Edit tour

Windows Analysis Report
kQibsaGS2E.exe

Overview

General Information

Sample name:	kQibsaGS2E.exe renamed because original name is a hash value
Original sample name:	9c1047801b38650382f68beedae4bcbd47bba142abad7405cac530f4e09f47ee.exe
Analysis ID:	1588574
MD5:	622477f506f2cc70c597fcec0aeac1a1
SHA1:	cb7bb785347769bff73647976c57350320ca498e
SHA256:	9c1047801b38650382f68beedae4bcbd47bba142abad7405cac530f4e09f47ee
Tags:	exeuser-adrian__luca
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to query CPU information (cpuid)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Found potential string decryption / allocating functions

One or more processes crash

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

kQibsaGS2E.exe (PID: 1540 cmdline: "C:\Users\user\Desktop\kQibsaGS2E.exe" MD5: 622477F506F2CC70C597FCEC0AEAC1A1)

WerFault.exe (PID: 2760 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 532 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: kQibsaGS2E.exe	Virustotal: Detection: 36%			Perma Link
Source: kQibsaGS2E.exe	ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for sample

Source: kQibsaGS2E.exe

Joe Sandbox ML: detected

Source: kQibsaGS2E.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: global traffic

TCP traffic: 192.168.2.7:58723 -> 162.159.36.2:53

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa

Source: Amcache.hve.4.dr

String found in binary or memory: http://upx.sf.net

System Summary

Binary is likely a compiled AutoIt script file

Source: kQibsaGS2E.exe, 00000000.00000000.1364764603.0000000000D04000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_54c5c528-e
Source: kQibsaGS2E.exe, 00000000.00000000.1364764603.0000000000D04000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_566f7ad0-f
Source: kQibsaGS2E.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d41b3cf3-9
Source: kQibsaGS2E.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_1e6960cf-b

Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C721C5	0_2_00C721C5
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C862D2	0_2_00C862D2
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00CD03DA	0_2_00CD03DA
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C8242E	0_2_00C8242E
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C725FA	0_2_00C725FA
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C666E1	0_2_00C666E1
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C5E6A0	0_2_00C5E6A0
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00CAE616	0_2_00CAE616
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C8878F	0_2_00C8878F
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00CB8889	0_2_00CB8889
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C86844	0_2_00C86844
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00CD0857	0_2_00CD0857
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C7CB21	0_2_00C7CB21
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C86DB6	0_2_00C86DB6
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C66F9E	0_2_00C66F9E
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C63030	0_2_00C63030
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C7F1D9	0_2_00C7F1D9
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C73187	0_2_00C73187
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C51287	0_2_00C51287
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C71484	0_2_00C71484
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C65520	0_2_00C65520
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C77696	0_2_00C77696
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C65760	0_2_00C65760
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C7D975	0_2_00C7D975
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C71978	0_2_00C71978
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C89AB5	0_2_00C89AB5
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C5FCE0	0_2_00C5FCE0
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00CD7DDB	0_2_00CD7DDB
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C71D90	0_2_00C71D90
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C7BDA6	0_2_00C7BDA6
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C63FE0	0_2_00C63FE0
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C5DF00	0_2_00C5DF00

Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: String function: 00C59A98 appears 32 times
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: String function: 00C598C0 appears 32 times
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: String function: 00C78900 appears 42 times

Source: C:\Users\user\Desktop\kQibsaGS2E.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 532

Source: kQibsaGS2E.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal60.winEXE@2/5@2/0

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1540

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\118aab88-6490-45db-b4ad-d2806923085d

Jump to behavior

Source: kQibsaGS2E.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\kQibsaGS2E.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: kQibsaGS2E.exe	Virustotal: Detection: 36%
Source: kQibsaGS2E.exe	ReversingLabs: Detection: 65%

Source: unknown	Process created: C:\Users\user\Desktop\kQibsaGS2E.exe "C:\Users\user\Desktop\kQibsaGS2E.exe"
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 532

Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Section loaded: wsock32.dll	Jump to behavior

Source: kQibsaGS2E.exe

Static file information: File size 1360384 > 1048576

Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C78945 push ecx; ret		0_2_00C78958
Source: C:\Users\user\Desktop\kQibsaGS2E.exe	Code function: 0_2_00C52F12 push es; retf		0_2_00C52F13

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\kQibsaGS2E.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\kQibsaGS2E.exe

Code function: 0_2_00C77DCD ___security_init_cookie,LdrInitializeThunk,

0_2_00C77DCD

Source: kQibsaGS2E.exe

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\kQibsaGS2E.exe

Code function: 0_2_00C7862B cpuid

0_2_00C7862B

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Process Injection	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	11 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
kQibsaGS2E.exe	36%	Virustotal		Browse
kQibsaGS2E.exe	66%	ReversingLabs	Win32.Trojan.AutoitInject
kQibsaGS2E.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
241.42.69.40.in-addr.arpa	unknown	unknown	false	high
time.windows.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.4.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588574
Start date and time:	2025-01-11 02:34:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	kQibsaGS2E.exe renamed because original name is a hash value
Original Sample Name:	9c1047801b38650382f68beedae4bcbd47bba142abad7405cac530f4e09f47ee.exe
Detection:	MAL
Classification:	mal60.winEXE@2/5@2/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 1 Number of non-executed functions: 61
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.40.149.189, 104.208.16.94, 13.107.246.45, 40.126.32.134, 20.12.23.50, 40.69.42.241, 52.149.20.212
Excluded domains from analysis (whitelisted): login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, twc.trafficmanager.net, otelrules.afd.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
20:35:52	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	1907125702104121563.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	2937924646314313784.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	RdichqztBg.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	AraK29dzhH.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	YrCSUX2O3I.exe	Get hash	malicious	GuLoader	Browse	13.107.246.45
	http://unikuesolutions.com/ck/bd/%7BRANDOM_NUMBER05%7D/YmVuc29uLmxpbkB2aGFjb3JwLmNvbQ==	Get hash	malicious	Unknown	Browse	13.107.246.45
	uG3I84bQEr.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	12621132703258916868.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	Cpfkf79Rzk.exe	Get hash	malicious	GuLoader	Browse	13.107.246.45
	https://noiclethomas.wixsite.com/rice	Get hash	malicious	Unknown	Browse	13.107.246.45

