Play interactive tour

Edit tour

Windows Analysis Report winhost.exe

Overview

General Information

Sample Name:	winhost.exe
Analysis ID:	459164
MD5:	fcf0f4b709606c50ce6157c044d10b9d
SHA1:	bb101a1b8357d52f8f7970d3f5f43bc25392bfeb
SHA256:	6169c9d6694e0263c7bc80e1409fea8e46188f08914095d91f3ad03a2d29fd08
Infos:
Most interesting Screenshot:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Contains functionality to detect virtual machines (IN, VMware)

Contains functionality to infect the boot sector

Tries to evade analysis by execution special instruction which cause usermode exception

Tries to harvest and steal browser information (history, passwords, etc)

Contains functionality for read data from the clipboard

Contains functionality to communicate with device drivers

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to simulate mouse events

Detected potential crypto function

Found potential string decryption / allocating functions

Installs a raw input device (often for capturing keystrokes)

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

winhost.exe (PID: 7056 cmdline: 'C:\Users\user\Desktop\winhost.exe' MD5: FCF0F4B709606C50CE6157C044D10B9D)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: winhost.exe	Virustotal: Detection: 21%			Perma Link
Source: winhost.exe	ReversingLabs: Detection: 28%

Source: winhost.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: winhost.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: C:\Qt\GiveMeMoney\Release\winhost.pdb source: winhost.exe

Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_001E3E60 SHGetValueW,SHGetFolderPathW,PathAppendW,PathAppendW,PathAppendW,PathAppendW,PathFileExistsW,GetFileAttributesW,SHGetFolderPathW,PathAppendW,PathAppendW,PathAppendW,PathAppendW,SHGetFolderPathW,PathAppendW,PathAppendW,PathAppendW,PathAppendW,PathAppendW,PathFileExistsW,GetFileAttributesW,GetCurrentDirectoryW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,SetCurrentDirectoryW,lstrcpyW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,FindNextFileW,PathFileExistsW,		0_2_001E3E60
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_003060B0 SHGetFolderPathW,SHGetFolderPathW,PathAppendW,PathAppendW,PathFileExistsW,PathFileExistsW,SHGetFolderPathW,PathAppendW,PathFileExistsW,lstrcpyW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,PathAppendW,PathAppendW,PathFileExistsW,lstrcpyW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,FindNextFileW,PathAppendW,FindNextFileW,		0_2_003060B0

Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 47.111.207.85:443
Source: global traffic	TCP traffic: 192.168.2.4:49737 -> 47.111.207.82:443

Source: C:\Users\user\Desktop\winhost.exe

Code function: 0_2_0032E280 InternetCrackUrlW,GetLastError,InternetOpenW,InternetConnectW,HttpOpenRequestW,HttpAddRequestHeadersW,HttpAddRequestHeadersA,InternetQueryOptionW,InternetSetOptionW,InternetSetOptionW,InternetSetOptionW,InternetSetOptionW,InternetSetOptionW,InternetSetOptionW,InternetSetOptionW,InternetSetOptionW,InternetSetOptionW,HttpSendRequestW,GetLastError,InternetQueryOptionW,InternetSetOptionW,WaitForSingleObject,HttpQueryInfoW,InternetOpenW,InternetOpenUrlW,HttpQueryInfoW,GetDesktopWindow,InternetErrorDlg,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,HttpQueryInfoW,GetLastError,InternetReadFile,SetEvent,WaitForSingleObject,InternetCloseHandle,InternetCloseHandle,HttpQueryInfoA,HttpQueryInfoA,HttpQueryInfoA,GetLastError,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_0032E280

Source: unknown

DNS traffic detected: queries for: static.scp.btoo3.com

Source: winhost.exe	String found in binary or memory: http://127.0.0.1/%s
Source: winhost.exe	String found in binary or memory: http://fontello.com
Source: winhost.exe	String found in binary or memory: http://profile.se.360.cn/proxyerr.php
Source: winhost.exe	String found in binary or memory: http://profile.se.360.cn/proxyerr.phpCheck
Source: winhost.exe, 00000000.00000003.669053547.00000000035F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: winhost.exe, 00000000.00000002.669554418.0000000000AEE000.00000004.00000001.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: winhost.exe, 00000000.00000002.669554418.0000000000AEE000.00000004.00000001.sdmp	String found in binary or memory: https://docs.google.com/
Source: winhost.exe, 00000000.00000002.669554418.0000000000AEE000.00000004.00000001.sdmp	String found in binary or memory: https://drive.google.com/
Source: winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp, winhost.exe, 00000000.00000002.669792761.0000000000EC4000.00000004.00000020.sdmp	String found in binary or memory: https://picssl.xunmzone.com/
Source: winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	String found in binary or memory: https://picssl.xunmzone.com/AppData
Source: winhost.exe, 00000000.00000003.658064538.0000000000ED7000.00000004.00000001.sdmp	String found in binary or memory: https://picssl.xunmzone.com/pic/v3.png
Source: winhost.exe, 00000000.00000002.669763422.0000000000E9A000.00000004.00000020.sdmp	String found in binary or memory: https://picssl.xunmzone.com/pic/v3.pngK
Source: winhost.exe, 00000000.00000002.669818189.0000000000ED7000.00000004.00000020.sdmp	String found in binary or memory: https://picssl.xunmzone.com/pic/v3.pngNJ
Source: winhost.exe, 00000000.00000002.669818189.0000000000ED7000.00000004.00000020.sdmp	String found in binary or memory: https://picssl.xunmzone.com/pic/v3.pngZJ
Source: winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	String found in binary or memory: https://picssl.xunmzone.com/pic/v3.pngm32
Source: winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	String found in binary or memory: https://picssl.xunmzone.com/pic/v3.pngp.btoo3.com
Source: winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	String found in binary or memory: https://picssl.xunmzone.com/pic/v3.pngq
Source: winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	String found in binary or memory: https://picssl.xunmzone.com/pic/v3.pngx
Source: winhost.exe, 00000000.00000002.669792761.0000000000EC4000.00000004.00000020.sdmp	String found in binary or memory: https://picssl.xunmzone.com/r
Source: winhost.exe, 00000000.00000002.669844237.0000000000EF5000.00000004.00000020.sdmp	String found in binary or memory: https://picssl.xunmzone.com/ver
Source: winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	String found in binary or memory: https://picssl.xunmzone.com/xunmzone.com/cal
Source: winhost.exe, 00000000.00000002.669792761.0000000000EC4000.00000004.00000020.sdmp	String found in binary or memory: https://static.scp.btoo3.com/
Source: winhost.exe, 00000000.00000002.669844237.0000000000EF5000.00000004.00000020.sdmp	String found in binary or memory: https://static.scp.btoo3.com/F
Source: winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	String found in binary or memory: https://static.scp.btoo3.com/c/v3.png
Source: winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	String found in binary or memory: https://static.scp.btoo3.com/icrosoft
Source: winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	String found in binary or memory: https://static.scp.btoo3.com/stic.html
Source: winhost.exe, 00000000.00000003.658064538.0000000000ED7000.00000004.00000001.sdmp	String found in binary or memory: https://static.scp.btoo3.com/stic.htmlC_%
Source: winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	String found in binary or memory: https://static.scp.btoo3.com/stic.htmlY
Source: winhost.exe, 00000000.00000002.669818189.0000000000ED7000.00000004.00000020.sdmp	String found in binary or memory: https://static.scp.btoo3.com/stic.htmlt_
Source: winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	String found in binary or memory: https://static.scp.btoo3.com/stic.htmlxE
Source: winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	String found in binary or memory: https://static.scp.btoo3.com/v3/bg.png
Source: winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	String found in binary or memory: https://static.scp.btoo3.com/x
Source: winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	String found in binary or memory: https://watson.telemete.com/
Source: winhost.exe, 00000000.00000002.669554418.0000000000AEE000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: C:\Users\user\Desktop\winhost.exe

