Edit tour

Windows Analysis Report
uo9m.exe

Overview

General Information

Sample name:	uo9m.exe
Analysis ID:	1590280
MD5:	a83802ca265a8d7d66f7307bf4f16367
SHA1:	0d4d784f97301527064dc66420cc136132df3337
SHA256:	cfab22760406b5b89f3f810702fd736306caa091dba036b8b9ffe206f415e794
Infos:

Detection

LummaC

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Suricata IDS alerts for network traffic

LummaC encrypted strings found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Contains functionality to call native functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

uo9m.exe (PID: 7412 cmdline: "C:\Users\user\Desktop\uo9m.exe" MD5: A83802CA265A8D7D66F7307BF4F16367)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T21:49:35.327874+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	23.197.127.21	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T21:49:35.950360+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49731	23.197.127.21	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://littlenotii.biz/api	Avira URL Cloud: Label: malware
Source: https://truculengisau.biz/api	Avira URL Cloud: Label: malware
Source: https://misha-lomonosov.com/2	Avira URL Cloud: Label: malware
Source: https://fraggielek.biz/apiMr	Avira URL Cloud: Label: malware
Source: https://misha-lomonosov.com/api	Avira URL Cloud: Label: malware
Source: https://spookycappy.biz/apii	Avira URL Cloud: Label: malware
Source: https://punishzement.biz/api	Avira URL Cloud: Label: malware
Source: https://marketlumpe.biz/api5t	Avira URL Cloud: Label: malware
Source: https://misha-lomonosov.com/	Avira URL Cloud: Label: malware

Source: C:\Users\user\Desktop\uo9m.exe

Code function: 0_2_00D3AE60 BCryptGenRandom,SystemFunction036,

0_2_00D3AE60

Source: uo9m.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: unknown

HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: uo9m.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D7E620 CloseHandle,memset,FindFirstFileExW,FindClose,		0_2_00D7E620
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D7CEA0 memcpy,memcpy,memset,FindFirstFileExW,memcpy,GetLastError,FindClose,DeleteFileW,GetLastError,		0_2_00D7CEA0

Source: C:\Users\user\Desktop\uo9m.exe	Code function: 4x nop then push ebp		0_2_00D34018
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 4x nop then push ebp		0_2_00D34112

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49731 -> 23.197.127.21:443

Source: Joe Sandbox View

IP Address: 23.197.127.21 23.197.127.21

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 23.197.127.21:443

Source: global traffic

HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\uo9m.exe

Code function: 0_2_00D807B0 recv,WSAGetLastError,

0_2_00D807B0

Source: global traffic

Source: uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: vContent-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=6ea142275864432a1ee55dcb; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35141Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 13 Jan 2025 20:49:35 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: truculengisau.biz
Source: global traffic	DNS traffic detected: DNS query: fraggielek.biz
Source: global traffic	DNS traffic detected: DNS query: grandiouseziu.biz
Source: global traffic	DNS traffic detected: DNS query: littlenotii.biz
Source: global traffic	DNS traffic detected: DNS query: marketlumpe.biz
Source: global traffic	DNS traffic detected: DNS query: nuttyshopr.biz
Source: global traffic	DNS traffic detected: DNS query: punishzement.biz
Source: global traffic	DNS traffic detected: DNS query: spookycappy.biz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: misha-lomonosov.com

Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: uo9m.exe, 00000000.00000002.2196703768.0000000003281000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: uo9m.exe, 00000000.00000002.2196703768.0000000003281000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: uo9m.exe, 00000000.00000002.2196703768.0000000003281000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923894784.0000000003268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=SCXpgixTDzt4&a
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=M_FULq_A
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=BFN_
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=iUcMsAN_acD6&l=e
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: uo9m.exe	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000734000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923931265.0000000000732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fraggielek.biz/apiMr
Source: uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000734000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923931265.0000000000732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://littlenotii.biz/api
Source: uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000734000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923931265.0000000000732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marketlumpe.biz/api5t
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: uo9m.exe, 00000000.00000003.1923931265.0000000000771000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://misha-lomonosov.com/
Source: uo9m.exe, 00000000.00000003.1923931265.0000000000771000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://misha-lomonosov.com/2
Source: uo9m.exe, 00000000.00000003.1923931265.0000000000771000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://misha-lomonosov.com/api
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000734000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923931265.0000000000732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://punishzement.biz/api
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000734000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923931265.0000000000732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spookycappy.biz/apii
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923931265.0000000000732000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000734000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923931265.0000000000732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/%s
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: uo9m.exe, 00000000.00000002.2196703768.0000000003281000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: uo9m.exe, 00000000.00000003.1923931265.000000000073D000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2195643216.0000000000688000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2195786323.000000000073D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: uo9m.exe, 00000000.00000002.2195643216.0000000000688000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900#
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923894784.0000000003268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: uo9m.exe, 00000000.00000003.1923931265.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: uo9m.exe, 00000000.00000003.1923931265.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: uo9m.exe, 00000000.00000002.2196703768.0000000003281000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000734000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923931265.0000000000732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://truculengisau.biz/api
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown

HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D27F50 memset,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,AddVectoredExceptionHandler,RtlAddVectoredExceptionHandler,NtQueryInformationProcess,NtQuerySystemInformation,NtOpenThread,NtGetContextThread,NtSetContextThread,NtClose,	0_2_00D27F50
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D7C080 NtOpenFile,RtlNtStatusToDosError,NtOpenFile,RtlNtStatusToDosError,	0_2_00D7C080
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D6C2AE NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,	0_2_00D6C2AE
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D6C80E NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,	0_2_00D6C80E
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D7F651 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,ReadFile,GetLastError,	0_2_00D7F651
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D7D750 GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,NtOpenFile,SetFileInformationByHandle,CloseHandle,GetLastError,SetFileInformationByHandle,GetLastError,CloseHandle,SwitchToThread,RtlNtStatusToDosError,NtOpenFile,RtlNtStatusToDosError,CloseHandle,SwitchToThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,DeviceIoControl,GetLastError,CloseHandle,memcpy,CloseHandle,CloseHandle,	0_2_00D7D750

Source: C:\Users\user\Desktop\uo9m.exe

Code function: 0_2_00D7EE00: memmove,DeviceIoControl,CloseHandle,GetLastError,

0_2_00D7EE00

Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D221E0	0_2_00D221E0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DB0190	0_2_00DB0190
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DBC1A0	0_2_00DBC1A0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D24160	0_2_00D24160
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DD2110	0_2_00DD2110
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2C2E0	0_2_00D2C2E0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D40290	0_2_00D40290
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D8C2B0	0_2_00D8C2B0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2C2BB	0_2_00D2C2BB
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DD4260	0_2_00DD4260
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D4E3F0	0_2_00D4E3F0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DB2370	0_2_00DB2370
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DCA370	0_2_00DCA370
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DAC5E0	0_2_00DAC5E0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D705A0	0_2_00D705A0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D36540	0_2_00D36540
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D5E6C9	0_2_00D5E6C9
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DA0684	0_2_00DA0684
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D26640	0_2_00D26640
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DB2610	0_2_00DB2610
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D347F0	0_2_00D347F0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DB87E0	0_2_00DB87E0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DC08D0	0_2_00DC08D0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DBC850	0_2_00DBC850
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D76840	0_2_00D76840
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DC2870	0_2_00DC2870
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DAE980	0_2_00DAE980
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DB2980	0_2_00DB2980
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D40940	0_2_00D40940
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D98964	0_2_00D98964
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DB8AB0	0_2_00DB8AB0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DC6A40	0_2_00DC6A40
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DCAA70	0_2_00DCAA70
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D88B10	0_2_00D88B10
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2EB00	0_2_00D2EB00
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DCEB01	0_2_00DCEB01
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D78CFE	0_2_00D78CFE
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DC6C90	0_2_00DC6C90
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DB2C50	0_2_00DB2C50
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DB0C00	0_2_00DB0C00
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D70DC1	0_2_00D70DC1
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2EDB0	0_2_00D2EDB0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D9EFBC	0_2_00D9EFBC
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2EF20	0_2_00D2EF20
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DA8F20	0_2_00DA8F20
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D510E0	0_2_00D510E0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D41080	0_2_00D41080
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D390B0	0_2_00D390B0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DB3040	0_2_00DB3040
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D8F02E	0_2_00D8F02E
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DA719E	0_2_00DA719E
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DB5260	0_2_00DB5260
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2B3D0	0_2_00D2B3D0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2B3E9	0_2_00D2B3E9
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DC5380	0_2_00DC5380
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D953B0	0_2_00D953B0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D83374	0_2_00D83374
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2B49D	0_2_00D2B49D
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DB74A1	0_2_00DB74A1
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2B45F	0_2_00D2B45F
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2B440	0_2_00D2B440
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2B47E	0_2_00D2B47E
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2B402	0_2_00D2B402
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2B421	0_2_00D2B421
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DBB5E0	0_2_00DBB5E0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DCF580	0_2_00DCF580
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D51540	0_2_00D51540
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D25680	0_2_00D25680
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DC1610	0_2_00DC1610
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D41720	0_2_00D41720
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2D880	0_2_00D2D880
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D5B850	0_2_00D5B850
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DB3840	0_2_00DB3840
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2B9C7	0_2_00D2B9C7
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2B9FF	0_2_00D2B9FF
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2B9E3	0_2_00D2B9E3
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D379B0	0_2_00D379B0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2BADF	0_2_00D2BADF
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2BAC3	0_2_00D2BAC3
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D7BAF0	0_2_00D7BAF0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2BAFB	0_2_00D2BAFB
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2BA8B	0_2_00D2BA8B
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00DB3AB0	0_2_00DB3AB0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2BAA7	0_2_00D2BAA7
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2BA53	0_2_00D2BA53

Source: C:\Users\user\Desktop\uo9m.exe	Code function: String function: 00DBA430 appears 44 times
Source: C:\Users\user\Desktop\uo9m.exe	Code function: String function: 00DBA790 appears 43 times
Source: C:\Users\user\Desktop\uo9m.exe	Code function: String function: 00DBE1A0 appears 32 times
Source: C:\Users\user\Desktop\uo9m.exe	Code function: String function: 00DBA050 appears 98 times

Source: uo9m.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal64.evad.winEXE@1/0@11/1

Source: C:\Users\user\Desktop\uo9m.exe

Code function: 0_2_00D811A0 memset,GetModuleHandleW,FormatMessageW,GetLastError,

0_2_00D811A0

Source: C:\Users\user\Desktop\uo9m.exe

Code function: 0_2_00D29790 CreateToolhelp32Snapshot,memset,Process32FirstW,memcpy,memcpy,Process32NextW,CloseHandle,GetCurrentProcessId,DebugActiveProcess,GetCurrentProcess,TerminateProcess,CloseHandle,CloseHandle,GetModuleHandleA,GetProcAddress,GetCurrentProcessId,DebugActiveProcess,GetCurrentProcess,TerminateProcess,

0_2_00D29790

Source: C:\Users\user\Desktop\uo9m.exe

Mutant created: \Sessions\1\BaseNamedObjects\TestyFlamingo

Source: uo9m.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\uo9m.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\uo9m.exe

File read: C:\Users\user\Desktop\uo9m.exe

Jump to behavior

Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: uo9m.exe

Static file information: File size 799014912 > 1048576

Source: uo9m.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\uo9m.exe

Code function: 0_2_00D27A40 CreateTimerQueue,CreateEventW,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,CreateEventW,WaitForSingleObject,SetEvent,DeleteTimerQueue,

0_2_00D27A40

Source: uo9m.exe

Static PE information: section name: .eh_fram

Source: C:\Users\user\Desktop\uo9m.exe

Code function: 0_2_00DD6D50 push eax; mov dword ptr [esp], esi

0_2_00DD6DF1

Source: C:\Users\user\Desktop\uo9m.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\uo9m.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: uo9m.exe, 00000000.00000002.2195643216.0000000000680000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: IDAG.EXE

Source: C:\Users\user\Desktop\uo9m.exe

0_2_00D29790

Source: C:\Users\user\Desktop\uo9m.exe

API coverage: 3.1 %

Source: C:\Users\user\Desktop\uo9m.exe TID: 7596

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D7E620 CloseHandle,memset,FindFirstFileExW,FindClose,		0_2_00D7E620
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D7CEA0 memcpy,memcpy,memset,FindFirstFileExW,memcpy,GetLastError,FindClose,DeleteFileW,GetLastError,		0_2_00D7CEA0

Source: C:\Users\user\Desktop\uo9m.exe

Code function: 0_2_00D61750 GetSystemInfo,

0_2_00D61750

Source: uo9m.exe, 00000000.00000003.1923931265.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2195643216.000000000070D000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\uo9m.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\uo9m.exe

0_2_00D29790

Source: C:\Users\user\Desktop\uo9m.exe

0_2_00D27A40

Source: C:\Users\user\Desktop\uo9m.exe

Code function: 0_2_00D2E250 GetProcessHeap,HeapFree,RtlFreeHeap,

0_2_00D2E250

Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D2116A Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,_cexit,_initterm,	0_2_00D2116A
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D5FE60 AddVectoredExceptionHandler,RtlAddVectoredExceptionHandler,SetThreadStackGuarantee,GetCurrentThread,SetThreadDescription,SetThreadDescription,	0_2_00D5FE60
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D27F50 memset,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,AddVectoredExceptionHandler,RtlAddVectoredExceptionHandler,NtQueryInformationProcess,NtQuerySystemInformation,NtOpenThread,NtGetContextThread,NtSetContextThread,NtClose,	0_2_00D27F50
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D21187 Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,__initenv,	0_2_00D21187
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D21160 Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,__initenv,	0_2_00D21160
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D21319 SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,	0_2_00D21319

Source: C:\Users\user\Desktop\uo9m.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: uo9m.exe	String found in binary or memory: truculengisau.biz
Source: uo9m.exe	String found in binary or memory: punishzement.biz
Source: uo9m.exe	String found in binary or memory: spookycappy.biz
Source: uo9m.exe	String found in binary or memory: marketlumpe.biz
Source: uo9m.exe	String found in binary or memory: nuttyshopr.biz
Source: uo9m.exe	String found in binary or memory: grandiouseziu.biz
Source: uo9m.exe	String found in binary or memory: littlenotii.biz
Source: uo9m.exe	String found in binary or memory: fraggielek.biz

Source: C:\Users\user\Desktop\uo9m.exe

Code function: 0_2_00D2E4D0 cpuid

0_2_00D2E4D0

Source: C:\Users\user\Desktop\uo9m.exe

Code function: 0_2_00D76F90 GetSystemTimePreciseAsFileTime,

0_2_00D76F90

Source: C:\Users\user\Desktop\uo9m.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D8E0F0 bind,listen,WSAGetLastError,closesocket,		0_2_00D8E0F0
Source: C:\Users\user\Desktop\uo9m.exe	Code function: 0_2_00D8E4A0 bind,WSAGetLastError,closesocket,		0_2_00D8E4A0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Deobfuscate/Decode Files or Information	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	14 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
https://littlenotii.biz/api	100%	Avira URL Cloud	malware
https://truculengisau.biz/api	100%	Avira URL Cloud	malware
https://misha-lomonosov.com/2	100%	Avira URL Cloud	malware
https://fraggielek.biz/apiMr	100%	Avira URL Cloud	malware
https://misha-lomonosov.com/api	100%	Avira URL Cloud	malware
https://spookycappy.biz/apii	100%	Avira URL Cloud	malware
https://punishzement.biz/api	100%	Avira URL Cloud	malware
https://marketlumpe.biz/api5t	100%	Avira URL Cloud	malware
https://misha-lomonosov.com/	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.197.127.21	true	false	high
littlenotii.biz	unknown	unknown	true	unknown
fraggielek.biz	unknown	unknown	true	unknown
nuttyshopr.biz	unknown	unknown	true	unknown
grandiouseziu.biz	unknown	unknown	true	unknown
marketlumpe.biz	unknown	unknown	true	unknown
misha-lomonosov.com	unknown	unknown	false	unknown
spookycappy.biz	unknown	unknown	true	unknown
truculengisau.biz	unknown	unknown	true	unknown
punishzement.biz	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199724331900	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/my/wishlist/	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://player.vimeo.com	uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900#	uo9m.exe, 00000000.00000002.2195643216.0000000000688000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/market/	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.rs/getrandom#nodejs-es-module-support	uo9m.exe	false		high
https://store.steampowered.com/subscriber_agreement/	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	uo9m.exe, 00000000.00000002.2196703768.0000000003281000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://littlenotii.biz/api	uo9m.exe, 00000000.00000002.2195786323.0000000000734000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923931265.0000000000732000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	uo9m.exe, 00000000.00000002.2196703768.0000000003281000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://spookycappy.biz/apii	uo9m.exe, 00000000.00000002.2195786323.0000000000734000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923931265.0000000000732000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://recaptcha.net/recaptcha/;	uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://truculengisau.biz/api	uo9m.exe, 00000000.00000002.2195786323.0000000000734000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923931265.0000000000732000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com	uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com	uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://medal.tv	uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://misha-lomonosov.com/2	uo9m.exe, 00000000.00000003.1923931265.0000000000771000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://misha-lomonosov.com/api	uo9m.exe, 00000000.00000003.1923931265.0000000000771000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/%s	uo9m.exe, 00000000.00000002.2195786323.0000000000734000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923931265.0000000000732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/workshop/	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb	uo9m.exe, 00000000.00000003.1923931265.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	uo9m.exe, 00000000.00000002.2196703768.0000000003281000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/	uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steam.tv/	uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://misha-lomonosov.com/	uo9m.exe, 00000000.00000003.1923931265.0000000000771000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=BFN_	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	uo9m.exe, 00000000.00000002.2196703768.0000000003281000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://fraggielek.biz/apiMr	uo9m.exe, 00000000.00000002.2195786323.0000000000734000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923931265.0000000000732000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/points/shop/	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://recaptcha.net	uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/	uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sketchfab.com	uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
http://127.0.0.1:27060	uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923894784.0000000003268000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=M_FULq_A	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://marketlumpe.biz/api5t	uo9m.exe, 00000000.00000002.2195786323.0000000000734000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923931265.0000000000732000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.steampowered.com/	uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.steampowered.com/	uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
http://store.steampowered.com/account/cookiepreferences/	uo9m.exe, 00000000.00000002.2196703768.0000000003281000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/mobile	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://punishzement.biz/api	uo9m.exe, 00000000.00000002.2195786323.0000000000734000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923931265.0000000000732000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/	uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923931265.0000000000732000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	uo9m.exe, 00000000.00000003.1923931265.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2195786323.0000000000763000.00000004.00000020.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=iUcMsAN_acD6&l=e	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000002.2196682769.0000000003240000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/badges	uo9m.exe, 00000000.00000003.1923894784.000000000326A000.00000004.00000800.00020000.00000000.sdmp, uo9m.exe, 00000000.00000003.1923894784.0000000003268000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.197.127.21	steamcommunity.com	United States		20940	AKAMAI-ASN1EU	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590280
Start date and time:	2025-01-13 21:48:20 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	uo9m.exe
Detection:	MAL
Classification:	mal64.evad.winEXE@1/0@11/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 15 Number of non-executed functions: 126
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.197.127.21	http://steamcomunity.aiq.ru/	Get hash	malicious	Unknown	Browse	steamcommunity.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
steamcommunity.com	L7GNkeVm5e.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	NDWffRLk7z.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	g3toRYa6JE.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	lBb4XI4eGD.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	UWYXurYZ2x.exe	Get hash	malicious	LummaC, Amadey, Babadeda, DanaBot, KeyLogger, LummaC Stealer, Poverty Stealer	Browse	104.102.49.254
	TBI87y49f9.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	H5JVfa61AV.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	2EG0jAmtY6.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	rii2.mp3.hta	Get hash	malicious	LummaC	Browse	104.102.49.254

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	https://timecusa-my.sharepoint.com/:f:/p/stephensw/Erq5TMDIJBVBvh6vbWmpurEB4UwHKTW8nzSkPE2Ckmvugg?e=SepTcT	Get hash	malicious	HTMLPhisher	Browse	2.16.168.113
	Handler.exe	Get hash	malicious	DanaBot, Vidar	Browse	23.44.203.172
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	2.16.168.102
	JUbmpeT.exe	Get hash	malicious	Vidar	Browse	23.48.224.229
	Cardfactory Executed Agreement DocsID- Sign & Review..eml	Get hash	malicious	HTMLPhisher	Browse	2.16.168.101
	ACC NUM - D0278.eml	Get hash	malicious	Unknown	Browse	2.16.168.119
	https://bnbswap.lakshmi.trading/	Get hash	malicious	Unknown	Browse	23.215.17.144
	http://ledger-recovery.co.uk/	Get hash	malicious	Unknown	Browse	95.101.148.20
	3.elf	Get hash	malicious	Unknown	Browse	23.221.74.103
	3bSDIpSIdF.msi	Get hash	malicious	Unknown	Browse	23.200.0.9

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	YYYY-NNN AUDIT DETAIL REPORT .docx	Get hash	malicious	Unknown	Browse	23.197.127.21
	msit.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	tesr.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	WSLRT.exe	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	msit.msi	Get hash	malicious	LummaC Stealer	Browse	23.197.127.21
	PCB - Lyell Highway Upgrades Queenstown to Strahan - March 2021.XLSM	Get hash	malicious	Unknown	Browse	23.197.127.21
	PCB - Lyell Highway Upgrades Queenstown to Strahan - March 2021.XLSM	Get hash	malicious	Unknown	Browse	23.197.127.21
	L7GNkeVm5e.exe	Get hash	malicious	LummaC	Browse	23.197.127.21

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	0.029844611142384448
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	uo9m.exe
File size:	799'014'912 bytes
MD5:	a83802ca265a8d7d66f7307bf4f16367
SHA1:	0d4d784f97301527064dc66420cc136132df3337
SHA256:	cfab22760406b5b89f3f810702fd736306caa091dba036b8b9ffe206f415e794
SHA512:	840aa02c0bac4ef8436dfbd36f1d5d384efa3ff1eaa5012f92b9337eade110ac526163935df7d7e8326e6b5b51b06718e7642b79d5ed6c66bf8cdb6e1f609479
SSDEEP:
TLSH:
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0.;.h..[.....&....*..........................@..........................0......:.....@... ............................