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_kQibsaGS2E.exe_f12af879545b8ce419ab756d07e8ef81bff6cfd_58958fe6_64b5c7c7-0e96-4516-9030-0e6ce3b40438\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8473868161112874
Encrypted:	false
SSDEEP:	96:37F0HBhuVsFhcX7ZfzQXIDcQvc6QcEVcw3cE/9Bz+HbHgoC5AJ8v3JIDV9Mb/XED:rQhuVC0BU/QjgLqzuiFDZ24IO8SR
MD5:	8C639DC7C8995C4EAC9AF404F7CE8A32
SHA1:	B77B5DEF9E766E2831538710D670D4545D5E3452
SHA-256:	6B57086E4A5A8B4CFDFF59D90B96D19408F3EBABA931F21EC40460F9E8023644
SHA-512:	054903DE9834397B7D41E5D9AD17557D05A6EFCCF061AF9E0EA1401012E13D59611C480D9651F920E80FA3A1A6F392849517BDB867C2E3F524C7561326EAF892
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.1.0.3.2.9.3.2.9.2.1.8.5.1.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.1.0.3.2.9.3.3.7.9.6.8.6.3.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.4.b.5.c.7.c.7.-.0.e.9.6.-.4.5.1.6.-.9.0.3.0.-.0.e.6.c.e.3.b.4.0.4.3.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.3.5.8.6.5.e.f.-.5.f.a.8.-.4.a.a.4.-.b.0.c.0.-.f.f.3.4.a.6.c.d.e.3.1.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.k.Q.i.b.s.a.G.S.2.E...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.6.0.4.-.0.0.0.1.-.0.0.1.4.-.9.0.1.7.-.9.2.1.a.c.9.6.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.6.4.2.7.f.f.1.6.e.3.d.e.3.6.a.c.7.c.c.a.9.4.2.3.9.6.1.5.3.6.f.0.0.0.0.0.9.0.8.!.0.0.0.0.c.b.7.b.b.7.8.5.3.4.7.7.6.9.b.f.f.7.3.6.4.7.9.7.6.c.5.7.3.5.0.3.2.0.c.a.4.9.8.e.!.k.Q.i.b.s.a.G.S.2.E...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER459.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Jan 11 01:35:33 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	39718
Entropy (8bit):	1.9506506349645674
Encrypted:	false
SSDEEP:	192:hXF2Qjp1oqwsYOYDFYeIPTBNThmQsKMY5Irlq0X:tFfjp+VsfOydnxsKMY5sq8
MD5:	6DCDC8EF55BD3CBC762FCB14E4BEE587
SHA1:	63CF3AEEA12DF770E7714514297F450E906D7A9E
SHA-256:	8DCD75C67B6315B2E506B9E0C379E606AE63009E2BFAB7A7FE2A390D6B15AE37
SHA-512:	06D5DA3FC2A5BE094888B06468AA3A7CB28E0576207A8B7C7DDB8FFDB97A036A58DE1AA4789360B9E3E3078EB6BBE61A0E5F7AF40D130E839DDF591A052D2BF2
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........g........................\...............b'..........T.......8...........T...........P..........................................................................................................eJ......\|.......GenuineIntel............T.............g.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER574.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8298
Entropy (8bit):	3.6959824402747223
Encrypted:	false
SSDEEP:	192:R6l7wVeJxX6t6YN6SUBlBXgmfmwpru89bJssfnjm:R6lXJR6t6YASUTBXgmfmCJ/f6
MD5:	EA684C5CC8DD63479F5F8C18A1266949
SHA1:	8643DB9BD2554BBB08BD6015483AA6E82342D856
SHA-256:	6A85140D91F050421FDEF6E6C88BEA3B4EAC3AEFF25CDAEECE550CCE9440F8A9
SHA-512:	6975AB446D999C355F86A2F8FF0CDB3502566C319E4F7E1898DDEE1F590C86B098890C0906648ED43ADCD11164433DA30F24129E6FAE7E3F2372DB1F66C24D06
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.5.4.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D2.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.471295980997048
Encrypted:	false
SSDEEP:	48:cvIwWl8zsPzJg77aI9YkeWpW8VY0gYm8M4JKmbtIFeR+q8ZWNn8cpfvkd:uIjfPNI7ikf7VnJKo1RSW+cpfvkd
MD5:	7755D27FDA6A704DD281D213B9D2DBCA
SHA1:	BE6F7A18CC152FDBCE548F303E6A33FE3B64F103
SHA-256:	C44BAF18D0333622E81F9F6483DFE08A115616CDB7A58CEF70729A4D729E192F
SHA-512:	3EDB7DE354FDAB9F719BD06BB1E70033CF9A174FD56B1904C4052CE5D4FD5E006EDF42F9A5EF3E4894AD0C9D1BB2B7BEFD69D1EE9820809F181CBC2009269760
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="670598" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.416627375337323
Encrypted:	false
SSDEEP:	6144:ccifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNd5+:xi58oSWIZBk2MM6AFB7o
MD5:	F4916D838F4945ADBAB9620FCA47FEEE
SHA1:	683E6291FCBF129896BDC235DEB0569F12AD661A
SHA-256:	164B78A4DBA0E0DA36569BCE0B5F66227C0D940C846FBD288AA85082804FDF53
SHA-512:	0F4E76D33CE23735AC1342CE40BAE52C287A7A3DA03BEB952EA9CFA44DBB2E9EE84DC8E26434FE6CF34103AAE5ACEE4A75ACD58BBCE96C3D58AD4B2C93869C84
Malicious:	false
Reputation:	low
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.C...c..............................................................................................................................................................................................................................................................................................................................................y...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.2046557062314545
TrID:	Win32 Executable (generic) a (10002005/4) 99.70% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	kQibsaGS2E.exe
File size:	1'360'384 bytes
MD5:	622477f506f2cc70c597fcec0aeac1a1
SHA1:	cb7bb785347769bff73647976c57350320ca498e
SHA256:	9c1047801b38650382f68beedae4bcbd47bba142abad7405cac530f4e09f47ee
SHA512:	ddb9ce92109548dac89da604d596ccb9909b1daf6f10a2606c249d94258f4e9a5a45ecb97528b65004392015e68708380f26e2e31df3da7ba448ceb93571b542
SSDEEP:	24576:1u6J33O0c+JY5UZ+XC0kGsoTCcLMkSjkpoftUXoBmZieeiftIZpN:Xu0c++OCvkGsECcLMrQaZoZiEFIZp
TLSH:	5B55D01273DDC360CB669173BF6AB7016EBB7C620630F95B2F980D3DA950161262D7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6750F820 [Thu Dec 5 00:47:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	bd3825b6e0410966f0c31f64b6c7644a

Entrypoint Preview

Instruction
call 00007FE3C88CBECAh
jmp 00007FE3C88BEC94h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FE3C88BEE1Ah
cmp edi, eax
jc 00007FE3C88BF17Eh
bt dword ptr [004C31FCh], 01h
jnc 00007FE3C88BEE19h
rep movsb
jmp 00007FE3C88BF12Ch
cmp ecx, 00000080h
jc 00007FE3C88BEFE4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FE3C88BEE20h
bt dword ptr [004BE324h], 01h
jc 00007FE3C88BF2F0h
bt dword ptr [004C31FCh], 00000000h
jnc 00007FE3C88BEFBDh
test edi, 00000003h
jne 00007FE3C88BEFCEh
test esi, 00000003h
jne 00007FE3C88BEFADh
bt edi, 02h
jnc 00007FE3C88BEE1Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FE3C88BEE23h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FE3C88BEE75h
bt esi, 03h
jnc 00007FE3C88BEEC8h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x83840	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	fc8a5b32808697dd41c898d938b66f67	False	0.3239911500677507	data	5.674452471189642	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x83840	0x83a00	6542f8bb443c155611cc24731fefae83	False	0.9494784247388414	data	7.937194013764426	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14b000	0x711c	0x7200	8a46a4bc77a3f321996ff4079f834054	False	0.0017475328947368421	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x7ab07	data			1.0003203756952253
RT_GROUP_ICON	0x14a2c0	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x14a338	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x14a34c	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x14a360	0x14	data	English	Great Britain	1.25
RT_VERSION	0x14a374	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x14a450	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
KERNEL32.DLL	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit
PSAPI.DLL	GetProcessMemoryInfo
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:35:59.710767031 CET	58723	53	192.168.2.7	162.159.36.2
Jan 11, 2025 02:35:59.715509892 CET	53	58723	162.159.36.2	192.168.2.7
Jan 11, 2025 02:35:59.715692997 CET	58723	53	192.168.2.7	162.159.36.2
Jan 11, 2025 02:35:59.720452070 CET	53	58723	162.159.36.2	192.168.2.7
Jan 11, 2025 02:36:00.219012976 CET	58723	53	192.168.2.7	162.159.36.2
Jan 11, 2025 02:36:00.237606049 CET	58723	53	192.168.2.7	162.159.36.2
Jan 11, 2025 02:36:00.242743015 CET	53	58723	162.159.36.2	192.168.2.7
Jan 11, 2025 02:36:00.242825031 CET	58723	53	192.168.2.7	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 02:35:27.583873987 CET	53378	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:35:59.710109949 CET	53	59135	162.159.36.2	192.168.2.7
Jan 11, 2025 02:36:00.328289986 CET	60318	53	192.168.2.7	1.1.1.1
Jan 11, 2025 02:36:00.335077047 CET	53	60318	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 02:35:27.583873987 CET	192.168.2.7	1.1.1.1	0x5452	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:36:00.328289986 CET	192.168.2.7	1.1.1.1	0xb0be	Standard query (0)	241.42.69.40.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 02:35:27.590581894 CET	1.1.1.1	192.168.2.7	0x5452	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:35:30.361957073 CET	1.1.1.1	192.168.2.7	0x828c	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 02:35:30.361957073 CET	1.1.1.1	192.168.2.7	0x828c	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 11, 2025 02:36:00.335077047 CET	1.1.1.1	192.168.2.7	0xb0be	Name error (3)	241.42.69.40.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: kQibsaGS2E.exePID: 1540, Parent PID: 4056

General

Target ID:	0
Start time:	20:35:32
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\kQibsaGS2E.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\kQibsaGS2E.exe"
Imagebase:	0xc50000
File size:	1'360'384 bytes
MD5 hash:	622477F506F2CC70C597FCEC0AEAC1A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 2760, Parent PID: 1540

General

Target ID:	4
Start time:	20:35:32
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 532
Imagebase:	0x450000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: kQibsaGS2E.exePID: 1540, Parent PID: 4056COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	66.7%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00C77DCD Relevance: 1.5, APIs: 1, Instructions: 2
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___security_init_cookie.LIBCMT ref: 00C77DCD

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 37d1d09d41eb5fcb3a4af465fc0fb251569986102ab4ab40f909050fe7e311e5
Instruction ID: 8d67408759f17f088a8f53c4cde82028f339bcef5b4ca089160a5ee8a42a240c
Opcode Fuzzy Hash: 37d1d09d41eb5fcb3a4af465fc0fb251569986102ab4ab40f909050fe7e311e5
Instruction Fuzzy Hash:

Non-executed Functions

Function 00C66F9E Relevance: 71.5, APIs: 19, Strings: 19, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C671C3
_memset.LIBCMT ref: 00C67539
_memmove.LIBCMT ref: 00C676AC