Code function: 0_2_001FD150 PathFileExistsW,OpenClipboard,EmptyClipboard,CloseClipboard,MapVirtualKeyW,MapVirtualKeyW,SendInput,SendInput,MapVirtualKeyW,SendInput,MapVirtualKeyW,SendInput,MapVirtualKeyW,SendInput,MapVirtualKeyW,SendInput,MapVirtualKeyW,SendInput,MapVirtualKeyW,SendInput,MapVirtualKeyW,SendInput,MapVirtualKeyW,SendInput,MapVirtualKeyW,SendInput,PostMessageW,PostMessageW,

0_2_001FD150

Source: winhost.exe, 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp

Binary or memory string: RegisterRawInputDevices

Source: C:\Users\user\Desktop\winhost.exe

Code function: 0_2_003271F0: CreateFileW,DeviceIoControl,FindCloseChangeNotification,

0_2_003271F0

Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_0030B1C0	0_2_0030B1C0
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_0032E280	0_2_0032E280
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_001E3E60	0_2_001E3E60
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_0032F0D0	0_2_0032F0D0
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_00370196	0_2_00370196
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_00324240	0_2_00324240
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_0033D380	0_2_0033D380
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_00357429	0_2_00357429
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_00318550	0_2_00318550
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_002BF5E0	0_2_002BF5E0
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_003305D0	0_2_003305D0
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_00343620	0_2_00343620
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_00338610	0_2_00338610
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_00357658	0_2_00357658
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_003268A0	0_2_003268A0
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_00357887	0_2_00357887
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_0036D9F2	0_2_0036D9F2
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_0033F9D0	0_2_0033F9D0

Source: C:\Users\user\Desktop\winhost.exe

Code function: String function: 00330BE0 appears 32 times

Source: winhost.exe, 00000000.00000003.658137511.0000000000EF5000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename vs winhost.exe
Source: winhost.exe, 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp	Binary or memory string: 3Check failed: data_.get(). c:\qt\givememoney\base\file_version_info_win.cc\VarFileInfo\TranslationCompanyNameCompanyShortNameInternalNameProductNameProductShortNameCommentsLegalCopyrightProductVersionFileDescriptionLegalTrademarksPrivateBuildFileVersionOriginalFilenameSpecialBuildLastChangeOfficial Build\StringFileInfo\%04x%04x\%ls vs winhost.exe
Source: winhost.exe, 00000000.00000002.670383856.0000000004050000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs winhost.exe
Source: winhost.exe	Binary or memory string: WCheck failed: data_.get(). c:\qt\givememoney\base\file_version_info_win.cc\VarFileInfo\TranslationCompanyNameCompanyShortNameInternalNameProductNameProductShortNameCommentsLegalCopyrightProductVersionFileDescriptionLegalTrademarksPrivateBuildFileVersionOriginalFilenameSpecialBuildLastChangeOfficial Build\StringFileInfo\%04x%04x\%ls vs winhost.exe
Source: winhost.exe	Binary or memory string: OriginalFilename vs winhost.exe

Source: winhost.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: classification engine

Classification label: mal64.spyw.evad.winEXE@1/2@2/2

Source: C:\Users\user\Desktop\winhost.exe

Code function: 0_2_0030D9F0 CoInitialize,CoCreateInstance,GetWindowLongW,SetWindowLongW,

0_2_0030D9F0

Source: C:\Users\user\Desktop\winhost.exe

File created: C:\Users\user\Desktop\uu

Jump to behavior

Source: C:\Users\user\Desktop\winhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\B0E87BF8-A8DC-4160-B331-54EBDD0DEE93

Source: winhost.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\winhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\winhost.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\winhost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\winhost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: winhost.exe	Virustotal: Detection: 21%
Source: winhost.exe	ReversingLabs: Detection: 28%

Source: winhost.exe	String found in binary or memory: debug-on-start
Source: winhost.exe	String found in binary or memory: ^--debug-on-startdisable-breakpadenable-dcheckfull-memory-crash-reportnoerrdialogstest-child-processvvmodulewait-for-debuggertrace-to-consolec:\qt\givememoney\base\at_exit.cc

Source: C:\Users\user\Desktop\winhost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D105A4D4-344C-48EB-9866-EE378D90658B}\InProcServer32

Jump to behavior

Source: winhost.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: winhost.exe

Static file information: File size 2256384 > 1048576

Source: winhost.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1d2200

Source: winhost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: winhost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: winhost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: winhost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: winhost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: winhost.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: winhost.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: winhost.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: C:\Qt\GiveMeMoney\Release\winhost.pdb source: winhost.exe