File Icon


Icon Hash:	29226ee6b692c62f

Static PE Info

General

Entrypoint:	0x4013e0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x3BE130B9 [Thu Nov 1 11:23:37 2001 UTC]
TLS Callbacks:	0x46d530, 0x4ba960, 0x4ba910, 0x4b5f40
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	870017c0621e77ae427bc42242f26bc8

Entrypoint Preview

Instruction
mov dword ptr [00560234h], 00000001h
jmp 00007F5D4CDFB7B6h
nop
mov dword ptr [00560234h], 00000000h
jmp 00007F5D4CDFB7A6h
nop
sub esp, 1Ch
mov eax, dword ptr [esp+20h]
mov dword ptr [esp], eax
call 00007F5D4CEB4D86h
cmp eax, 01h
sbb eax, eax
add esp, 1Ch
ret
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 08h
lea ecx, dword ptr [00546104h]
lea eax, dword ptr [00560020h]
mov dword ptr [esp], ecx
mov dword ptr [esp+04h], eax
call 00007F5D4CEAEDF7h
add esp, 08h
pop ebp
ret
nop word ptr [eax+eax+00000000h]
nop dword ptr [eax]
push ebp
mov ebp, esp
sub esp, 08h
lea ecx, dword ptr [00546104h]
lea eax, dword ptr [00560020h]
mov dword ptr [esp], ecx
mov dword ptr [esp+04h], eax
call 00007F5D4CEAF057h
add esp, 08h
pop ebp
ret
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+0Ch]
mov edx, dword ptr [eax+14h]
test dl, 00000010h
jne 00007F5D4CDFBA56h
mov ecx, dword ptr [ebp+08h]
test dl, 00000020h
jne 00007F5D4CDFBA54h
push eax
push ecx
call 00007F5D4CEA3F28h
add esp, 08h
pop ebp
ret
pop ebp
jmp 00007F5D4CEA324Dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x161000	0x1c0c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x165000	0x6c0c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x16c000	0x68fc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1455e4	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1614a4	0x3b4	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xbe480	0xbe600	14afe16819cefb456a57dfbb261bfa84	False	0.5144246552856205	data	6.536835421663965	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xc0000	0x6a4	0x800	b0a386aff6633dee36d56775aea5f680	False	0.103515625	data	0.8174171019176437	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc1000	0x848a8	0x84a00	a0b17314fc2d598b41e4a0eb92ddfd0b	False	0.748982018732328	data	7.707327915600917	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.eh_fram	0x146000	0x19e38	0x1a000	8212dba1448bfaca52fe84c1c28105b3	False	0.32677283653846156	data	5.083061671706065	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x160000	0x270	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x161000	0x1c0c	0x1e00	d92df5b41991508676da4070bcda8775	False	0.31940104166666666	SysEx File - Oberheim	5.017837839075456	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x163000	0x38	0x200	96ef153fd5ad30b3f2dac280a614d5fd	False	0.078125	data	0.33445688494273207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x164000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x165000	0x6c0c	0x6e00	afb169a073748710747c9549937b7fb8	False	0.5189630681818181	data	5.960924050488915	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x16c000	0x68fc	0x6a00	8ea008d8151b2c3d348cef8e65b3146e	False	0.7341907429245284	data	6.631303672357615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1652b0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	English	United States	0.23902439024390243
RT_ICON	0x165918	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	United States	0.38306451612903225
RT_ICON	0x165c00	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	United States	0.597972972972973
RT_ICON	0x165d28	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.6084754797441365
RT_ICON	0x166bd0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.8172382671480144
RT_ICON	0x167478	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.7276011560693642
RT_ICON	0x1679e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.4179460580912863
RT_ICON	0x169f88	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.6719043151969981
RT_ICON	0x16b030	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.8315602836879432
RT_GROUP_ICON	0x16b498	0x84	data	English	United States	0.6363636363636364
RT_VERSION	0x16b51c	0x228	data	English	United States	0.4891304347826087
RT_MANIFEST	0x16b744	0x4c7	exported SGML document, ASCII text	English	United States	0.4145543744889616

Imports

DLL	Import
ntdll.dll	NtGetContextThread, NtOpenThread, NtSetContextThread
advapi32.dll	GetTokenInformation, OpenProcessToken, SystemFunction036
bcrypt.dll	BCryptGenRandom
kernel32.dll	AddVectoredExceptionHandler, CancelIo, CloseHandle, CompareStringOrdinal, CopyFileExW, CreateDirectoryW, CreateEventW, CreateFileMappingA, CreateFileW, CreateHardLinkW, CreateMutexA, CreateNamedPipeW, CreatePipe, CreateProcessW, CreateSymbolicLinkW, CreateThread, CreateTimerQueue, CreateToolhelp32Snapshot, CreateWaitableTimerExW, DebugActiveProcess, DeleteFileW, DeleteProcThreadAttributeList, DeleteTimerQueue, DeviceIoControl, DuplicateHandle, ExitProcess, FindClose, FindFirstFileExW, FindNextFileW, FlushFileBuffers, FormatMessageW, FreeEnvironmentStringsW, GetCommandLineW, GetConsoleMode, GetConsoleOutputCP, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetEnvironmentStringsW, GetEnvironmentVariableW, GetExitCodeProcess, GetFileAttributesW, GetFileInformationByHandle, GetFileInformationByHandleEx, GetFileType, GetFinalPathNameByHandleW, GetFullPathNameW, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleExW, GetModuleHandleW, GetOverlappedResult, GetProcAddress, GetProcessHeap, GetProcessId, GetStdHandle, GetSystemDirectoryW, GetSystemInfo, GetSystemTimePreciseAsFileTime, GetTempPathW, GetWindowsDirectoryW, HeapAlloc, HeapCreate, HeapFree, HeapReAlloc, InitOnceBeginInitialize, InitOnceComplete, InitializeProcThreadAttributeList, LoadLibraryA, LockFileEx, MapViewOfFile, Module32FirstW, Module32NextW, MultiByteToWideChar, Process32FirstW, Process32NextW, QueryPerformanceCounter, QueryPerformanceFrequency, ReadConsoleW, ReadFile, ReadFileEx, ReleaseMutex, RemoveDirectoryW, RtlCaptureContext, SetCurrentDirectoryW, SetEnvironmentVariableW, SetEvent, SetFileAttributesW, SetFileInformationByHandle, SetFilePointerEx, SetFileTime, SetHandleInformation, SetLastError, SetThreadStackGuarantee, SetUnhandledExceptionFilter, SetWaitableTimer, Sleep, SleepEx, SwitchToThread, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnlockFile, UnmapViewOfFile, UpdateProcThreadAttribute, WaitForMultipleObjects, WaitForSingleObject, WaitForSingleObjectEx, WideCharToMultiByte, WriteConsoleW, WriteFileEx, lstrlenW
ntdll.dll	NtClose, NtOpenFile, NtQueryInformationProcess, NtQuerySystemInformation, NtReadFile, NtWriteFile, RtlNtStatusToDosError
userenv.dll	GetUserProfileDirectoryW
ws2_32.dll	WSACleanup, WSADuplicateSocketW, WSAGetLastError, WSARecv, WSASend, WSASocketW, WSAStartup, accept, bind, closesocket, connect, freeaddrinfo, getaddrinfo, getpeername, getsockname, getsockopt, ioctlsocket, listen, recv, recvfrom, select, send, sendto, setsockopt, shutdown
api-ms-win-core-synch-l1-2-0.dll	WaitOnAddress, WakeByAddressAll, WakeByAddressSingle
bcryptprimitives.dll	ProcessPrng
KERNEL32.dll	CreateEventA, CreateSemaphoreA, DeleteCriticalSection, EnterCriticalSection, GetCurrentThreadId, GetHandleInformation, GetProcessAffinityMask, GetSystemTimeAsFileTime, GetThreadContext, GetThreadPriority, GetTickCount, InitializeCriticalSection, IsDebuggerPresent, LeaveCriticalSection, OpenProcess, OutputDebugStringA, RaiseException, ReleaseSemaphore, ResetEvent, ResumeThread, SetProcessAffinityMask, SetThreadContext, SetThreadPriority, SuspendThread, TryEnterCriticalSection, VirtualProtect, VirtualQuery
msvcrt.dll	__getmainargs, __initenv, __p__commode, __p__fmode, __set_app_type, __setusermatherr, _amsg_exit, _beginthreadex, _cexit, _commode, _endthreadex, _errno, _exit, _fmode, _fpreset, _initterm, _iob, _onexit, _setjmp3, _strdup, _vsnprintf, abort, calloc, exit, fprintf, free, fwrite, longjmp, malloc, memcmp, memcpy, memmove, memset, printf, realloc, signal, strlen, strncmp, vfprintf

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T21:49:35.327874+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	23.197.127.21	443	TCP
2025-01-13T21:49:35.950360+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49731	23.197.127.21	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 21:49:34.674621105 CET	49731	443	192.168.2.4	23.197.127.21
Jan 13, 2025 21:49:34.674724102 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:34.674802065 CET	49731	443	192.168.2.4	23.197.127.21
Jan 13, 2025 21:49:34.678911924 CET	49731	443	192.168.2.4	23.197.127.21
Jan 13, 2025 21:49:34.678952932 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:35.327728033 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:35.327873945 CET	49731	443	192.168.2.4	23.197.127.21
Jan 13, 2025 21:49:35.334722042 CET	49731	443	192.168.2.4	23.197.127.21
Jan 13, 2025 21:49:35.334752083 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:35.335073948 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:35.379550934 CET	49731	443	192.168.2.4	23.197.127.21
Jan 13, 2025 21:49:35.467123985 CET	49731	443	192.168.2.4	23.197.127.21
Jan 13, 2025 21:49:35.507330894 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:35.950355053 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:35.950376034 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:35.950412035 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:35.950427055 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:35.950428963 CET	49731	443	192.168.2.4	23.197.127.21
Jan 13, 2025 21:49:35.950459957 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:35.950478077 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:35.950495005 CET	49731	443	192.168.2.4	23.197.127.21
Jan 13, 2025 21:49:35.950517893 CET	49731	443	192.168.2.4	23.197.127.21
Jan 13, 2025 21:49:36.033955097 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:36.034003973 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:36.034035921 CET	49731	443	192.168.2.4	23.197.127.21
Jan 13, 2025 21:49:36.034076929 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:36.034122944 CET	49731	443	192.168.2.4	23.197.127.21
Jan 13, 2025 21:49:36.052323103 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:36.052386999 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:36.052426100 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:36.052423954 CET	49731	443	192.168.2.4	23.197.127.21
Jan 13, 2025 21:49:36.052470922 CET	49731	443	192.168.2.4	23.197.127.21
Jan 13, 2025 21:49:36.054680109 CET	49731	443	192.168.2.4	23.197.127.21
Jan 13, 2025 21:49:36.054701090 CET	443	49731	23.197.127.21	192.168.2.4
Jan 13, 2025 21:49:36.054722071 CET	49731	443	192.168.2.4	23.197.127.21
Jan 13, 2025 21:49:36.054728031 CET	443	49731	23.197.127.21	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 21:49:34.560789108 CET	65134	53	192.168.2.4	1.1.1.1
Jan 13, 2025 21:49:34.570327044 CET	53	65134	1.1.1.1	192.168.2.4
Jan 13, 2025 21:49:34.574959993 CET	57114	53	192.168.2.4	1.1.1.1
Jan 13, 2025 21:49:34.584358931 CET	53	57114	1.1.1.1	192.168.2.4
Jan 13, 2025 21:49:34.585494041 CET	60525	53	192.168.2.4	1.1.1.1
Jan 13, 2025 21:49:34.593867064 CET	53	60525	1.1.1.1	192.168.2.4
Jan 13, 2025 21:49:34.595487118 CET	50195	53	192.168.2.4	1.1.1.1
Jan 13, 2025 21:49:34.604391098 CET	53	50195	1.1.1.1	192.168.2.4
Jan 13, 2025 21:49:34.609302044 CET	51667	53	192.168.2.4	1.1.1.1
Jan 13, 2025 21:49:34.618798971 CET	53	51667	1.1.1.1	192.168.2.4
Jan 13, 2025 21:49:34.622479916 CET	59375	53	192.168.2.4	1.1.1.1
Jan 13, 2025 21:49:34.631232977 CET	53	59375	1.1.1.1	192.168.2.4
Jan 13, 2025 21:49:34.633290052 CET	63514	53	192.168.2.4	1.1.1.1
Jan 13, 2025 21:49:34.641906023 CET	53	63514	1.1.1.1	192.168.2.4
Jan 13, 2025 21:49:34.643944979 CET	55196	53	192.168.2.4	1.1.1.1
Jan 13, 2025 21:49:34.653342962 CET	53	55196	1.1.1.1	192.168.2.4
Jan 13, 2025 21:49:34.659301996 CET	53925	53	192.168.2.4	1.1.1.1
Jan 13, 2025 21:49:34.666135073 CET	53	53925	1.1.1.1	192.168.2.4
Jan 13, 2025 21:49:36.059969902 CET	62169	53	192.168.2.4	1.1.1.1
Jan 13, 2025 21:49:37.067166090 CET	62169	53	192.168.2.4	1.1.1.1
Jan 13, 2025 21:49:37.423036098 CET	53	62169	1.1.1.1	192.168.2.4
Jan 13, 2025 21:49:37.423122883 CET	53	62169	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 21:49:34.560789108 CET	192.168.2.4	1.1.1.1	0xdf76	Standard query (0)	truculengisau.biz	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:34.574959993 CET	192.168.2.4	1.1.1.1	0x24b9	Standard query (0)	fraggielek.biz	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:34.585494041 CET	192.168.2.4	1.1.1.1	0xf6c0	Standard query (0)	grandiouseziu.biz	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:34.595487118 CET	192.168.2.4	1.1.1.1	0xf8fe	Standard query (0)	littlenotii.biz	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:34.609302044 CET	192.168.2.4	1.1.1.1	0xac65	Standard query (0)	marketlumpe.biz	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:34.622479916 CET	192.168.2.4	1.1.1.1	0xa49f	Standard query (0)	nuttyshopr.biz	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:34.633290052 CET	192.168.2.4	1.1.1.1	0x54f6	Standard query (0)	punishzement.biz	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:34.643944979 CET	192.168.2.4	1.1.1.1	0x97f8	Standard query (0)	spookycappy.biz	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:34.659301996 CET	192.168.2.4	1.1.1.1	0x1a05	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:36.059969902 CET	192.168.2.4	1.1.1.1	0xd1f6	Standard query (0)	misha-lomonosov.com	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:37.067166090 CET	192.168.2.4	1.1.1.1	0xd1f6	Standard query (0)	misha-lomonosov.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 21:49:34.570327044 CET	1.1.1.1	192.168.2.4	0xdf76	Name error (3)	truculengisau.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:34.584358931 CET	1.1.1.1	192.168.2.4	0x24b9	Name error (3)	fraggielek.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:34.593867064 CET	1.1.1.1	192.168.2.4	0xf6c0	Name error (3)	grandiouseziu.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:34.604391098 CET	1.1.1.1	192.168.2.4	0xf8fe	Name error (3)	littlenotii.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:34.618798971 CET	1.1.1.1	192.168.2.4	0xac65	Name error (3)	marketlumpe.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:34.631232977 CET	1.1.1.1	192.168.2.4	0xa49f	Name error (3)	nuttyshopr.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:34.641906023 CET	1.1.1.1	192.168.2.4	0x54f6	Name error (3)	punishzement.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:34.653342962 CET	1.1.1.1	192.168.2.4	0x97f8	Name error (3)	spookycappy.biz	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:34.666135073 CET	1.1.1.1	192.168.2.4	0x1a05	No error (0)	steamcommunity.com		23.197.127.21	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:37.423036098 CET	1.1.1.1	192.168.2.4	0xd1f6	Server failure (2)	misha-lomonosov.com	none	none	A (IP address)	IN (0x0001)	false
Jan 13, 2025 21:49:37.423122883 CET	1.1.1.1	192.168.2.4	0xd1f6	Server failure (2)	misha-lomonosov.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	23.197.127.21	443	7412	C:\Users\user\Desktop\uo9m.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-13 20:49:35 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2025-01-13 20:49:35 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 13 Jan 2025 20:49:35 GMT Content-Length: 35141 Connection: close Set-Cookie: sessionid=6ea142275864432a1ee55dcb; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2025-01-13 20:49:35 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2025-01-13 20:49:36 UTC	10097	IN	Data Raw: 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a Data Ascii: eamcommunity.com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">
2025-01-13 20:49:36 UTC	10565	IN	Data Raw: 2c 26 71 75 6f 74 3b 57 45 42 5f 55 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f Data Ascii: ,"WEB_UNIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL&quo

Target ID:	0
Start time:	15:49:22
Start date:	13/01/2025
Path:	C:\Users\user\Desktop\uo9m.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\uo9m.exe"
Imagebase:	0xd20000
File size:	799'014'912 bytes
MD5 hash:	A83802CA265A8D7D66F7307BF4F16367
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	75.1%
Total number of Nodes:	842
Total number of Limit Nodes:	14

Executed Functions

Function 00D29790 Relevance: 40.7, APIs: 19, Strings: 3, Instructions: 2160processCOMMON

Download Yara Rule

APIs

Part of subcall function 00D29320: memcpy.MSVCRT(00000001,!Z,00E45AC0), ref: 00D2937D

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00D29FDD
memset.MSVCRT ref: 00D29FFB
Process32FirstW.KERNEL32(00000000,?), ref: 00D2A033
memcpy.MSVCRT(00000000,?,00000000), ref: 00D2A128
memcpy.MSVCRT(00000001,?,00000000,?,?,?,00000002,00000000), ref: 00D2A245
Process32NextW.KERNEL32(?,0000022C), ref: 00D2A304
CloseHandle.KERNEL32(00000000,?,00000002,00000000), ref: 00D2A37A
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 00D2A3D1

Strings

called `Result::unwrap()` on an `Err` value/rustc/243d2ca4db6f96d2d18aaf3a2381251d38eb6b0b\library\alloc\src\slice.rs, xrefs: 00D2B355, 00D2B397
;Z, xrefs: 00D2B2C3
:, xrefs: 00D2B03E

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: memcpy$CloseHandleProcess32$CreateFirstNextSnapshotToolhelp32memset
String ID: :$;Z$called `Result::unwrap()` on an `Err` value/rustc/243d2ca4db6f96d2d18aaf3a2381251d38eb6b0b\library\alloc\src\slice.rs
API String ID: 3108730875-3034944078
Opcode ID: a025377b3ffe629b0d548b0be3e6d7c2a0ec7ca1d6f09988b390ae403275531f
Instruction ID: b366f3384c7f1724e8fce06e4361977fe87047aa65784e30353b64ab09180952
Opcode Fuzzy Hash: a025377b3ffe629b0d548b0be3e6d7c2a0ec7ca1d6f09988b390ae403275531f
Instruction Fuzzy Hash: 5613A771E40728ABDB20DF24EC46FDAB379EF59708F0441E5F5087A182E7B19A858F61

Function 00D27A40 Relevance: 35.3, APIs: 19, Strings: 1, Instructions: 335
libraryloadertimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateTimerQueue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,00D22382), ref: 00D27A49
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D27A60
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00D27A6F

Part of subcall function 00D29320: memcpy.MSVCRT(00000001,!Z,00E45AC0), ref: 00D2937D

LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,00000000,00000000), ref: 00D27AC5
GetProcAddress.KERNEL32(00000000,?), ref: 00D27AEB
GetModuleHandleA.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,00000000), ref: 00D27B3C
GetProcAddress.KERNEL32(00000000,?), ref: 00D27B62
LoadLibraryA.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,00000000,?,?,?,00000000,?), ref: 00D27BB3
LoadLibraryA.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,00000000,?,?,?,00000000,?), ref: 00D27C2A
GetProcAddress.KERNEL32(00000000,?), ref: 00D27C50
LoadLibraryA.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,00000000,?,?,?,00000000,?), ref: 00D27CA1
GetProcAddress.KERNEL32(00000000,?), ref: 00D27CC7
LoadLibraryA.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,00000000,?,?,?,00000000,?), ref: 00D27D18
GetProcAddress.KERNEL32(00000000,?), ref: 00D27D3E
GetProcAddress.KERNEL32(00000000,?), ref: 00D27BD9

Part of subcall function 00D2E250: GetProcessHeap.KERNEL32(?), ref: 00D79460
Part of subcall function 00D2E250: HeapFree.KERNEL32(00000000,00000000,00000000,?), ref: 00D79469

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,?,?,?,?,00000000,?,?,?,00000000,?), ref: 00D27DAE
WaitForSingleObject.KERNEL32(00000000,00D22382,00000000,00000001,00000000,00000000,00000000,?,?,?,?,?,00000000), ref: 00D27DBD
SetEvent.KERNEL32(00000000,00000000,00D22382,00000000,00000001,00000000,00000000,00000000,?,?,?,?,?,00000000), ref: 00D27DE2
DeleteTimerQueue.KERNEL32(00000000), ref: 00D27DE8

Strings

{~U, xrefs: 00D27CF9

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: AddressProc$LibraryLoad$CreateEvent$HandleHeapModuleQueueTimer$DeleteFreeObjectProcessSingleWaitmemcpy
String ID: {~U
API String ID: 93789523-940978701
Opcode ID: 75712b865dc9a893409cf3d74282237afd20b0d92015c048cb283c9654fa52a8
Instruction ID: d964d6111702ed7ffc6d9ad951d974e08efba739078ede5e4df5a3bc33398d0c
Opcode Fuzzy Hash: 75712b865dc9a893409cf3d74282237afd20b0d92015c048cb283c9654fa52a8
Instruction Fuzzy Hash: 11B131B6E40319BBEF10EAB5AC43FAE776CEF64748F044125F901B6283E6B5D9048670

Function 00D221E0 Relevance: 33.3, APIs: 13, Strings: 5, Instructions: 1764memorysynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00D29320: memcpy.MSVCRT(00000001,!Z,00E45AC0), ref: 00D2937D

CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00D22290
GetLastError.KERNEL32(00000000,00000000,00000000), ref: 00D22295
SetFileAttributesW.KERNEL32(?,00000007,?,?,?,?,?,?,00000000), ref: 00D22349
memcpy.MSVCRT(00000000,00DE12C4,000632FF,?,?,?,00000000), ref: 00D223B1
HeapCreate.KERNEL32(00040000,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00D22412
HeapAlloc.KERNEL32(00000000,00000008,000632FF,00040000,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00D22423
memcpy.MSVCRT(00000000,00000000,000632FF,00000000,00000008,000632FF,00040000,00000000,00000000), ref: 00D22435

Strings

a Display implementation returned an error unexpectedly/rustc/243d2ca4db6f96d2d18aaf3a2381251d38eb6b0b\library\alloc\src\string.rs, xrefs: 00D237EB, 00D2385F, 00D2387E
/i:S, xrefs: 00D22564
J, xrefs: 00D2327B, 00D23313, 00D23343, 00D233B3, 00D230A6, 00D230AC, 00D23281, 00D23349, 00D23362
, xrefs: 00D2312A
SYNC, xrefs: 00D22569

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: memcpy$CreateHeap$AllocAttributesErrorFileLastMutex
String ID: $ J$/i:S$SYNC$a Display implementation returned an error unexpectedly/rustc/243d2ca4db6f96d2d18aaf3a2381251d38eb6b0b\library\alloc\src\string.rs
API String ID: 394507146-4107024699
Opcode ID: dfbce9807defea3d1d7040cf9740ab5874ea0f4eaaab4395db4a798dac71341c
Instruction ID: 4c8666ea759a322dcc09f15c4b8e2d716ff9b21af54f0503e22ec373781d2040
Opcode Fuzzy Hash: dfbce9807defea3d1d7040cf9740ab5874ea0f4eaaab4395db4a798dac71341c
Instruction Fuzzy Hash: 56E220B5E00228ABEF20DB54ED42FEEB7B9AF64708F044195F509B7281D7719E448B71

Function 00D27F50 Relevance: 26.8, APIs: 13, Strings: 2, Instructions: 587
librarynativeloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00D27F6A
GetModuleHandleA.KERNEL32(00000000), ref: 00D2802F
LoadLibraryA.KERNEL32(00000000,00000000), ref: 00D2803C
GetProcAddress.KERNEL32(?,00000000), ref: 00D280F4
GetModuleHandleA.KERNEL32(00000000), ref: 00D281F0
GetProcAddress.KERNEL32(?,00000000), ref: 00D282A2
AddVectoredExceptionHandler.KERNEL32(00000001,00D27E80), ref: 00D282EB

Part of subcall function 00D29320: memcpy.MSVCRT(00000001,!Z,00E45AC0), ref: 00D2937D

NtQueryInformationProcess.NTDLL(000000FF,00000000,?,00000018,00000000), ref: 00D2830D
NtQuerySystemInformation.NTDLL(00000005,00000000,00100000,00000000), ref: 00D28357

Strings

?, xrefs: 00D27F79
called `Result::unwrap()` on an `Err` value, xrefs: 00D28003, 00D280C2, 00D281C3, 00D28272

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: AddressHandleInformationModuleProcQuery$ExceptionHandlerLibraryLoadProcessSystemVectoredmemcpymemset
String ID: ?$called `Result::unwrap()` on an `Err` value
API String ID: 4247985971-3528718506
Opcode ID: d7c168c9f9e40d143b62bb1379754c6a5024adf0827b5e7a010dae57e7035975
Instruction ID: b9498f06b07a0c792836b6860666df6bbde1b7d1175ba1754fe8c28ae87bb5a7
Opcode Fuzzy Hash: d7c168c9f9e40d143b62bb1379754c6a5024adf0827b5e7a010dae57e7035975
Instruction Fuzzy Hash: 94226171E01328AFDB11DF94EC41BAEBBB8AF64708F184065F805B7292DBB19944DB71

Function 00D2116A Relevance: 15.2, APIs: 10, Instructions: 150
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00D2119F
SetUnhandledExceptionFilter.KERNEL32 ref: 00D21220
malloc.MSVCRT ref: 00D2124F
strlen.MSVCRT ref: 00D21283
malloc.MSVCRT ref: 00D2128E
memcpy.MSVCRT ref: 00D212A4

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandledmemcpystrlen
String ID:
API String ID: 3806033187-0
Opcode ID: f07c803e8dc6e9dc825c56366bd4ec149ec29216d9079e0ae7de49b6b07689d9
Instruction ID: 6097b2658ce2a80afe2f1c2c3e99bc68bdb83a96b099dadabd79169427d49f8b
Opcode Fuzzy Hash: f07c803e8dc6e9dc825c56366bd4ec149ec29216d9079e0ae7de49b6b07689d9
Instruction Fuzzy Hash: 29517AB4904315CFCB50EF69E88465DBBF1FF54304F14892AD988AB321D770A948DBB2

Function 00D21319 Relevance: 10.6, APIs: 7, Instructions: 96
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00D21220
malloc.MSVCRT ref: 00D2124F
strlen.MSVCRT ref: 00D21283
malloc.MSVCRT ref: 00D2128E
memcpy.MSVCRT ref: 00D212A4
_amsg_exit.MSVCRT ref: 00D2133A
_initterm.MSVCRT ref: 00D2135C

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled_amsg_exit_inittermmemcpystrlen
String ID:
API String ID: 1364285269-0
Opcode ID: f39fdc743dc5d96743c3098c27a84bc21f2999d65105170a0c539a611db6c620
Instruction ID: a784bca6ad367912b1ae593a06190ce6b4cb039f43fb5bec9f99eb6ec4184360
Opcode Fuzzy Hash: f39fdc743dc5d96743c3098c27a84bc21f2999d65105170a0c539a611db6c620
Instruction Fuzzy Hash: 954145B8904315CFCB50EF69E88425DBBF1FF54304F05882ED888A7321D774A949DBA2