Strings

', xrefs: 00C670B7
{, xrefs: 00C6707B
<, xrefs: 00C670A3
]K, xrefs: 00CA1A22
o, xrefs: 00C6711B
R, xrefs: 00C670AD
P\K, xrefs: 00CA1AB8
+, xrefs: 00C67071
9, xrefs: 00C67099
n, xrefs: 00C67111
), xrefs: 00C6708F
", xrefs: 00CA2E92
@, xrefs: 00CA3C88
, xrefs: 00C670E9
q, xrefs: 00C6712F
s{p, xrefs: 00C67BCD
p, xrefs: 00C67125
-, xrefs: 00C670C1
0, xrefs: 00C67085

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _memmove$_memset
String ID: $ ]K$"$'$)$+$-$0$9$<$@$P\K$R$n$o$p$q$s{p${
API String ID: 1357608183-3800155241
Opcode ID: b28a790e45669a4902d64bf1598fd7c3bcb7bf2305bb98875f8069baf6f44106
Instruction ID: d3a02dbcddce87b8325e9a66f9e7d58a8bf234e1f4e39c69ee7274cba0c7d661
Opcode Fuzzy Hash: b28a790e45669a4902d64bf1598fd7c3bcb7bf2305bb98875f8069baf6f44106
Instruction Fuzzy Hash: 7C93B371E00216DFDB24CF98C891BADB7B1FF49318F24856AE955AB281E7709E81CB50

Function 00C63FE0 Relevance: 15.1, APIs: 1, Strings: 7, Instructions: 1132COMMON

Download Yara Rule

Strings

ERCP, xrefs: 00C640BF
VUUU, xrefs: 00C6437B
VUUU, xrefs: 00C976E2
0DJ, xrefs: 00C6430C
VUUU, xrefs: 00C6438D
0DJ, xrefs: 00C64232
VUUU, xrefs: 00C643C0

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID:
String ID: 0DJ$0DJ$ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-223423113
Opcode ID: f5ff305bdbafe341a1db575146456b4f73aa52c1d9f9d9bce80aef23edd1e421
Instruction ID: cb33c29515b0edc260feb0bebb7dd85392889c0dba4ad39961260ba48a8f1d9f
Opcode Fuzzy Hash: f5ff305bdbafe341a1db575146456b4f73aa52c1d9f9d9bce80aef23edd1e421
Instruction Fuzzy Hash: 5CA28E70E0521ACBDF38CF59C9947ADB7B1BF54314F1482AAD92AA7280E7309E81DF50

Function 00C65760 Relevance: 11.0, APIs: 7, Instructions: 532
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memmove.LIBCMT ref: 00C658A5
_memmove.LIBCMT ref: 00C658F5
_memmove.LIBCMT ref: 00C6595B

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: bc5590fee32963866547a934e2f4481e6f2daf4eb5e9485274101ae2dbc06eb9
Instruction ID: 21489d0dfac1f64bd661c52cdd4c8c691210a72989a9fd870d273d5052b2dc7c
Opcode Fuzzy Hash: bc5590fee32963866547a934e2f4481e6f2daf4eb5e9485274101ae2dbc06eb9
Instruction Fuzzy Hash: 1012BB70A0060ADFCF14DFA5D981AAEB3F5FF48304F208529E846E7290EB36AD55DB54

Function 00C63030 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 587
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3cA, xrefs: 00C6323F

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: __itow__swprintf
String ID: 3cA
API String ID: 674341424-2523384761
Opcode ID: bd8f269727dd203b3cd5d455fda2b58de944a4bb22d2e13bbec33b21dd907dda
Instruction ID: f5bd5b17200a5d1815561594ac5a653a854d532b6019a41e9a6e55610db78899
Opcode Fuzzy Hash: bd8f269727dd203b3cd5d455fda2b58de944a4bb22d2e13bbec33b21dd907dda
Instruction Fuzzy Hash: 7222BB716083419FCB24DF24C881B6FBBE4EF84704F14492DF89A97291DB71EA49DB92

Function 00C5FCE0 Relevance: 8.0, APIs: 3, Strings: 1, Instructions: 1040COMMON

Download Yara Rule

Strings

pbL, xrefs: 00C949B9

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID:
String ID: pbL
API String ID: 0-2198975964
Opcode ID: f4dcd20d2bc5d81d89870ef2a695217c5eca1df5ed962e9f7e233abbde67ac23
Instruction ID: 6554485dcf0cbe135f2b832ac16bb7eb4da04f67bcbee7b778c313926be3cf38
Opcode Fuzzy Hash: f4dcd20d2bc5d81d89870ef2a695217c5eca1df5ed962e9f7e233abbde67ac23
Instruction Fuzzy Hash: 699257746083418FDB24DF14C484B2BB7E1BF85304F24896DE89A9B362D771ED86CB96

Function 00C65520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00C70DB6: std::exception::exception.LIBCMT ref: 00C70DEC
Part of subcall function 00C70DB6: __CxxThrowException@8.LIBCMT ref: 00C70E01

_memmove.LIBCMT ref: 00CA0258
_memmove.LIBCMT ref: 00CA036D
_memmove.LIBCMT ref: 00CA0414

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 7e59d6d005cac17bdf0d515b6185c65b2e751bd3579f41a42c57154c824fcbd6
Instruction ID: 44d6de36e13e4a8b058c83e7d0250480bc0f479ffc1161f3cac41b2130b7e053
Opcode Fuzzy Hash: 7e59d6d005cac17bdf0d515b6185c65b2e751bd3579f41a42c57154c824fcbd6
Instruction Fuzzy Hash: BD02D0B0A00209DBCF14DF64D981AAEBBB5FF45304F248069E80ADB395EB31DE54DB95

Function 00C5E6A0 Relevance: 6.0, Strings: 4, Instructions: 1004COMMON

Download Yara Rule

Strings

DdL, xrefs: 00C5EAC1
DdL, xrefs: 00C93B2E
DdL, xrefs: 00C93AF5
DdL, xrefs: 00C5EABA

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID:
String ID: DdL$DdL$DdL$DdL
API String ID: 0-1563988167
Opcode ID: d23c6b499de0a7fbb547df9319404598a5cece590a92a1b032f5e0038fb359f7
Instruction ID: 7b987e068d5ee2c0f1b59980b23477db67a8c259d344990bb3fc1ef6cdefb6bc
Opcode Fuzzy Hash: d23c6b499de0a7fbb547df9319404598a5cece590a92a1b032f5e0038fb359f7
Instruction Fuzzy Hash: 9E929E79A00215CFCB28CF58C484AAEB7B1FF59311F248169EC159B351D775EE8ACB88

Function 00CD7DDB Relevance: 3.6, APIs: 2, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a1e612490df0e2fd5aff0df4db96d0646e8fd45de2b35679b98956547aaa80
Instruction ID: e58c3f6f69622edb27f640e23834d6917d76e031af0716f917cf4f1158c8a3b7
Opcode Fuzzy Hash: 25a1e612490df0e2fd5aff0df4db96d0646e8fd45de2b35679b98956547aaa80
Instruction Fuzzy Hash: 7712F171500205ABEB249F65CC49FAF7BF8EF45310F24462AFA15EA3E1EB709949DB10

Function 00CB8889 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00CB889B

Part of subcall function 00C7520A: __aulldiv.LIBCMT ref: 00C75233

Strings

0eL, xrefs: 00CB8892

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: __aulldiv__time64
String ID: 0eL
API String ID: 325419493-3167399643
Opcode ID: 173a61627ebe1b4304b39b54128586dabbe463c8e4c1c1e482927ec7599268c1
Instruction ID: e5d2489c9bd7b3f4fe806738bf2243d7f7ccd1869e06fdc73baff3a944f972f2
Opcode Fuzzy Hash: 173a61627ebe1b4304b39b54128586dabbe463c8e4c1c1e482927ec7599268c1
Instruction Fuzzy Hash: BE21AF326256108BC729CF29D841A92B3E5EFA5311F698E6CD0F5CB2C0CA75A909CB54

Function 00C5DF00 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fedcd55ce1be01234807a739cd4bdd318ff75d00aeb43b21d4f5e2df7acffac
Instruction ID: 28b9c620604f5cf6d4a8b061db0af01e9c6fbbca9500b2a5513e7485aa3ef693
Opcode Fuzzy Hash: 7fedcd55ce1be01234807a739cd4bdd318ff75d00aeb43b21d4f5e2df7acffac
Instruction Fuzzy Hash: A622CF78900215DFCF28DF94C484AAEB7B0FF08311F148169EC669B391D770AA89DB95

Function 00C666E1 Relevance: 3.4, Strings: 2, Instructions: 889COMMON

Download Yara Rule

Strings

0DJ0EJ0FJpGJ, xrefs: 00C66881, 00C6688A
pGJ, xrefs: 00C66751

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID:
String ID: 0DJ0EJ0FJpGJ$pGJ
API String ID: 0-2520054932
Opcode ID: 6a8c43c5cd2287656802195d535ea908290b48d8ab3bfd826a36c9d68e310c78
Instruction ID: f3b13a11c88c80fd30596d6185c215df40b2718e1f7fbc5fb44148aedea6d2d4
Opcode Fuzzy Hash: 6a8c43c5cd2287656802195d535ea908290b48d8ab3bfd826a36c9d68e310c78
Instruction Fuzzy Hash: 1A728171E0021ADBDF24CF59C8807AEB7B5FF49314F14816AE959EB290E7349E81DB90