Source: winhost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: winhost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: winhost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: winhost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: winhost.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_001F0400 push ecx; mov dword ptr [esp], 43160000h	0_2_001F0560
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_001F0400 push ecx; mov dword ptr [esp], 43160000h	0_2_001F0648
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_001F0400 push ecx; mov dword ptr [esp], 42900000h	0_2_001F06ED

Persistence and Installation Behavior:

Contains functionality to infect the boot sector

Show sources

Source: C:\Users\user\Desktop\winhost.exe	Code function: CreateFileW,DeviceIoControl,FindCloseChangeNotification, \\.\PhysicalDrive%d	0_2_00327730
Source: C:\Users\user\Desktop\winhost.exe	Code function: CreateFileW,DeviceIoControl,FindCloseChangeNotification,CloseHandle, \\.\PhysicalDrive%d	0_2_00326FE0
Source: C:\Users\user\Desktop\winhost.exe	Code function: CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	0_2_003274A0

Boot Survival:

Contains functionality to infect the boot sector

Show sources

Source: C:\Users\user\Desktop\winhost.exe	Code function: CreateFileW,DeviceIoControl,FindCloseChangeNotification, \\.\PhysicalDrive%d	0_2_00327730
Source: C:\Users\user\Desktop\winhost.exe	Code function: CreateFileW,DeviceIoControl,FindCloseChangeNotification,CloseHandle, \\.\PhysicalDrive%d	0_2_00326FE0
Source: C:\Users\user\Desktop\winhost.exe	Code function: CreateFileW,DeviceIoControl,DeviceIoControl,CloseHandle, \\.\PhysicalDrive%d	0_2_003274A0

Source: C:\Users\user\Desktop\winhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\winhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\winhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect virtual machines (IN, VMware)

Show sources

Source: C:\Users\user\Desktop\winhost.exe

Code function: 0_2_0030C820 in eax, dx

0_2_0030C820

Tries to evade analysis by execution special instruction which cause usermode exception

Show sources

Source: C:\Users\user\Desktop\winhost.exe

Special instruction interceptor: First address: 000000000030C7B9 instructions 0F3F070B85DB0F9445E75BEB388B45 caused by: Unknown instruction #UD exception

Source: C:\Users\user\Desktop\winhost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_001E3E60 SHGetValueW,SHGetFolderPathW,PathAppendW,PathAppendW,PathAppendW,PathAppendW,PathFileExistsW,GetFileAttributesW,SHGetFolderPathW,PathAppendW,PathAppendW,PathAppendW,PathAppendW,SHGetFolderPathW,PathAppendW,PathAppendW,PathAppendW,PathAppendW,PathAppendW,PathFileExistsW,GetFileAttributesW,GetCurrentDirectoryW,SetCurrentDirectoryW,FindFirstFileW,FindNextFileW,SetCurrentDirectoryW,lstrcpyW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,lstrcmpW,FindNextFileW,PathFileExistsW,		0_2_001E3E60
Source: C:\Users\user\Desktop\winhost.exe	Code function: 0_2_003060B0 SHGetFolderPathW,SHGetFolderPathW,PathAppendW,PathAppendW,PathFileExistsW,PathFileExistsW,SHGetFolderPathW,PathAppendW,PathFileExistsW,lstrcpyW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,PathAppendW,PathAppendW,PathFileExistsW,lstrcpyW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,FindNextFileW,PathAppendW,FindNextFileW,		0_2_003060B0

Source: winhost.exe, 00000000.00000003.658137511.0000000000EF5000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWonic
Source: winhost.exe, 00000000.00000003.658137511.0000000000EF5000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\winhost.exe

Code function: 0_2_0035E2B2 mov eax, dword ptr fs:[00000030h]

0_2_0035E2B2

Source: C:\Users\user\Desktop\winhost.exe

Code function: 0_2_001FC4C0 KillTimer,mouse_event,GetTickCount,OpenClipboard,EmptyClipboard,CloseClipboard,MapVirtualKeyW,MapVirtualKeyW,SendInput,SendInput,MapVirtualKeyW,SendInput,MapVirtualKeyW,SendInput,MapVirtualKeyW,SendInput,MapVirtualKeyW,SendInput,MapVirtualKeyW,SendInput,MapVirtualKeyW,SendInput,MapVirtualKeyW,SendInput,MapVirtualKeyW,SendInput,MapVirtualKeyW,SendInput,PostMessageW,

0_2_001FC4C0

Source: C:\Users\user\Desktop\winhost.exe	Code function: GetLocaleInfoW,	0_2_0036C0DD
Source: C:\Users\user\Desktop\winhost.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0036C206
Source: C:\Users\user\Desktop\winhost.exe	Code function: GetLocaleInfoW,	0_2_0036C30D
Source: C:\Users\user\Desktop\winhost.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_0036C3DA
Source: C:\Users\user\Desktop\winhost.exe	Code function: GetLocaleInfoW,	0_2_0036640D

Source: C:\Users\user\Desktop\winhost.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\winhost.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\winhost.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\winhost.exe

Code function: 0_2_0031B12A GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0031B12A

Source: C:\Users\user\Desktop\winhost.exe

Code function: 0_2_00325460 GetCurrentProcess,GetModuleHandleW,GetProcAddress,GetVersionExW,GetNativeSystemInfo,GetModuleHandleW,GetProcAddress,

0_2_00325460

Stealing of Sensitive Information:

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\winhost.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter2	Bootkit1	Path Interception	Masquerading1	OS Credential Dumping1	System Time Discovery1	Remote Services	Input Capture11	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion11	Input Capture11	Security Software Discovery111	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Deobfuscate/Decode Files or Information1	Security Account Manager	Virtualization/Sandbox Evasion11	SMB/Windows Admin Shares	Data from Local System1	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	Remote System Discovery1	Distributed Component Object Model	Clipboard Data1	Scheduled Transfer	Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Bootkit1	LSA Secrets	File and Directory Discovery2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Information Discovery133	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
winhost.exe	22%	Virustotal		Browse
winhost.exe	9%	Metadefender		Browse
winhost.exe	29%	ReversingLabs	Win32.Trojan.FlySvr

