB9B19
__initptd.LIBCMT ref: 00DB9B3B

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: __calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 206718379-0
Opcode ID: 077d5c0f99fda34c06fd1b26cca46798951cce19c7061b0ffca82948e383fe55
Instruction ID: e25e9dde3c4791e08baf156daea0e5ba12ee1cc817a91c987e51170c7d35ac6b
Opcode Fuzzy Hash: 077d5c0f99fda34c06fd1b26cca46798951cce19c7061b0ffca82948e383fe55
Instruction Fuzzy Hash: 59F0F632519791DBE6347776BC63ACAA684DF02730F240A29F213C51D2EF1088004278

Function 00DFA1EF Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00DFA231
_memset.LIBCMT ref: 00DFA2B2
_wcsncpy.LIBCMT ref: 00DFA2EE

Strings

\, xrefs: 00DFA247
:, xrefs: 00DFA252

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: __swprintf_memset_wcsncpy
String ID: :$\
API String ID: 214737766-1166558509
Opcode ID: f5c4c2d66afbbd10ee5f85d9a25c73fd31d49a88663bd8fadf72adc8619a6d0a
Instruction ID: 10d1e23f2519cfdd9df523fcba5d18fcd54e5c1a1adfa52c6b9d2a928a85a45f
Opcode Fuzzy Hash: f5c4c2d66afbbd10ee5f85d9a25c73fd31d49a88663bd8fadf72adc8619a6d0a
Instruction Fuzzy Hash: 193191B150010AABDB209FA4DC49FFF77BCEF88700F1445BAFA09D6160EA7096448B39

Function 00DEA439 Relevance: 7.8, APIs: 5, Instructions: 273COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00DEA51B
_wcscmp.LIBCMT ref: 00DEA52E
_wcscmp.LIBCMT ref: 00DEA5BF
_wcscmp.LIBCMT ref: 00DEA731
_wcscmp.LIBCMT ref: 00DEA76B

Part of subcall function 00DB362C: _iswctype.LIBCMT ref: 00DB3634

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _wcscmp$__swprintf_iswctype
String ID:
API String ID: 3564621516-0
Opcode ID: 22f345dc1749fc61d738452cff1ec01fec5d702c3361f6a434a16c0623e3483b
Instruction ID: d3d9a195a32c045842f2bcdf5a03aace4752979be8e75470cb70efb1ecf824b9
Opcode Fuzzy Hash: 22f345dc1749fc61d738452cff1ec01fec5d702c3361f6a434a16c0623e3483b
Instruction Fuzzy Hash: A0A1DE31204647AFD715EF69C884BAAB7E8FF44314F048629F999D2190DB30F959CBB2

Function 00DB541D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB547B
_memcpy_s.LIBCMT ref: 00DB54ED
__read_nolock.LIBCMT ref: 00DB554B
__filbuf.LIBCMT ref: 00DB556E
_memset.LIBCMT ref: 00DB55B2

Part of subcall function 00DB8B28: __getptd_noexit.LIBCMT ref: 00DB8B28

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 5f1ff27ecb40ff672c6b963bdcbb91b938089e4726130bfa6a2e3a5f931ee01a
Instruction ID: a0d636eb29e082b658494992143cc6f9e1f88e36a799463c98f5e38d5b2a4b52
Opcode Fuzzy Hash: 5f1ff27ecb40ff672c6b963bdcbb91b938089e4726130bfa6a2e3a5f931ee01a
Instruction Fuzzy Hash: AF51A670A00B05DBDB249E69E8407EE77E6EF40321F288729F867962D8D771DD909B70

Function 00DF46B7 Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00DF4721
_memmove.LIBCMT ref: 00DF4734
_strcat.LIBCMT ref: 00DF474D
_wcscpy.LIBCMT ref: 00DF4764
_wcscpy.LIBCMT ref: 00DF4780