Function 00CAE616 Relevance: 3.1, Strings: 2, Instructions: 561COMMON

Download Yara Rule

Strings

(, xrefs: 00CAE66E
|, xrefs: 00CAE658

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID:
String ID: ($|
API String ID: 0-1631851259
Opcode ID: e10e0101c6e5428e3f3f3b8754e90dc55a18d34dd6833db7f52c40727a3dee7e
Instruction ID: c2e719418abdcfdd6158d681dae6531794a9296d83ec5d031f1ea2178418479d
Opcode Fuzzy Hash: e10e0101c6e5428e3f3f3b8754e90dc55a18d34dd6833db7f52c40727a3dee7e
Instruction Fuzzy Hash: B1323675A007069FD728CF59C4819AAB7F0FF48314B15C46EE8AADB3A1D770E941CB94

Function 00C7F1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe7d9b8eee1d273b37d623b7cc6cd26b30c9621dfee01b7311cae72a06f2c816
Instruction ID: 966e53770daa1b5fe9e5e1cf1e0117c52d12e143e203ad30879a7f0427663ce1
Opcode Fuzzy Hash: fe7d9b8eee1d273b37d623b7cc6cd26b30c9621dfee01b7311cae72a06f2c816
Instruction Fuzzy Hash: 0C320422D29F014DD7239635D872335A288AFB73D8F15D73BF829B59A6EB28D5834204

Function 00C8242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a83e6c9a1e03463649304356993a4cc28f03311dd18012bd76db8a2bb8b356c
Instruction ID: 3fe0576c697d03a9dccc52f34f4ddb31871f5346aa59c7ad13acf6720d2ad6ed
Opcode Fuzzy Hash: 9a83e6c9a1e03463649304356993a4cc28f03311dd18012bd76db8a2bb8b356c
Instruction Fuzzy Hash: 68B10231D2AF404DD723A6398835336B65CAFBB2C9F51D72BFC2674D22EB2185934285

Function 00CD0857 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb806d70b46a9202dd3e543ee6ca14ab650e64b5adbaddcfbe08c0bc828943e
Instruction ID: a65c772efe3f2250d6bf97eb70762d5d4fdb27a6ca9a020cfad416022dad27d3
Opcode Fuzzy Hash: 5eb806d70b46a9202dd3e543ee6ca14ab650e64b5adbaddcfbe08c0bc828943e
Instruction Fuzzy Hash: 810269756006019FCB14EF28C881E2AB7E5FF89710F14885DF9999B3A2CB30ED45DB85

Function 00CD03DA Relevance: .4, Instructions: 397COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 4343597e8507452ccff4b02692f110eb0ad94be3eec77fb80de36c15d9900197
Instruction ID: 016451a01c64e7819c67d4c1be20c6c1677b577d6535a8483a8da4b8a8462332
Opcode Fuzzy Hash: 4343597e8507452ccff4b02692f110eb0ad94be3eec77fb80de36c15d9900197
Instruction Fuzzy Hash: 6BE15D71604200EFCB14DF28C891E2ABBE4EF89314F14896DF959DB3A1DB30E945DB92

Function 00C51287 Relevance: .4, Instructions: 379COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8db6b4c7db5f97784a80f15b687025ec058e6c3025e7102d3aafc5b58ad8fc88
Instruction ID: 1db01cf74a842d457b3969627709de309f346143ad9a29aa4136e3e552bb1853
Opcode Fuzzy Hash: 8db6b4c7db5f97784a80f15b687025ec058e6c3025e7102d3aafc5b58ad8fc88
Instruction Fuzzy Hash: 83A1397C102585BED629BA2A4C8CF7F255CDB42347B1C011AFD22D1192DA249EC9F37D

Function 00C721C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 348fce67231e7e0514b7932cc69d5ed44c7f1e4b6ca3601af391cf7c851de175
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 27C196322051930ADF6E463EC47503EFBA15EA27B131E875DD8BBCB1D5EE20CA65D620

Function 00C725FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 2fee0fc2522c2bf2c4eabf730e24f9d82612d226aba1af1ea040dcf7b515febd
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 3AC186332051930ADF2E463EC43513EBBA15FA27B131E976DD8B6DB1D5EE20CA25D620

Function 00C71D90 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: f83f53c6054457e6be58e66e6979d1c82b2a3f8651791b143901220b60670df7
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: BAC167322051930ADF2E463E847513EFAA15EA27B131E875DDCBBDB1D4EE10CB65DA20

Function 00C71978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 2da361cbb85b8673568cb3b1acf026efec14cddf50d7cf48a9e0a90da1ec4325
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: BDC186322051930ADF2E463EC47513EBAA15EA27B131E975DDCBBDB1C4EE10CA25D610

Function 00C568DC Relevance: 18.3, APIs: 12, Instructions: 275
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wcsnicmp.LIBCMT ref: 00C56931
__wcsnicmp.LIBCMT ref: 00C56949
__wcsnicmp.LIBCMT ref: 00C56961
__wcsnicmp.LIBCMT ref: 00C56979
__wcsnicmp.LIBCMT ref: 00C56991
__wcsnicmp.LIBCMT ref: 00C569A9
__wcsnicmp.LIBCMT ref: 00C569C1
__wcsnicmp.LIBCMT ref: 00C569D5
__wcsnicmp.LIBCMT ref: 00C56A16
__wcsnicmp.LIBCMT ref: 00C56A2A
__wcsnicmp.LIBCMT ref: 00C56A3E
__wcsnicmp.LIBCMT ref: 00C56A52

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: __wcsnicmp
String ID:
API String ID: 1038674560-0
Opcode ID: 925611d6804fe502eb64822f337db5433ea1a7a143fe913b499dbfc23ac76dca
Instruction ID: 5ecd29b4efaacf4dff1b91d5a1812905541cfc0a2cd3e15eb9a254861703d09f
Opcode Fuzzy Hash: 925611d6804fe502eb64822f337db5433ea1a7a143fe913b499dbfc23ac76dca
Instruction Fuzzy Hash: 528126B4600205BACF20BA61EC42FAF7768AF15715F544025FC45AB192EB71DE89E3A8

Function 00CB449A Relevance: 18.2, APIs: 12, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 00CB4500
_wcscmp.LIBCMT ref: 00CB450B
_wcscat.LIBCMT ref: 00CB4521
_wcsstr.LIBCMT ref: 00CB452C
_wcscat.LIBCMT ref: 00CB4591
_wcscat.LIBCMT ref: 00CB4598
_wcsncpy.LIBCMT ref: 00CB45C3

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _wcscat$_wcscmp_wcscpy_wcsncpy_wcsstr
String ID:
API String ID: 3576275495-0
Opcode ID: f2dd82df36c9484ed452d294227e50002af446f68463c0679fc1068f518ba4c5
Instruction ID: ea3d8ac139e555186c5ad1e4d570c2cde8544f2dc491a66a9973bdc54c4a41d4
Opcode Fuzzy Hash: f2dd82df36c9484ed452d294227e50002af446f68463c0679fc1068f518ba4c5
Instruction Fuzzy Hash: 3C41E632904204BBDB24BB759C47FFF776CDF51710F14846AF909E6182EB349A01A7A9

Function 00C76E03 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00C76E3E

Part of subcall function 00C78B28: __getptd_noexit.LIBCMT ref: 00C78B28

__gmtime64_s.LIBCMT ref: 00C76ED7
__gmtime64_s.LIBCMT ref: 00C76F0D
__gmtime64_s.LIBCMT ref: 00C76F2A
__allrem.LIBCMT ref: 00C76F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C76F9C
__allrem.LIBCMT ref: 00C76FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C76FD1
__allrem.LIBCMT ref: 00C76FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C77006
__invoke_watson.LIBCMT ref: 00C77077

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: 654b2c65f2767f39b3204084eb5036e87c5f46407fda3d3b476b2ddd7a6a7139
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: 2E710776A00B17ABD714EE79DC81B9AB7A8AF04724F14C229F528E7681E770DE409790

Function 00CB9155 Relevance: 12.3, APIs: 8, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CB8F5F: __time64.LIBCMT ref: 00CB8F69

Part of subcall function 00C54EE5: _fseek.LIBCMT ref: 00C54EFD

__wsplitpath.LIBCMT ref: 00CB9234

Part of subcall function 00C740FB: __wsplitpath_helper.LIBCMT ref: 00C7413B

_wcscpy.LIBCMT ref: 00CB9247
_wcscat.LIBCMT ref: 00CB925A
__wsplitpath.LIBCMT ref: 00CB927F
_wcscat.LIBCMT ref: 00CB9295
_wcscat.LIBCMT ref: 00CB92A8