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
picssl.xunmzone.com	0%	Virustotal		Browse
static.scp.btoo3.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://static.scp.btoo3.com/stic.htmlt_	0%	Avira URL Cloud	safe
https://picssl.xunmzone.com/pic/v3.pngK	0%	Avira URL Cloud	safe
https://picssl.xunmzone.com/pic/v3.pngZJ	0%	Avira URL Cloud	safe
https://picssl.xunmzone.com/pic/v3.png	0%	Avira URL Cloud	safe
https://static.scp.btoo3.com/stic.htmlC_%	0%	Avira URL Cloud	safe
https://static.scp.btoo3.com/stic.html	0%	Avira URL Cloud	safe
https://static.scp.btoo3.com/F	0%	Avira URL Cloud	safe
https://picssl.xunmzone.com/AppData	0%	Avira URL Cloud	safe
https://picssl.xunmzone.com/pic/v3.pngx	0%	Avira URL Cloud	safe
https://picssl.xunmzone.com/xunmzone.com/cal	0%	Avira URL Cloud	safe
https://static.scp.btoo3.com/stic.htmlY	0%	Avira URL Cloud	safe
https://watson.telemete.com/	0%	Avira URL Cloud	safe
https://picssl.xunmzone.com/pic/v3.pngNJ	0%	Avira URL Cloud	safe
https://static.scp.btoo3.com/icrosoft	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
https://picssl.xunmzone.com/pic/v3.pngq	0%	Avira URL Cloud	safe
https://static.scp.btoo3.com/	0%	Avira URL Cloud	safe
https://static.scp.btoo3.com/x	0%	Avira URL Cloud	safe
https://picssl.xunmzone.com/	0%	Avira URL Cloud	safe
http://127.0.0.1/%s	0%	Avira URL Cloud	safe
https://static.scp.btoo3.com/c/v3.png	0%	Avira URL Cloud	safe
https://picssl.xunmzone.com/ver	0%	Avira URL Cloud	safe
https://picssl.xunmzone.com/pic/v3.pngp.btoo3.com	0%	Avira URL Cloud	safe
https://picssl.xunmzone.com/pic/v3.pngm32	0%	Avira URL Cloud	safe
https://static.scp.btoo3.com/v3/bg.png	0%	Avira URL Cloud	safe
https://picssl.xunmzone.com/r	0%	Avira URL Cloud	safe
https://static.scp.btoo3.com/stic.htmlxE	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
picssl.xunmzone.com	47.111.207.82	true	false	0%, Virustotal, Browse	unknown
static.scp.btoo3.com	47.111.207.85	true	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://static.scp.btoo3.com/stic.htmlt_	winhost.exe, 00000000.00000002.669818189.0000000000ED7000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://picssl.xunmzone.com/pic/v3.pngK	winhost.exe, 00000000.00000002.669763422.0000000000E9A000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://picssl.xunmzone.com/pic/v3.pngZJ	winhost.exe, 00000000.00000002.669818189.0000000000ED7000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://picssl.xunmzone.com/pic/v3.png	winhost.exe, 00000000.00000003.658064538.0000000000ED7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://fontello.com	winhost.exe	false		high
https://static.scp.btoo3.com/stic.htmlC_%	winhost.exe, 00000000.00000003.658064538.0000000000ED7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://static.scp.btoo3.com/stic.html	winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://static.scp.btoo3.com/F	winhost.exe, 00000000.00000002.669844237.0000000000EF5000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://picssl.xunmzone.com/AppData	winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://picssl.xunmzone.com/pic/v3.pngx	winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://picssl.xunmzone.com/xunmzone.com/cal	winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://static.scp.btoo3.com/stic.htmlY	winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://profile.se.360.cn/proxyerr.php	winhost.exe	false		high
https://docs.google.com/	winhost.exe, 00000000.00000002.669554418.0000000000AEE000.00000004.00000001.sdmp	false		high
https://watson.telemete.com/	winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://picssl.xunmzone.com/pic/v3.pngNJ	winhost.exe, 00000000.00000002.669818189.0000000000ED7000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://static.scp.btoo3.com/icrosoft	winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn	winhost.exe, 00000000.00000003.669053547.00000000035F2000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://picssl.xunmzone.com/pic/v3.pngq	winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://static.scp.btoo3.com/	winhost.exe, 00000000.00000002.669792761.0000000000EC4000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://static.scp.btoo3.com/x	winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://picssl.xunmzone.com/	winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp, winhost.exe, 00000000.00000002.669792761.0000000000EC4000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1/%s	winhost.exe	false	Avira URL Cloud: safe	unknown
https://static.scp.btoo3.com/c/v3.png	winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	winhost.exe, 00000000.00000002.669554418.0000000000AEE000.00000004.00000001.sdmp	false		high
https://picssl.xunmzone.com/ver	winhost.exe, 00000000.00000002.669844237.0000000000EF5000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://picssl.xunmzone.com/pic/v3.pngp.btoo3.com	winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://profile.se.360.cn/proxyerr.phpCheck	winhost.exe	false		high
https://picssl.xunmzone.com/pic/v3.pngm32	winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://static.scp.btoo3.com/v3/bg.png	winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/	winhost.exe, 00000000.00000002.669554418.0000000000AEE000.00000004.00000001.sdmp	false		high
https://picssl.xunmzone.com/r	winhost.exe, 00000000.00000002.669792761.0000000000EC4000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://static.scp.btoo3.com/stic.htmlxE	winhost.exe, 00000000.00000002.669734114.0000000000E67000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://clients2.google.com/service/update2/crx	winhost.exe, 00000000.00000002.669554418.0000000000AEE000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
47.111.207.82	picssl.xunmzone.com	China		37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
47.111.207.85	static.scp.btoo3.com	China		37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	459164
Start date:	04.08.2021
Start time:	11:00:06
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	winhost.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.spyw.evad.winEXE@1/2@2/2
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 64% Number of executed functions: 78 Number of non-executed functions: 77
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Stop behavior analysis, all processes terminated
Warnings:	Show All Exclude process from analysis (whitelisted): svchost.exe Excluded IPs from analysis (whitelisted): 52.114.76.35, 104.43.139.144, 20.189.173.20 Excluded domains from analysis (whitelisted): skypedataprdcolneu03.cloudapp.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, browser.events.data.trafficmanager.net, skypedataprdcolcus16.cloudapp.net, watson.telemetry.microsoft.com, browser.pipe.aria.microsoft.com Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:00:55	API Interceptor	5x Sleep call for process: winhost.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	rCr0tVxmK3	Get hash	malicious	Browse	119.23.55.28
	sTcU2w5mZY	Get hash	malicious	Browse	8.186.115.143
	niKcsf1qRy	Get hash	malicious	Browse	112.74.42.15
	3etkq3iOPQ	Get hash	malicious	Browse	182.94.212.107
	peach.arm7	Get hash	malicious	Browse	120.55.82.92
	gji54VjOlP	Get hash	malicious	Browse	112.125.213.168
	NqS5Kl0fD1.exe	Get hash	malicious	Browse	47.111.28.81
	mmY2tjq2Pe.exe	Get hash	malicious	Browse	47.111.28.81
	9Id75kh8Og.exe	Get hash	malicious	Browse	47.96.15.92
	urKffbunX5	Get hash	malicious	Browse	8.173.175.221
	EWTqmooWJi	Get hash	malicious	Browse	8.152.201.84
	uGf1521l6S	Get hash	malicious	Browse	47.97.60.76
	uiInKzkLQx	Get hash	malicious	Browse	112.124.68.114
	NQrs7jd2jx	Get hash	malicious	Browse	8.136.60.75
	557IyF5NeE	Get hash	malicious	Browse	8.138.200.189
	dTeFpeVR7V	Get hash	malicious	Browse	42.120.69.24
	K2pnt8OlRe	Get hash	malicious	Browse	8.138.48.143
	vhTZ5hgW6j	Get hash	malicious	Browse	121.197.201.64
	FTFGYpE43O	Get hash	malicious	Browse	8.175.178.15
	0wagQPl5bl	Get hash	malicious	Browse	8.137.69.115
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	rCr0tVxmK3	Get hash	malicious	Browse	119.23.55.28
	sTcU2w5mZY	Get hash	malicious	Browse	8.186.115.143
	niKcsf1qRy	Get hash	malicious	Browse	112.74.42.15
	3etkq3iOPQ	Get hash	malicious	Browse	182.94.212.107
	peach.arm7	Get hash	malicious	Browse	120.55.82.92
	gji54VjOlP	Get hash	malicious	Browse	112.125.213.168
	NqS5Kl0fD1.exe	Get hash	malicious	Browse	47.111.28.81
	mmY2tjq2Pe.exe	Get hash	malicious	Browse	47.111.28.81
	9Id75kh8Og.exe	Get hash	malicious	Browse	47.96.15.92
	urKffbunX5	Get hash	malicious	Browse	8.173.175.221
	EWTqmooWJi	Get hash	malicious	Browse	8.152.201.84
	uGf1521l6S	Get hash	malicious	Browse	47.97.60.76
	uiInKzkLQx	Get hash	malicious	Browse	112.124.68.114
	NQrs7jd2jx	Get hash	malicious	Browse	8.136.60.75
	557IyF5NeE	Get hash	malicious	Browse	8.138.200.189
	dTeFpeVR7V	Get hash	malicious	Browse	42.120.69.24
	K2pnt8OlRe	Get hash	malicious	Browse	8.138.48.143
	vhTZ5hgW6j	Get hash	malicious	Browse	121.197.201.64
	FTFGYpE43O	Get hash	malicious	Browse	8.175.178.15
	0wagQPl5bl	Get hash	malicious	Browse	8.137.69.115