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _wcscpy$_memmove_strcat
String ID:
API String ID: 559723171-0
Opcode ID: de56ce9617f3aca52c0813d3aa7d2567c867b191378b8155293d27d06681c82b
Instruction ID: b6ae417464897d2f14f6138216878ba73082ae214870592fe86ee0087a166d31
Opcode Fuzzy Hash: de56ce9617f3aca52c0813d3aa7d2567c867b191378b8155293d27d06681c82b
Instruction Fuzzy Hash: 4A11D831500118ABDB10BB30AC4AEFF77BCEB01711F1585BAF54696051EF74D9858BB4

Function 00DEBC9E Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00DEBCB3
_memcmp.LIBCMT ref: 00DEBCD1
_memcmp.LIBCMT ref: 00DEBCE4
_memcmp.LIBCMT ref: 00DEBCFC
_memcmp.LIBCMT ref: 00DEBD14

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 7c26e2e8b89362a653cc0400413d5b10d698c9d03250d8de96d81db894dbabbb
Instruction ID: 2c070c624bd31f16b12844160e5ea56eade907d831c28463f4ea9397c9940fc2
Opcode Fuzzy Hash: 7c26e2e8b89362a653cc0400413d5b10d698c9d03250d8de96d81db894dbabbb
Instruction Fuzzy Hash: 0301B571604145BBD6047A229E52FFBB75CDE503A8B284433FD0696242FB54FE10C6B4

Function 00D96A8C Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 478COMMON

Download Yara Rule

Strings

AU3!, xrefs: 00D96B61
EA06, xrefs: 00DCE452

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _iswctype_wcscpy
String ID: AU3!$EA06
API String ID: 2497406411-2658333250
Opcode ID: 4781125ca166825588d68b5edf5b5f887c139103f418c94bf321b8132ec7d7c5
Instruction ID: 148d3a235ea162cf0cc2617a40fceef5b1b68edeb75c22516a90e6bef9e38095
Opcode Fuzzy Hash: 4781125ca166825588d68b5edf5b5f887c139103f418c94bf321b8132ec7d7c5
Instruction Fuzzy Hash: 69028A711083419FCB25EF24C881AAFBBE5EF95314F14492DF49A972A2DB30D949CB72

Function 00DFEB23 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00D99837: __itow.LIBCMT ref: 00D99862
Part of subcall function 00D99837: __swprintf.LIBCMT ref: 00D998AC

Part of subcall function 00DAFC86: _wcscpy.LIBCMT ref: 00DAFCA9

_wcstok.LIBCMT ref: 00DFEC94
_wcscpy.LIBCMT ref: 00DFED23
_memset.LIBCMT ref: 00DFED56

Strings

X, xrefs: 00DFED93

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 5f63eabd900585ca30706693ede9ba4275561f5c38432772f56cd3c6626f7487
Instruction ID: e60a1f0942dabda628699e59937542867d852a01382d8743d74aa79421dd4f19
Opcode Fuzzy Hash: 5f63eabd900585ca30706693ede9ba4275561f5c38432772f56cd3c6626f7487
Instruction Fuzzy Hash: 7CC191715083449FCB14EF28D881A6AB7E4FF85310F15892DF9999B2A2DB30ED45CB72

Function 00DA2CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00DB0DB6: std::exception::exception.LIBCMT ref: 00DB0DEC
Part of subcall function 00DB0DB6: __CxxThrowException@8.LIBCMT ref: 00DB0E01

Part of subcall function 00D97DE1: _memmove.LIBCMT ref: 00D97E22

Part of subcall function 00D97A51: _memmove.LIBCMT ref: 00D97AAB

__swprintf.LIBCMT ref: 00DA2ECD

Strings

(+I, xrefs: 00DA2EF4, 00DA2F51, 00DA2EF8

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: (+I
API String ID: 1943609520-2960116247
Opcode ID: 21f521673211c63e055d0da72932523ff923a3a2e42963ed3dbe2612b8802916
Instruction ID: 9f9bae700f93813d37cf090de39efa04600cde1607a75fc09630df4fc4f2dd83
Opcode Fuzzy Hash: 21f521673211c63e055d0da72932523ff923a3a2e42963ed3dbe2612b8802916
Instruction Fuzzy Hash: F3911C71118201AFCB14EF28D895D7FB7A4EF95710F04491EF4969B2A1EB20EE44CBB2