Part of subcall function 00CB8FA5: _memmove.LIBCMT ref: 00CB8FDE
Part of subcall function 00CB8FA5: _memmove.LIBCMT ref: 00CB8FED

_wcscmp.LIBCMT ref: 00CB91EF

Part of subcall function 00CB9734: _wcscmp.LIBCMT ref: 00CB9824
Part of subcall function 00CB9734: _wcscmp.LIBCMT ref: 00CB9837

_wcsncpy.LIBCMT ref: 00CB94C5

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _wcscat_wcscmp$__wsplitpath_memmove$__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 2744720387-0
Opcode ID: 399d582de9c20c8765367d64c56b1fa89cf83462de3145a455e9ac53565308cb
Instruction ID: 62dd192fdf32753b5c2ca9d9c07d3648b101bd15463f64d25702b532d34a64b4
Opcode Fuzzy Hash: 399d582de9c20c8765367d64c56b1fa89cf83462de3145a455e9ac53565308cb
Instruction Fuzzy Hash: 8AC14BB1D00219ABDF25DFA5CC85ADEB7BCEF45300F0040AAF609E6151DB309A88DF65

Function 00CABBAF Relevance: 12.1, APIs: 8, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memcmp.LIBCMT ref: 00CABBC4
_memcmp.LIBCMT ref: 00CABBE6
_memcmp.LIBCMT ref: 00CABBFE
_memcmp.LIBCMT ref: 00CABC11
_memcmp.LIBCMT ref: 00CABC2B
_memcmp.LIBCMT ref: 00CABC3E
_memcmp.LIBCMT ref: 00CABC56
_memcmp.LIBCMT ref: 00CABC71

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 69f4a9ee4471d3b742fe204232521a94e9e3c838df7205ae948ccdb36eb6070b
Instruction ID: d219ce41fcf5553a645d01acf2898b3401be637a4772c41da6e7d560be2ce7e0
Opcode Fuzzy Hash: 69f4a9ee4471d3b742fe204232521a94e9e3c838df7205ae948ccdb36eb6070b
Instruction Fuzzy Hash: 8F21F3716012077BEB046626AE42FFB775CAE1235CF188021FD0996687EBA8DF1192B5

Function 00CBC75C Relevance: 10.8, APIs: 7, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__swprintf.LIBCMT ref: 00CBC890
__swprintf.LIBCMT ref: 00CBC8D3

Part of subcall function 00C57DE1: _memmove.LIBCMT ref: 00C57E22

__swprintf.LIBCMT ref: 00CBC927

Part of subcall function 00C73698: __woutput_l.LIBCMT ref: 00C736F1

__swprintf.LIBCMT ref: 00CBC975

Part of subcall function 00C73698: __flsbuf.LIBCMT ref: 00C73713
Part of subcall function 00C73698: __flsbuf.LIBCMT ref: 00C7372B

__swprintf.LIBCMT ref: 00CBC9C4
__swprintf.LIBCMT ref: 00CBCA13
__swprintf.LIBCMT ref: 00CBCA62

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: __swprintf$__flsbuf$__woutput_l_memmove
String ID:
API String ID: 1085135966-0
Opcode ID: 08cbf9ea8a07e00e0847f29702dfc94e1c29246ef4a4e0b45be8a7287cd81770
Instruction ID: 1ed6a5bf547b96db922e8e5fbaf6d65fbf8b9d4b9a6068570ca9e128cdd7e3ff
Opcode Fuzzy Hash: 08cbf9ea8a07e00e0847f29702dfc94e1c29246ef4a4e0b45be8a7287cd81770
Instruction Fuzzy Hash: BAA12CB6408344ABC700EFA4C886DAFB7ECFF94701F40492DF99586191EB35DA48DB66

Function 00CAAED4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscmp.LIBCMT ref: 00CAAF29
_wcscmp.LIBCMT ref: 00CAAF8C
_wcsstr.LIBCMT ref: 00CAAF9D
_wcscmp.LIBCMT ref: 00CAAFE5
_wcscmp.LIBCMT ref: 00CAB065

Strings

@, xrefs: 00CAAEF9

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _wcscmp$_wcsstr
String ID: @
API String ID: 3312506106-2766056989
Opcode ID: 525916a8bc504fa4b13b14d336d007f5d6dda10833d5cc4250fb434a5272fc3c
Instruction ID: 9c29c9ea813d05fc9a2e03748af9c1b62a8871bae6739da33bef1b39b3fb8192
Opcode Fuzzy Hash: 525916a8bc504fa4b13b14d336d007f5d6dda10833d5cc4250fb434a5272fc3c
Instruction Fuzzy Hash: 9F81C2711082069FDB04DF50C885FAA7BE8FF45318F14856EFDA98A092DB34DE89DB61

Function 00CB64B8 Relevance: 9.2, APIs: 6, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memmove.LIBCMT ref: 00CB660B
_memmove.LIBCMT ref: 00CB6546

Part of subcall function 00C59837: __itow.LIBCMT ref: 00C59862
Part of subcall function 00C59837: __swprintf.LIBCMT ref: 00C598AC

_memmove.LIBCMT ref: 00CB65B9
_memmove.LIBCMT ref: 00CB66A0
_memmove.LIBCMT ref: 00CB66B9
_memmove.LIBCMT ref: 00CB66D5

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 7737c114a36851362f9cff69a5865d84050081a44473ada8722d867349a6da20
Instruction ID: fbcafbced950f7cac6c0405b0a75d3770c040b08287e2b7d052d4c2da8cd6404
Opcode Fuzzy Hash: 7737c114a36851362f9cff69a5865d84050081a44473ada8722d867349a6da20
Instruction Fuzzy Hash: D4618B3450065A9BCF11EF60CC82EFE37A5EF05308F048559FC696B292DB38AD59EB54

Function 00CB4CC1 Relevance: 9.2, APIs: 6, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscmp.LIBCMT ref: 00CB4D5A

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: 9f483328b87e2f9089392b2207326b9a11b8e00c1f4561b81bc0a43578ca8f4b
Instruction ID: 537652d47a7f9bd0c3c8e9b696274924afc6bef224320fd77141c624f2ee183a
Opcode Fuzzy Hash: 9f483328b87e2f9089392b2207326b9a11b8e00c1f4561b81bc0a43578ca8f4b
Instruction Fuzzy Hash: 895164B200C3859BC724DBA0D8919DFB3ECAF84351F00492EF589D3152EF35A689D76A

Function 00C59837 Relevance: 9.1, APIs: 6, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__itow.LIBCMT ref: 00C59862
__swprintf.LIBCMT ref: 00C598AC
__i64tow.LIBCMT ref: 00C8F5E6

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID:
API String ID: 421087845-0
Opcode ID: 7bcafa12e8cb9d546087ae0c13376f8b73a3c8d299bf9db3645951ad734d3080
Instruction ID: ec55572f518c0f99a6e0356b73a17f953cb9c63cf379ab1959f4a35ea7903cf3
Opcode Fuzzy Hash: 7bcafa12e8cb9d546087ae0c13376f8b73a3c8d299bf9db3645951ad734d3080
Instruction Fuzzy Hash: 37410475500205EFDB24EF74D842A7A77E8FF05304F3044BEE959D7281EA319A86DB24

Function 00CB55FD Relevance: 9.1, APIs: 6, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcsncpy.LIBCMT ref: 00CB563F
_wcsncpy.LIBCMT ref: 00CB5671
_wcsncpy.LIBCMT ref: 00CB56A4
_wcsncpy.LIBCMT ref: 00CB56E6
_wcsncpy.LIBCMT ref: 00CB5720
_wcsncpy.LIBCMT ref: 00CB574F

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _wcsncpy
String ID:
API String ID: 1735881322-0
Opcode ID: 07e0947fe95a8180eaf0aa6e348e8d9897622cda980e67335bb2af8a3bf9752e
Instruction ID: 0044b740244ef4e76c3341f7d2cbc3f6163b9cbf5a2ad1fac5fad81c3dd623ac
Opcode Fuzzy Hash: 07e0947fe95a8180eaf0aa6e348e8d9897622cda980e67335bb2af8a3bf9752e
Instruction Fuzzy Hash: 07419176C1065476CB11EBB48C86ACFB3B8AF04310F50C966F91DE3221EB34A355D7AA

Function 00C79AE6 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00C79AE6

Part of subcall function 00C73187: __initp_misc_winsig.LIBCMT ref: 00C731A5

__mtinitlocks.LIBCMT ref: 00C79AEB
__mtterm.LIBCMT ref: 00C79AF4

Part of subcall function 00C79B5C: _free.LIBCMT ref: 00C79C5D

__calloc_crt.LIBCMT ref: 00C79B19
__initptd.LIBCMT ref: 00C79B3B

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: __calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 206718379-0
Opcode ID: 077d5c0f99fda34c06fd1b26cca46798951cce19c7061b0ffca82948e383fe55
Instruction ID: f858f817bc1eb7984bd7910209a888ce54e9e82b34fe06d2ba6edb8e9f05d27e
Opcode Fuzzy Hash: 077d5c0f99fda34c06fd1b26cca46798951cce19c7061b0ffca82948e383fe55
Instruction Fuzzy Hash: 23F0BE3261A7116BE6347B76BC07A8A3795DF02730F20CA2AF46DD61D2FF30894162B4