Function 00D21187 Relevance: 9.1, APIs: 6, Instructions: 102
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00D2119F
SetUnhandledExceptionFilter.KERNEL32 ref: 00D21220
malloc.MSVCRT ref: 00D2124F
strlen.MSVCRT ref: 00D21283
malloc.MSVCRT ref: 00D2128E
memcpy.MSVCRT ref: 00D212A4
_amsg_exit.MSVCRT ref: 00D2133A
_initterm.MSVCRT ref: 00D2135C

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_inittermmemcpystrlen
String ID:
API String ID: 2601417275-0
Opcode ID: 25cc1f25ed5119d1517eb47e6a9bc15ab6afd262fc20b72a514586d572fc063f
Instruction ID: 2d21b81e9604b33a58b70175d5595c614864d7146ace01fb4ab1f461e02771bd
Opcode Fuzzy Hash: 25cc1f25ed5119d1517eb47e6a9bc15ab6afd262fc20b72a514586d572fc063f
Instruction Fuzzy Hash: CC4148B5A04215CFCB50EF69E88475EB7F1FF54344F048929D888AB320D770A949CBA2

Function 00D5FE60 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AddVectoredExceptionHandler.KERNEL32(00000000,00D8A790,?,?,?,?,?,?,?,?,?,?,00000001,?,?,00D23F4A), ref: 00D5FE70
SetThreadStackGuarantee.KERNEL32(00005000,00000000,00D8A790,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00D5FE80
GetCurrentThread.KERNEL32 ref: 00D5FE85
SetThreadDescription.KERNELBASE(00000000,main,00005000,00000000,00D8A790,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00D5FE96

Part of subcall function 00D60440: TlsGetValue.KERNEL32(?,?,?,00D5FE9D,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00D6044F

Part of subcall function 00D602D0: TlsGetValue.KERNEL32(00000000,?,00000000,00E80058,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00D602F4

Strings

main, xrefs: 00D5FE90

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Thread$Value$CurrentDescriptionExceptionGuaranteeHandlerStackVectored
String ID: main
API String ID: 1241031705-3207122276
Opcode ID: e19aca8f1df4d25d76defd4f4940b280942e92920078b598695a8b520764a411
Instruction ID: 098bdc30b21ec8ea45d3636f91b652292ab391313da39d6f3d5eabe9af2a675a
Opcode Fuzzy Hash: e19aca8f1df4d25d76defd4f4940b280942e92920078b598695a8b520764a411
Instruction Fuzzy Hash: 604145B1D00209ABDB00EBA5EC45BDEBBB8EF44304F144025F919BB281E779994DCBB5

Function 00D21160 Relevance: 7.6, APIs: 5, Instructions: 110
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00D2119F
SetUnhandledExceptionFilter.KERNEL32 ref: 00D21220
malloc.MSVCRT ref: 00D2124F
strlen.MSVCRT ref: 00D21283
malloc.MSVCRT ref: 00D2128E
memcpy.MSVCRT ref: 00D212A4

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandledmemcpystrlen
String ID:
API String ID: 3806033187-0
Opcode ID: bb44c0f3a2432a6d32bdb5b862f9d149e8d4ecfca571d64a4a24220becd65af4
Instruction ID: 67e0c7f3e4d0e7d9700c2d791949aeec6ce0815ebb6daf5fb2624c073e5c0992
Opcode Fuzzy Hash: bb44c0f3a2432a6d32bdb5b862f9d149e8d4ecfca571d64a4a24220becd65af4
Instruction Fuzzy Hash: 0A417AB5904315CFCB50EF69E98465EBBF1FF54304F04892DE848AB320E770A949DBA2

Function 00D3AE60 Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

BCryptGenRandom.BCRYPT(00000000,?,?,00000002,00000000,00000000,?,?,00D3A9A7,?,00D35C59,?,00000000,?,00D35C59,?), ref: 00D3AE77
SystemFunction036.ADVAPI32(?,?,00000000,?,?,00000002,00000000,00000000,?,?,00D3A9A7,?,00D35C59,?,00000000), ref: 00D3AE89

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: CryptFunction036RandomSystem
String ID:
API String ID: 1232939966-0
Opcode ID: 64ff9b39271a35cde2008302aba175f506d380be61680f8c4f234fde65af9d4d
Instruction ID: b0314b4fdc804b344064ccfa6eb2921ae16a499189f0eea4148c0c111b003f0f
Opcode Fuzzy Hash: 64ff9b39271a35cde2008302aba175f506d380be61680f8c4f234fde65af9d4d
Instruction Fuzzy Hash: 73E04F733013297AEE2019999C85FA6AB9DCBC5BE4F164222FF18A7191C9618C4102F5

Function 00D2E250 Relevance: 2.5, APIs: 2, Instructions: 19
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?), ref: 00D79460
HeapFree.KERNEL32(00000000,00000000,00000000,?), ref: 00D79469

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 16e183b6eb68152252668b6be5a544e1ffa688d1baf64f404ecaa14cce942121
Instruction ID: 396bca75dd2a8f2cfe261ef202767c06b34a8f72160b39385471810cc6cbf858
Opcode Fuzzy Hash: 16e183b6eb68152252668b6be5a544e1ffa688d1baf64f404ecaa14cce942121
Instruction Fuzzy Hash: ABE0EC31105215BBCA00AA59C809A4BFBE8EB85768F108415F94C67211D370FD40C6E9

Function 00DD5B20 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 126
threadlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00DD5B3D
CreateEventA.KERNEL32 ref: 00DD5B65
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000004,74DEDF20), ref: 00DD5BA7
GetCurrentThread.KERNEL32 ref: 00DD5BAB
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000004,74DEDF20), ref: 00DD5BB3
DuplicateHandle.KERNELBASE ref: 00DD5BDF
GetThreadPriority.KERNEL32 ref: 00DD5BF6
TlsSetValue.KERNEL32 ref: 00DD5C22
TlsGetValue.KERNEL32 ref: 00DD5C60
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA9E
GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00DD3854), ref: 00DDBADC
GetProcAddress.KERNEL32 ref: 00DDBAFC
GetProcAddress.KERNEL32 ref: 00DDBB10

Strings

kernel32.dll, xrefs: 00DDBAD5
RemoveVectoredExceptionHandler, xrefs: 00DDBB05
AddVectoredExceptionHandler, xrefs: 00DDBAF1

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Current$Thread$AddressHandleProcProcessValue$CreateDuplicateEventModulePriorityabort
String ID: AddVectoredExceptionHandler$RemoveVectoredExceptionHandler$kernel32.dll
API String ID: 1214264455-3889795909
Opcode ID: 8855ab8746b432c8ba0cdbc9119656b75b997cadff38a6497752bdfd790bbe9a
Instruction ID: 878690964f0e1c6cf66c3b56fced43dd6b05d7aa28dd56b69192c66c429be77b
Opcode Fuzzy Hash: 8855ab8746b432c8ba0cdbc9119656b75b997cadff38a6497752bdfd790bbe9a
Instruction Fuzzy Hash: 42414CB18047008FDB00AF79E98931ABFF8FB44354F444A6EE89987356E774D449CBA2

Function 00D29320 Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 225
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT(00000001,!Z,00E45AC0), ref: 00D2937D

Strings

nd 3, xrefs: 00D293B8
!Z, xrefs: 00D29379, 00D296B0
2-by, xrefs: 00D293C3
called `Result::unwrap()` on an `Err` value, xrefs: 00D295F7, 00D29646
Z, xrefs: 00D29573
expa, xrefs: 00D294F8, 00D29500
te k, xrefs: 00D293CE
!Z, xrefs: 00D2957E

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: memcpy
String ID: !Z$!Z$2-by$called `Result::unwrap()` on an `Err` value$expa$nd 3$te k$Z
API String ID: 3510742995-4268648072
Opcode ID: f64bace392b1a5f310477d46f70c1901c42fa9f66739e60b9df9612d641c1e07
Instruction ID: 9aacc4c1f2fbd051e62481d1411aa0e30b004b3d1f135d281af4b7dbca300350
Opcode Fuzzy Hash: f64bace392b1a5f310477d46f70c1901c42fa9f66739e60b9df9612d641c1e07
Instruction Fuzzy Hash: F8916C71908B849BD721DF14E841BABB7E9FFDA344F044A1EF8886B241EB709544CB72

Function 00D341E0 Relevance: 6.5, APIs: 5, Instructions: 247
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsGetValue.KERNEL32(-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00D341FB
memset.MSVCRT ref: 00D342C2
TlsGetValue.KERNEL32(00000000), ref: 00D34350
TlsSetValue.KERNEL32(00000000,00000000,00000000), ref: 00D3435D
TlsGetValue.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00D3439E

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Value$memset
String ID:
API String ID: 3732838118-0
Opcode ID: ddb299176ec3113e4214138a0616f1dad98d73c3f2719a672fd1d6dda1f1426c
Instruction ID: d971be576d4dc3bd6be641ddde17a81e891d40679b1a1067e9b73cfba59b9914
Opcode Fuzzy Hash: ddb299176ec3113e4214138a0616f1dad98d73c3f2719a672fd1d6dda1f1426c
Instruction Fuzzy Hash: 74912871D04740AFD701DB249C427EABBA4EFA5318F048618F9845B3D2E7B5A648C7B2

Function 00D8A950 Relevance: 2.5, APIs: 2, Instructions: 14
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00D7942C,?,?,?,?,?,?,?,?,?,?,?,?,80000000,?), ref: 00D8A953
HeapAlloc.KERNEL32(00000000,?,?,?,00D7942C), ref: 00D8A963

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: d7fd53b4c5597121ba28862d77ff2c03ee8de1afbacbf0044e3576887307571b
Instruction ID: adc80a83f76203c22eb5901f3d0aaa9b8ed17f329dc3c6b45720482da46376a6
Opcode Fuzzy Hash: d7fd53b4c5597121ba28862d77ff2c03ee8de1afbacbf0044e3576887307571b
Instruction Fuzzy Hash: A3C08C3200430C2A9F003EF02C05A2B3F5CAF84320F480426FD0C80612E936D420DAB4

Non-executed Functions

Function 00D83374 Relevance: 107.7, APIs: 49, Strings: 10, Instructions: 4422COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00D833C7
FreeEnvironmentStringsW.KERNEL32(?), ref: 00D83559
CloseHandle.KERNEL32(?), ref: 00D83EBD
GetLastError.KERNEL32 ref: 00D871E3
CloseHandle.KERNEL32(?), ref: 00D87ABB

Strings

assertion failed: is_code_point_boundary(self, new_len), xrefs: 00D858A6
]?\\, xrefs: 00D83D2A
.exeprogram not found, xrefs: 00D83FE4
?, xrefs: 00D86DA8
assertion failed: self.height > 0, xrefs: 00D86809
program path has no file name, xrefs: 00D87C4C
H, xrefs: 00D86860
exe\\.\NULexit code: , xrefs: 00D8577E, 00D85F97, 00D8610F, 00D8631C, 00D86511
PATHlibrary\std\src\sys_common\process.rs, xrefs: 00D86433
\?\\, xrefs: 00D83D22

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: CloseEnvironmentHandleStrings$ErrorFreeLast
String ID: program path has no file name$.exeprogram not found$?$H$PATHlibrary\std\src\sys_common\process.rs$\?\\$]?\\$assertion failed: is_code_point_boundary(self, new_len)$assertion failed: self.height > 0$exe\\.\NULexit code:
API String ID: 1593577933-227677938
Opcode ID: 9786350a9902a6a54278be5773cd3e7f04b79e67d4902bdc9b7beece213b75b2
Instruction ID: ee00d1f59de6e19738d255d0fddfcb277f6189112f4dbda280390ece0f784046
Opcode Fuzzy Hash: 9786350a9902a6a54278be5773cd3e7f04b79e67d4902bdc9b7beece213b75b2
Instruction Fuzzy Hash: 7483C1719083419FD720EF24D881BAABBE5EFD5314F18892DE8C997352E770D905CBA2

Function 00DD2110 Relevance: 53.0, APIs: 27, Strings: 3, Instructions: 494stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00DD219D

Strings

kernel32.dll, xrefs: 00DDBAD5
RemoveVectoredExceptionHandler, xrefs: 00DDBB05
AddVectoredExceptionHandler, xrefs: 00DDBAF1

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: strlen
String ID: AddVectoredExceptionHandler$RemoveVectoredExceptionHandler$kernel32.dll
API String ID: 39653677-3889795909
Opcode ID: 4df824aca85ddb2a7f2ba1728a6218675ffafacea0b0a4e0e2f7d8f673bd4102
Instruction ID: 19a6707ae6bcde604353c26fc9dcdf554fe92d5315ee92bbde9873b79e040463
Opcode Fuzzy Hash: 4df824aca85ddb2a7f2ba1728a6218675ffafacea0b0a4e0e2f7d8f673bd4102
Instruction Fuzzy Hash: B512B0B15087408FD720CF28C484776BBE1AFA5314F0D86AEE4D58B3A2D775E849DB62

Function 00D8F02E Relevance: 45.6, APIs: 18, Strings: 6, Instructions: 3587COMMON

Download Yara Rule

Strings

4, xrefs: 00D91F9E
O, xrefs: 00D92CE6
O, xrefs: 00D922BC
.debug_abbrev.debug_addr.debug_aranges.debug_cu_index.debug_info.debug_line.debug_line_str.debug_loc.debug_loclists.debug_ranges.debug_rnglists.debug_str.debug_str_offsets.debug_tu_index.debug_types, xrefs: 00D900D3
P, xrefs: 00D912B2
.debug_abbrev.dwo.debug_info.dwo.debug_line.dwo.debug_loc.dwo.debug_loclists.dwo.debug_rnglists.dwo.debug_str.dwo.debug_str_offsets.dwo.debug_types.dwo, xrefs: 00D924A9

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: .debug_abbrev.debug_addr.debug_aranges.debug_cu_index.debug_info.debug_line.debug_line_str.debug_loc.debug_loclists.debug_ranges.debug_rnglists.debug_str.debug_str_offsets.debug_tu_index.debug_types$.debug_abbrev.dwo.debug_info.dwo.debug_line.dwo.debug_loc.dwo.debug_loclists.dwo.debug_rnglists.dwo.debug_str.dwo.debug_str_offsets.dwo.debug_types.dwo$4$O$O$P
API String ID: 0-793445337
Opcode ID: 1e66065edaee023c891e1342ca41443e765243558da510700794d42f4f36e88f
Instruction ID: 76b159575d100b6f5e9a78de9382ea212e1d677c8763de7b99fd9985df5120ca
Opcode Fuzzy Hash: 1e66065edaee023c891e1342ca41443e765243558da510700794d42f4f36e88f
Instruction Fuzzy Hash: 6A8325B19087819FD774CF28C480BABB7E1BFC9304F148A2EE9D997251DB709945CB62

Function 00D7D750 Relevance: 42.7, APIs: 28, Instructions: 706COMMON

Download Yara Rule

APIs

GetFileInformationByHandleEx.KERNEL32(?,00000000,?,00000028), ref: 00D7D7EF
GetLastError.KERNEL32(?,00000000,?,00000028), ref: 00D7D828
CloseHandle.KERNEL32(?,?,00000000,?,00000028), ref: 00D7D837
GetFileInformationByHandleEx.KERNEL32(?,00000001,?,00000400), ref: 00D7D8CB
GetLastError.KERNEL32(?,?,00000001,?,00000400), ref: 00D7D8E1
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000028), ref: 00D7DD9F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000028), ref: 00D7DDB2
CloseHandle.KERNEL32(?,?,?,?,00000028), ref: 00D7DE21

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Handle$Close$ErrorFileInformationLast
String ID:
API String ID: 4143594976-0
Opcode ID: f9723cdf5afd294ca178e94d6e484186b251873f9aa8df519921f927e59a7ecf
Instruction ID: d9df22e29b1c824ec7d0d6f6a2df51a816c20ed98329ac2ac0cb9fd4ba9fc637
Opcode Fuzzy Hash: f9723cdf5afd294ca178e94d6e484186b251873f9aa8df519921f927e59a7ecf
Instruction Fuzzy Hash: 7242BD71508340ABD7209F24C841B6BBBF6EFD9314F18891DF99897292E7B1D944CBB2

Function 00DD4260 Relevance: 24.9, APIs: 11, Strings: 3, Instructions: 396COMMON

Download Yara Rule

Strings

kernel32.dll, xrefs: 00DDBAD5
RemoveVectoredExceptionHandler, xrefs: 00DDBB05
AddVectoredExceptionHandler, xrefs: 00DDBAF1

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: AddVectoredExceptionHandler$RemoveVectoredExceptionHandler$kernel32.dll
API String ID: 0-3889795909
Opcode ID: c5f4910ac5b88c43036480261631739c2c65836e223fb0ff4a81028516d8417a
Instruction ID: a31228edb033fdb341f36ad36bc9f3add5b2d635ac232490d52c2d81921b1803
Opcode Fuzzy Hash: c5f4910ac5b88c43036480261631739c2c65836e223fb0ff4a81028516d8417a
Instruction Fuzzy Hash: E4E18E71A047018FCB14DF29D48066AB7E1FF84314F598A6FE899AB305DB30ED45CBA2

Function 00D8C2B0 Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 428COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 00D8C3F1
GetFullPathNameW.KERNEL32(?,00000000,00000002,00000000,00000000), ref: 00D8C400
GetLastError.KERNEL32(?,00000000,?,00000000,00000000,?,00000000,00000002,00000000,00000000), ref: 00D8C40B
GetLastError.KERNEL32(?,00000000,?,00000000,00000000,?,00000000,00000002,00000000,00000000), ref: 00D8C41C

Strings

\\?\, xrefs: 00D8C529
\\?\UNC\, xrefs: 00D8C5E5

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID: \\?\$\\?\UNC\
API String ID: 2482867836-3019864461
Opcode ID: 9ffb4a5b0a20099cdf26a43dfc35476268b3bcdd18ad5a8cb78e0924b0c39ea1
Instruction ID: 7db348ebb468678de0640969293ac75bd745ef43b804ba0055380117616b9c33
Opcode Fuzzy Hash: 9ffb4a5b0a20099cdf26a43dfc35476268b3bcdd18ad5a8cb78e0924b0c39ea1
Instruction Fuzzy Hash: 99F1A1B1E10215DBCF20EF98C885AAEB7B1FF54314F189029E815AB251E770EC46CBB1

Function 00DB5260 Relevance: 11.9, Strings: 9, Instructions: 621COMMON

Download Yara Rule

Strings

assertion failed: edelta >= 0library\core\src\num\diy_float.rs, xrefs: 00DB5D95
assertion failed: d.mant.checked_add(d.plus).is_some(), xrefs: 00DB46A8, 00DB5144, 00DB5D51
assertion failed: d.minus > 0, xrefs: 00DB4686, 00DB5122, 00DB5D2F
assertion failed: buf.len() >= MAX_SIG_DIGITS, xrefs: 00DB46CA, 00DB5D73
\}, xrefs: 00DB51F5, 00DB57AA, 00DB5CD8, 00DB590B, 00DB59DB, 00DB5B33
assertion failed: d.mant > 0, xrefs: 00DB4675, 00DB5111, 00DB5D1E
assertion failed: d.mant + d.plus < (1 << 61), xrefs: 00DB5D84
assertion failed: d.mant.checked_sub(d.minus).is_some(), xrefs: 00DB46B9, 00DB5155, 00DB5D62
+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 00DB5264, 00DB5DD4

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: +NaNinf00e00E0assertion failed: ndigits > 0$\}$assertion failed: buf.len() >= MAX_SIG_DIGITS$assertion failed: d.mant + d.plus < (1 << 61)$assertion failed: d.mant > 0$assertion failed: d.mant.checked_add(d.plus).is_some()$assertion failed: d.mant.checked_sub(d.minus).is_some()$assertion failed: d.minus > 0$assertion failed: edelta >= 0library\core\src\num\diy_float.rs
API String ID: 0-2274042458
Opcode ID: 2de4e176fc2e7624f6b15a55674b243a26dbe88068ff35bd88651f4381473548
Instruction ID: cf9049333adee73974c0d48b30dc01381c528b40ece6c3febab5982b2028f83f
Opcode Fuzzy Hash: 2de4e176fc2e7624f6b15a55674b243a26dbe88068ff35bd88651f4381473548
Instruction Fuzzy Hash: F6324875A087019FC704CF2DD880B5AF7E2AFC8754F198A2DF899A73A5D670D8058B92

Function 00D25680 Relevance: 11.0, APIs: 5, Strings: 2, Instructions: 457COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00D25756
memcpy.MSVCRT(?,00000001,00000000), ref: 00D25765
memset.MSVCRT ref: 00D25853
memcpy.MSVCRT(?,00000001,?), ref: 00D25862
memcpy.MSVCRT(?,00E45AB0,00000240), ref: 00D258DE

Strings

!Z, xrefs: 00D25680
Q7, xrefs: 00D259B9

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: memcpy$memset
String ID: !Z$Q7
API String ID: 438689982-1704855296
Opcode ID: 51cd769674b17652000b33d8aa882b98000c20deab7dd4487be4c678346ddde5
Instruction ID: 815204279701f5ffb6fa1f4259e10989e8a4910731af52b3842729f4a9e0a591
Opcode Fuzzy Hash: 51cd769674b17652000b33d8aa882b98000c20deab7dd4487be4c678346ddde5
Instruction Fuzzy Hash: 431271A18093D09EE7029B38A82D79B7F905F6631CF1C45BCE4D80E283D677955AC7B2

Function 00D347F0 Relevance: 9.9, Strings: 7, Instructions: 1131COMMON

Download Yara Rule

Strings

te k2-by, xrefs: 00D34A61
te k2-byexpate knd 3, xrefs: 00D34AC4
expand 3, xrefs: 00D34B8B
te knd 3expa, xrefs: 00D34B94
expa, xrefs: 00D34B44
nd 32-by, xrefs: 00D34A7C
2-by, xrefs: 00D34BA4

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: 2-by$expa$expand 3$nd 32-by$te k2-by$te k2-byexpate knd 3$te knd 3expa
API String ID: 0-1772262818
Opcode ID: 1391a8e0975a9adc2b0a8bfe7d6b8fa79609e5bb0249d7250758481f8c467e98
Instruction ID: f667fa7c937909993b3b22ebc1cdef48890763d3a36d1e98adb727708446c2eb
Opcode Fuzzy Hash: 1391a8e0975a9adc2b0a8bfe7d6b8fa79609e5bb0249d7250758481f8c467e98
Instruction Fuzzy Hash: F9E244B0D012288FDB64CFA9C984BCDFBF1BF88314F6581AAD409B7215D7706A968F54

Function 00D811A0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 407windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00D811C6
GetModuleHandleW.KERNEL32(NTDLL.DLL), ref: 00D811E2
FormatMessageW.KERNEL32(00001200,00000000,?,00000000,?,00000800,00000000), ref: 00D8120E
GetLastError.KERNEL32(00001200,00000000,?,00000000,?,00000800,00000000), ref: 00D81274

Strings

NTDLL.DLL, xrefs: 00D811DD

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ErrorFormatHandleLastMessageModulememset
String ID: NTDLL.DLL
API String ID: 1434010500-1613819793
Opcode ID: e451c3002f5521537ccb30fbb89dbd953ce35c3b544549ebbee98dad532cae1d
Instruction ID: e0426aceba64393712bae3d0289af5c7675357175990cf19c71b2f36fe8cde3a
Opcode Fuzzy Hash: e451c3002f5521537ccb30fbb89dbd953ce35c3b544549ebbee98dad532cae1d
Instruction Fuzzy Hash: A2E19F76D00219ABDF10EF94DC82AEEBBBCEF49354F180125F905B7241E771994A8BB4

Function 00D2B3D0 Relevance: 9.1, Strings: 6, Instructions: 1608COMMON

Download Yara Rule

Strings

expa, xrefs: 00D2C615
te kexpate k2-bynd 3expa, xrefs: 00D2C6AC
te k2-bynd 3, xrefs: 00D2C57D
2-bynd 3, xrefs: 00D2C5D6
expa, xrefs: 00D2C609
te k2-bynd 3, xrefs: 00D2C715

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: 2-bynd 3$expa$expa$te k2-bynd 3$te k2-bynd 3$te kexpate k2-bynd 3expa
API String ID: 3859560861-1169423403
Opcode ID: b3bfee0bd5dba486e5d42040b4a3bcdae1049ce0dde488c11a7bfe1c92ddc570
Instruction ID: 792a746850d30a6e4907c56ee726d6080f74906f71daa495c46037dc816b4c1a
Opcode Fuzzy Hash: b3bfee0bd5dba486e5d42040b4a3bcdae1049ce0dde488c11a7bfe1c92ddc570
Instruction Fuzzy Hash: F8039CB0D002288BDF64CF69D981BDDBBB5BF48318F1581AAE409B7211D770AE95CF64