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Roaming\Osa\c Download File
Process:	C:\Users\user\Desktop\winhost.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	880
Entropy (8bit):	5.572742462599468
Encrypted:	false
SSDEEP:	24:m6NJjRkVuFRkVuFRkVPzg1kVPzKeH+kVPzi7q:hNdff08gLVGe
MD5:	AC05AE81D7767A7B01AA20BD894E052A
SHA1:	464918A74A585A01BCF6FD353C0C0CE1EFB9D345
SHA-256:	70E406B3B2223694333ACEAC0510EDB24EF5A6AB0C728C52749183DD365DECEB
SHA-512:	D7E94F49F4E8DAC33B0061B2725AC55CD422D14563F3F7790DAAE032DB90675F295ACBC60B9699306166B07738BDC5A7DAD9DFFBAFCA809E471A0C3DC4D23CBB
Malicious:	false
Reputation:	low
Preview:	RHBDT1BrYTJ1SWhKZ2p5cktTMlAvUT09bDB2UittSVNuRVNDOUxNektJNjJYN2k3d3FOMXBzWFY4Ym5yU3hvQm51NmdOYlduSU5GOHN3S0VlMWxyeFpZem1nVEpqanRubUxjZkJPbWlYalNyVXc9PQ==bDB2UittSVNuRVNDOUxNektJNjJYN2k3d3FOMXBzWFY4Ym5yU3hvQm51NTdIUGdXaWJ1aUhPaUt6Wm5oNEwyeS9uaFE5RWFXZmcrVk5QOEJQbjJpYmc9PQ==bDB2UittSVNuRVNDOUxNektJNjJYN2k3d3FOMXBzWFY4Ym5yU3hvQm51NTdIUGdXaWJ1aUhPaUt6Wm5oNEwyeS9uaFE5RWFXZmcrVk5QOEJQbjJpYmc9PQ==bDB2UittSVNuRVNDOUxNektJNjJYN2k3d3FOMXBzWFY4Ym5yU3hvQm51NTdIUGdXaWJ1aUhPaUt6Wm5oNEwyeTNRMUd3dUs2c1JUenRHR0dLSGkwdzFpdXFWVWdzZ0JITlQzdnhNeHpwT009bDB2UittSVNuRVNDOUxNektJNjJYN2k3d3FOMXBzWFY4Ym5yU3hvQm51NTdIUGdXaWJ1aUhPaUt6Wm5oNEwyeTNRMUd3dUs2c1JUenRHR0dLSGkwd3pXdGtRVVVWdzhMTjZBWkVCMGgreVYxUFJxRFFwUzE2em5LQUEwdzVGNUc=bDB2UittSVNuRVNDOUxNektJNjJYN2k3d3FOMXBzWFY4Ym5yU3hvQm51NTdIUGdXaWJ1aUhPaUt6Wm5oNEwyeTNRMUd3dUs2c1JUenRHR0dLSGkwdzRWeWdpbllEZFMvOHROTFE0bU1tUnl5Sis2aHZtMlFoM3Evbi9HTVlkTnc=