Function 00CBA1EF Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00CBA231
_memset.LIBCMT ref: 00CBA2B2
_wcsncpy.LIBCMT ref: 00CBA2EE

Strings

:, xrefs: 00CBA252
\, xrefs: 00CBA247

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: __swprintf_memset_wcsncpy
String ID: :$\
API String ID: 214737766-1166558509
Opcode ID: f5c4c2d66afbbd10ee5f85d9a25c73fd31d49a88663bd8fadf72adc8619a6d0a
Instruction ID: e4bf016a338c6f97b2260e4f33a2d1925cab979e18289eb81f28aa31f5c86eff
Opcode Fuzzy Hash: f5c4c2d66afbbd10ee5f85d9a25c73fd31d49a88663bd8fadf72adc8619a6d0a
Instruction Fuzzy Hash: 21319EB1904109ABDB219FA0DC49FEF77BCEF88740F1045BAF919D6160EB7097448B29

Function 00CAA439 Relevance: 7.8, APIs: 5, Instructions: 273COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00CAA51B
_wcscmp.LIBCMT ref: 00CAA52E
_wcscmp.LIBCMT ref: 00CAA5BF
_wcscmp.LIBCMT ref: 00CAA731
_wcscmp.LIBCMT ref: 00CAA76B

Part of subcall function 00C7362C: _iswctype.LIBCMT ref: 00C73634

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _wcscmp$__swprintf_iswctype
String ID:
API String ID: 3564621516-0
Opcode ID: 22f345dc1749fc61d738452cff1ec01fec5d702c3361f6a434a16c0623e3483b
Instruction ID: ab5fba402ea5039d23047c9d2ac4e726e004a868fa9ed0e25fbdbae98c1257fa
Opcode Fuzzy Hash: 22f345dc1749fc61d738452cff1ec01fec5d702c3361f6a434a16c0623e3483b
Instruction Fuzzy Hash: 68A1B171204707BFD715DF60C884BAAB7E8FF45318F108629F9A9D2190DB30EA56DB92

Function 00C7541D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C7547B
_memcpy_s.LIBCMT ref: 00C754ED
__read_nolock.LIBCMT ref: 00C7554B
__filbuf.LIBCMT ref: 00C7556E
_memset.LIBCMT ref: 00C755B2

Part of subcall function 00C78B28: __getptd_noexit.LIBCMT ref: 00C78B28

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 5f1ff27ecb40ff672c6b963bdcbb91b938089e4726130bfa6a2e3a5f931ee01a
Instruction ID: c6f16bf4249fbdecc0330c4e80e89a8c1c8045d349c36f8933577944d8b6a37a
Opcode Fuzzy Hash: 5f1ff27ecb40ff672c6b963bdcbb91b938089e4726130bfa6a2e3a5f931ee01a
Instruction Fuzzy Hash: 3E51C470A00B05DBCB649FA9D88066E7BA6EF40325F24C729F83D962D0D7B09E909B41

Function 00CB46B7 Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00CB4721
_memmove.LIBCMT ref: 00CB4734
_strcat.LIBCMT ref: 00CB474D
_wcscpy.LIBCMT ref: 00CB4764
_wcscpy.LIBCMT ref: 00CB4780

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _wcscpy$_memmove_strcat
String ID:
API String ID: 559723171-0
Opcode ID: de56ce9617f3aca52c0813d3aa7d2567c867b191378b8155293d27d06681c82b
Instruction ID: bd96c85fb3a5e0fe4851dc302e280b640d478368418776c0b0a4f4f6ad52d5dc
Opcode Fuzzy Hash: de56ce9617f3aca52c0813d3aa7d2567c867b191378b8155293d27d06681c82b
Instruction Fuzzy Hash: 61112731504104AFDB24AB309C46EEE77BCEF12711F1041BAF459A6092FF748AC5DB54

Function 00CABC9E Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00CABCB3
_memcmp.LIBCMT ref: 00CABCD1
_memcmp.LIBCMT ref: 00CABCE4
_memcmp.LIBCMT ref: 00CABCFC
_memcmp.LIBCMT ref: 00CABD14

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 7c26e2e8b89362a653cc0400413d5b10d698c9d03250d8de96d81db894dbabbb
Instruction ID: cc31dd96d6097e34da7cd6e328f1ce328a6299a0f564259fd3f16ff1bffc9b05
Opcode Fuzzy Hash: 7c26e2e8b89362a653cc0400413d5b10d698c9d03250d8de96d81db894dbabbb
Instruction Fuzzy Hash: BF01B5716001067FD7046A1A9E42FBBB75CDE1239CF188021FD1997247EB54EE10A2A4

Function 00C56A8C Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 478COMMON

Download Yara Rule

Strings

EA06, xrefs: 00C8E452
AU3!, xrefs: 00C56B61

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _iswctype_wcscpy
String ID: AU3!$EA06
API String ID: 2497406411-2658333250
Opcode ID: 4781125ca166825588d68b5edf5b5f887c139103f418c94bf321b8132ec7d7c5
Instruction ID: a7e6fed446e1af4814f9da533dafb03092f9be98cf78d3c10e940551ccdb2b8c
Opcode Fuzzy Hash: 4781125ca166825588d68b5edf5b5f887c139103f418c94bf321b8132ec7d7c5
Instruction Fuzzy Hash: 2502BF341083419FC724EF20C8919AFBBF5EF95318F50491DF89A972A1DB30DA89DB5A

Function 00CBEB23 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00C59837: __itow.LIBCMT ref: 00C59862
Part of subcall function 00C59837: __swprintf.LIBCMT ref: 00C598AC

Part of subcall function 00C6FC86: _wcscpy.LIBCMT ref: 00C6FCA9

_wcstok.LIBCMT ref: 00CBEC94
_wcscpy.LIBCMT ref: 00CBED23
_memset.LIBCMT ref: 00CBED56

Strings

X, xrefs: 00CBED93

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 5f63eabd900585ca30706693ede9ba4275561f5c38432772f56cd3c6626f7487
Instruction ID: 5c2762c8fe1f58a8c51be0be7b59ae801cd5dcade5f0c1babaa704fc0275c5a7
Opcode Fuzzy Hash: 5f63eabd900585ca30706693ede9ba4275561f5c38432772f56cd3c6626f7487
Instruction Fuzzy Hash: 22C18075508740DFC724EF24D841AAAB7E4FF85310F14492DF8999B2A2DB30ED89DB86

Function 00C62CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00C70DB6: std::exception::exception.LIBCMT ref: 00C70DEC
Part of subcall function 00C70DB6: __CxxThrowException@8.LIBCMT ref: 00C70E01

Part of subcall function 00C57DE1: _memmove.LIBCMT ref: 00C57E22

Part of subcall function 00C57A51: _memmove.LIBCMT ref: 00C57AAB

__swprintf.LIBCMT ref: 00C62ECD

Strings

(+I, xrefs: 00C62EF4, 00C62F51, 00C62EF8

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: (+I
API String ID: 1943609520-2960116247
Opcode ID: 21f521673211c63e055d0da72932523ff923a3a2e42963ed3dbe2612b8802916
Instruction ID: 709b0698b890688db85eb900156806f48b0d080a0e72773b0e5f4ebe772ee47c
Opcode Fuzzy Hash: 21f521673211c63e055d0da72932523ff923a3a2e42963ed3dbe2612b8802916
Instruction Fuzzy Hash: A591AF751087019FCB24EF24D885C6FB7A8EF95311F00491DF8959B2A1EB30EE88EB56

Function 00C63137 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C63277
_memmove.LIBCMT ref: 00C63310
_free.LIBCMT ref: 00C63336
_memmove.LIBCMT ref: 00C633E9

Strings

3cA, xrefs: 00C6323F

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _memmove$_free
String ID: 3cA
API String ID: 2620147621-2523384761
Opcode ID: 1b99c16daf26ba05b26fd3cba724ea838179ea068b8530a01c401a2aae47b380
Instruction ID: d390a38749f103509c7759483d6f52130c3e25163794905ec5ea3e54be60e155
Opcode Fuzzy Hash: 1b99c16daf26ba05b26fd3cba724ea838179ea068b8530a01c401a2aae47b380
Instruction Fuzzy Hash: CE515A716083818FDB35CF28C880B6EBBE5EF85314F04882DE99997351DB31EA41CB42

Function 00C66192 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C66248
_memmove.LIBCMT ref: 00C662E4
_memset.LIBCMT ref: 00C66308