Function 00DA3137 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00DA3277
_memmove.LIBCMT ref: 00DA3310
_free.LIBCMT ref: 00DA3336
_memmove.LIBCMT ref: 00DA33E9

Strings

3cA, xrefs: 00DA323F

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _memmove$_free
String ID: 3cA
API String ID: 2620147621-2523384761
Opcode ID: 1b99c16daf26ba05b26fd3cba724ea838179ea068b8530a01c401a2aae47b380
Instruction ID: addad49d5963485f9313b713bdeecb7508f3a7b7963e697564cbe2f0e303140a
Opcode Fuzzy Hash: 1b99c16daf26ba05b26fd3cba724ea838179ea068b8530a01c401a2aae47b380
Instruction Fuzzy Hash: CA514B716043418FDB25CF68C441B6EBBE6EF8A310F08882DF99987351DB71E901CBA2

Function 00DA6192 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DA6248
_memmove.LIBCMT ref: 00DA62E4
_memset.LIBCMT ref: 00DA6308

Strings

ERCP, xrefs: 00DA61B3

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: f26897e622874a94d3a5be45ebb38ce857f1f7ed6e3ab2c2ed74d649e7167b68
Instruction ID: 63b4f7f445dd193e36a9ad630ecbc6bf25e87172664fe723e3bd347d7fe59fbf
Opcode Fuzzy Hash: f26897e622874a94d3a5be45ebb38ce857f1f7ed6e3ab2c2ed74d649e7167b68
Instruction Fuzzy Hash: 2551B071900305DBDB24DF65C8817EABBE4EF05314F28856EE58ACB240E774EA41CB74

Function 00E1B635 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E1B644
_memset.LIBCMT ref: 00E1B653

Strings

oL, xrefs: 00E1B63E
doL, xrefs: 00E1B64D

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _memset
String ID: oL$doL
API String ID: 2102423945-3421622115
Opcode ID: f6592324f54b6d11ff0072cf87150bc2a8f8a0fa5e3a8a7e269d397b8f6a706e
Instruction ID: d063f95130564a958f092f6aac2cb7aaec938eb0a131700718dacb37a27f8e1a
Opcode Fuzzy Hash: f6592324f54b6d11ff0072cf87150bc2a8f8a0fa5e3a8a7e269d397b8f6a706e
Instruction Fuzzy Hash: 18F05EB2540300BAE6502761BC06FBB3A9CEB08395F018439BA09E5192D7759C0087BC

Function 00DFD899 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00DFDA10
_wcscat.LIBCMT ref: 00DFDA28
_wcscat.LIBCMT ref: 00DFDA3A

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _wcscat$__wsplitpath
String ID:
API String ID: 1413645957-0
Opcode ID: 188660a599668010583c76a9614ab57aaee43a98a951f5589b54779c745aba27
Instruction ID: c03935c5b71466b366e0ebe65798216e90df76bc3f261b41ace906071ecec9ba
Opcode Fuzzy Hash: 188660a599668010583c76a9614ab57aaee43a98a951f5589b54779c745aba27
Instruction Fuzzy Hash: 3F81A2725042499FCB20EFA4C84497AB7EAEF89314F19C82EF989C7251E670D945CF72

Function 00DFDC1A Relevance: 6.2, APIs: 4, Instructions: 185COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00DFDD56
_wcscat.LIBCMT ref: 00DFDD6E
_wcscat.LIBCMT ref: 00DFDD80
_wcscpy.LIBCMT ref: 00DFDE08