Function 00D2B3E9 Relevance: 9.1, Strings: 6, Instructions: 1599COMMON

Download Yara Rule

Strings

expa, xrefs: 00D2C615
te kexpate k2-bynd 3expa, xrefs: 00D2C6AC
te k2-bynd 3, xrefs: 00D2C57D
2-bynd 3, xrefs: 00D2C5D6
expa, xrefs: 00D2C609
te k2-bynd 3, xrefs: 00D2C715

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: 2-bynd 3$expa$expa$te k2-bynd 3$te k2-bynd 3$te kexpate k2-bynd 3expa
API String ID: 3859560861-1169423403
Opcode ID: 97f48c8a2df15bce88681cfdd8023e39d4d935f3ea2e86bb036e49e5159a010f
Instruction ID: b911fb70c05569916553219500ce86dbfed7183d6495b33dc373e1ca3ad90cf4
Opcode Fuzzy Hash: 97f48c8a2df15bce88681cfdd8023e39d4d935f3ea2e86bb036e49e5159a010f
Instruction Fuzzy Hash: 14039CB0D002288BDB64CF69D981BDDFBB5BF48318F1581AAE409B7211D7706E958F64

Function 00D2B402 Relevance: 9.1, Strings: 6, Instructions: 1590COMMON

Download Yara Rule

Strings

expa, xrefs: 00D2C615
te kexpate k2-bynd 3expa, xrefs: 00D2C6AC
te k2-bynd 3, xrefs: 00D2C57D
2-bynd 3, xrefs: 00D2C5D6
expa, xrefs: 00D2C609
te k2-bynd 3, xrefs: 00D2C715

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: 2-bynd 3$expa$expa$te k2-bynd 3$te k2-bynd 3$te kexpate k2-bynd 3expa
API String ID: 3859560861-1169423403
Opcode ID: 5a53c02f49d76ba054c5d8cdedf8ccb7d9c4aa8412a1ef7929b9f78e25328295
Instruction ID: 98897ebe586da3d458b0c69fcaf909a5a03a58528d82afbc34c9b1164dd02c34
Opcode Fuzzy Hash: 5a53c02f49d76ba054c5d8cdedf8ccb7d9c4aa8412a1ef7929b9f78e25328295
Instruction Fuzzy Hash: DB039BB0D002288FDB64CFA9D981BDDFBB5BF48318F1581AAE409B7211D7706E958F64

Function 00D2B421 Relevance: 9.1, Strings: 6, Instructions: 1581COMMON

Download Yara Rule

Strings

expa, xrefs: 00D2C615
te kexpate k2-bynd 3expa, xrefs: 00D2C6AC
te k2-bynd 3, xrefs: 00D2C57D
2-bynd 3, xrefs: 00D2C5D6
expa, xrefs: 00D2C609
te k2-bynd 3, xrefs: 00D2C715

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: 2-bynd 3$expa$expa$te k2-bynd 3$te k2-bynd 3$te kexpate k2-bynd 3expa
API String ID: 3859560861-1169423403
Opcode ID: d0d6c653647b1ac2fc5204ca45a0add7fe6ca094c464a0d1f0e59dc988b86494
Instruction ID: 02aa6bee82e9a0f4669cddea974ff44793cabf30520e6f59127b0a61db193fdf
Opcode Fuzzy Hash: d0d6c653647b1ac2fc5204ca45a0add7fe6ca094c464a0d1f0e59dc988b86494
Instruction Fuzzy Hash: 5E039BB0D002288BDB64CFA9D981BDDFBB5BF88314F1581AAE409B7211D7706E95CF64

Function 00D2B440 Relevance: 9.1, Strings: 6, Instructions: 1572COMMON

Download Yara Rule

Strings

expa, xrefs: 00D2C615
te kexpate k2-bynd 3expa, xrefs: 00D2C6AC
te k2-bynd 3, xrefs: 00D2C57D
2-bynd 3, xrefs: 00D2C5D6
expa, xrefs: 00D2C609
te k2-bynd 3, xrefs: 00D2C715

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: 2-bynd 3$expa$expa$te k2-bynd 3$te k2-bynd 3$te kexpate k2-bynd 3expa
API String ID: 3859560861-1169423403
Opcode ID: 2d908bec1a1d2e581b9ce5a7d83b88b4ebd8b32afe260412c86cb5c25306573d
Instruction ID: bfaf6fc91c9be94e9e45d3e9f960c047eab71b6299325c5fa01d12e41be01150
Opcode Fuzzy Hash: 2d908bec1a1d2e581b9ce5a7d83b88b4ebd8b32afe260412c86cb5c25306573d
Instruction Fuzzy Hash: 47039BB0D002288BDB64CFA9D981BDDFBB5BF88314F1581AAE409B7211D7706E95CF64

Function 00D705A0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 316threadCOMMON

Download Yara Rule

APIs

InitializeProcThreadAttributeList.KERNEL32(00000000,?,00000000,00000000), ref: 00D705C2
InitializeProcThreadAttributeList.KERNEL32(00000001,?,00000000,00000000,00000000,?,00000000,00000000), ref: 00D70663
UpdateProcThreadAttribute.KERNEL32(?,00000000,?,?,?,00000000,00000000,00000001,?,00000000,00000000,00000000,?,00000000,00000000), ref: 00D70746

Strings

panicked at :fulllibrary\std\src\path.rs, xrefs: 00D70843

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: AttributeProcThread$InitializeList$Update
String ID: panicked at :fulllibrary\std\src\path.rs
API String ID: 3806694049-4028486446
Opcode ID: 0d796f54b4178da69a25daf57de0841b42c0c20e62f5ee71bc84f1630d93aea5
Instruction ID: 73507b31f872d093339366c5b0187b892f9c7c42725812b1d8daa584a743c450
Opcode Fuzzy Hash: 0d796f54b4178da69a25daf57de0841b42c0c20e62f5ee71bc84f1630d93aea5
Instruction Fuzzy Hash: AEB1D575A00310DBDB149F54D891BAABBA9EF95304F08C42DFD49AB382E771AC05CBB1

Function 00D2B45F Relevance: 9.1, Strings: 6, Instructions: 1563COMMON

Download Yara Rule

Strings

expa, xrefs: 00D2C615
te kexpate k2-bynd 3expa, xrefs: 00D2C6AC
te k2-bynd 3, xrefs: 00D2C57D
2-bynd 3, xrefs: 00D2C5D6
expa, xrefs: 00D2C609
te k2-bynd 3, xrefs: 00D2C715

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: 2-bynd 3$expa$expa$te k2-bynd 3$te k2-bynd 3$te kexpate k2-bynd 3expa
API String ID: 3859560861-1169423403
Opcode ID: 532962badd38df1cb995748a58e9fdd6c4e6288cdcdf5b2eddac7b7c85a74756
Instruction ID: 4ea593d512eefa49364e72280f81768a6fc97893d1d3bfc25f567edd79f50d0d
Opcode Fuzzy Hash: 532962badd38df1cb995748a58e9fdd6c4e6288cdcdf5b2eddac7b7c85a74756
Instruction Fuzzy Hash: 40038BB0D002288BDB64CFA9D981BDDFBB5BF88314F1581AAE409B7211D7706E95CF64

Function 00D2B47E Relevance: 9.1, Strings: 6, Instructions: 1554COMMON

Download Yara Rule

Strings

expa, xrefs: 00D2C615
te kexpate k2-bynd 3expa, xrefs: 00D2C6AC
te k2-bynd 3, xrefs: 00D2C57D
2-bynd 3, xrefs: 00D2C5D6
expa, xrefs: 00D2C609
te k2-bynd 3, xrefs: 00D2C715

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: 2-bynd 3$expa$expa$te k2-bynd 3$te k2-bynd 3$te kexpate k2-bynd 3expa
API String ID: 3859560861-1169423403
Opcode ID: 07ecdccdceb3101277b9e4b56625270e025fe5ad9bc3cd12b1419d8d0e5065cd
Instruction ID: 097d862ff8921028f0028775614ee3c16aba30965fcb5c385e28fee202934842
Opcode Fuzzy Hash: 07ecdccdceb3101277b9e4b56625270e025fe5ad9bc3cd12b1419d8d0e5065cd
Instruction Fuzzy Hash: 14038AB0D002288BDB64CFA9D981BDDFBB5BF88314F1581AAE409B7211D7706E95CF64

Function 00D2B49D Relevance: 9.0, Strings: 6, Instructions: 1545COMMON

Download Yara Rule

Strings

expa, xrefs: 00D2C615
te kexpate k2-bynd 3expa, xrefs: 00D2C6AC
te k2-bynd 3, xrefs: 00D2C57D
2-bynd 3, xrefs: 00D2C5D6
expa, xrefs: 00D2C609
te k2-bynd 3, xrefs: 00D2C715

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: 2-bynd 3$expa$expa$te k2-bynd 3$te k2-bynd 3$te kexpate k2-bynd 3expa
API String ID: 3859560861-1169423403
Opcode ID: b9f984c8f28114fb4950daa2d55bf18ddf86b999a331c8ed514b31ddf38ab385
Instruction ID: baa90c73b54085c044225738788aead0d68fc611143bd5973da818665fb59951
Opcode Fuzzy Hash: b9f984c8f28114fb4950daa2d55bf18ddf86b999a331c8ed514b31ddf38ab385
Instruction Fuzzy Hash: E6038AB0D002288FDB64CFA9D981B9DFBB5BF88314F1581AAE409B7211D7706E95CF64

Function 00D2C2BB Relevance: 8.7, Strings: 6, Instructions: 1154COMMON

Download Yara Rule

Strings

expa, xrefs: 00D2C615
te kexpate k2-bynd 3expa, xrefs: 00D2C6AC
te k2-bynd 3, xrefs: 00D2C57D
2-bynd 3, xrefs: 00D2C5D6
expa, xrefs: 00D2C609
te k2-bynd 3, xrefs: 00D2C715

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: 2-bynd 3$expa$expa$te k2-bynd 3$te k2-bynd 3$te kexpate k2-bynd 3expa
API String ID: 3859560861-1169423403
Opcode ID: 493cbb696afc764adfdf4cd0c010092deedfd2ad82f3e2a1a88f88279add4c1b
Instruction ID: 3fd0f41c50a28613065639aff45721f5360485f7fce8ed23f74bfddafecad585
Opcode Fuzzy Hash: 493cbb696afc764adfdf4cd0c010092deedfd2ad82f3e2a1a88f88279add4c1b
Instruction Fuzzy Hash: 7EE253B0D012288FDB64CFA9C980BDDFBB1BF88314F2581AAD509B7215D7706A95CF94

Function 00D2C2E0 Relevance: 8.6, Strings: 6, Instructions: 1147COMMON

Download Yara Rule

Strings

expa, xrefs: 00D2C615
te kexpate k2-bynd 3expa, xrefs: 00D2C6AC
te k2-bynd 3, xrefs: 00D2C57D
2-bynd 3, xrefs: 00D2C5D6
expa, xrefs: 00D2C609
te k2-bynd 3, xrefs: 00D2C715

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: 2-bynd 3$expa$expa$te k2-bynd 3$te k2-bynd 3$te kexpate k2-bynd 3expa
API String ID: 0-1169423403
Opcode ID: 5b4e6dc10e4845c98df1a516c390e4f0a8b47a4ab8de50f9d2de8cc8d659db94
Instruction ID: 318c85beef055dc6f5e716111c30605f43f572dea4c5a2d74f42b7a7c06b2aac
Opcode Fuzzy Hash: 5b4e6dc10e4845c98df1a516c390e4f0a8b47a4ab8de50f9d2de8cc8d659db94
Instruction Fuzzy Hash: 5DE252B0D012288FDB64CFA9C980BDDFBB1BF88314F2581AAD509B7215D7706A95CF94

Function 00DA0684 Relevance: 8.2, Strings: 6, Instructions: 734COMMON

Download Yara Rule

Strings

fs10, xrefs: 00DA1024
ft10, xrefs: 00DA1034
11tf, xrefs: 00DA104E
fs11, xrefs: 00DA102C
21tf, xrefs: 00DA1046
zero, xrefs: 00DA101C

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: 11tf$21tf$fs10$fs11$ft10$zero
API String ID: 0-3297899624
Opcode ID: 392d2f25d44e45a3f4478907d7506dfbff153e0ad2e0708c9d3bfbe1bfcbb4cd
Instruction ID: 521ff62b784e6d35659b34a81ccbf222211fd85b0eef1771fe468aaf48e5a56f
Opcode Fuzzy Hash: 392d2f25d44e45a3f4478907d7506dfbff153e0ad2e0708c9d3bfbe1bfcbb4cd
Instruction Fuzzy Hash: 4A429E1C40C2B18CD7AA5B26C4260737AE2DF5B741B4F8097D7C74FAF9D1698B80A2B1

Function 00DB0190 Relevance: 8.0, APIs: 3, Strings: 2, Instructions: 484COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(00000000,00000000,00000003,?,?,?,00001200,00000000), ref: 00DB0352

Strings

@k, xrefs: 00DB03CC, 00DB03DD
@k, xrefs: 00DB02C9, 00DB055A, 00DB06F4

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: memcpy
String ID: @k$@k
API String ID: 3510742995-1676244581
Opcode ID: 7333287da004dc55299fead2c8d73d515df960c17d95f48116f3582458628a8c
Instruction ID: f133425045fb6a0750ec18c71685474cbb7a0c30b45c8f7ca40a3361a5d4f45e
Opcode Fuzzy Hash: 7333287da004dc55299fead2c8d73d515df960c17d95f48116f3582458628a8c
Instruction Fuzzy Hash: 19028E72E00219CFDF10CF98C8817EFBBB4EB59314F184569E856A7381D678AA45DBB0

Function 00D7F651 Relevance: 7.8, APIs: 5, Instructions: 275filenativesynchronizationCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,00000000,00000000,00000000,00000103,?,?,00000000,00000000), ref: 00D7F7C0
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,00000000,00000000,00000103,?,?,00000000,00000000), ref: 00D7F7D1

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: FileObjectReadSingleWait
String ID:
API String ID: 631497895-0
Opcode ID: d278ed7dfd5868cc0e7e0324b0533814112cb6ffedc6906971760babaa276f98
Instruction ID: db52fe5210db56d28babe43e8a6168cfd418a35a2c01b8d8809f658ed37787a9
Opcode Fuzzy Hash: d278ed7dfd5868cc0e7e0324b0533814112cb6ffedc6906971760babaa276f98
Instruction Fuzzy Hash: 26B191B1A002199FDB24CF98D850BAEBBF5FF48314F248529E859E7341E375E945CBA0

Function 00DB74A1 Relevance: 7.6, Strings: 6, Instructions: 131COMMON

Download Yara Rule

Strings

}, xrefs: 00DB7672
{, xrefs: 00DB767D
{, xrefs: 00DB757C
}, xrefs: 00DB7571
\u, xrefs: 00DB7575
\u, xrefs: 00DB7676

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: \u$\u${${$}$}
API String ID: 0-582841131
Opcode ID: e6e947eea89db5448a336d2ca07fbc3b985848f50500bb6001c10bcbe1d6f67a
Instruction ID: df33ad9f5e7ebba573161da9c76d4d211db8f9e59efe2aa02236ef7432532ca7
Opcode Fuzzy Hash: e6e947eea89db5448a336d2ca07fbc3b985848f50500bb6001c10bcbe1d6f67a
Instruction Fuzzy Hash: 26514722E1AAD586C7558B7845102EEFFF21FEA211F2D829BC4992F383C6358605C7B5

Function 00DA719E Relevance: 7.6, Strings: 6, Instructions: 123COMMON

Download Yara Rule

Strings

{, xrefs: 00DA7272
\u, xrefs: 00DA726B
\u, xrefs: 00DA735B
}, xrefs: 00DA7267
}, xrefs: 00DA7357
{, xrefs: 00DA7362

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: \u$\u${${$}$}
API String ID: 0-582841131
Opcode ID: fa05b7f4960a5d455b7df260376a3542df92801b402f294437297aad9ed272e8
Instruction ID: 4084b7fb3af15ad2e0c4932f930b996196f79bae5780cf0e11b52337943128f9
Opcode Fuzzy Hash: fa05b7f4960a5d455b7df260376a3542df92801b402f294437297aad9ed272e8
Instruction Fuzzy Hash: 69415712E0ABC585D7418B7448102BEFFB21FE6210F6D87AAC4AD2F383C6349145D3B5

Function 00DAC5E0 Relevance: 7.2, Strings: 5, Instructions: 957COMMON

Download Yara Rule

Strings

.g, xrefs: 00DACD54
__ZN, xrefs: 00DACA5B
.g, xrefs: 00DAC935
.llvm./rust/deps\rustc-demangle-0.1.24\src\lib.rs, xrefs: 00DAC5F8
`fmt::Error`s should be impossible without a `fmt::Formatter`, xrefs: 00DAD230

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: memcmp
String ID: .g$.g$.llvm./rust/deps\rustc-demangle-0.1.24\src\lib.rs$__ZN$`fmt::Error`s should be impossible without a `fmt::Formatter`
API String ID: 1475443563-4161860961
Opcode ID: 265c83aecc94b97e6ffeeb076f7aa35e53bd671721d9135e59845e4082d7d428
Instruction ID: ce530eb2ad723638e2050a4f9ce346d5ab6fade05dc5f71718be6331f837e241
Opcode Fuzzy Hash: 265c83aecc94b97e6ffeeb076f7aa35e53bd671721d9135e59845e4082d7d428
Instruction Fuzzy Hash: 7B72E472A187519FD714CF18C49066AB7E2FFC6320F188A1DF8A69B291D374DD41CBA2

Function 00DB3040 Relevance: 6.8, Strings: 5, Instructions: 577COMMON

Download Yara Rule

Strings

FFFF, xrefs: 00DB308B
cannot parse float from empty stringinvalid float literalassertion failed: edelta >= 0library\core\src\num\diy_float.rs, xrefs: 00DB3729
(z, xrefs: 00DB36FE
FFFF, xrefs: 00DB323B
-, xrefs: 00DB36C4

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: (z$-$FFFF$FFFF$cannot parse float from empty stringinvalid float literalassertion failed: edelta >= 0library\core\src\num\diy_float.rs
API String ID: 0-2673944413
Opcode ID: 5314109b0f871ab6d5a9175e9c2a39e63bb71bbf2de2b9a87ce42c6b84730d38
Instruction ID: 2a0c13da876e8e0315e820fab72376836760a80a4a6a01d100e6544a6f47dc66
Opcode Fuzzy Hash: 5314109b0f871ab6d5a9175e9c2a39e63bb71bbf2de2b9a87ce42c6b84730d38
Instruction Fuzzy Hash: 58226F71E002198FCB18CF9DC8807EEBBF2FF89314F298129D415AB395D7749A459BA0

Function 00DB2610 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 267COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00DB2630
memset.MSVCRT ref: 00DB28F5
memcpy.MSVCRT(?,?,0000030C), ref: 00DB290D

Strings

-, xrefs: 00DB28D1

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: memset$memcpy
String ID: -
API String ID: 368790112-2547889144
Opcode ID: 69d1cb1a9860dbf35956f31e9fc9ef1b9e33449f4ece9e863f5c05db5492577d
Instruction ID: 8f79a6befe71d57796474fdeb768393f48d4286638ed574f51397aaf7425cec8
Opcode Fuzzy Hash: 69d1cb1a9860dbf35956f31e9fc9ef1b9e33449f4ece9e863f5c05db5492577d
Instruction Fuzzy Hash: 3891F976E00259CBDF25CE69C8807FEB7A6FF48310F5C8569D85667280E730AE418BB0

Function 00D7E620 Relevance: 6.2, APIs: 4, Instructions: 226COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00D7E78A
memset.MSVCRT ref: 00D7E7A7
FindFirstFileExW.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00D7E7C2
FindClose.KERNEL32(00000000,?,00000001,?,00000000,00000000,00000000), ref: 00D7E7D4

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: CloseFind$FileFirstHandlememset
String ID:
API String ID: 4181070385-0
Opcode ID: 7ecbe1628e7cd48f7581625cf54dc9eca581097102232d79518f2467efe830e0
Instruction ID: 3d4b89e32a2f8c2e5bc5b514b1516757b85d3f037a1b9e52ba135fea07739d00
Opcode Fuzzy Hash: 7ecbe1628e7cd48f7581625cf54dc9eca581097102232d79518f2467efe830e0
Instruction Fuzzy Hash: 4E917CB0E003199FEB24CF94D885BAEBBF5EF58304F148459E849AB381E774A944CF61

Function 00D8E0F0 Relevance: 6.1, APIs: 4, Instructions: 101networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D803A0: WSASocketW.WS2_32(00000002,00D6E889,00000000,00000000,00000000,00000081), ref: 00D803CC

bind.WS2_32(?,?,00000010), ref: 00D8E1D4
listen.WS2_32(?,00000080), ref: 00D8E1E4
WSAGetLastError.WS2_32 ref: 00D8E1F6
closesocket.WS2_32(?), ref: 00D8E20C

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ErrorLastSocketbindclosesocketlisten
String ID:
API String ID: 1850986032-0
Opcode ID: a26d09a11970176c06c35a5206041e92d59164d2ab731c020be7574e8fa5da36
Instruction ID: 55204dcff3ce722965c544ecf48a171cc8dace070d86797a1620de1ab594ed0f
Opcode Fuzzy Hash: a26d09a11970176c06c35a5206041e92d59164d2ab731c020be7574e8fa5da36
Instruction Fuzzy Hash: 9141B2708043599EDB10DF68C880BAEBBF5EF55310F18C55AE998AB342E334E944CB71

Function 00D7C080 Relevance: 6.1, APIs: 4, Instructions: 101filenativeCOMMON

Download Yara Rule

APIs

NtOpenFile.NTDLL(00000000,?,?,00000103,00000007,?), ref: 00D7C0F7

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: FileOpen
String ID:
API String ID: 2669468079-0
Opcode ID: 0e41b68e605035bd08c70b3d8171141ede838c57dab4feadddf154022c3baffc
Instruction ID: 40c2a8be71f949f8ec4c15f7b71db53cb157f15397cc3598356bd87d015b63b5
Opcode Fuzzy Hash: 0e41b68e605035bd08c70b3d8171141ede838c57dab4feadddf154022c3baffc
Instruction Fuzzy Hash: CA313EB09103099FEB14DF94D895BEFBBB8EB48304F54542EE949E7241E3749984CBB1

Function 00D807B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,7FFFFFFF,00000000), ref: 00D80832
WSAGetLastError.WS2_32(?,?,7FFFFFFF,00000000,?,?,assertion failed: socket != sys::c::INVALID_SOCKET as RawSocketlibrary\std\src\os\windows\io\socket.rs,0000003F,00E4AED4), ref: 00D8083C

Part of subcall function 00D70330: memset.MSVCRT ref: 00D70350
Part of subcall function 00D70330: GetCurrentProcessId.KERNEL32 ref: 00D7035A
Part of subcall function 00D70330: WSADuplicateSocketW.WS2_32(0F08C483,00000000,?), ref: 00D70362
Part of subcall function 00D70330: WSASocketW.WS2_32(?,?,?,?,00000000,00000081), ref: 00D70386

Strings

assertion failed: socket != sys::c::INVALID_SOCKET as RawSocketlibrary\std\src\os\windows\io\socket.rs, xrefs: 00D80805

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Socket$CurrentDuplicateErrorLastProcessmemsetrecv
String ID: assertion failed: socket != sys::c::INVALID_SOCKET as RawSocketlibrary\std\src\os\windows\io\socket.rs
API String ID: 3340724250-42570012
Opcode ID: f3846dbf804ff2e63f43a066390e144f5dbe7252c4e6115c045177e2b73da6ef
Instruction ID: 78d41dd20cd6c3bbcd643acc029e64832aaa7d6117efe7b7596fda1f4f674383
Opcode Fuzzy Hash: f3846dbf804ff2e63f43a066390e144f5dbe7252c4e6115c045177e2b73da6ef
Instruction Fuzzy Hash: BF21D831A00258ABCB20AF68D8405EDBBA5DF05330F14856AF9B9D73D0D630A944CBA1

Function 00D6C2AE Relevance: 4.8, APIs: 3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db616937e1de4e7669cd4d408b45d5e79a9c96f40831b32cabe570f83d421b37
Instruction ID: e392b15805bf97123c46917e0881f4be38a31d25767776ea4bd2dae96611b5d9
Opcode Fuzzy Hash: db616937e1de4e7669cd4d408b45d5e79a9c96f40831b32cabe570f83d421b37
Instruction Fuzzy Hash: 8CB17CB5E10259CFDB14CF98C890BEDBBB1AF49304F28815AE495AB391D374A941CF60