Strings

ERCP, xrefs: 00C661B3

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: f26897e622874a94d3a5be45ebb38ce857f1f7ed6e3ab2c2ed74d649e7167b68
Instruction ID: 4dbcc8559c91dd23c47d35f76225110b7c814faec136d8ce06c37a036473ce94
Opcode Fuzzy Hash: f26897e622874a94d3a5be45ebb38ce857f1f7ed6e3ab2c2ed74d649e7167b68
Instruction Fuzzy Hash: F951AF71A00706DBDB24CF65C985BAABBE8EF04304F20857EE95ADB251E770EA44CB50

Function 00CDB635 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CDB644
_memset.LIBCMT ref: 00CDB653

Strings

doL, xrefs: 00CDB64D
oL, xrefs: 00CDB63E

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _memset
String ID: oL$doL
API String ID: 2102423945-3421622115
Opcode ID: f6592324f54b6d11ff0072cf87150bc2a8f8a0fa5e3a8a7e269d397b8f6a706e
Instruction ID: 30ec9ee8f6885bece9ac25b6ee260e45bd0cfb8f82f7232f7f5a284dc870832d
Opcode Fuzzy Hash: f6592324f54b6d11ff0072cf87150bc2a8f8a0fa5e3a8a7e269d397b8f6a706e
Instruction Fuzzy Hash: D0F05EB2540300BAE2502761BC06FBB3A9CEB08395F01C439BA08E5192D7759C00C7AC

Function 00CBD899 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00CBDA10
_wcscat.LIBCMT ref: 00CBDA28
_wcscat.LIBCMT ref: 00CBDA3A

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _wcscat$__wsplitpath
String ID:
API String ID: 1413645957-0
Opcode ID: 188660a599668010583c76a9614ab57aaee43a98a951f5589b54779c745aba27
Instruction ID: c2d1fcf3239a6c2b85defea2a88c62b9f299b403a0949e604ae07178e0240b9a
Opcode Fuzzy Hash: 188660a599668010583c76a9614ab57aaee43a98a951f5589b54779c745aba27
Instruction Fuzzy Hash: BE81B3719043009FCB24EF65C8449EAB7E4EF89310F18882EF89AC7251EB35DA84DB52

Function 00CBDC1A Relevance: 6.2, APIs: 4, Instructions: 185COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00CBDD56
_wcscat.LIBCMT ref: 00CBDD6E
_wcscat.LIBCMT ref: 00CBDD80
_wcscpy.LIBCMT ref: 00CBDE08

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _wcscat$__wsplitpath_wcscpy
String ID:
API String ID: 3240238573-0
Opcode ID: 4f4890e2e2a3eabc3efe22c229ca72d21f946308a6877a74bd565c218d50dfe6
Instruction ID: febf2d6456cd82d3c8d5d3cd102b1727bc9ed2b6ac97e38146433ae2fd76dfbe
Opcode Fuzzy Hash: 4f4890e2e2a3eabc3efe22c229ca72d21f946308a6877a74bd565c218d50dfe6
Instruction Fuzzy Hash: 67617B765043459FCB10EF20C8449EEB7E8FF89314F04496DF99A87251EB31EA49CB96

Function 00CB9E4A Relevance: 6.2, APIs: 4, Instructions: 156COMMON

Download Yara Rule

APIs

Part of subcall function 00C57DE1: _memmove.LIBCMT ref: 00C57E22

__swprintf.LIBCMT ref: 00CB9F0C
__swprintf.LIBCMT ref: 00CB9F25
_wprintf.LIBCMT ref: 00CB9FDB
_wprintf.LIBCMT ref: 00CB9FF9

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: __swprintf_wprintf$_memmove
String ID:
API String ID: 2249476411-0
Opcode ID: caf2c998783c6d6a87866aef771a2fbcf86fc1c5da1596bf467658d350e7574b
Instruction ID: 66951260da8f90b16d39e1c8b28827aabda28f7b64e4f7656af7daac2d80e10c
Opcode Fuzzy Hash: caf2c998783c6d6a87866aef771a2fbcf86fc1c5da1596bf467658d350e7574b
Instruction Fuzzy Hash: D5517E71900509ABCF15EBE0DD46EEEB778EF04301F204165B905721A2EB316F99EB69

Function 00CB955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00C54EE5: _fseek.LIBCMT ref: 00C54EFD

Part of subcall function 00CB9734: _wcscmp.LIBCMT ref: 00CB9824
Part of subcall function 00CB9734: _wcscmp.LIBCMT ref: 00CB9837

_free.LIBCMT ref: 00CB96A2
_free.LIBCMT ref: 00CB96A9
_free.LIBCMT ref: 00CB9714
_free.LIBCMT ref: 00CB971C

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _free$_wcscmp$_fseek
String ID:
API String ID: 3404660211-0
Opcode ID: 8c66bba008aa022ea217763876d92d68911b16dfe2cdbb3685ec8a45d3e1b5f3
Instruction ID: f42b6d931b29af01c464dc5c0ecce6b9c3fdb6cdea7eb5994a005dd70b5c64c1
Opcode Fuzzy Hash: 8c66bba008aa022ea217763876d92d68911b16dfe2cdbb3685ec8a45d3e1b5f3
Instruction Fuzzy Hash: BE517CB1D04218ABDF289FA4CC85ADEBBB9EF48300F10419EF60DA3241DB715A84DF58

Function 00CB9C38 Relevance: 6.2, APIs: 4, Instructions: 150COMMON

Download Yara Rule

APIs

Part of subcall function 00C57DE1: _memmove.LIBCMT ref: 00C57E22

__swprintf.LIBCMT ref: 00CB9CF9
__swprintf.LIBCMT ref: 00CB9D12
_wprintf.LIBCMT ref: 00CB9DB9
_wprintf.LIBCMT ref: 00CB9DD7

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: __swprintf_wprintf$_memmove
String ID:
API String ID: 2249476411-0
Opcode ID: 3b826556c743c12135e1125909714c24acfff879d9fb167c7e2db4d00805d54e
Instruction ID: 41ac5172d25352c5ed88f8b3d765243904e0a600938376b99688d4c87d26765b
Opcode Fuzzy Hash: 3b826556c743c12135e1125909714c24acfff879d9fb167c7e2db4d00805d54e
Instruction Fuzzy Hash: FA518071900509ABCF14EBE0DD46EEEB778EF14301F604165F909721A2EB352F99EB68

Function 00C7470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C747A0
__flush.LIBCMT ref: 00C747C0
__write.LIBCMT ref: 00C747F3
__flsbuf.LIBCMT ref: 00C74821

Part of subcall function 00C78B28: __getptd_noexit.LIBCMT ref: 00C78B28

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 8d5e84d796d2a622fb585a85b2cb739199fd67226ed781522a47284023b78b74
Instruction ID: 3d7223854d1d90362120e5e87c300726f3452f9f14cd9a956529d4adc2ff9d95
Opcode Fuzzy Hash: 8d5e84d796d2a622fb585a85b2cb739199fd67226ed781522a47284023b78b74
Instruction Fuzzy Hash: 5C41B775A007499BDB1CCF69C8809AE77A6EF46364B24C53DE82DCB680DB70DE41CB41

Function 00C88F37 Relevance: 6.1, APIs: 4, Instructions: 130COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C78B28: __getptd_noexit.LIBCMT ref: 00C78B28

__getbuf.LIBCMT ref: 00C88FD1
__write.LIBCMT ref: 00C88FFF
__lseeki64.LIBCMT ref: 00C89043
__write.LIBCMT ref: 00C89072

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: __write$__getbuf__getptd_noexit__lseeki64
String ID:
API String ID: 4182129353-0
Opcode ID: b77aae38ed6e34726ab9f9f279fa09a21295c2db3db9c1ce0869ba17ac253568
Instruction ID: 1f2d3ff078937c3ec072b98900bb0e989b85871851e7633a98456ef2ce918842
Opcode Fuzzy Hash: b77aae38ed6e34726ab9f9f279fa09a21295c2db3db9c1ce0869ba17ac253568
Instruction Fuzzy Hash: B9411871100B019FD334AF69C881A7A77E5EF45328F08C61DE6BA8B6D1DB74E9409B58

Function 00CBEF95 Relevance: 6.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00CBEFCB
_wcscmp.LIBCMT ref: 00CBEFE2
_wcscmp.LIBCMT ref: 00CBF074
_wcscmp.LIBCMT ref: 00CBF08B

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: 6ca42bdee5e764a2d4c938babfd9147ccfee36eb28773e9f100ec5c7d0d625b2
Instruction ID: c207347f39e469d827635dbb9332f51e099ad4236727282cfe2d79c352e78387
Opcode Fuzzy Hash: 6ca42bdee5e764a2d4c938babfd9147ccfee36eb28773e9f100ec5c7d0d625b2
Instruction Fuzzy Hash: 2B31F3325002186ADF14FFB4EC48AEE77AC9F48360F1045BAE814E21A1DB75DB85DB69

Function 00CBF0F2 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00CBF128
_wcscmp.LIBCMT ref: 00CBF13F
_wcscmp.LIBCMT ref: 00CBF1BC
_wcscmp.LIBCMT ref: 00CBF1D3