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _wcscat$__wsplitpath_wcscpy
String ID:
API String ID: 3240238573-0
Opcode ID: 4f4890e2e2a3eabc3efe22c229ca72d21f946308a6877a74bd565c218d50dfe6
Instruction ID: dce2145d465c25543185911093eb86546d97495b3777b6ac61ce28025dd1e629
Opcode Fuzzy Hash: 4f4890e2e2a3eabc3efe22c229ca72d21f946308a6877a74bd565c218d50dfe6
Instruction Fuzzy Hash: FD617E725043099FCB10EF64C8559AEB3E9FF89314F05892DF98987251EB31E945CBB2

Function 00DF9E4A Relevance: 6.2, APIs: 4, Instructions: 156COMMON

Download Yara Rule

APIs

Part of subcall function 00D97DE1: _memmove.LIBCMT ref: 00D97E22

__swprintf.LIBCMT ref: 00DF9F0C
__swprintf.LIBCMT ref: 00DF9F25
_wprintf.LIBCMT ref: 00DF9FDB
_wprintf.LIBCMT ref: 00DF9FF9

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: __swprintf_wprintf$_memmove
String ID:
API String ID: 2249476411-0
Opcode ID: caf2c998783c6d6a87866aef771a2fbcf86fc1c5da1596bf467658d350e7574b
Instruction ID: fd5130a03303a63b063dce405d502eecd80ef2c748102c2d688e524437f36214
Opcode Fuzzy Hash: caf2c998783c6d6a87866aef771a2fbcf86fc1c5da1596bf467658d350e7574b
Instruction Fuzzy Hash: D7517D71900109BACF15EBA4DD46EEEB778EF04300F604165B509721A2EB316F59DF75

Function 00DF955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00D94EE5: _fseek.LIBCMT ref: 00D94EFD

Part of subcall function 00DF9734: _wcscmp.LIBCMT ref: 00DF9824
Part of subcall function 00DF9734: _wcscmp.LIBCMT ref: 00DF9837

_free.LIBCMT ref: 00DF96A2
_free.LIBCMT ref: 00DF96A9
_free.LIBCMT ref: 00DF9714
_free.LIBCMT ref: 00DF971C

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _free$_wcscmp$_fseek
String ID:
API String ID: 3404660211-0
Opcode ID: 8c66bba008aa022ea217763876d92d68911b16dfe2cdbb3685ec8a45d3e1b5f3
Instruction ID: b77868b2c72bab5c7804e8027e36eb0c24a6fcef258e67ea6d7e4c347b283a7b
Opcode Fuzzy Hash: 8c66bba008aa022ea217763876d92d68911b16dfe2cdbb3685ec8a45d3e1b5f3
Instruction Fuzzy Hash: 3F515EB1D14258AFDF249F64DC81BAEBBB9EF48300F10449EF609A7241DB715A81CF68

Function 00DF9C38 Relevance: 6.2, APIs: 4, Instructions: 150COMMON

Download Yara Rule

APIs

Part of subcall function 00D97DE1: _memmove.LIBCMT ref: 00D97E22

__swprintf.LIBCMT ref: 00DF9CF9
__swprintf.LIBCMT ref: 00DF9D12
_wprintf.LIBCMT ref: 00DF9DB9
_wprintf.LIBCMT ref: 00DF9DD7

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: __swprintf_wprintf$_memmove
String ID:
API String ID: 2249476411-0
Opcode ID: 3b826556c743c12135e1125909714c24acfff879d9fb167c7e2db4d00805d54e
Instruction ID: 5771098e9b3c73ae1124141fed9869666b466dc3fcdb202f0161f852ac63edac
Opcode Fuzzy Hash: 3b826556c743c12135e1125909714c24acfff879d9fb167c7e2db4d00805d54e
Instruction Fuzzy Hash: 34517A32D00609AADF15EBE0DD46EEEB778EF14300F604165B509720A2EB352F59DB74

Function 00DB470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00DB47A0
__flush.LIBCMT ref: 00DB47C0
__write.LIBCMT ref: 00DB47F3
__flsbuf.LIBCMT ref: 00DB4821