Function 00D8E4A0 Relevance: 4.6, APIs: 3, Instructions: 95networkCOMMON

Download Yara Rule

APIs

bind.WS2_32(?,?,00000010), ref: 00D8E57E

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: bind
String ID:
API String ID: 1187836755-0
Opcode ID: 01d5bc96df894329c81adbdb7b81a57a0d1a50cfe7af5a31b262a0f806918c56
Instruction ID: eeece6ae27f4d680b03f7647fb178eb024d10393816422e327a8a6428f4814ca
Opcode Fuzzy Hash: 01d5bc96df894329c81adbdb7b81a57a0d1a50cfe7af5a31b262a0f806918c56
Instruction Fuzzy Hash: C441D270909299DFCB10DF68D580AAEBBF1EF55304F18C49AE8995B382E335E944CB71

Function 00D5E6C9 Relevance: 4.5, Strings: 3, Instructions: 790COMMON

Download Yara Rule

Strings

O, xrefs: 00D5F786
O, xrefs: 00D5EF3D
O, xrefs: 00D5EC34

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: O$O$O
API String ID: 0-1604089782
Opcode ID: 916451372e31eb55dae78e2a022311c8cb43f44b7dd1b0be704b8cd70878464d
Instruction ID: 67616489c7f4012aa72b19dc89389b3041ae6c6c5d2f1318a6c68d4fc140385d
Opcode Fuzzy Hash: 916451372e31eb55dae78e2a022311c8cb43f44b7dd1b0be704b8cd70878464d
Instruction Fuzzy Hash: AB8217759087418FC724CF19C480A5AFBE1BF98311F158A6DECD99B362D730E949CBA2

Function 00DC5380 Relevance: 4.3, Strings: 3, Instructions: 576COMMON

Download Yara Rule

Strings

-, xrefs: 00DC59C1
NAN, xrefs: 00DC5707
, xrefs: 00DC54A5

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: $-$NAN
API String ID: 0-3673145351
Opcode ID: 7c4033cad07f087f2187d34b8f336ff4a5a6ae2557bc66f14418aecc99949da7
Instruction ID: c9b5b019aeb871a105175edace22e8ec3c95e4f38138dfcffe48a43334b29a59
Opcode Fuzzy Hash: 7c4033cad07f087f2187d34b8f336ff4a5a6ae2557bc66f14418aecc99949da7
Instruction Fuzzy Hash: 51223871908746CFC710CF24E880BAEB7E5FF85314F18892DE885A7285D775E989CBA1

Function 00DCA370 Relevance: 4.3, Strings: 3, Instructions: 525COMMON

Download Yara Rule

Strings

., xrefs: 00DCA8DC
-+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 00DCA96A
d, xrefs: 00DCA430

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: -+NaNinf00e00E0assertion failed: ndigits > 0$.$d
API String ID: 0-1458908954
Opcode ID: d180bec714e6f0dbbaceb34f82378888fa25246c28d55031f8905974533aa1a9
Instruction ID: 56dec51c5f85e4a79cfe565d3657cdb209423d40e920aac6f3ca538b7cac6fa9
Opcode Fuzzy Hash: d180bec714e6f0dbbaceb34f82378888fa25246c28d55031f8905974533aa1a9
Instruction Fuzzy Hash: 7902E372F0022A8FDF18CE6DC895BADB6F6AF88304F19813DD809EB391D6759D058791

Function 00D36540 Relevance: 3.7, Strings: 2, Instructions: 1198COMMON

Download Yara Rule

Strings

te kexpate k2-byte kte k2-by2-bynd 3nd 3expa2-byexpand 3, xrefs: 00D36856
nd 3expa, xrefs: 00D368A4

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: nd 3expa$te kexpate k2-byte kte k2-by2-bynd 3nd 3expa2-byexpand 3
API String ID: 0-2854347106
Opcode ID: 2b2ef7bf626ba3561d90350d0672682bb1427ab6151d2fbfd63804d0ef1256a2
Instruction ID: 7fbfcfe1781a543d6842949524f7d4fe33bd5dcd8bbbdb4fc143094fad4e9c41
Opcode Fuzzy Hash: 2b2ef7bf626ba3561d90350d0672682bb1427ab6151d2fbfd63804d0ef1256a2
Instruction Fuzzy Hash: 4FE25AB0D012288FDB68CF99C984BDDFBB1BF88314F6581AAD409B7215D7346A86CF54

Function 00D390B0 Relevance: 3.7, Strings: 2, Instructions: 1178COMMON

Download Yara Rule

Strings

te kexpate k2-byte kte k2-by2-bynd 3nd 3expa2-byexpand 3, xrefs: 00D39386
nd 3expa, xrefs: 00D393D4

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: nd 3expa$te kexpate k2-byte kte k2-by2-bynd 3nd 3expa2-byexpand 3
API String ID: 0-2854347106
Opcode ID: 64ed0acc27c8227c16d32ef560bab9731505e12ab7309660c7c83622f68fff33
Instruction ID: 90f6a4dae1b1b7e1317ac6961d2855868db36c7d5160f417c14cb9bc9a2d59e2
Opcode Fuzzy Hash: 64ed0acc27c8227c16d32ef560bab9731505e12ab7309660c7c83622f68fff33
Instruction Fuzzy Hash: D0E259B0D012288FDB68CF99C984BDDFBB1BF88314F6581AAD409B7215D7346A86CF54

Function 00D41080 Relevance: 3.0, APIs: 2, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 701328e23a0e5dc6adafd7ed6b7304df9096c2c5af97ebf4c13bbf5a1365ffbc
Instruction ID: 58a22d64bb21b47b95f3efd2349201c4bbc47173e8c4558fb3de0e4941f32f3d
Opcode Fuzzy Hash: 701328e23a0e5dc6adafd7ed6b7304df9096c2c5af97ebf4c13bbf5a1365ffbc
Instruction Fuzzy Hash: F012BF75A047019FCB14CF18C880A6AB7F2FFC9354F198A1DE5899B351D770E985CBA2

Function 00D40290 Relevance: 3.0, APIs: 2, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d20080d5f17355b49bba04f9ac84e2d96974d37429b8600816d4b17ab09c53b
Instruction ID: dac3a5dcd7dd7ba2541f02ff7e7a83a2ee7531cb28faaf9d4f5748383f5dc549
Opcode Fuzzy Hash: 9d20080d5f17355b49bba04f9ac84e2d96974d37429b8600816d4b17ab09c53b
Instruction Fuzzy Hash: 68129071A087019FCB14CF18C880A6ABBE6FFC9354F158A1DF6899B351D730E945CBA2

Function 00D41720 Relevance: 2.9, APIs: 2, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cddcd4f8e800f8c1d161ef288d1f7d3b86d5a7ad7660ea52d0ae7d7d10d6a89
Instruction ID: 7280feba324ec7443a6a24882bbe750ba9814c4fe4f725bd9267555ad081475c
Opcode Fuzzy Hash: 2cddcd4f8e800f8c1d161ef288d1f7d3b86d5a7ad7660ea52d0ae7d7d10d6a89
Instruction Fuzzy Hash: E7F16E75E002199FCF24CF98C981AEEB7B6FF89310F198129E855B7351D631AD81CBA4

Function 00D26640 Relevance: 2.9, Strings: 2, Instructions: 374COMMON

Download Yara Rule

Strings

called `Result::unwrap()` on an `Err` valueRng::fill failed~\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rand-0.8.5\src\rng.rs, xrefs: 00D26845
XP, xrefs: 00D2684F

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: XP$called `Result::unwrap()` on an `Err` valueRng::fill failed~\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rand-0.8.5\src\rng.rs
API String ID: 0-605685950
Opcode ID: 78bdc02ec41206bf25ff312e6d18498b56304ca51cee0e0494f8ee50da0991f5
Instruction ID: 19c9785e31f9b30113d5ea8fc23ec7eaf1a2e9d8a834386a5e7023d71471478c
Opcode Fuzzy Hash: 78bdc02ec41206bf25ff312e6d18498b56304ca51cee0e0494f8ee50da0991f5
Instruction Fuzzy Hash: 2DD11835E04B655BC7128F3C988166AF7A1BFE6348F44C72EECA177646D730D94582A0

Function 00DBC1A0 Relevance: 2.7, Strings: 2, Instructions: 234COMMON

Download Yara Rule

Strings

-+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 00DBC300
e0E0assertion failed: buf.len() >= ndigits || buf.len() >= maxlen, xrefs: 00DBC459

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: -+NaNinf00e00E0assertion failed: ndigits > 0$e0E0assertion failed: buf.len() >= ndigits || buf.len() >= maxlen
API String ID: 0-3864725730
Opcode ID: 81f93cf18b5536b475f48a4a9cb8117f83ec65440927edd20affdf036e9d9c8b
Instruction ID: 5d59347e5f8ef57d7e3e94099035ab964855e7e5a03d248e8b4a5dc316a8a4f0
Opcode Fuzzy Hash: 81f93cf18b5536b475f48a4a9cb8117f83ec65440927edd20affdf036e9d9c8b
Instruction Fuzzy Hash: 0B910671A18340DBD714CF14C8817ABB7E2FFC8304F54A92EF99A57290DBB5D9048B66

Function 00DBB5E0 Relevance: 2.7, Strings: 2, Instructions: 233COMMON

Download Yara Rule

Strings

assertion failed: buf.len() >= maxlen, xrefs: 00DBB943
-+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 00DBB731

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: -+NaNinf00e00E0assertion failed: ndigits > 0$assertion failed: buf.len() >= maxlen
API String ID: 0-2939795802
Opcode ID: e652007f72039b83e711517467cbba81c9099f4ac84824b2741ed22858bfcf32
Instruction ID: 877967d8125ee4c351288f24ab5c0e0496d1d32dc8824f375637750e11be4394
Opcode Fuzzy Hash: e652007f72039b83e711517467cbba81c9099f4ac84824b2741ed22858bfcf32
Instruction Fuzzy Hash: F691AEB1A08300DBD704CF15C8417ABB7E6EFC8314F148A2EF99A9B290DBB5D945CB56

Function 00DC1610 Relevance: 2.1, APIs: 1, Instructions: 802COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(00000001,?,00000000), ref: 00DC17BE

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 285aa0d6c74c960ac35d68614e0dee6143c84371a882b24701151b86a7d2fae8
Instruction ID: 2d9533b5447fd80da30c17e297a3f21ff4b377fd17f164e802d324d214f92fd3
Opcode Fuzzy Hash: 285aa0d6c74c960ac35d68614e0dee6143c84371a882b24701151b86a7d2fae8
Instruction Fuzzy Hash: 3262C675E0022A8FDB15CF68C840BFEB7B6BF9A340F15825DE855B7242D7719D418BA0

Function 00DB87E0 Relevance: 1.8, Strings: 1, Instructions: 519COMMON

Download Yara Rule

Strings

0, xrefs: 00DB8BAD

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 24956c45270d8bae2036164a76ac29c9e19dee877c5abcfb51be31e0b2b1b43f
Instruction ID: b10e202bad4780f7417ad66343be9a57cd88e547bafe5ad0a64b626a808df164
Opcode Fuzzy Hash: 24956c45270d8bae2036164a76ac29c9e19dee877c5abcfb51be31e0b2b1b43f
Instruction Fuzzy Hash: D4227E71D0422ACFCF14CF68C8906EDBBB6BF49314F19825AD8627B385DB359941DBA0

Function 00D51540 Relevance: 1.5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

8, xrefs: 00D519E5

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: 30dc2d6210e65d507386ea76b5b4443455e9e63ab62d1f8b099af04167086ef8
Instruction ID: 723db6e96317f21c46dad38a5375add265afe2154b30a9ce3c9f91e60a7aed4e
Opcode Fuzzy Hash: 30dc2d6210e65d507386ea76b5b4443455e9e63ab62d1f8b099af04167086ef8
Instruction Fuzzy Hash: 23C14EB5D002198FDF14CF99C8807ADFBF2BF88315F24866AD855AB344D774994ACBA0

Function 00D61750 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00D61770

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 989f2c1414a9bf8259de64dce92bbec471387f720fbc2c0506de04ef2c1e1c1b
Instruction ID: 001930dd129abf04c38a13a91ad80ad0c831a529f9c27c11e754eaa70d0de227
Opcode Fuzzy Hash: 989f2c1414a9bf8259de64dce92bbec471387f720fbc2c0506de04ef2c1e1c1b
Instruction Fuzzy Hash: 15F08274D08348CBCB10DFA9D9807EABBF8EF19310F189519E889A7300E330A9C4C7A5

Function 00DCF580 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c577a29ef774787a1919f375276ae424bd2802d0fc49b20c554d7c1c64a02053
Instruction ID: 863ad3990a994713f8ef0e9350c5d3578c3c069c7b1a705056ebac8fc4f82bc1
Opcode Fuzzy Hash: c577a29ef774787a1919f375276ae424bd2802d0fc49b20c554d7c1c64a02053
Instruction Fuzzy Hash: C2C16A33B003215BDB1C4B2D9CD0AAD73D7DBC4395B1F863AD95A7B291D5709D0A86E0

Function 00D953B0 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9ce4338fd887141fb9612d4b48a9eaff70d8ba9a6276033decfccce72a02b81
Instruction ID: 529d9393a42905c8547d8fda66b0b5ebd996d8e5cd1fec8cbb5f977232f9a9cf
Opcode Fuzzy Hash: b9ce4338fd887141fb9612d4b48a9eaff70d8ba9a6276033decfccce72a02b81
Instruction Fuzzy Hash: 38B17B32B00A158BDF198E6DE8907BEB7E2EF85320F5D817DD8859B35DD6348C8587A0

Function 00DC08D0 Relevance: .3, Instructions: 340COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff770072793ce04a42c52e2bb17460be005374ad3926009d11591fb2bff88ad1
Instruction ID: c0d48f817a5a5e0b63faf6ef9d91c526c6761ecf2685374913a245b827e1ad0a
Opcode Fuzzy Hash: ff770072793ce04a42c52e2bb17460be005374ad3926009d11591fb2bff88ad1
Instruction Fuzzy Hash: F4C15C76E29B824BD7138B3DD802665F790AFE7290F15D72EFCE473982EB3096814244

Function 00D510E0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c72fc035f39ff18bf0ebcc914572c194267d3bf521bf6442c4757bc8df46418d
Instruction ID: cfea4fd80400da2642d1de8fde82e394b0ea21f08e1510a048d0b987ed8ea8f8
Opcode Fuzzy Hash: c72fc035f39ff18bf0ebcc914572c194267d3bf521bf6442c4757bc8df46418d
Instruction Fuzzy Hash: 96C13CB5A083418FD704CF29C48061AFBE1FFD9315F258A6DE8998B351D771D84ACB92

Function 00D4E3F0 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29c05a1d145bfee6839909fe7057fdf2cb79e8d31774a3f9a4b20896963833e5
Instruction ID: b73cee9efc286aca17d569fb5d8e1220b52177c18437eb65a18bc3770d24e699
Opcode Fuzzy Hash: 29c05a1d145bfee6839909fe7057fdf2cb79e8d31774a3f9a4b20896963833e5
Instruction Fuzzy Hash: 36B185B5D012159FCB04CF69C4806ADFBF2FF99314F29829AC459AB352D3759846CBA0

Function 00DB2370 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c91a48977f46359da621acba703dc88080e726c3dcdd94117558011faff4a52b
Instruction ID: da5675ef669807ff312ce717d7ba03b4507b4e95cb74f255e662f9683108b5bf
Opcode Fuzzy Hash: c91a48977f46359da621acba703dc88080e726c3dcdd94117558011faff4a52b
Instruction Fuzzy Hash: 56817F72E01215CBCB19CF68C8A17FEB7F2EF88315F194129D9566B385DB349D428BA0

Function 00D24160 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba0542e0dbc63720bdf364172a76aa6d5459309c8d63a1c4e712a61c7f6849b
Instruction ID: 35bf0073f1ecae2c3cc0e40d27baf795624bce21f49546d33ffeb488cb09ca8d
Opcode Fuzzy Hash: 9ba0542e0dbc63720bdf364172a76aa6d5459309c8d63a1c4e712a61c7f6849b
Instruction Fuzzy Hash: 06415368E15F955AE3039B3C68036B3F758AFF72C9B41E70BECE035417E72099929254

Function 00D34018 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f8aad2d6413faeac46a3ed75cc5bf9ef96fbcaf51b8db1757c0a2f35813ca7
Instruction ID: bc718a518cc292e4099a53d96af5a7b645c0ce09f50bf620344d394c0916c7ff
Opcode Fuzzy Hash: 34f8aad2d6413faeac46a3ed75cc5bf9ef96fbcaf51b8db1757c0a2f35813ca7
Instruction Fuzzy Hash: 4601BCB18053549FC71ADF68C845896BFB5EF46210B06C2A7EC48AB322D334E900CBF2

Function 00D34112 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ffd6cbd36bce322eade584a8a91c75ecc27ad9f0d7b14e3488de81505caf5f0
Instruction ID: 1dfa019d15c400734de7ec75fd774abe40d2a041604ce36bc8bc2c12d471eed3
Opcode Fuzzy Hash: 3ffd6cbd36bce322eade584a8a91c75ecc27ad9f0d7b14e3488de81505caf5f0
Instruction Fuzzy Hash: B4018F718053549FC71ADF28C855896BFB1EF46210B06C296EC48AB362C734ED00CBF1

Function 00D2E4D0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10cef05763defb033a44319dae4ad22752cacac71541a26caaf554056c166449
Instruction ID: ca5f96fc38c15c90fc8bfe73d86c1b070346586a6a821a208665f092205271a1
Opcode Fuzzy Hash: 10cef05763defb033a44319dae4ad22752cacac71541a26caaf554056c166449
Instruction Fuzzy Hash: CED05E716097104BC3244F4FE400502FBECDBC4320700C43FA08EC3700C5B0A4004B94

Function 00DD0520 Relevance: 64.9, APIs: 34, Strings: 3, Instructions: 197COMMON

Download Yara Rule

Strings

kernel32.dll, xrefs: 00DDBAD5
RemoveVectoredExceptionHandler, xrefs: 00DDBB05
AddVectoredExceptionHandler, xrefs: 00DDBAF1

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: AddVectoredExceptionHandler$RemoveVectoredExceptionHandler$kernel32.dll
API String ID: 0-3889795909
Opcode ID: 852eb35aa26673c644f8a14d359afa95df09f13258309b91b0a67d3244ed4451
Instruction ID: 403d70d655ad713e6dd3c4ee9f0606c0557dab561956037b7de9901db0f5f1fa
Opcode Fuzzy Hash: 852eb35aa26673c644f8a14d359afa95df09f13258309b91b0a67d3244ed4451
Instruction Fuzzy Hash: 3051BDB19053459FEB20DF29E48472ABFE0BFC5324F08859ED8859B352C734E845CBA2

Function 00DD06B0 Relevance: 63.2, APIs: 33, Strings: 3, Instructions: 170libraryloaderCOMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA09
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA0E
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA13
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA18
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA1D
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA22
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA27
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA2C
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA31
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA36
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA3B
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA40
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA45
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA4A
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA4F
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA54
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA59
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA60
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA65
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA6A
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA6F
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA74
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA79
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA7E
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA83
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA88
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA8D
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA94
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA99
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA9E
GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00DD3854), ref: 00DDBADC
GetProcAddress.KERNEL32 ref: 00DDBAFC
GetProcAddress.KERNEL32 ref: 00DDBB10

Strings

kernel32.dll, xrefs: 00DDBAD5
RemoveVectoredExceptionHandler, xrefs: 00DDBB05
AddVectoredExceptionHandler, xrefs: 00DDBAF1

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: abort$AddressProc$HandleModule
String ID: AddVectoredExceptionHandler$RemoveVectoredExceptionHandler$kernel32.dll
API String ID: 1748640044-3889795909
Opcode ID: b8460e1c236c0f98eeed6b3cd48458ce3fc5438c0205c2dd0b4689b7b8b8aa8f
Instruction ID: fd11f5b5df7e7fabe93c5ef7aa91e1122aed5fd157933b2588679dbcfc634741
Opcode Fuzzy Hash: b8460e1c236c0f98eeed6b3cd48458ce3fc5438c0205c2dd0b4689b7b8b8aa8f
Instruction Fuzzy Hash: D241DF71605704AFD710DF58E8817AABBF5EB84360F08892BE5898B352D334E849DB72

Function 00D7B0B0 Relevance: 60.0, APIs: 24, Strings: 10, Instructions: 484libraryloaderstringCOMMON

Download Yara Rule

APIs

WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,00000000,00000000,?), ref: 00D7B0CC
LoadLibraryA.KERNEL32(dbghelp.dll,00000000,000000FF,00000000,00000000,00000000,?), ref: 00D7B0DF
GetProcAddress.KERNEL32(?,SymGetOptions), ref: 00D7B113
GetProcAddress.KERNEL32(SymSetOptions), ref: 00D7B141
GetProcAddress.KERNEL32(SymInitializeW), ref: 00D7B170
GetCurrentProcess.KERNEL32(SymInitializeW), ref: 00D7B184
memset.MSVCRT ref: 00D7B1D2
GetProcAddress.KERNEL32(SymGetSearchPathW), ref: 00D7B202
GetCurrentProcess.KERNEL32(SymGetSearchPathW), ref: 00D7B216
lstrlenW.KERNEL32(00000002), ref: 00D7B22A
memcpy.MSVCRT(?,Local\RustBacktraceMutex00000000,00000021), ref: 00D7B24F
GetCurrentProcessId.KERNEL32 ref: 00D7B257
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 00D7B2DC
CloseHandle.KERNEL32(00000000,00000000,00000000,?), ref: 00D7B2FA
GetProcAddress.KERNEL32(EnumerateLoadedModulesW64), ref: 00D7B3B0
GetCurrentProcess.KERNEL32(EnumerateLoadedModulesW64), ref: 00D7B3C4
GetProcAddress.KERNEL32(SymSetSearchPathW), ref: 00D7B420
GetCurrentProcess.KERNEL32(SymSetSearchPathW), ref: 00D7B430
ReleaseMutex.KERNEL32(?,000000FF,00000021,00E4BF9C), ref: 00D7B4D1
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,00E4BF9C), ref: 00D7B4EC

Strings

SymSetOptions, xrefs: 00D7B136
Local\RustBacktraceMutex00000000, xrefs: 00D7B249
called `Result::unwrap()` on an `Err` value, xrefs: 00D7B6B8
dbghelp.dll, xrefs: 00D7B0DA
SymGetSearchPathW, xrefs: 00D7B1F7
assertion failed: len >= 0, xrefs: 00D7B485
EnumerateLoadedModulesW64, xrefs: 00D7B3A5
SymSetSearchPathW, xrefs: 00D7B415
SymGetOptions, xrefs: 00D7B10D
SymInitializeW, xrefs: 00D7B165

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: AddressProc$CurrentProcess$Mutexlstrlen$CloseCreateHandleLibraryLoadObjectReleaseSingleWaitmemcpymemset
String ID: EnumerateLoadedModulesW64$Local\RustBacktraceMutex00000000$SymGetOptions$SymGetSearchPathW$SymInitializeW$SymSetOptions$SymSetSearchPathW$assertion failed: len >= 0$called `Result::unwrap()` on an `Err` value$dbghelp.dll
API String ID: 2256804348-37522383
Opcode ID: 4c0f76546be8c42dcc37bd0dbe3eceb429059f0613a427a69362422ca5e20432
Instruction ID: e271a202f40f513744d227d540829311894c88112d38b5d77e3268694aebd820
Opcode Fuzzy Hash: 4c0f76546be8c42dcc37bd0dbe3eceb429059f0613a427a69362422ca5e20432
Instruction Fuzzy Hash: EC02A371E012199FCB10DFA5DC86BAEBBB5EF54724F184126E508BB292FB709944C7B0

Function 00DD1230 Relevance: 54.4, APIs: 28, Strings: 3, Instructions: 185libraryloaderCOMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA22
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA27
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA2C
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA31
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA36
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA3B
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA40
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA45
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA4A
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA4F
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA54
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA59
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA60
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA65
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA6A
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA6F
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA74
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA79
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA7E
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA83
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA88
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA8D
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA94
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA99
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA9E
GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00DD3854), ref: 00DDBADC
GetProcAddress.KERNEL32 ref: 00DDBAFC
GetProcAddress.KERNEL32 ref: 00DDBB10

Strings

kernel32.dll, xrefs: 00DDBAD5
RemoveVectoredExceptionHandler, xrefs: 00DDBB05
AddVectoredExceptionHandler, xrefs: 00DDBAF1

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: abort$AddressProc$HandleModule
String ID: AddVectoredExceptionHandler$RemoveVectoredExceptionHandler$kernel32.dll
API String ID: 1748640044-3889795909
Opcode ID: 25f19879309d35fd598fc2894c2a07e3858b638d95b8913d636bc0868beb2545
Instruction ID: 8a778333f88d5761557d0d6077c639fbd6e3b300416c03303987ae3303eb8189
Opcode Fuzzy Hash: 25f19879309d35fd598fc2894c2a07e3858b638d95b8913d636bc0868beb2545
Instruction Fuzzy Hash: 6151F172A04608AFCB10DF6CD8827A9BBF1FB84354F084126E895DB351E735E845CBA5