C:\Users\user\Desktop\uu Download File
Process:	C:\Users\user\Desktop\winhost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	108
Entropy (8bit):	5.551060942271384
Encrypted:	false
SSDEEP:	3:iEgIshsQXc/oCoOyNgBAKywUYPANK1zsTmkXgwYn:iEgIs6CcXykvyAANK1zsTmkX1Y
MD5:	12B5A707240C4EB17E09A0DF82B1E8DB
SHA1:	3FC9502C04FCDF7373E20C5940C362A2DA7DDB9A
SHA-256:	F5DCA188C1E0AAEB4789B16328D4FEA226B58B17D3B089FDAF1DDAF89DE01B84
SHA-512:	57C10F932A13E307BB454D091357D17F96204C63354FBF6F110ADE25CAA7F33490FBF556277EC73493BB2EE12BA97EF64294EEB84FA6C4D9F88F2C2947B863E0
Malicious:	false
Reputation:	low
Preview:	vmnaEUXaIkpOk/aI5r907EZoWx7uxajDsFwmOJjDLpnE7FAqxr0/KqYKiPHkWhEGGe/bwyRB1QDB87ZQeh/MM+9HatKHuvZKuU81S9CTeEU=

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.311591849713371
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	winhost.exe
File size:	2256384
MD5:	fcf0f4b709606c50ce6157c044d10b9d
SHA1:	bb101a1b8357d52f8f7970d3f5f43bc25392bfeb
SHA256:	6169c9d6694e0263c7bc80e1409fea8e46188f08914095d91f3ad03a2d29fd08
SHA512:	386791473c36aa63caeec06ca3625b44dbc1bcf45b6ab7691f3dfdd5c5878d483f3ad56c57dccde7270129241bbefd02d81ae65a09bdda2b4bb1cc0c5c28f5a8
SSDEEP:	24576:LUk6yom8kcK2XztnuO2Q3faj+VB6xkfio9sWlUNYVyB8ksId1DCviJ:6xPkcK2Xztq+g2FuN58ks36J
File Content Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.........(@.aF..aF..aF.]....aF.4....aF.4...1aF.4....aF...B..aF...C..aF...C..aF...B..aF...E..aF.]....aF.]....aF.]....aF..aG.9`F...O..aF

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x55aa9d
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5FCF35D3 [Tue Dec 8 08:14:11 2020 UTC]
TLS Callbacks:	0x582eb0
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	60fd4f63c7daf9f307e9aab3ac58a7e8