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: 5e4c1ca136502ca1550e0c7352cbc5842e7fcfe98f56b9ff86b85f6952a77760
Instruction ID: 5406df75b77cc38f84dd9d83ec6f8c1b79de7a02d5a30eb6f83d9c0e6e04b7b9
Opcode Fuzzy Hash: 5e4c1ca136502ca1550e0c7352cbc5842e7fcfe98f56b9ff86b85f6952a77760
Instruction Fuzzy Hash: 6C31E7365002197ADF14AFB4EC49BEE77AC9F45360F200579E824E21A0DB31DF46DB69

Function 00C86FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00C86FDB

Part of subcall function 00C876C2: __fltout2.LIBCMT ref: 00C876EB

__cftog_l.LIBCMT ref: 00C87001
__cftoe_l.LIBCMT ref: 00C87033

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: c9bcdafa2dda591dfdd0374f0b62248d9ea36421bb063f7943ebe4283ea40cb4
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: EF014E7244814ABBCF166F84CC45CED3F62BB18359B698615FA2859031E336CAB1BB85

Function 00CCAEA2 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 00CCAFAE

Strings

xbL, xrefs: 00CCAFE4
xbL, xrefs: 00CCB010

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: __itow_s
String ID: xbL$xbL
API String ID: 3653519197-3351732020
Opcode ID: d646e4bb21cf180c2b3bcf2ba2aa6e399e6fdbde90ff57f1201e620ffab942ef
Instruction ID: a084054dc5c76ca481a99dce5e0be48c2846176ef6ea8423cf21be52714302f4
Opcode Fuzzy Hash: d646e4bb21cf180c2b3bcf2ba2aa6e399e6fdbde90ff57f1201e620ffab942ef
Instruction Fuzzy Hash: 02B16B74A00209AFCB14DF95C895EAEBBB9FF58300F14805DF9459B291EB30EE85DB64

Function 00CA8310 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 224COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CA8353

Strings

, xrefs: 00CA8362

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-3916222277
Opcode ID: aa973d33a02bfa199831d235f317d3626315b443824ea58ce6c4261de3f61784
Instruction ID: 0eb2fae853032d68aa8bd5daf7ff46166d195de61ca540e1923d67dbaf3e01a5
Opcode Fuzzy Hash: aa973d33a02bfa199831d235f317d3626315b443824ea58ce6c4261de3f61784
Instruction Fuzzy Hash: 30816D71D0020AAFEF119FA4CC45AEE7BB9FF09308F144169FD24A6161DB319E19EB24

Function 00C5708B Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_wcscat.LIBCMT ref: 00C8E9A0

Strings

\, xrefs: 00C8E9C3

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _wcscat
String ID: \
API String ID: 2563891980-2967466578
Opcode ID: 37f8556a626ae037f6edf7abe1d4f3c4d2ba69555b9a07e1d7be78a4c2c9eb1a
Instruction ID: daded4130ba34010a89e51b35c424e7155d9c7652a6c66b426d20cfcbc2844f3
Opcode Fuzzy Hash: 37f8556a626ae037f6edf7abe1d4f3c4d2ba69555b9a07e1d7be78a4c2c9eb1a
Instruction Fuzzy Hash: 57719D751083019EC340FF65E841DAFBBE8FF94350B51893EF845871A0EB719988DB5A

Function 00CCF41E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CCF448
_memset.LIBCMT ref: 00CCF511

Part of subcall function 00C59837: __itow.LIBCMT ref: 00C59862
Part of subcall function 00C59837: __swprintf.LIBCMT ref: 00C598AC

Part of subcall function 00C6FC86: _wcscpy.LIBCMT ref: 00C6FCA9

Strings

@, xrefs: 00CCF525

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _memset$__itow__swprintf_wcscpy
String ID: @
API String ID: 2523036003-2766056989
Opcode ID: fc9b12f333b0dcf5a4b7df1c92d6160ab3b60f831e68bfb17c9988c3f6607c25
Instruction ID: f96e32a1a0c1ee0774de5729a60519a2bcb4defcae52521df76357b5d80200c5
Opcode Fuzzy Hash: fc9b12f333b0dcf5a4b7df1c92d6160ab3b60f831e68bfb17c9988c3f6607c25
Instruction Fuzzy Hash: 15618075A00619DFCB14DF54C881AAEBBF5FF49310F14806DE855AB351CB30AE46DB94

Function 00CD7152 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CD716A

Strings

0, xrefs: 00CD7160
F, xrefs: 00CD7262

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: _memset
String ID: 0$F
API String ID: 2102423945-3044882817
Opcode ID: 8d361ed52167b8eab7a66d10bcbcea6876906ccdec482831028141534145e52f
Instruction ID: 504db13b6ac27d7e494d6403d5001a4c402a64b2db241b5517d4aa51ed586fb4
Opcode Fuzzy Hash: 8d361ed52167b8eab7a66d10bcbcea6876906ccdec482831028141534145e52f
Instruction Fuzzy Hash: E1417B74A01205EFDB20DF64D884E9ABBF5FF09310F144529FA15A7361E731AA24CFA4

Function 00C76B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00C76B93
__calloc_crt.LIBCMT ref: 00C76BAC

Strings

K, xrefs: 00C76BD1

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: __calloc_crt
String ID: K
API String ID: 3494438863-4153964727
Opcode ID: fc675e1694061d9c38afe518b907dae0cef97e15bff182515fce2e9d9647b47a
Instruction ID: 614ad17d53b45e796259f3f96909aeda50628ce3013140682530f75911336c02
Opcode Fuzzy Hash: fc675e1694061d9c38afe518b907dae0cef97e15bff182515fce2e9d9647b47a
Instruction Fuzzy Hash: 33F0C871204E128BF7A48F15BC51F9667D4E741330F508066F209CE180EB3099C16AD8

Function 00C79B79 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00C79B94

Part of subcall function 00C79C0B: __mtinitlocknum.LIBCMT ref: 00C79C1D

__updatetlocinfoEx_nolock.LIBCMT ref: 00C79BA4

Part of subcall function 00C79100: ___addlocaleref.LIBCMT ref: 00C7911C
Part of subcall function 00C79100: ___removelocaleref.LIBCMT ref: 00C79127
Part of subcall function 00C79100: ___freetlocinfo.LIBCMT ref: 00C7913B

Strings

8K, xrefs: 00C79B85

Memory Dump Source

Source File: 00000000.00000002.1568277658.0000000000C51000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C50000, based on PE: true

Associated: 00000000.00000002.1568253148.0000000000C50000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000CDF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568345180.0000000000D04000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D0E000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568392013.0000000000D12000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1568439264.0000000000D17000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c50000_kQibsaGS2E.jbxd

Similarity

API ID: Ex_nolock___addlocaleref___freetlocinfo___removelocaleref__lock__mtinitlocknum__updatetlocinfo
String ID: 8K
API String ID: 3369060592-2802361588
Opcode ID: d41c92ecd1d7e74e0adb9f475a826e210c9bd16fdcadbad4fdccb8f20f9f3334
Instruction ID: ae1a57ae6b64cace8a264f5fde871176aefc6f4d44a49c6ab8a524ad52019f47
Opcode Fuzzy Hash: d41c92ecd1d7e74e0adb9f475a826e210c9bd16fdcadbad4fdccb8f20f9f3334
Instruction Fuzzy Hash: 4DE08C3198B301ABEA64FBA9A907BCD2660DB81B21F20826AF15D550C1CE782500A66F

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report kQibsaGS2E.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_kQibsaGS2E.exe_f12af879545b8ce419ab756d07e8ef81bff6cfd_58958fe6_64b5c7c7-0e96-4516-9030-0e6ce3b40438\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER459.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER574.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D2.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Windows Analysis Report
kQibsaGS2E.exe

Function 00C77DCD Relevance: 1.5, APIs: 1, Instructions: 2
COMMON

Function 00C65760 Relevance: 11.0, APIs: 7, Instructions: 532
COMMON

Function 00C63030 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 587
COMMON

Function 00C568DC Relevance: 18.3, APIs: 12, Instructions: 275
COMMON

Function 00CB449A Relevance: 18.2, APIs: 12, Instructions: 179
COMMON

Function 00C76E03 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Function 00CB9155 Relevance: 12.3, APIs: 8, Instructions: 322
COMMON

Function 00CABBAF Relevance: 12.1, APIs: 8, Instructions: 92
COMMON

Function 00CBC75C Relevance: 10.8, APIs: 7, Instructions: 280
COMMON

Function 00CAAED4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 249
COMMON

Function 00CB64B8 Relevance: 9.2, APIs: 6, Instructions: 205
COMMON

Function 00CB4CC1 Relevance: 9.2, APIs: 6, Instructions: 170
COMMON

Function 00C59837 Relevance: 9.1, APIs: 6, Instructions: 146
COMMON

Function 00CB55FD Relevance: 9.1, APIs: 6, Instructions: 138
COMMON