Function 00DD2760 Relevance: 49.1, APIs: 25, Strings: 3, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD2110: strlen.MSVCRT ref: 00DD219D

abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA31
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA36
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA3B
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA40
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA45
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA4A
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA4F
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA54
abort.MSVCRT(?,?,?,?,00000001,?,00DD1A63), ref: 00DDBA59
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA60
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA65
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA6A
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA6F
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA74
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA79
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA7E
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA83
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA88
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA8D
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA94
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA99
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA9E
GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00DD3854), ref: 00DDBADC
GetProcAddress.KERNEL32 ref: 00DDBAFC
GetProcAddress.KERNEL32 ref: 00DDBB10

Strings

kernel32.dll, xrefs: 00DDBAD5
RemoveVectoredExceptionHandler, xrefs: 00DDBB05
AddVectoredExceptionHandler, xrefs: 00DDBAF1

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: abort$AddressProc$HandleModulestrlen
String ID: AddVectoredExceptionHandler$RemoveVectoredExceptionHandler$kernel32.dll
API String ID: 1472221321-3889795909
Opcode ID: e7b6b59db0ad8a32eb7679daba2413320f971fe52ad772528b0d4c887c11d14f
Instruction ID: 7722f43bac4630ec5afd66d7f4adfe29a7a4b82f4d0df2a1d9ff145a16ae49da
Opcode Fuzzy Hash: e7b6b59db0ad8a32eb7679daba2413320f971fe52ad772528b0d4c887c11d14f
Instruction Fuzzy Hash: 38418FB0509380DEE750DF3AE8497167FE4AB91318F48459ED688A7362D7B5880CCB37

Function 00DD3060 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 113COMMON

Download Yara Rule

Strings

kernel32.dll, xrefs: 00DDBAD5
RemoveVectoredExceptionHandler, xrefs: 00DDBB05
AddVectoredExceptionHandler, xrefs: 00DDBAF1

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: AddVectoredExceptionHandler$RemoveVectoredExceptionHandler$kernel32.dll
API String ID: 0-3889795909
Opcode ID: 4265661fbc61fb7f56315e5a0fd20f762dcd82d875deb3ac9d4d67ab08276e25
Instruction ID: c7547ede22414ab8b8b4b73a68897125be616e28bdb0c4f5b2348562f2fc9fda
Opcode Fuzzy Hash: 4265661fbc61fb7f56315e5a0fd20f762dcd82d875deb3ac9d4d67ab08276e25
Instruction Fuzzy Hash: BF3152709012099FCB50EF68D981AEEBBF4FF85314F04846AE849A7311DB30AD45CBB2

Function 00DD3130 Relevance: 36.9, APIs: 17, Strings: 4, Instructions: 112COMMON

Download Yara Rule

Strings

kernel32.dll, xrefs: 00DDBAD5
RemoveVectoredExceptionHandler, xrefs: 00DDBB05
@, xrefs: 00DD319B
AddVectoredExceptionHandler, xrefs: 00DDBAF1

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: strlen
String ID: @$AddVectoredExceptionHandler$RemoveVectoredExceptionHandler$kernel32.dll
API String ID: 39653677-2564961135
Opcode ID: 91c5c53bfa23214ded35f656900b1a06defe8ed5f96c4aa7d76746bd5b02d271
Instruction ID: 2bd683dc7920931ead089b584d85cdbeb7c22c4192e6b83424de2f642bebc96a
Opcode Fuzzy Hash: 91c5c53bfa23214ded35f656900b1a06defe8ed5f96c4aa7d76746bd5b02d271
Instruction Fuzzy Hash: DE31DEB1A053099FDB10EF6CED857AA7BF4EB85340F08446BE84997301D7349A48CBB2

Function 00D77630 Relevance: 33.7, APIs: 13, Strings: 6, Instructions: 429libraryloaderthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00D62C10: SetLastError.KERNEL32(00000000), ref: 00D62C85
Part of subcall function 00D62C10: GetCurrentDirectoryW.KERNEL32(00000000,00000002,00000000), ref: 00D62C8C
Part of subcall function 00D62C10: GetLastError.KERNEL32(00000000,?,00000000,00000000,00000002,00000000), ref: 00D62C97
Part of subcall function 00D62C10: GetLastError.KERNEL32(00000000,?,00000000,00000000,00000002,00000000), ref: 00D62CA8

GetCurrentProcess.KERNEL32 ref: 00D77758
GetCurrentThread.KERNEL32 ref: 00D77761
memset.MSVCRT ref: 00D77779
RtlCaptureContext.KERNEL32(?), ref: 00D77782
GetProcAddress.KERNEL32(SymFunctionTableAccess64,?), ref: 00D777C8
GetProcAddress.KERNEL32(SymGetModuleBase64,SymFunctionTableAccess64), ref: 00D777F7
GetCurrentProcess.KERNEL32(SymFunctionTableAccess64,?), ref: 00D7780B
GetProcAddress.KERNEL32(StackWalkEx,SymFunctionTableAccess64), ref: 00D77828
memset.MSVCRT ref: 00D77851

Strings

SymFunctionTableAccess64, xrefs: 00D777BD
stack backtrace:, xrefs: 00D77702
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_end_short_backtrace__rust_begin_short_backtraces [... omitted frame ...], xrefs: 00D77A7B
StackWalk64, xrefs: 00D77B95
SymGetModuleBase64, xrefs: 00D777EC
StackWalkEx, xrefs: 00D7781D

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Current$AddressErrorLastProc$Processmemset$CaptureContextDirectoryThread
String ID: StackWalk64$StackWalkEx$SymFunctionTableAccess64$SymGetModuleBase64$note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_end_short_backtrace__rust_begin_short_backtraces [... omitted frame ...]$stack backtrace:
API String ID: 1663827168-1816762948
Opcode ID: e109b92ee1c1c2f1cdee24b7fec0664fe62d6e25b9e150c87b3a08fbbfacf71c
Instruction ID: 3327429344dfbc529c1981e9ac29b0da5e0bc1b9ae04d113439ab597643310b4
Opcode Fuzzy Hash: e109b92ee1c1c2f1cdee24b7fec0664fe62d6e25b9e150c87b3a08fbbfacf71c
Instruction Fuzzy Hash: FA1226B190D380AFE761DF24C845B9BBBE4AF85714F04891EF5C897291E771D908CBA2

Function 00D7D320 Relevance: 33.6, APIs: 18, Strings: 1, Instructions: 364fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00110080,00000007,00000000,00000003,02200080,00000000), ref: 00D7D41F
GetFileInformationByHandleEx.KERNEL32(00000000,00000009,?,00000008,?,00110080,00000007,00000000,00000003,02200080,00000000), ref: 00D7D435
GetLastError.KERNEL32(?,00110080,00000007,00000000,00000003,02200080,00000000), ref: 00D7D462
CreateFileW.KERNEL32(?,00110000,00000007,00000000,00000003,02000080,00000000,?,00110080,00000007,00000000,00000003,02200080,00000000), ref: 00D7D49F
memcpy.MSVCRT(-0000000C,?,?,?,?,02200080,00000000), ref: 00D7D506
SetFileInformationByHandle.KERNEL32(?,00000016,00000000,?,?,?,?,?,?,02200080,00000000), ref: 00D7D517
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,02200080,00000000), ref: 00D7D538
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,02200080,00000000), ref: 00D7D66E

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00D7D643

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: FileHandle$CloseCreateInformation$ErrorLastmemcpy
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 2465000479-2333694755
Opcode ID: bb14b3c740f340f2a973bb57b5f66806be384e62d191720e6c7192d1fba24aac
Instruction ID: a380557aed2b1dea4aacb489936493892c1b43e45ddc49b76de6dd1ddd3da1b1
Opcode Fuzzy Hash: bb14b3c740f340f2a973bb57b5f66806be384e62d191720e6c7192d1fba24aac
Instruction Fuzzy Hash: F2D16EB1E00209ABDF14DFA4DC82BAEBBB5EF55304F148429F549B7382E671A9408B75

Function 00DD3320 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 134libraryloaderCOMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA60
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA65
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA6A
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA6F
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA74
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA79
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA7E
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA83
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA88
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA8D
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA94
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA99
abort.MSVCRT(?,?,00000008,?,00000000,?,00DD3854), ref: 00DDBA9E
GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00DD3854), ref: 00DDBADC
GetProcAddress.KERNEL32 ref: 00DDBAFC
GetProcAddress.KERNEL32 ref: 00DDBB10

Strings

kernel32.dll, xrefs: 00DDBAD5
RemoveVectoredExceptionHandler, xrefs: 00DDBB05
AddVectoredExceptionHandler, xrefs: 00DDBAF1

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: abort$AddressProc$HandleModule
String ID: AddVectoredExceptionHandler$RemoveVectoredExceptionHandler$kernel32.dll
API String ID: 1748640044-3889795909
Opcode ID: 812041b9d488215d3cba0b70f81081af32eea65d1eb91ce61633dea57ff7d91d
Instruction ID: 337034646d7752b4c0892aa9ee0f357a6930e1ec186452e15bb49fd5147cce4e
Opcode Fuzzy Hash: 812041b9d488215d3cba0b70f81081af32eea65d1eb91ce61633dea57ff7d91d
Instruction Fuzzy Hash: 2331D3726052148FD704DF6CE8826AA77F5FBC1318F18816FE4898B315D736E806CB62

Function 00D63670 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 363COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 00D6370E
GetUserProfileDirectoryW.USERENV(000000FC,?,?,00000000), ref: 00D6371F
GetLastError.KERNEL32(000000FC,?,?,00000000), ref: 00D63760
GetLastError.KERNEL32(000000FC,?,?,00000000), ref: 00D63777

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00D63B1E
USERPROFILE\\.\pipe\__rust_anonymous_pipe1__., xrefs: 00D63685

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ErrorLast$DirectoryProfileUser
String ID: USERPROFILE\\.\pipe\__rust_anonymous_pipe1__.$called `Result::unwrap()` on an `Err` value
API String ID: 2013343546-4144570884
Opcode ID: 7f6b9576b3ac1e4d067efefda139af312106c53a0d7245bd34a9662afb8996ee
Instruction ID: 5bc7b247b0b88690815c70b37c9b5fd513f837dda415a09a5fc894ddcafb3159
Opcode Fuzzy Hash: 7f6b9576b3ac1e4d067efefda139af312106c53a0d7245bd34a9662afb8996ee
Instruction Fuzzy Hash: F7C1A3B1A04305ABDB109F54DC86BAEBBE8EF94314F184529F994A7342E774DE048BB1

Function 00D8A3B0 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 273COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 00D8A425
GetFullPathNameW.KERNEL32(?,00000000,00000002,00000000,00000000), ref: 00D8A431
GetLastError.KERNEL32(?,00000000,?,00000000,00000000,?,00000000,00000002,00000000,00000000), ref: 00D8A43C
GetLastError.KERNEL32(?,00000000,?,00000000,00000000,?,00000000,00000002,00000000,00000000), ref: 00D8A44D

Strings

SetThreadDescription, xrefs: 00D8A6F1
kernel32, xrefs: 00D8A6E3

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID: SetThreadDescription$kernel32
API String ID: 2482867836-1950310818
Opcode ID: 11158bc7509b8ad53a0ef936d7c22627d915d52158a929faac09cea43d14d010
Instruction ID: 07a138d91862884bbcd2b84c36c4ae5f8da854c91e17e5d5731bf3aa91be7fce
Opcode Fuzzy Hash: 11158bc7509b8ad53a0ef936d7c22627d915d52158a929faac09cea43d14d010
Instruction Fuzzy Hash: 6A917471E002059BEB10ABA8DC46FBEBBB8EF55314F18402AE905B7352E7759D00CB76

Function 00DD63F0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00DD53F0: calloc.MSVCRT ref: 00DD547E

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00DD4AF3), ref: 00DD646F
TlsGetValue.KERNEL32 ref: 00DD6495
TlsGetValue.KERNEL32 ref: 00DD64BF
fprintf.MSVCRT ref: 00DD6500

Strings

kernel32.dll, xrefs: 00DDBAD5
RemoveVectoredExceptionHandler, xrefs: 00DDBB05
once %p is %ld, xrefs: 00DD64F5
AddVectoredExceptionHandler, xrefs: 00DDBAF1

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Value$callocfprintf
String ID: once %p is %ld$AddVectoredExceptionHandler$RemoveVectoredExceptionHandler$kernel32.dll
API String ID: 811747394-2209695033
Opcode ID: 230f46a5e55f17b240136cbebf1706706e6aa2cf1d5f0bf957d4817b3595d22f
Instruction ID: bf397d50f25e82c619a792d790198cc3279d075a56205176566378e7b6e54ff9
Opcode Fuzzy Hash: 230f46a5e55f17b240136cbebf1706706e6aa2cf1d5f0bf957d4817b3595d22f
Instruction Fuzzy Hash: A84178B55087108FD710BF35E98562ABBE4EF84750F09892FE88987315E774D889CBB2

Function 00DD57F0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 135threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00DD5865
OutputDebugStringA.KERNEL32 ref: 00DD588A
abort.MSVCRT ref: 00DD5893
free.MSVCRT ref: 00DD58CD
free.MSVCRT ref: 00DD58DC
free.MSVCRT ref: 00DD58EB

Strings

Error cleaning up spin_keys for thread %lu., xrefs: 00DD586B
5, xrefs: 00DD5877

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: free$CurrentDebugOutputStringThreadabort
String ID: 5$Error cleaning up spin_keys for thread %lu.
API String ID: 2974864059-2130375756
Opcode ID: d05ab09a2acff1e8668f5eec81dd6c0f948678ba34ed20bd0eaa791fec2c442f
Instruction ID: ee2ac98359105f41a51f9240d21cb5e828b7c185105356398132c840dd1b2743
Opcode Fuzzy Hash: d05ab09a2acff1e8668f5eec81dd6c0f948678ba34ed20bd0eaa791fec2c442f
Instruction Fuzzy Hash: D25164B0608701CFD700EF29E89871ABBE5FF84344F44482EE8889B349D775D549CBA2

Function 00DD9470 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00DD94A2
CreateSemaphoreA.KERNEL32 ref: 00DD94F8
CreateSemaphoreA.KERNEL32 ref: 00DD951F
InitializeCriticalSection.KERNEL32 ref: 00DD953E
InitializeCriticalSection.KERNEL32 ref: 00DD9549
InitializeCriticalSection.KERNEL32 ref: 00DD9554

Strings

l, xrefs: 00DD9493

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: CriticalInitializeSection$CreateSemaphore$calloc
String ID: l
API String ID: 2075313795-2517025534
Opcode ID: 6a70c41120865471ccd491f8e876ddf81a67be9ebd591335de10c4a6e0aca701
Instruction ID: 2fd8c728bebbdf2ed010ee009fda671756175a527be35b95946b2426085901c0
Opcode Fuzzy Hash: 6a70c41120865471ccd491f8e876ddf81a67be9ebd591335de10c4a6e0aca701
Instruction Fuzzy Hash: 14312DB55043008FEB10BF39E55835ABBE4EF40314F158AAED8948B395E775D844CF92

Function 00D804F0 Relevance: 16.7, APIs: 11, Instructions: 183networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,8004667E,00000001), ref: 00D8051B
WSAGetLastError.WS2_32 ref: 00D8054A
connect.WS2_32(?,00000001,00000010), ref: 00D805A5
ioctlsocket.WS2_32(?,8004667E,00000001), ref: 00D805C4
WSAGetLastError.WS2_32 ref: 00D805D0
ioctlsocket.WS2_32(?,8004667E,00000001), ref: 00D805F2
WSAGetLastError.WS2_32(?,8004667E,00000001), ref: 00D8063B
memset.MSVCRT ref: 00D8069F
memset.MSVCRT ref: 00D806C5
select.WS2_32(00000001,00000000,00000001,00000001,?), ref: 00D806ED
WSAGetLastError.WS2_32 ref: 00D806FE

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ErrorLast$ioctlsocket$memset$connectselect
String ID:
API String ID: 1299707133-0
Opcode ID: d515175a3c605d06c4b3b991ec0aff856297aaeff4dcff79e5b36f2bef1ca46d
Instruction ID: f17e63e238956985636bd86a12e1787ef79ad30f855aabeba0a8e93f1325f06a
Opcode Fuzzy Hash: d515175a3c605d06c4b3b991ec0aff856297aaeff4dcff79e5b36f2bef1ca46d
Instruction Fuzzy Hash: 6071C3B090060ADFDB10EF64C841BEDBBB5EF85324F244155E818AB391E734AA59CBB1

Function 00D70330 Relevance: 16.6, APIs: 11, Instructions: 81networkCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00D70350
GetCurrentProcessId.KERNEL32 ref: 00D7035A
WSADuplicateSocketW.WS2_32(0F08C483,00000000,?), ref: 00D70362
WSASocketW.WS2_32(?,?,?,?,00000000,00000081), ref: 00D70386
WSAGetLastError.WS2_32 ref: 00D70398
WSAGetLastError.WS2_32(?,?,?,?,00000000,00000081), ref: 00D703BA
WSASocketW.WS2_32(?,?,?,?,00000000,00000001), ref: 00D703E4
SetHandleInformation.KERNEL32(00000000,00000001,00000000,?,?,?,?,00000000,00000001,?,?,?,?,00000000,00000081), ref: 00D703F5
WSAGetLastError.WS2_32(?,?,?,?,00000000,00000001,?,?,?,?,00000000,00000081), ref: 00D70407
GetLastError.KERNEL32(00000000,00000001,00000000,?,?,?,?,00000000,00000001,?,?,?,?,00000000,00000081), ref: 00D70417
closesocket.WS2_32(00000000), ref: 00D70426

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ErrorLast$Socket$CurrentDuplicateHandleInformationProcessclosesocketmemset
String ID:
API String ID: 2222771188-0
Opcode ID: 385d7b35f455f21a572e9bde6b22e34dce3e72efc4e3b4c79ed6e4c15a8551a0
Instruction ID: 055c7c03b618700cb1dfe8873697e336895bbd04633e39f954fc0dcf7d3c59f7
Opcode Fuzzy Hash: 385d7b35f455f21a572e9bde6b22e34dce3e72efc4e3b4c79ed6e4c15a8551a0
Instruction Fuzzy Hash: F321D170400341EADB306B68CC45F6A7EA5DF41714F24856EF29C9A2D1E67598858731

Function 00D8D7D0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 205memoryCOMMON

Download Yara Rule

APIs

InitOnceBeginInitialize.KERNEL32(?,00000000,00000000,00000000,?,00000001,00005000), ref: 00D8D7F5
TlsAlloc.KERNEL32(?,00000000,00000000,00000000,?,00000001,00005000), ref: 00D8D80C
InitOnceComplete.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,?,00000001,00005000), ref: 00D8D847
TlsAlloc.KERNEL32(?,00000001,00005000,?,00D60486,00E80178,?,?,00D5FE9D), ref: 00D8D84E
TlsFree.KERNEL32(00E80178,?,00000001,00005000,?,00D60486,00E80178,?,?,00D5FE9D), ref: 00D8D878
InitOnceComplete.KERNEL32(?,00000004,00000000,00000000,00000000,00E4CA64,00000000,00E4D4B0,?,00000000), ref: 00D8D8AD
freeaddrinfo.WS2_32(0000003A,?,assertion failed: len >= mem::size_of::<c::sockaddr_in6>(),0000003A,00E4D5B8), ref: 00D8DA68

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00D8DA4F
assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs, xrefs: 00D8DA3E

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: InitOnce$AllocComplete$BeginFreeInitializefreeaddrinfo
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs
API String ID: 253073994-513854611
Opcode ID: d2d970d8de487ae65ddc2a80f193562bbb95588b4b15677521b708cfe46aa2b0
Instruction ID: c1db3eb434c35f7737117aada9d94f8b141cc58bed8a59db43fb4c530fcc48dd
Opcode Fuzzy Hash: d2d970d8de487ae65ddc2a80f193562bbb95588b4b15677521b708cfe46aa2b0
Instruction Fuzzy Hash: 13818CB09003199FDB14EF99D841BAEBBB5FF48324F24815AE9547B391C7B4A841CBB4

Function 00D75750 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 203synchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00D7576B
CloseHandle.KERNEL32(?), ref: 00D7584E
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00D75862
GetLastError.KERNEL32(00000000,00000000,00000000,000000FF), ref: 00D7586B
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 00D758BF
CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,000000FF), ref: 00D7590A
CloseHandle.KERNEL32(00000001,00000000,00000000,00000000,00000000,000000FF), ref: 00D75910
CloseHandle.KERNEL32(?), ref: 00D759C0

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00D757F2, 00D7593E, 00D75967

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: CloseHandle$CodeErrorExitLastObjectProcessSingleWait
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 17306042-2333694755
Opcode ID: 6b47b84c9bced21addf28526a095d4ac9b307c20c625ac80cccaaeb0402fd9e0
Instruction ID: a864647548555a6334631334c101d9738a7d7db0dae97b82eddee80dff01b6ba
Opcode Fuzzy Hash: 6b47b84c9bced21addf28526a095d4ac9b307c20c625ac80cccaaeb0402fd9e0
Instruction Fuzzy Hash: 6D71A271D00B09ABDF10DFA4EC41BEEB7B8EF45304F148519E9197A281E7B1A945CBB2

Function 00D4B550 Relevance: 15.5, APIs: 8, Strings: 2, Instructions: 462COMMON

Download Yara Rule

APIs

memmove.MSVCRT(?,?,?), ref: 00D4B5D2
memmove.MSVCRT(?,?,?), ref: 00D4B605
memmove.MSVCRT(?,?,?), ref: 00D4B9FB

Strings

assertion failed: new_left_len <= CAPACITY, xrefs: 00D4BBF1
assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}, xrefs: 00D4BC09, 00D4BC53

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: memmove
String ID: assertion failed: match track_edge_idx { LeftOrRight::Left(idx) => idx <= old_left_len, LeftOrRight::Right(idx) => idx <= right_len,}$assertion failed: new_left_len <= CAPACITY
API String ID: 2162964266-2079967719
Opcode ID: fe9ce651eaddbe03d67b333dff9c7cc41449ea37988dd37277a28d2aaf366d70
Instruction ID: 999da2fa866c66145ec6a18a99e4691109afa0d7f319365f2e2c0b4c84649639
Opcode Fuzzy Hash: fe9ce651eaddbe03d67b333dff9c7cc41449ea37988dd37277a28d2aaf366d70
Instruction Fuzzy Hash: 16223B75D00619CBDB14CF99C880AEEF7B5FF98314F14866ED8096B216E730AA46CF61

Function 00D8D530 Relevance: 15.2, APIs: 12, Instructions: 232COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 00D8D57D
TlsSetValue.KERNEL32(?,00000000), ref: 00D8D58E
TlsGetValue.KERNEL32 ref: 00D8D5CD
TlsSetValue.KERNEL32(?,00000000), ref: 00D8D5DE
TlsGetValue.KERNEL32 ref: 00D8D61D
TlsSetValue.KERNEL32(?,00000000), ref: 00D8D62E
TlsGetValue.KERNEL32 ref: 00D8D66D
TlsSetValue.KERNEL32(?,00000000), ref: 00D8D67E
TlsGetValue.KERNEL32(?), ref: 00D8D6BA
TlsSetValue.KERNEL32(?,00000000,?), ref: 00D8D6C8
TlsGetValue.KERNEL32(00000000), ref: 00D8D6E0
TlsSetValue.KERNEL32(00000000,00000002,00000000), ref: 00D8D6F9

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: ca488060ad713f17cfb8bb5f8bfd87a1ad0f50734b36c0b1c1edffcfc145f7b0
Instruction ID: d9c285f08f0cc74410c9a33c7be2e7d66062ce76a0d3047ca9b1d3dee21a0be2
Opcode Fuzzy Hash: ca488060ad713f17cfb8bb5f8bfd87a1ad0f50734b36c0b1c1edffcfc145f7b0
Instruction Fuzzy Hash: 2A71A3B1A006089BDB20BF65DC82BAFB3A9EF45714F1D4429D959B72C1EB31EC0487B1

Function 00D6F2B0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 150networkCOMMON

Download Yara Rule

APIs

accept.WS2_32(?,?,00000080), ref: 00D6F30E
WSAGetLastError.WS2_32 ref: 00D6F35E
closesocket.WS2_32(00000000), ref: 00D6F3F3
closesocket.WS2_32(00000000), ref: 00D6F44A
setsockopt.WS2_32(?,00000000,00000004,00000000,00000004), ref: 00D6F47E
WSAGetLastError.WS2_32(?,00000000,00000004,00000000,00000004,00000000,00000000,?,00000000,00000000), ref: 00D6F48A

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00D6F435
assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs, xrefs: 00D6F424, 00D6F43C