Part of subcall function 00DB8B28: __getptd_noexit.LIBCMT ref: 00DB8B28

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 8d5e84d796d2a622fb585a85b2cb739199fd67226ed781522a47284023b78b74
Instruction ID: a74ad065e6d6f85cc362e5ba7255da7b7a7f4e437abff59d22bdb0c3b83ca927
Opcode Fuzzy Hash: 8d5e84d796d2a622fb585a85b2cb739199fd67226ed781522a47284023b78b74
Instruction Fuzzy Hash: 9E41C479A00745DBDB18CE69C8909EE7BA6EF46360B28813DE857C7642DB70DD41CBB0

Function 00DC8F37 Relevance: 6.1, APIs: 4, Instructions: 130COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00DB8B28: __getptd_noexit.LIBCMT ref: 00DB8B28

__getbuf.LIBCMT ref: 00DC8FD1
__write.LIBCMT ref: 00DC8FFF
__lseeki64.LIBCMT ref: 00DC9043
__write.LIBCMT ref: 00DC9072

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: __write$__getbuf__getptd_noexit__lseeki64
String ID:
API String ID: 4182129353-0
Opcode ID: b77aae38ed6e34726ab9f9f279fa09a21295c2db3db9c1ce0869ba17ac253568
Instruction ID: 424cc04d6554080dff28e2b653ae7915a9ed3083c629379432dc424c2781e3e3
Opcode Fuzzy Hash: b77aae38ed6e34726ab9f9f279fa09a21295c2db3db9c1ce0869ba17ac253568
Instruction Fuzzy Hash: AC4129711007029FD3349F68C865FBAB7E5EF41320F08862DE5A68B6D1EB34E840AB70

Function 00DFEF95 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00DFEFCB
_wcscmp.LIBCMT ref: 00DFEFE2
_wcscmp.LIBCMT ref: 00DFF074
_wcscmp.LIBCMT ref: 00DFF08B

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: 6ca42bdee5e764a2d4c938babfd9147ccfee36eb28773e9f100ec5c7d0d625b2
Instruction ID: 831adecb07b57fe55607c110132c3712c5527040b97d207ef18c98bf890187b6
Opcode Fuzzy Hash: 6ca42bdee5e764a2d4c938babfd9147ccfee36eb28773e9f100ec5c7d0d625b2
Instruction Fuzzy Hash: 1A31D43250020D6ADF24AFA4DC48BFE77AC9F44360F1585BAE904D20A1DF75DA44CB79

Function 00DFF0F2 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00DFF128
_wcscmp.LIBCMT ref: 00DFF13F
_wcscmp.LIBCMT ref: 00DFF1BC
_wcscmp.LIBCMT ref: 00DFF1D3

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: 5e4c1ca136502ca1550e0c7352cbc5842e7fcfe98f56b9ff86b85f6952a77760
Instruction ID: e1b913f2b2bf539e0f4408a72d701be44159953e4041c441db5c2958b35e3d60
Opcode Fuzzy Hash: 5e4c1ca136502ca1550e0c7352cbc5842e7fcfe98f56b9ff86b85f6952a77760
Instruction Fuzzy Hash: 2231933650021DAADF20AFA4EC49BFE77ACDF45360F254175E900E20A0DB31DA45DA78

Function 00DC6FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00DC6FDB

Part of subcall function 00DC76C2: __fltout2.LIBCMT ref: 00DC76EB

__cftog_l.LIBCMT ref: 00DC7001
__cftoe_l.LIBCMT ref: 00DC7033

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: b2480b7925b1b11d0445c27138912305a1f3ab18a7e6b90239b76a400eaef3c5
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: A5014B7244814ABBCF265E85CC01DEE3F72BB18391B588419FA585A031D636C9B1BFA1