Entrypoint Preview

Instruction
call 00007F9570C63DBAh
jmp 00007F9570C6355Fh
push ebp
mov ebp, esp
push 00000000h
call dword ptr [005D409Ch]
push dword ptr [ebp+08h]
call dword ptr [005D40A0h]
push C0000409h
call dword ptr [005D4098h]
push eax
call dword ptr [005D4074h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call 00007F9570CD17ADh
test eax, eax
je 00007F9570C636E7h
push 00000002h
pop ecx
int 29h
mov dword ptr [006035B0h], eax
mov dword ptr [006035ACh], ecx
mov dword ptr [006035A8h], edx
mov dword ptr [006035A4h], ebx
mov dword ptr [006035A0h], esi
mov dword ptr [0060359Ch], edi
mov word ptr [006035C8h], ss
mov word ptr [006035BCh], cs
mov word ptr [00603598h], ds
mov word ptr [00603594h], es
mov word ptr [00603590h], fs
mov word ptr [0060358Ch], gs
pushfd
pop dword ptr [006035C0h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [006035B4h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [006035B8h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [006035C4h], eax
mov eax, dword ptr [ebp-00000324h]
mov dword ptr [00603500h], 00010001h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1f98f0	0x12c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x20c000	0x14568	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x221000	0x10e90	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1ed5b0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1ed6c0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1ed620	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1d4000	0x5d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1d2097	0x1d2200	False	0.334815068551	data	6.10378651378	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x1d4000	0x27ba4	0x27c00	False	0.449851365959	data	5.41416041177	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1fc000	0xfa68	0x7600	False	0.172768802966	DOS executable (block device driver\277DN\346@\273)	3.64521339483	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x20c000	0x14568	0x14600	False	0.905207534509	data	7.80257652691	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x221000	0x10e90	0x11000	False	0.664967256434	data	6.72836143913	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
PNG	0x20edd8	0x31a	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced	English	United States
PNG	0x20f0f8	0x72d	PNG image data, 240 x 135, 8-bit colormap, non-interlaced	English	United States
PNG	0x20f828	0x5df	PNG image data, 160 x 90, 8-bit colormap, non-interlaced	English	United States
PNG	0x20fe08	0x4e3	PNG image data, 160 x 90, 8-bit colormap, non-interlaced	English	United States
PNG	0x2102f0	0xcee	PNG image data, 240 x 135, 8-bit colormap, non-interlaced	English	United States
PNG	0x210fe0	0x874	PNG image data, 160 x 90, 8-bit colormap, non-interlaced	English	United States
PNG	0x211858	0x766	PNG image data, 160 x 90, 8-bit colormap, non-interlaced	English	United States
PNG	0x211fc0	0x37b8	PNG image data, 240 x 135, 8-bit colormap, non-interlaced	English	United States
PNG	0x215778	0x1fc0	PNG image data, 160 x 90, 8-bit colormap, non-interlaced	English	United States
PNG	0x217738	0x20e0	PNG image data, 160 x 90, 8-bit colormap, non-interlaced	English	United States
PNG	0x219818	0x5b9	PNG image data, 152 x 112, 8-bit colormap, non-interlaced	English	United States
PNG	0x219dd8	0x890	PNG image data, 152 x 112, 8-bit colormap, non-interlaced	English	United States
PNG	0x21a668	0x21ec	PNG image data, 152 x 112, 8-bit colormap, non-interlaced	English	United States
PNG	0x21c858	0x37c	PNG image data, 152 x 112, 8-bit colormap, non-interlaced	English	United States
PNG	0x21cbd8	0x38b	PNG image data, 240 x 135, 8-bit colormap, non-interlaced	English	United States
PNG	0x21cf68	0x5cc	PNG image data, 160 x 90, 8-bit colormap, non-interlaced	English	United States
PNG	0x21d538	0x7b1	PNG image data, 160 x 90, 8-bit colormap, non-interlaced	English	United States
PNG	0x21dcf0	0x209a	PNG image data, 160 x 90, 8-bit colormap, non-interlaced	English	United States
RT_DIALOG	0x20c4e0	0x168	data
RT_RCDATA	0x20c888	0x12d4	TrueType Font data, 11 tables, 1st "GSUB", 18 names, Macintosh,	English	United States
RT_RCDATA	0x20db60	0x1274	TrueType Font data, 11 tables, 1st "GSUB", 18 names, Macintosh,	English	United States
RT_VERSION	0x20c648	0x23c	data	English	United States
RT_MANIFEST	0x21fd90	0x7d8	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	GlobalLock, GlobalUnlock, GetTempPathW, WaitForSingleObject, LocalFree, GetProcAddress, HeapReAlloc, HeapSize, WritePrivateProfileStringW, GetPrivateProfileStringW, FreeResource, TerminateProcess, OpenProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, K32GetProcessImageFileNameW, GetPriorityClass, IsDebuggerPresent, IsProcessorFeaturePresent, GetCurrentProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetModuleHandleW, FindResourceW, SizeofResource, LockResource, LoadResource, InitializeCriticalSection, GetModuleFileNameW, LeaveCriticalSection, EnterCriticalSection, lstrcmpW, lstrcpyW, FindNextFileW, FindFirstFileW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFileAttributesW, DecodePointer, QueryDepthSList, InterlockedPopEntrySList, ReleaseSemaphore, VirtualFree, GlobalAlloc, VirtualAlloc, GetThreadTimes, UnregisterWait, SetThreadAffinityMask, GetProcessAffinityMask, GetNumaHighestNodeNumber, DeleteTimerQueueTimer, ChangeTimerQueueTimer, CreateTimerQueueTimer, GetLogicalProcessorInformation, GetThreadPriority, SignalObjectAndWait, CreateTimerQueue, WriteConsoleW, SetEnvironmentVariableA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, GetTimeZoneInformation, ReadConsoleW, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetFileType, SetStdHandle, GetConsoleMode, GetConsoleCP, GetACP, GetStdHandle, ExitProcess, FreeLibraryAndExitThread, ExitThread, GetProcessHeap, GetTickCount, GetCommandLineW, RaiseException, CreateEventW, CreateProcessW, CreateMutexW, Sleep, MulDiv, HeapFree, HeapAlloc, MoveFileW, DeleteFileW, VirtualProtect, DeleteCriticalSection, InitializeCriticalSectionEx, GetLastError, CloseHandle, FindFirstFileExW, LoadLibraryExW, FreeLibrary, InterlockedFlushSList, InterlockedPushEntrySList, RtlUnwind, RegisterWaitForSingleObject, WaitForSingleObjectEx, ResetEvent, UnregisterWaitEx, SetThreadPriority, FindClose, SetFilePointerEx, FlushFileBuffers, FileTimeToSystemTime, SystemTimeToTzSpecificLocalTime, GetUserDefaultLangID, ReleaseMutex, OutputDebugStringA, SystemTimeToFileTime, IsBadWritePtr, IsBadReadPtr, CreateWaitableTimerW, WaitForMultipleObjects, CancelWaitableTimer, SetWaitableTimer, SetFileTime, SetFilePointer, SetEndOfFile, GetDiskFreeSpaceExW, ExpandEnvironmentStringsW, SuspendThread, TerminateThread, CreateThread, CopyFileW, WriteFile, RemoveDirectoryW, ReadFile, GetTempFileNameW, GetFileAttributesExW, CreateDirectoryW, lstrcmpA, DeviceIoControl, CreateFileW, LoadLibraryW, GetModuleHandleA, GetVersionExW, OutputDebugStringW, SetEvent, InitializeCriticalSectionAndSpinCount, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, GetCPInfo, GetLocaleInfoW, LCMapStringW, InitializeSListHead, CompareStringW, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, SetLastError, GetNativeSystemInfo, GetCurrentThread, SwitchToThread, DuplicateHandle, GetStringTypeW, MultiByteToWideChar, GetModuleHandleExW, QueueUserWorkItem, EncodePointer, TryEnterCriticalSection, WideCharToMultiByte, FormatMessageW, GetStartupInfoW
USER32.dll	DeferWindowPos, EndDeferWindowPos, SetClipboardData, GetFocus, IsClipboardFormatAvailable, GetClipboardData, SendMessageTimeoutW, GetSystemMetrics, GetAncestor, SendInput, MapVirtualKeyW, GetLastActivePopup, GetTopWindow, GetWindow, GetDesktopWindow, EndDialog, GetMessageW, DispatchMessageW, TranslateMessage, SetWindowLongW, GetWindowLongW, CreateWindowExW, SendMessageW, PostMessageW, GetWindowTextW, SetWindowPos, GetWindowRect, ScreenToClient, BeginPaint, CloseClipboard, GetDC, PostQuitMessage, ReleaseDC, UpdateWindow, ShowWindow, IsWindowVisible, SetTimer, KillTimer, GetParent, GetDlgItem, MessageBoxW, OpenClipboard, GetWindowThreadProcessId, IsWindow, GetClassNameW, GetMonitorInfoW, DefWindowProcW, LoadCursorW, RegisterClassExW, EnumDisplayMonitors, BeginDeferWindowPos, DialogBoxParamW, GetCursorPos, SetCursor, GetRawInputData, mouse_event, UpdateLayeredWindow, FindWindowW, LoadIconW, RegisterClassW, GetForegroundWindow, SetLayeredWindowAttributes, GetLastInputInfo, EmptyClipboard, SetForegroundWindow, GetWindowDC, RegisterRawInputDevices, GetShellWindow, EndPaint, MonitorFromWindow, EnumWindows, SystemParametersInfoW
GDI32.dll	DeleteObject, GetObjectW, GetStockObject, DeleteDC, BitBlt, CreateCompatibleDC, CreateCompatibleBitmap, CreateSolidBrush, SelectObject, CreateFontIndirectW, GetDeviceCaps
ADVAPI32.dll	RegCloseKey, RegQueryValueExW, RegOpenKeyExW, RegEnumKeyExW, RegCreateKeyExW
SHELL32.dll	SHCreateDirectoryExW, SHGetFolderPathW, SHFileOperationW, ShellExecuteExW, CommandLineToArgvW, ShellExecuteW, SHGetSpecialFolderPathW
ole32.dll	CoUninitialize, CoCreateGuid, CreateStreamOnHGlobal, CoCreateInstance, CoInitialize
SHLWAPI.dll	PathGetDriveNumberW, PathFileExistsW, SHGetValueW, PathAppendW, SHSetValueW, SHDeleteValueW, StrStrIW, SHGetValueA, SHSetValueA
gdiplus.dll	GdipAlloc, GdipDeleteBrush, GdipCreateSolidFill, GdipCreatePen1, GdipDeletePen, GdipCreateStringFormat, GdipDeleteStringFormat, GdipCreatePath, GdipDeletePath, GdipResetPath, GdipAddPathString, GdipCreateFromHDC, GdipDeleteGraphics, GdipReleaseDC, GdipSetTextRenderingHint, GdipFree, GdipSetSmoothingMode, GdipSetPixelOffsetMode, GdipDrawRectangleI, GdipGraphicsClear, GdipDrawString, GdipDrawImagePointRectI, GdipGetPathWorldBounds, GdipGetFontCollectionFamilyCount, GdipGetFontCollectionFamilyList, GdipCloneFontFamily, GdipNewPrivateFontCollection, GdipDeletePrivateFontCollection, GdipPrivateAddFontFile, GdipPrivateAddMemoryFont, GdipCreateFontFamilyFromName, GdipDeleteFontFamily, GdipCreateFont, GdipDeleteFont, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipDisposeImage, GdipSetInterpolationMode, GdipCreateBitmapFromStream, GdipCloneImage
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WTSAPI32.dll	WTSRegisterSessionNotification
POWRPROF.dll	PowerReadACValueIndex, PowerReadDCValueIndex, PowerGetActiveScheme
NETAPI32.dll	Netbios
WININET.dll	InternetCrackUrlW, InternetOpenW, InternetCloseHandle, InternetOpenUrlW, InternetReadFile, InternetQueryOptionW, InternetSetOptionW, HttpOpenRequestW, HttpAddRequestHeadersA, InternetConnectW, HttpSendRequestW, HttpQueryInfoA, HttpQueryInfoW, InternetErrorDlg, InternetReadFileExA, InternetWriteFile, InternetSetOptionA, InternetGetLastResponseInfoW, InternetSetStatusCallbackW, FtpOpenFileW, FtpCommandW, FtpGetFileSize, HttpSendRequestExW, HttpEndRequestW, HttpAddRequestHeadersW
WINMM.dll	timeGetTime