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ErrorLastclosesocket$acceptsetsockopt
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs
API String ID: 1216698370-513854611
Opcode ID: 3dff5e8ccd70833f94e09111b7dcca5d0b8cef51d99c2f23ba7eb1fcce47c370
Instruction ID: ae497d02987d797d87a04512f9b939b7d4d743650508a1e3fe6a35da2713f10b
Opcode Fuzzy Hash: 3dff5e8ccd70833f94e09111b7dcca5d0b8cef51d99c2f23ba7eb1fcce47c370
Instruction Fuzzy Hash: 7D518E705087409BD728CF18E481AABB7F5EFC9314F10892EF9D987350D735A945CBA6

Function 00D7C2F0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 130fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00D7C366
FindNextFileW.KERNEL32(0544C5E8,?), ref: 00D7C370
memcpy.MSVCRT(?,?,00000250,0544C5E8,?), ref: 00D7C3D7
memcpy.MSVCRT(?,00D66288,0000021E), ref: 00D7C470
FindClose.KERNEL32(0544C5E8,?,0544C5E8,?), ref: 00D7C4B8

Strings

., xrefs: 00D7C39B

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Findmemcpy$CloseFileNextmemset
String ID: .
API String ID: 924662966-248832578
Opcode ID: 29ac1023d57b7cbd743a62390d38b3630b2b1577139acb3c0ce0037c9c84b8e2
Instruction ID: 90f5a5addb4666d634e3a151ba1dac48b839e274baff50503613f81c60beacfd
Opcode Fuzzy Hash: 29ac1023d57b7cbd743a62390d38b3630b2b1577139acb3c0ce0037c9c84b8e2
Instruction Fuzzy Hash: E051CC759106199FCB21DF14C8847AAB7B4FF89314F48D29AE84C6F282E734E981C7B5

Function 00D7C5C0 Relevance: 13.7, APIs: 9, Instructions: 215fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,?,?,?,?,00000000), ref: 00D7C717
GetLastError.KERNEL32(?,00000000,?,?,?,?,00000000), ref: 00D7C738
SetFileInformationByHandle.KERNEL32(00000000,00000005,00000000,00000008,?,00000000), ref: 00D7C760
GetLastError.KERNEL32(00000000,00000005,00000000,00000008,?,00000000), ref: 00D7C769
SetFileInformationByHandle.KERNEL32(00000000,00000006,00000000,00000008,00000000,00000005), ref: 00D7C794
GetLastError.KERNEL32(?,00000000,?,?,?,?,00000000), ref: 00D7C7C7
GetLastError.KERNEL32(00000000,00000006,00000000,00000008,00000000,00000005), ref: 00D7C7F4
CloseHandle.KERNEL32(?,00000000,00000006,00000000,00000008,00000000,00000005), ref: 00D7C803
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00D7C850

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ErrorHandleLast$File$CloseInformation$Create
String ID:
API String ID: 4230017884-0
Opcode ID: 4ad237f512d01191d6db7a41f464435c6110ea584c0e82c141afed7652981534
Instruction ID: 3e69ce74585427b372aad0b30f5f4d92be406de237b19bf7cbc37e1bc4132eb5
Opcode Fuzzy Hash: 4ad237f512d01191d6db7a41f464435c6110ea584c0e82c141afed7652981534
Instruction Fuzzy Hash: 5981C1B05183409FEB24CF14C881B6A7BE0AF95308F18A95EE9DD5B292E770D804CB72

Function 00D8E230 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 164networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32(?,?,?), ref: 00D8E284
WSAGetLastError.WS2_32 ref: 00D8E30B

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00D8E361
socketOwnedSocketlibrary\std\src\os\windows\process.rs, xrefs: 00D8E44D
TcpListenerUdpSocketlibrary\std\src\..\..\backtrace\src\symbolize\gimli\lru.rs, xrefs: 00D8E391
assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs, xrefs: 00D8E372
addrlinenolibrary\std\src\..\..\backtrace\src\symbolize\mod.rs, xrefs: 00D8E431

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ErrorLastgetsockname
String ID: TcpListenerUdpSocketlibrary\std\src\..\..\backtrace\src\symbolize\gimli\lru.rs$addrlinenolibrary\std\src\..\..\backtrace\src\symbolize\mod.rs$assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs$socketOwnedSocketlibrary\std\src\os\windows\process.rs
API String ID: 566540725-3069411103
Opcode ID: 88e9591da8f74407544942a5dda40c2861e8d5d087c7e44b30efb6ee9ba5183a
Instruction ID: d943f0c791441477bde8aef59ce58a91d3d041145d6bc9908e317315900b4610
Opcode Fuzzy Hash: 88e9591da8f74407544942a5dda40c2861e8d5d087c7e44b30efb6ee9ba5183a
Instruction Fuzzy Hash: F451F230808B44E6DB21EF58D842AAFB7F8EF95715F048609F8896B141E7709585CBA2

Function 00D63270 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 00D6336A
GetEnvironmentVariableW.KERNEL32(?,?,?,00000000), ref: 00D63375
GetLastError.KERNEL32(00000200,?,00000000,00000000), ref: 00D63380
GetLastError.KERNEL32(00000200,?,00000000,00000000), ref: 00D63391

Strings

environment variable not foundenvironment variable was not valid unicode: , xrefs: 00D635A7

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ErrorLast$EnvironmentVariable
String ID: environment variable not foundenvironment variable was not valid unicode:
API String ID: 2691138088-3632183283
Opcode ID: 9bfd51ded772c184a871ecd0bd536d4b74670c71085a8092a150f92a07a49bc1
Instruction ID: ad72b3cccd1812f9b53c820044d7dc082d04a7b64a69bf1d8c90a07ffccd93d8
Opcode Fuzzy Hash: 9bfd51ded772c184a871ecd0bd536d4b74670c71085a8092a150f92a07a49bc1
Instruction Fuzzy Hash: 919181B1A04301AFD710DF54DC42B6ABBE8EF94714F148819F999A7352E771EE048BB2

Function 00D8A0A0 Relevance: 10.7, APIs: 7, Instructions: 245COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 00D8A115
GetFullPathNameW.KERNEL32(?,00000000,00000002,00000000,00000000), ref: 00D8A121
GetLastError.KERNEL32(?,00000000,?,00000000,00000000,?,00000000,00000002,00000000,00000000), ref: 00D8A12C
GetLastError.KERNEL32(?,00000000,?,00000000,00000000,?,00000000,00000002,00000000,00000000), ref: 00D8A13D

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ErrorLast$FullNamePath
String ID:
API String ID: 2482867836-0
Opcode ID: 6c32b60d524e8a1362dc33d3098d5c6a9a327a4bb5cd9ce48dd4fd91ea629170
Instruction ID: b636eb5fd4d781f4416eec2050b8205cc17ede54053bb8bdc779d513782ec958
Opcode Fuzzy Hash: 6c32b60d524e8a1362dc33d3098d5c6a9a327a4bb5cd9ce48dd4fd91ea629170
Instruction Fuzzy Hash: 168165B1E003059BEB10AF99DC46FAEBBB9EF55314F18401AE805BB352E7759D008B76

Function 00DB6750 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 234COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00DB697B
memcpy.MSVCRT(?,?,?,00000000,?,+NaNinf00e00E0assertion failed: ndigits > 0,?,assertion failed: parts.len() >= 6,00000022,00E585F0,assertion failed: buf[0] > b'0',0000001F,00E585BC,assertion failed: !buf.is_empty(),00000021,00E585AC), ref: 00DB699C

Strings

assertion failed: parts.len() >= 6, xrefs: 00DB687D
assertion failed: buf[0] > b'0', xrefs: 00DB686C
.0., xrefs: 00DB67AF
eEe-E--+NaNinf00e00E0assertion failed: ndigits > 0, xrefs: 00DB67F1
assertion failed: !buf.is_empty(), xrefs: 00DB685B

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: memcpymemset
String ID: .0.$assertion failed: !buf.is_empty()$assertion failed: buf[0] > b'0'$assertion failed: parts.len() >= 6$eEe-E--+NaNinf00e00E0assertion failed: ndigits > 0
API String ID: 1297977491-168991425
Opcode ID: 908a7fa8a3f0111f23366b7cd43cb3951b9b9e7b8133db709ea2d3ea8a72b076
Instruction ID: 5aae4e412528ea4368b261346ee699bb1d33247717847b7e5ffff6f7d171b736
Opcode Fuzzy Hash: 908a7fa8a3f0111f23366b7cd43cb3951b9b9e7b8133db709ea2d3ea8a72b076
Instruction Fuzzy Hash: EB81FA72E00320DBDB208F08C445BEE77E5FF80714F1A8569E85A6B291D7B9DD85CBA1

Function 00D76360 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

WakeByAddressAll.API-MS-WIN-CORE-SYNCH-L1-2-0(?), ref: 00D763C1
WaitOnAddress.API-MS-WIN-CORE-SYNCH-L1-2-0(00000004,?,00000004,000000FF), ref: 00D76420
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(?), ref: 00D76509

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00D764F9, 00D76556

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Address$Wake$SingleWait
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 2488680809-2333694755
Opcode ID: 57fff6acfb26916b82561439a1b6f296cd4926f6b12b0956a401caaae9284a0b
Instruction ID: d6dde7fd639a217641a0f317824bacbb9d0b0048bdac1b2f3b64a132a1d2037f
Opcode Fuzzy Hash: 57fff6acfb26916b82561439a1b6f296cd4926f6b12b0956a401caaae9284a0b
Instruction Fuzzy Hash: 256147719047159FCF119F649801AAFBBF8AF01718F588859E5ADA3282F331E90587B1

Function 00D82590 Relevance: 10.7, APIs: 7, Instructions: 180COMMON

Download Yara Rule

APIs

Part of subcall function 00D827F0: CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,00000000,?,00D825A9,?), ref: 00D82802

CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D825C0

Part of subcall function 00D3E2A0: CloseHandle.KERNEL32(?,000000FF), ref: 00D3E2B3
Part of subcall function 00D3E2A0: CloseHandle.KERNEL32(?,?,000000FF), ref: 00D3E2BB

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: CloseHandle$CreateEvent
String ID:
API String ID: 1371578007-0
Opcode ID: f5d3158d2f5567d7d0e53a1e79cc3f361e245f2bb47352cdc558e0ad307ff00f
Instruction ID: 318ddc6731263a5869a5c4b625161749f27b043fe55f239317f4eb9f6d5e1c36
Opcode Fuzzy Hash: f5d3158d2f5567d7d0e53a1e79cc3f361e245f2bb47352cdc558e0ad307ff00f
Instruction Fuzzy Hash: FC6125B4E002189BDF14EF95C881AFEBBB6EF59310F28441AE845AB351D770AD45CB71

Function 00DD95E0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 169synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD69E0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000014,76ECE820), ref: 00DD69F0

Part of subcall function 00DD82F0: WaitForMultipleObjects.KERNEL32 ref: 00DD835A

ResetEvent.KERNEL32 ref: 00DD964C

Part of subcall function 00DD6D50: TlsGetValue.KERNEL32 ref: 00DD6D62

WaitForSingleObject.KERNEL32 ref: 00DD968B

Strings

(, xrefs: 00DD9739

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ValueWait$EventMultipleObjectObjectsResetSingle
String ID: (
API String ID: 2327612466-3887548279
Opcode ID: 7466790d3b091f9630f89547464193e0a7961d3df9ab0fd4d96e389a6da92151
Instruction ID: 2f5086ceaefac5db341d94e4c0b938ff2913602f8a59dd9dbecc50492098b6a0
Opcode Fuzzy Hash: 7466790d3b091f9630f89547464193e0a7961d3df9ab0fd4d96e389a6da92151
Instruction Fuzzy Hash: E45173715083108AD7306F69896536EFAE4AF41744F19482FE9C893350EA77DC49DBB3

Function 00D6F7C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 118networkCOMMON

Download Yara Rule

APIs

getpeername.WS2_32(?,?,?), ref: 00D6F81A
WSAGetLastError.WS2_32(?,?,?), ref: 00D6F8A1
setsockopt.WS2_32(?,0000FFFF,00000020,00000080,00000004), ref: 00D6F942
WSAGetLastError.WS2_32(?,0000FFFF,00000020,00000080,00000004,00000000,?,?,assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs,00000039,00E4D56C,?,?,?), ref: 00D6F94E

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00D6F8F9
assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs, xrefs: 00D6F90A

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ErrorLast$getpeernamesetsockopt
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs
API String ID: 2225440259-513854611
Opcode ID: 73e14e42966a45fbddf980079e82002458d4c52a3d95b0508b1de534dc34692f
Instruction ID: 99bbc61179bb0942bbede444465646beb3fab5f1f79e7993a453035c16637b59
Opcode Fuzzy Hash: 73e14e42966a45fbddf980079e82002458d4c52a3d95b0508b1de534dc34692f
Instruction Fuzzy Hash: 2E41E570908B80EAD725CF18D802BABB7F4FF86314F009A1DF5DA57290E7759584CBA2

Function 00D803A0 Relevance: 10.6, APIs: 7, Instructions: 65networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(00000002,00D6E889,00000000,00000000,00000000,00000081), ref: 00D803CC
WSAGetLastError.WS2_32(?,?,?,?,00D6E889,?,?,00000001), ref: 00D803E3
WSASocketW.WS2_32(00000002,00D6E889,00000000,00000000,00000000,00000001), ref: 00D80400
SetHandleInformation.KERNEL32(00000000,00000001,00000000,00000002,00D6E889,00000000,00000000,00000000,00000001,?,?,?,?,00D6E889,?,?), ref: 00D80411
WSAGetLastError.WS2_32(00000002,00D6E889,00000000,00000000,00000000,00000001,?,?,?,?,00D6E889,?,?,00000001), ref: 00D80427
GetLastError.KERNEL32(00000000,00000001,00000000,00000002,00D6E889,00000000,00000000,00000000,00000001,?,?,?,?,00D6E889,?,?), ref: 00D80437
closesocket.WS2_32(00000000), ref: 00D80446

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ErrorLast$Socket$HandleInformationclosesocket
String ID:
API String ID: 3114377017-0
Opcode ID: 81ad3a217a5e93e07ae17fa3f306bf76d5498596ad451f06f19f4abb31d4762f
Instruction ID: c03809cb9e48a79a857cc2947f730da8379a654b00e895d7d985468f1c11ff37
Opcode Fuzzy Hash: 81ad3a217a5e93e07ae17fa3f306bf76d5498596ad451f06f19f4abb31d4762f
Instruction Fuzzy Hash: 9011E370240341ABEB306B688C42F667ED8DF41B50F24482FFA99EB2C1D2B4E8448374

Function 00D6E220 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 277COMMON

Download Yara Rule

APIs

freeaddrinfo.WS2_32 ref: 00D6E25A
freeaddrinfo.WS2_32(?), ref: 00D6E4F1
freeaddrinfo.WS2_32(?), ref: 00D6E5A5

Strings

assertion failed: len >= mem::size_of::<c::sockaddr_in6>(), xrefs: 00D6E532, 00D6E562
assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs, xrefs: 00D6E521, 00D6E539, 00D6E551, 00D6E569

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: freeaddrinfo
String ID: assertion failed: len >= mem::size_of::<c::sockaddr_in6>()$assertion failed: len >= mem::size_of::<c::sockaddr_in>()library\std\src\sys_common\net.rs
API String ID: 2731292433-513854611
Opcode ID: 5feb3cad39c2073487eb2569970b41883090e9a939e23443ffae3b4f4b2de8d3
Instruction ID: e69891a6dc7332ff39fbdf234fc82281c42ccd1ac95bfcd0bd8a4b5fd98d4f93
Opcode Fuzzy Hash: 5feb3cad39c2073487eb2569970b41883090e9a939e23443ffae3b4f4b2de8d3
Instruction Fuzzy Hash: CDC149B5E04225CFCB18CF49D491AAEBBB1FF88304F15806EE845AB352DB759D41CBA4

Function 00D89580 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00D8958F
CloseHandle.KERNEL32(?,?,000000FF), ref: 00D8959A
GetLastError.KERNEL32(?,000000FF), ref: 00D895A7
CloseHandle.KERNEL32(?), ref: 00D89601

Strings

SystemTime, xrefs: 00D89634

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: CloseHandle$ErrorLastObjectSingleWait
String ID: SystemTime
API String ID: 1454876536-2656138
Opcode ID: 7925e7d75fc105cad344b80e4ce35b85e0de82f52fa6bfeee6cecb7e4e43d824
Instruction ID: 2dd036c497188b4c25e721b82c88c8069e5eb7aa8c995735bab6c3b585c5cb78
Opcode Fuzzy Hash: 7925e7d75fc105cad344b80e4ce35b85e0de82f52fa6bfeee6cecb7e4e43d824
Instruction Fuzzy Hash: E921B272D01208BADB00BBA8AC46AEEBB78EF46328F141115F91877282E771561587F2

Function 00D78350 Relevance: 8.0, APIs: 3, Strings: 2, Instructions: 467COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(00000001,?,?), ref: 00D7839A
memcpy.MSVCRT(00000001,00000000,?), ref: 00D78437

Part of subcall function 00D2E250: GetProcessHeap.KERNEL32(?), ref: 00D79460
Part of subcall function 00D2E250: HeapFree.KERNEL32(00000000,00000000,00000000,?), ref: 00D79469

memcpy.MSVCRT(00000001,?,?), ref: 00D7852D

Strings

assertion failed: self.height > 0, xrefs: 00D78938
PATHlibrary\std\src\sys_common\process.rs, xrefs: 00D783EA, 00D78596

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: memcpy$Heap$FreeProcess
String ID: PATHlibrary\std\src\sys_common\process.rs$assertion failed: self.height > 0
API String ID: 2997710474-3507162100
Opcode ID: e96150c5cc78b21b590a53780bf202e9578c54704b27c6a22b4913997a9beee0
Instruction ID: ff70877ac3f0188221787e93a5ec6420a363d3728c61830138a619fe18f7d429
Opcode Fuzzy Hash: e96150c5cc78b21b590a53780bf202e9578c54704b27c6a22b4913997a9beee0
Instruction Fuzzy Hash: CA12AE71D006199BDB10DFA4DC85BEEB7B9FF59304F14816AE809BB242EB709941CBB1

Function 00D25324 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 196COMMON

Download Yara Rule

Strings

Internal buffer state failure~\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\murmur3-0.5.2\src\murmur3_32.rs, xrefs: 00D254F1
EN, xrefs: 00D254EA
@M, xrefs: 00D2549A
hQ, xrefs: 00D254A5

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID: @M$EN$Internal buffer state failure~\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\murmur3-0.5.2\src\murmur3_32.rs$hQ
API String ID: 0-2742669996
Opcode ID: 73605157e3ea656bc37a9b9fe66e752ee20e0deb53f48db0a46028e2b8e42180
Instruction ID: 3da2c2d7046f591181ca8b2c9bbd5ff93e75038a501b2fe34241b2ba7acb8fd4
Opcode Fuzzy Hash: 73605157e3ea656bc37a9b9fe66e752ee20e0deb53f48db0a46028e2b8e42180
Instruction Fuzzy Hash: 6C61EAB2E006248FCB04DF58EC51BAEB7B1EF99324F094169E819A7392D735D905CBB0

Function 00D650AE Relevance: 7.6, APIs: 5, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a065edf2285ab03d69dbc0da9d86720ce3e260153358480695c83e767d1e24
Instruction ID: bf85ae048ee09e751fda51a58e103486118e940c6dd2432c98556d99cf511f67
Opcode Fuzzy Hash: 90a065edf2285ab03d69dbc0da9d86720ce3e260153358480695c83e767d1e24
Instruction Fuzzy Hash: BB51E071D043499FCB10DFA4EC91BAEBBB0AF5A304F188049E944BB342E7359885CBB1

Function 00D602D0 Relevance: 7.6, APIs: 6, Instructions: 104COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,00000000,00E80058,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00D602F4
TlsGetValue.KERNEL32(00000000,00000000,?,00000000,00E80058,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00D60317
TlsGetValue.KERNEL32(00000000,00000000,00000000,?,00000000,00E80058,?,?,?,?,?,?,?,?,?,?), ref: 00D6032D
TlsSetValue.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,00000000,00E80058), ref: 00D60361
TlsSetValue.KERNEL32(00000000,?,00000001,00000000,00000000,00000000,?,00000000,00E80058), ref: 00D60376
TlsSetValue.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,?,00000000,00E80058), ref: 00D60399

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 3320288fc391b49ab01bec1c6ecdce26936600117fa7ce13f4d1d58049cd9866
Instruction ID: 8a9eeca0f6d3f69013871a1ae9bb94281a3c344abdc70b53111612e85120381f
Opcode Fuzzy Hash: 3320288fc391b49ab01bec1c6ecdce26936600117fa7ce13f4d1d58049cd9866
Instruction Fuzzy Hash: 2E3188B1B452055B9B50EB69DC46D3F3BA8EF84751B080025F84EF7382E631ED099772

Function 00DD8620 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

calloc.MSVCRT ref: 00DD8648
free.MSVCRT ref: 00DD86D7
free.MSVCRT ref: 00DD86FF

Part of subcall function 00DD9470: calloc.MSVCRT ref: 00DD94A2
Part of subcall function 00DD9470: CreateSemaphoreA.KERNEL32 ref: 00DD94F8
Part of subcall function 00DD9470: CreateSemaphoreA.KERNEL32 ref: 00DD951F
Part of subcall function 00DD9470: InitializeCriticalSection.KERNEL32 ref: 00DD953E
Part of subcall function 00DD9470: InitializeCriticalSection.KERNEL32 ref: 00DD9549
Part of subcall function 00DD9470: InitializeCriticalSection.KERNEL32 ref: 00DD9554

free.MSVCRT ref: 00DD8747

Strings

, xrefs: 00DD8639

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: CriticalInitializeSectionfree$CreateSemaphorecalloc
String ID:
API String ID: 3430360044-3916222277
Opcode ID: 7c7c0541aae3a9993defe68905c02274730ffd7a2e58aa1a6a661b71b853b83b
Instruction ID: 8e1d5fd88cb9d218f552a5d0ddaba469fbd2ba948617e4d9c0ae801c6162dcd0
Opcode Fuzzy Hash: 7c7c0541aae3a9993defe68905c02274730ffd7a2e58aa1a6a661b71b853b83b
Instruction Fuzzy Hash: D2313EB56097058FD700AF26E48531BBBE5EF80314F15886FE4888B305D775D84A9BF2

Function 00D8D2C0 Relevance: 7.6, APIs: 5, Instructions: 74COMMON

Download Yara Rule

APIs

WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(00E800E4,?,?,00D796F6,00E800E8,00000000), ref: 00D8D2EC
WakeByAddressSingle.API-MS-WIN-CORE-SYNCH-L1-2-0(00E800EC,?,?,00D796F6,00E800E8,00000000), ref: 00D8D32A
WakeByAddressAll.API-MS-WIN-CORE-SYNCH-L1-2-0(00E800E8,?,00D796F6,00E800E8,00000000), ref: 00D8D33E
TlsSetValue.KERNEL32(?,00000001,00000000,?,?,?,00E4D44C,00000024,00E4D470,?,?,00D796F6,00E800E8,00000000), ref: 00D8D36F
TlsSetValue.KERNEL32(?,00000000,?,00000001,00000000,?,?,?,00E4D44C,00000024,00E4D470,?,?,00D796F6,00E800E8,00000000), ref: 00D8D382

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: AddressWake$SingleValue
String ID:
API String ID: 1317188499-0
Opcode ID: d928b422c1d1a096d0f400324e56e42f06a7ff1a3ab18d995347f1c0f38c24e8
Instruction ID: 18fc74df39715b078a38f5493af525b66279a544185bc1033bae2695e593b126
Opcode Fuzzy Hash: d928b422c1d1a096d0f400324e56e42f06a7ff1a3ab18d995347f1c0f38c24e8
Instruction Fuzzy Hash: 4121D571240211ABDF256B58F801B9A77A9DF45329F04443DF54EE72C1CE30E842C7E6

Function 00D7C1D0 Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00D7C080: NtOpenFile.NTDLL(00000000,?,?,00000103,00000007,?), ref: 00D7C0F7

SetFileInformationByHandle.KERNEL32(?,00000015,00000013,00000004), ref: 00D7C212
GetLastError.KERNEL32(?,00000015,00000013,00000004), ref: 00D7C21B
SetFileInformationByHandle.KERNEL32(?,00000004,00000001,00000001,?,00000015,00000013,00000004), ref: 00D7C23C
CloseHandle.KERNEL32(?,?,00000015,00000013,00000004), ref: 00D7C248
GetLastError.KERNEL32(?,00000004,00000001,00000001,?,00000015,00000013,00000004), ref: 00D7C265

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: FileHandle$ErrorInformationLast$CloseOpen
String ID:
API String ID: 1689364314-0
Opcode ID: b79ccbc9543e70f309300c1fa5a0497ca0ee9464cb26cf698f68fbcf3bb9e4e1
Instruction ID: 1095433b2d53133aae13b8a3d37d684e512e263f2641048b3a842248ea5624cc
Opcode Fuzzy Hash: b79ccbc9543e70f309300c1fa5a0497ca0ee9464cb26cf698f68fbcf3bb9e4e1
Instruction Fuzzy Hash: 5B11EC71E101086FEB2095D89C42BBF76ACDBC6704F148029F618E6283F561CD4183B5