Function 00E0AEA2 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 00E0AFAE

Strings

xbL, xrefs: 00E0AFE4
xbL, xrefs: 00E0B010

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: __itow_s
String ID: xbL$xbL
API String ID: 3653519197-3351732020
Opcode ID: d646e4bb21cf180c2b3bcf2ba2aa6e399e6fdbde90ff57f1201e620ffab942ef
Instruction ID: cccdab1aa75990f1e0c4c0d3319b181a35b2b52735f96ba373dba4261daa4faa
Opcode Fuzzy Hash: d646e4bb21cf180c2b3bcf2ba2aa6e399e6fdbde90ff57f1201e620ffab942ef
Instruction Fuzzy Hash: CFB17174A00209EFCF14DF54C891EBABBB9FF58304F149569F945AB291DB30D981CB60

Function 00DE8310 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DE8353

Strings

, xrefs: 00DE8362

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-3916222277
Opcode ID: aa973d33a02bfa199831d235f317d3626315b443824ea58ce6c4261de3f61784
Instruction ID: 3243c8794588afd6a5361c022ca939bc3df60aad9d7d7e247ba93b34953687c7
Opcode Fuzzy Hash: aa973d33a02bfa199831d235f317d3626315b443824ea58ce6c4261de3f61784
Instruction Fuzzy Hash: 53818D71900289AFDF11EFA5CC45AEE7B79FF08304F184169F819A6161DB319E15EB34

Function 00D9708B Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_wcscat.LIBCMT ref: 00DCE9A0

Strings

\, xrefs: 00DCE9C3

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _wcscat
String ID: \
API String ID: 2563891980-2967466578
Opcode ID: 37f8556a626ae037f6edf7abe1d4f3c4d2ba69555b9a07e1d7be78a4c2c9eb1a
Instruction ID: 7ac9bb7a99ee1ec432e7440017f62ffc66f1b018c53c1874989cca7cc424fbd7
Opcode Fuzzy Hash: 37f8556a626ae037f6edf7abe1d4f3c4d2ba69555b9a07e1d7be78a4c2c9eb1a
Instruction Fuzzy Hash: C3718F71508301AEC744EF25E841EABBBE8FF85310F45893EF445871A1EB719948CB7A

Function 00E0F41E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E0F448
_memset.LIBCMT ref: 00E0F511

Part of subcall function 00D99837: __itow.LIBCMT ref: 00D99862
Part of subcall function 00D99837: __swprintf.LIBCMT ref: 00D998AC

Part of subcall function 00DAFC86: _wcscpy.LIBCMT ref: 00DAFCA9

Strings

@, xrefs: 00E0F525

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _memset$__itow__swprintf_wcscpy
String ID: @
API String ID: 2523036003-2766056989
Opcode ID: fc9b12f333b0dcf5a4b7df1c92d6160ab3b60f831e68bfb17c9988c3f6607c25
Instruction ID: 177dede8972fc2faa6ee66aad1ee380d3887401aed1bfd18b57dc153c8f389e1
Opcode Fuzzy Hash: fc9b12f333b0dcf5a4b7df1c92d6160ab3b60f831e68bfb17c9988c3f6607c25
Instruction Fuzzy Hash: AF61AE71A006199FCF14EFA8C8919AEBBB4FF48314F10446DE815BB791CB30AD41CBA0

Function 00E17152 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00E1716A

Strings

0, xrefs: 00E17160
F, xrefs: 00E17262

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: _memset
String ID: 0$F
API String ID: 2102423945-3044882817
Opcode ID: 8d361ed52167b8eab7a66d10bcbcea6876906ccdec482831028141534145e52f
Instruction ID: f52e38cde74013a76c2f11b7c9a6e729450c0ca49e7624e78199e18b5bf1600d
Opcode Fuzzy Hash: 8d361ed52167b8eab7a66d10bcbcea6876906ccdec482831028141534145e52f
Instruction Fuzzy Hash: 7D4147B5A01205EFDB20DFA4D884EEA7BF5FF48310F144429F945A7361D731A9A4CBA4

Function 00DB6B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00DB6B93
__calloc_crt.LIBCMT ref: 00DB6BAC

Strings

K, xrefs: 00DB6BD1

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: __calloc_crt
String ID: K
API String ID: 3494438863-4153964727
Opcode ID: fc675e1694061d9c38afe518b907dae0cef97e15bff182515fce2e9d9647b47a
Instruction ID: dcb1eb7982e4df0fd0ab21486e60e1cf9e8457c6d6a9bedc6f7feef34e3c6be6
Opcode Fuzzy Hash: fc675e1694061d9c38afe518b907dae0cef97e15bff182515fce2e9d9647b47a
Instruction Fuzzy Hash: FEF04471204611DBEBA49F55BC51ED667E4E740730B540466E502CE190EF78D8819ABC

Function 00DB9B79 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00DB9B94

Part of subcall function 00DB9C0B: __mtinitlocknum.LIBCMT ref: 00DB9C1D

__updatetlocinfoEx_nolock.LIBCMT ref: 00DB9BA4

Part of subcall function 00DB9100: ___addlocaleref.LIBCMT ref: 00DB911C
Part of subcall function 00DB9100: ___removelocaleref.LIBCMT ref: 00DB9127
Part of subcall function 00DB9100: ___freetlocinfo.LIBCMT ref: 00DB913B

Strings

8K, xrefs: 00DB9B85

Memory Dump Source

Source File: 00000000.00000002.1887568934.0000000000D91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D90000, based on PE: true

Associated: 00000000.00000002.1887549867.0000000000D90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E1F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887635868.0000000000E44000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E4E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887705522.0000000000E52000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1887754421.0000000000E57000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d90000_WN9uCxgU1T.jbxd

Similarity

API ID: Ex_nolock___addlocaleref___freetlocinfo___removelocaleref__lock__mtinitlocknum__updatetlocinfo
String ID: 8K
API String ID: 3369060592-2802361588
Opcode ID: d41c92ecd1d7e74e0adb9f475a826e210c9bd16fdcadbad4fdccb8f20f9f3334
Instruction ID: 629a8db97bdf2e4748cf8387b9c11449e61d9142a51748c521ff6730868d19c4
Opcode Fuzzy Hash: d41c92ecd1d7e74e0adb9f475a826e210c9bd16fdcadbad4fdccb8f20f9f3334
Instruction Fuzzy Hash: 73E08C7194B340EAEE24FBA9A963BC9B664DB80B21F20026EF147550C1CE782400DA3F

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report WN9uCxgU1T.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_WN9uCxgU1T.exe_a87e78bd101179c21e5cabb6292eaed3b922c0e6_95d20471_05260d53-cf84-4b07-9286-790e3bfe886c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6946.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A12.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A42.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
WN9uCxgU1T.exe

Function 00DB7DCD Relevance: 1.5, APIs: 1, Instructions: 2
COMMON

Function 00DA5760 Relevance: 11.0, APIs: 7, Instructions: 532
COMMON

Function 00DA3030 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 587
COMMON

Function 00D968DC Relevance: 18.3, APIs: 12, Instructions: 275
COMMON

Function 00DF449A Relevance: 18.2, APIs: 12, Instructions: 179
COMMON

Function 00DB6E03 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Function 00DF9155 Relevance: 12.3, APIs: 8, Instructions: 322
COMMON

Function 00DEBBAF Relevance: 12.1, APIs: 8, Instructions: 92
COMMON

Function 00DFC75C Relevance: 10.8, APIs: 7, Instructions: 280
COMMON

Function 00DEAED4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 249
COMMON

Function 00DF64B8 Relevance: 9.2, APIs: 6, Instructions: 205
COMMON

Function 00DF4CC1 Relevance: 9.2, APIs: 6, Instructions: 170
COMMON

Function 00D99837 Relevance: 9.1, APIs: 6, Instructions: 146
COMMON

Function 00DF55FD Relevance: 9.1, APIs: 6, Instructions: 138
COMMON