Function 00D827F0 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,00000000,?,00D825A9,?), ref: 00D82802
GetLastError.KERNEL32(00000000,00000001,00000001,00000000,?,?,00000000,?,00D825A9,?), ref: 00D8284B
CloseHandle.KERNEL32(?,00000000,00000001,00000001,00000000,?,?,00000000,?,00D825A9,?), ref: 00D8285E
CloseHandle.KERNEL32(00000000,?,?,00D825A9,?), ref: 00D82879
CloseHandle.KERNEL32(?,00000000,?,?,00D825A9,?), ref: 00D8287F

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: CloseHandle$CreateErrorEventLast
String ID:
API String ID: 3743700123-0
Opcode ID: ee350ca5565e079627bf0ce25616038491ad30b1ee811489c2a7836417036e5d
Instruction ID: d3d1a131fa8b0a918e0f2e39596556b9904b79a582069c362a0cb06d5dd8c212
Opcode Fuzzy Hash: ee350ca5565e079627bf0ce25616038491ad30b1ee811489c2a7836417036e5d
Instruction Fuzzy Hash: 9C11A571A407027FE710AF259C42B26BBA8EF86714F144126F608AF692EBB09550C7F1

Function 00D755E0 Relevance: 7.6, APIs: 5, Instructions: 51synchronizationCOMMON

Download Yara Rule

APIs

TerminateProcess.KERNEL32(?,00000001,00000000,?,?,?,?,?), ref: 00D75603
GetLastError.KERNEL32(?,00000001,00000000,?,?,?,?,?), ref: 00D75611
WaitForSingleObject.KERNEL32(?,00000000,?,00000001,00000000,?,?,?,?,?), ref: 00D75620
GetLastError.KERNEL32(?,?,?,00000000,?,00000001,00000000,?,?,?,?,?), ref: 00D75647

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ErrorLast$ObjectProcessSingleTerminateWait
String ID:
API String ID: 536955195-0
Opcode ID: 25a8aaf39ca2f70561c3e3ef9cfea3edae8c9d3b2d333671584e5bae49a495be
Instruction ID: a1441fb34e5fdc06c1556dab304d8880c709366e2524fdb533bebb41d3ef834b
Opcode Fuzzy Hash: 25a8aaf39ca2f70561c3e3ef9cfea3edae8c9d3b2d333671584e5bae49a495be
Instruction Fuzzy Hash: 220184702006046BEB205A559C81F7E7FACDB86750F98802AF94CC7246E6B1D84186B3

Function 00D89680 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,00D7676B,?,00000000,00000000), ref: 00D896B9
GetLastError.KERNEL32(?,?,?,?,?,?,00D7676B,?,00000000,00000000), ref: 00D89793
CloseHandle.KERNEL32(?,?,00000000,00E4BA84), ref: 00D897F8

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00D897B5

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: CloseErrorFrequencyHandleLastPerformanceQuery
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 4077432747-2333694755
Opcode ID: f1eadf1409619535b77f3b8c734f60fa0997ac55e710bf52b2fd7ce4c638f6df
Instruction ID: ae389efbde7e4563067c73643a5f066c63323aff6ca2fedf57b7fe4947d248b9
Opcode Fuzzy Hash: f1eadf1409619535b77f3b8c734f60fa0997ac55e710bf52b2fd7ce4c638f6df
Instruction Fuzzy Hash: C741D772A043056FCB04EF29DC41A6ABBF9EFC4750F05892DF89CA7351E73199048BA2

Function 00D8A740 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 00D8A748
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 00D8A757

Strings

GetTempPath2W, xrefs: 00D8A751
kernel32, xrefs: 00D8A743

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetTempPath2W$kernel32
API String ID: 1646373207-407914046
Opcode ID: 85eec4ac46bbd6921246a356c31794ce106554f6a1941e8afd436b0825d662fd
Instruction ID: d6b16ea46ccc81be1622b6164227f5f5201a4a2f9cf68aeee5b3de101da562d5
Opcode Fuzzy Hash: 85eec4ac46bbd6921246a356c31794ce106554f6a1941e8afd436b0825d662fd
Instruction Fuzzy Hash: 17D05E3038D3045A6748776A2E1A7213FD8DA80310700003FEA00D6751E9B1D80092BD

Function 00D48680 Relevance: 6.7, APIs: 5, Instructions: 420COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 55238de87f37f1ab514e042006d3740614b72326d0ed59cda950c538865051fd
Instruction ID: 008809e69f5f7ca9784e547314548a5eef3568e5cbd947cb84eca1b3914962cb
Opcode Fuzzy Hash: 55238de87f37f1ab514e042006d3740614b72326d0ed59cda950c538865051fd
Instruction Fuzzy Hash: 2922D875D00A19CBCB14CF59C890AEEF7B5FF89314F1486AAD819AB315DB30AA45CF60

Function 00D48602 Relevance: 6.7, APIs: 5, Instructions: 418COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 8c84599d8e24940f1c4933370620b3830b6c0aea3ab83f5099d7f7bd6fffc1b1
Instruction ID: 81158698f974abc8b99b3c19ef0d7df0f36091f0c0cf2e8fa7590edd8cdd7cf2
Opcode Fuzzy Hash: 8c84599d8e24940f1c4933370620b3830b6c0aea3ab83f5099d7f7bd6fffc1b1
Instruction Fuzzy Hash: C922C775D00A198BCB15CF59C890AEEF7B5FF89304F1486AAD8197B315DB30AA85CF60

Function 00D4867E Relevance: 6.7, APIs: 5, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 0df7e72be962efcb2994aab0aa51887e08c832ae9610e9f9641bdaa7bfb29bb6
Instruction ID: b5534f3ab57900f264f2d16cf455af50efac37a57793d8466aa08b5063e4fda8
Opcode Fuzzy Hash: 0df7e72be962efcb2994aab0aa51887e08c832ae9610e9f9641bdaa7bfb29bb6
Instruction Fuzzy Hash: AD22C875D00A198BCB15CF59C890AEEF7B5FF89304F1486AAD8196B315DB30AA85CF60

Function 00D4865D Relevance: 6.7, APIs: 5, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: f394d26b791d61e6280c5b6e89c887c57d08623dc58929aed10a3a2c114dc0fd
Instruction ID: 90f3fd9640eaec8acab4e77a4312db8fbb209dd60b48b35a9f3602fe2b60c381
Opcode Fuzzy Hash: f394d26b791d61e6280c5b6e89c887c57d08623dc58929aed10a3a2c114dc0fd
Instruction Fuzzy Hash: DB22C675D00A19CBCB15CF59C890AEEF7B5FF89304F1486AAD8196B315DB30AA85CF60

Function 00D2E270 Relevance: 6.3, APIs: 5, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,00DAD75B,00000000,?,?,?,?,00D7C5DB,00D7C5DA,?,?,00000000,00E56A0C), ref: 00D79494
HeapReAlloc.KERNEL32(00000000,00000000,?,00000000,?,?,?,?,00DAD75B,00000000,?,?,?,?,00D7C5DB,00D7C5DA), ref: 00D7949E
memcpy.MSVCRT(00000000,?,00000000,?,?,?,?,?,00E56A0C,?,?,?,00000000,?,?), ref: 00D794E1
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,00E56A0C,?,?,?,00000000,?,?), ref: 00D794EC
HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,?,?,00E56A0C,?,?,?,00000000), ref: 00D794F5

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Heap$Process$AllocFreememcpy
String ID:
API String ID: 3405790324-0
Opcode ID: 46882976521753e962c88f999377f3c58e74f38a72441a89e94f0b68cf1a7511
Instruction ID: 679ad7f20e704cdcabca1833fb1defc0cb3f05f399aedfb960d7c268fcc47689
Opcode Fuzzy Hash: 46882976521753e962c88f999377f3c58e74f38a72441a89e94f0b68cf1a7511
Instruction Fuzzy Hash: 8D1170726052156BDB10AE68C885B5BBBEDEFC4314F15852AF84897301E670EC0586BA

Function 00DAE090 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 200COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(00000000,00000000,00D2B0EA,?,?,00D2B0EA,00000000,?,?), ref: 00DAE0D2
memcpy.MSVCRT(00000000,?,?,?,?,?,?,?,00000000,?,$l,$l,00D2B0EA,00000000,?,?), ref: 00DAE1D2

Strings

$l, xrefs: 00DAE151, 00DAE251
$l, xrefs: 00DAE15D, 00DAE16E, 00DAE25D, 00DAE26E

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: memcpy
String ID: $l$$l
API String ID: 3510742995-2422038930
Opcode ID: c8d024c50c7e9ba628ebf3a54b01071d4b56349483c2cd4e40f1bed36428fdb8
Instruction ID: 509ced469b5a9ddd18596260a6aac8b9b04ba45357f0d495da298b0ece9a331f
Opcode Fuzzy Hash: c8d024c50c7e9ba628ebf3a54b01071d4b56349483c2cd4e40f1bed36428fdb8
Instruction Fuzzy Hash: 8751C8B0D00315AFDB00AFA9DC85FBA7BBCEF46315F188466F8199B252E6719900C7B1

Function 00DB14A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 160COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(00000001,?,?), ref: 00DB14F7
memcpy.MSVCRT(00000001,?,?), ref: 00DB1551

Strings

@k, xrefs: 00DB15FB
@k, xrefs: 00DB160E

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: memcpy
String ID: @k$@k
API String ID: 3510742995-1676244581
Opcode ID: b6b17158166764abb2523c57fc780bec80d9de2ecf14560210eb930c44bb04e9
Instruction ID: a7705f7c805ab1f0c856f3f033d61b48e58acc165d65f057e9d612d1dd2cc817
Opcode Fuzzy Hash: b6b17158166764abb2523c57fc780bec80d9de2ecf14560210eb930c44bb04e9
Instruction Fuzzy Hash: F85120B5E00219DFCB10DF98DC91AEEB7B9EF49314F584429E91AA7341E731A904CBB1

Function 00D89180 Relevance: 6.1, APIs: 4, Instructions: 128COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000,?), ref: 00D891F2
ReadConsoleW.KERNEL32(?,00E4CF04,00000001,00000000,?,00000000,?), ref: 00D89202
GetLastError.KERNEL32(?,00E4CF04,00000001,00000000,?,00000000,?), ref: 00D89212
GetLastError.KERNEL32(?,00E4CF04,00000001,00000000,?,00000000,?), ref: 00D89287

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ErrorLast$ConsoleRead
String ID:
API String ID: 2254617233-0
Opcode ID: 34e13ffec724e1e8c6dd217594261a4964956ebdabd0e6a51f673e053179a7e6
Instruction ID: 05b86cbb599d40d6992a06b7fa23a88d8847a1f690a166ec86aae400c5de62ca
Opcode Fuzzy Hash: 34e13ffec724e1e8c6dd217594261a4964956ebdabd0e6a51f673e053179a7e6
Instruction Fuzzy Hash: DA41C471A00319BBCF10EFA8C891BBFBBA8EF45310F584029F949AB241D735A941C7B5

Function 00D7E190 Relevance: 6.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

CreateSymbolicLinkW.KERNEL32(00D7E17B,00000000,-00000002,?,?,?,?,00D7E17B,00000000,?,00000000,00000000,?,00000000,00000000), ref: 00D7E247
GetLastError.KERNEL32(00D7E17B,00000000,-00000002,?,?,?,?,00D7E17B,00000000,?,00000000,00000000,?,00000000,00000000), ref: 00D7E255
CreateSymbolicLinkW.KERNEL32(00000000,00000000,?,00D7E17B,00000000,-00000002,?,?,?,?,00D7E17B,00000000,?,00000000,00000000,?), ref: 00D7E268
GetLastError.KERNEL32(00000000,00000000,?,00D7E17B,00000000,-00000002,?,?,?,?,00D7E17B,00000000,?,00000000,00000000,?), ref: 00D7E271

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: CreateErrorLastLinkSymbolic
String ID:
API String ID: 191780330-0
Opcode ID: 7c7179d733266c1e405f60b6e60e406e7f1ce5a2ade1fc9c9036a895c68fe891
Instruction ID: b40e4f76306d34f1573ef65702de41bdad10f5a7ab250972a6e74183498555e1
Opcode Fuzzy Hash: 7c7179d733266c1e405f60b6e60e406e7f1ce5a2ade1fc9c9036a895c68fe891
Instruction Fuzzy Hash: 473190B5D0021AABDF14DFD4DC42AEEBBB9EF58304F148469E859B7342E6319900CBB5

Function 00D21001 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00D2106B
__p__fmode.MSVCRT ref: 00D21070
__p__commode.MSVCRT ref: 00D2107D

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: __p__commode__p__fmode__set_app_type
String ID:
API String ID: 3338496922-0
Opcode ID: 18fd7aad98adc9b354ed51c64d6c057bb4d302ad1301e8ba2d7f9671c8465348
Instruction ID: 3ff3192ead75833214bf15cd9e6fc354c7bb9cf8677ef36ca22c1200adf92bf8
Opcode Fuzzy Hash: 18fd7aad98adc9b354ed51c64d6c057bb4d302ad1301e8ba2d7f9671c8465348
Instruction Fuzzy Hash: A021CD74500212DFC750AF64EA457A537E1FB20308F99CA69C0585B326D77AD8CACBB2

Function 00D65430 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

UnlockFile.KERNEL32(?,00000000,00000000,000000FF,000000FF), ref: 00D65446
UnlockFile.KERNEL32(?,00000000,00000000,000000FF,000000FF,?,00000000,00000000,000000FF,000000FF), ref: 00D65458
GetLastError.KERNEL32(?,00000000,00000000,000000FF,000000FF,?,00000000,00000000,000000FF,000000FF), ref: 00D65461
GetLastError.KERNEL32(?,00000000,00000000,000000FF,000000FF), ref: 00D65472

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ErrorFileLastUnlock
String ID:
API String ID: 3655728120-0
Opcode ID: cd91cb9532f03e2d504fe89ff3b9144a8d410329774d4e8a71c7d3a3d2a98376
Instruction ID: 04c9ce049118a6172003143d59b61117839513e9b07efc3dcee89f9c65f965fc
Opcode Fuzzy Hash: cd91cb9532f03e2d504fe89ff3b9144a8d410329774d4e8a71c7d3a3d2a98376
Instruction Fuzzy Hash: 9FF096302482116BDB205B589C01B167B988B82771F34479AFAB4A73C5DA70F8818375

Function 00D75670 Relevance: 6.0, APIs: 4, Instructions: 39synchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00D7568B
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00D75696
GetLastError.KERNEL32(?,?,?,000000FF), ref: 00D7569F
GetExitCodeProcess.KERNEL32(?,?), ref: 00D756BB

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: CloseCodeErrorExitHandleLastObjectProcessSingleWait
String ID:
API String ID: 2321548817-0
Opcode ID: 69a56f6582363e804a401e43d8be51aba516ca54cd33ddb105b77b7c2e86dab8
Instruction ID: 87464196789fa54d159de2d4f18ab8b13bdbe93f911334cf6c2a89afa327faa5
Opcode Fuzzy Hash: 69a56f6582363e804a401e43d8be51aba516ca54cd33ddb105b77b7c2e86dab8
Instruction Fuzzy Hash: EBF04FB0500645ABDB10EF59D800B5EFBF8EF85320F54801AE96897381E774E841CBB6

Function 00D76730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32 ref: 00D7674D
GetLastError.KERNEL32 ref: 00D7678B

Part of subcall function 00D89680: QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,00D7676B,?,00000000,00000000), ref: 00D896B9

Strings

called `Result::unwrap()` on an `Err` value, xrefs: 00D767AD

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: PerformanceQuery$CounterErrorFrequencyLast
String ID: called `Result::unwrap()` on an `Err` value
API String ID: 158728112-2333694755
Opcode ID: c2dae1e0fcca4d2a4d771a6627b968f4ea3cc974b979b03f16fb90d89228535c
Instruction ID: a2ee7bc25d863cef2e0b5ccdde5b3557f59387fd3ca96121b1f04c5eed5e238b
Opcode Fuzzy Hash: c2dae1e0fcca4d2a4d771a6627b968f4ea3cc974b979b03f16fb90d89228535c
Instruction Fuzzy Hash: FC216676904305ABCB00AF59DC05A9BBBF8EFC9764F04882DF99D97251E631D510CBA2

Function 00DD5610 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00DD56BC

Strings

%p not found?!?!, xrefs: 00DD56B1

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: fprintf
String ID: %p not found?!?!
API String ID: 383729395-11085004
Opcode ID: 3027a89d36669b8762b4cbf4150c668d378b29f0d9854024572e3c9d8df3b3a4
Instruction ID: 3c710aeaf59d49770fd66462649b037abab488b81bf4417dd112306fbeb73635
Opcode Fuzzy Hash: 3027a89d36669b8762b4cbf4150c668d378b29f0d9854024572e3c9d8df3b3a4
Instruction Fuzzy Hash: 18115271509B108FCB60BF35E484629BBE4AF00750F89846ED4898B309D771D884CB72

Function 00D60690 Relevance: 5.1, APIs: 4, Instructions: 146COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,00000001,?,?,?,?,?,?,?,00000000,00000000,00000000,?,00D60600,00000000,00D75A7E), ref: 00D606B2
TlsGetValue.KERNEL32(?,?,00000001,?,?,?,?,?,?,?,00000000,00000000,00000000,?,00D60600,00000000), ref: 00D606C6
TlsGetValue.KERNEL32(?,?,?,00000001,?,?,?,?,?,?,?,00000000,00000000,00000000,?,00D60600), ref: 00D606DC
TlsSetValue.KERNEL32(00000000,-00000007,?,?,00000001), ref: 00D6076E

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 93a6ed12c4419c4377023741404c17f7e89a15f02c0ac2381c9d8e8c71e73c4b
Instruction ID: b9f290fcdcae3e4c1a19400e0edda1873345dbf6e6a881608c9d8f83c7499d41
Opcode Fuzzy Hash: 93a6ed12c4419c4377023741404c17f7e89a15f02c0ac2381c9d8e8c71e73c4b
Instruction Fuzzy Hash: 605150B0D412099BEB40EFA5DC85BEF7BB4EF44314F184015E805BB282D7769949CBB5

Function 00D94060 Relevance: 5.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(-00000001,?,?,00000008,00000018), ref: 00D94075
TlsGetValue.KERNEL32(00000000,?,00000000,?,?,?,00000008,00000018), ref: 00D940C5
TlsSetValue.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,00000008,00000018), ref: 00D940D1
TlsGetValue.KERNEL32(00000000,?,?,?,00000008,00000018), ref: 00D94100

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f087ead707db3e1f251789358af4e22020b6739e49616927e53eee50ae583722
Instruction ID: 2b51daa6a38625705eaf36a905c6606a83965218ed4f2f472f35057bdadb0200
Opcode Fuzzy Hash: f087ead707db3e1f251789358af4e22020b6739e49616927e53eee50ae583722
Instruction Fuzzy Hash: 162135729002145FDF10BB69AC02F6FBBA8EF81750F094416EA09AB393DA719D0687B1

Function 00D887D0 Relevance: 5.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000000,?,?,00000001,?,00D89118,?), ref: 00D887EE
memmove.MSVCRT(?,?,00000004,?,00D89118,?), ref: 00D88808
GetStdHandle.KERNEL32(FFFFFFF4,?,?,?,?,?,?,00D6DB2E,?,?,?,00D6D2D9,?,00D6DB2E,?,00D6DB2E), ref: 00D88853
GetLastError.KERNEL32(FFFFFFF4,?,?,?,?,?,?,00D6DB2E,?,?,?,00D6D2D9,?,00D6DB2E,?,00D6DB2E), ref: 00D88863

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: ErrorHandleLastmemcpymemmove
String ID:
API String ID: 2696460671-0
Opcode ID: e45be057f6ca88db3bbf7844e583fea07cecd157b246ea301822c8461881a7f6
Instruction ID: 25f71f733b06cc9912fc9a0dc7336b6552dd2041dad8dd90fa0fa99b74c3944a
Opcode Fuzzy Hash: e45be057f6ca88db3bbf7844e583fea07cecd157b246ea301822c8461881a7f6
Instruction Fuzzy Hash: FE11EB616012046ED6107A79AC85B777BACDB52364FD8853AF94987242E971DC01A3B1

Function 00D774D0 Relevance: 5.1, APIs: 4, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(00000000,?,?), ref: 00D7750E
memcpy.MSVCRT(00000000,?,?), ref: 00D77552
GetProcessHeap.KERNEL32 ref: 00D7755D
HeapFree.KERNEL32(00000000,00000000,?), ref: 00D77566

Part of subcall function 00D8A950: GetProcessHeap.KERNEL32(?,00D7942C,?,?,?,?,?,?,?,?,?,?,?,?,80000000,?), ref: 00D8A953
Part of subcall function 00D8A950: HeapAlloc.KERNEL32(00000000,?,?,?,00D7942C), ref: 00D8A963

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Heap$Processmemcpy$AllocFree
String ID:
API String ID: 1904491526-0
Opcode ID: 73df4b082369a9695a373649fd978ccbebfab89fba2fcdb34035ad8a3d1ba8fe
Instruction ID: c2c6c89184be88b6476afbbc8495601e9832c9ed11bca11d21a73589f859792e
Opcode Fuzzy Hash: 73df4b082369a9695a373649fd978ccbebfab89fba2fcdb34035ad8a3d1ba8fe
Instruction Fuzzy Hash: 8911A3B2A083116BCB10AF699C86A4F7BE9EBC4710F59853AFC0C97301F630D81487B6

Function 00D60440 Relevance: 5.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,00D5FE9D,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00D6044F
TlsGetValue.KERNEL32(00000000,00D5FE9D,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00D6048A
TlsGetValue.KERNEL32(00000000,00000000,00D5FE9D,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00D6049F
TlsGetValue.KERNEL32(00000000,00000000,00000000,00D5FE9D,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00D604B1

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b106f609f5b413f8bab3d5a8c469385066d743922286cd67c0e8217ffa75e49e
Instruction ID: 0ea6f3201d02962df214b6c969249387139db3c3bc561eede6d31c3e236773a0
Opcode Fuzzy Hash: b106f609f5b413f8bab3d5a8c469385066d743922286cd67c0e8217ffa75e49e
Instruction Fuzzy Hash: E201B970B81204575AA072A96C47E6B7B89DEC47617080832E91EF7645ED21EC4C53B1

Function 00D704D0 Relevance: 5.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00D704E7
CloseHandle.KERNEL32(?), ref: 00D704F5
CloseHandle.KERNEL32(?), ref: 00D70503
CloseHandle.KERNEL32(?), ref: 00D70509

Memory Dump Source

Source File: 00000000.00000002.2196265838.0000000000D21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000000.00000002.2196250472.0000000000D20000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196325381.0000000000DE0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196338774.0000000000DE1000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196398410.0000000000E81000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196411433.0000000000E82000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2196424749.0000000000E85000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d20000_uo9m.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: a322bf90f38147dd208aabad70a575d61a942dd54d757470b5a91c8da1f53763
Instruction ID: 5d2297fda815ccfb5a6600f6d1e3cab0e6f0a4eeffecca59159d7a221f4e0d16
Opcode Fuzzy Hash: a322bf90f38147dd208aabad70a575d61a942dd54d757470b5a91c8da1f53763
Instruction Fuzzy Hash: FEF03031100204EBDF256F08D885B667F68EB80325F0880A2FA082A696D771DC50CBF1

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report uo9m.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Windows Analysis Report
uo9m.exe

Function 00D27A40 Relevance: 35.3, APIs: 19, Strings: 1, Instructions: 335
libraryloadertimeCOMMON

Function 00D27F50 Relevance: 26.8, APIs: 13, Strings: 2, Instructions: 587
librarynativeloaderCOMMON

Function 00D2116A Relevance: 15.2, APIs: 10, Instructions: 150
sleepstringCOMMON

Function 00D21319 Relevance: 10.6, APIs: 7, Instructions: 96
stringCOMMON

Function 00D21187 Relevance: 9.1, APIs: 6, Instructions: 102
sleepstringCOMMON

Function 00D5FE60 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129
threadCOMMON

Function 00D21160 Relevance: 7.6, APIs: 5, Instructions: 110
sleepstringCOMMON

Function 00D3AE60 Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Function 00D2E250 Relevance: 2.5, APIs: 2, Instructions: 19
memoryCOMMON

Function 00DD5B20 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 126
threadlibraryloaderCOMMON

Function 00D29320 Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 225
COMMON

Function 00D341E0 Relevance: 6.5, APIs: 5, Instructions: 247
COMMON

Function 00D8A950 Relevance: 2.5, APIs: 2, Instructions: 14
memoryCOMMON