Version Infos

Description	Data
LegalCopyright	Copyright (C) 2019
InternalName
FileVersion	5.2.2.2
CompanyName
ProductName
ProductVersion	5.2.2.2
FileDescription
OriginalFilename
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 4, 2021 11:00:56.344932079 CEST	49734	443	192.168.2.4	47.111.207.85
Aug 4, 2021 11:00:56.348329067 CEST	49735	443	192.168.2.4	47.111.207.85
Aug 4, 2021 11:00:56.430186987 CEST	49737	443	192.168.2.4	47.111.207.82
Aug 4, 2021 11:00:56.430368900 CEST	49738	443	192.168.2.4	47.111.207.82
Aug 4, 2021 11:00:59.352907896 CEST	49734	443	192.168.2.4	47.111.207.85
Aug 4, 2021 11:00:59.352942944 CEST	49735	443	192.168.2.4	47.111.207.85
Aug 4, 2021 11:00:59.431102991 CEST	49737	443	192.168.2.4	47.111.207.82
Aug 4, 2021 11:00:59.431106091 CEST	49738	443	192.168.2.4	47.111.207.82
Aug 4, 2021 11:01:00.430435896 CEST	49742	443	192.168.2.4	47.111.207.85
Aug 4, 2021 11:01:03.415906906 CEST	49742	443	192.168.2.4	47.111.207.85
Aug 4, 2021 11:01:04.434081078 CEST	49748	443	192.168.2.4	47.111.207.82

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 4, 2021 11:00:49.806888103 CEST	58028	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:00:49.835550070 CEST	53	58028	8.8.8.8	192.168.2.4
Aug 4, 2021 11:00:50.177292109 CEST	53097	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:00:50.209837914 CEST	53	53097	8.8.8.8	192.168.2.4
Aug 4, 2021 11:00:51.063666105 CEST	49257	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:00:51.100745916 CEST	53	49257	8.8.8.8	192.168.2.4
Aug 4, 2021 11:00:52.476656914 CEST	62389	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:00:52.510797024 CEST	53	62389	8.8.8.8	192.168.2.4
Aug 4, 2021 11:00:53.843600988 CEST	49910	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:00:53.870711088 CEST	53	49910	8.8.8.8	192.168.2.4
Aug 4, 2021 11:00:54.621578932 CEST	55854	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:00:54.650405884 CEST	53	55854	8.8.8.8	192.168.2.4
Aug 4, 2021 11:00:55.959737062 CEST	64549	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:00:55.960536003 CEST	63153	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:00:56.295855999 CEST	53	64549	8.8.8.8	192.168.2.4
Aug 4, 2021 11:00:56.358196020 CEST	52991	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:00:56.383375883 CEST	53	52991	8.8.8.8	192.168.2.4
Aug 4, 2021 11:00:56.427577019 CEST	53	63153	8.8.8.8	192.168.2.4
Aug 4, 2021 11:00:57.426990986 CEST	53700	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:00:57.453129053 CEST	53	53700	8.8.8.8	192.168.2.4
Aug 4, 2021 11:00:58.480881929 CEST	51726	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:00:58.508363962 CEST	53	51726	8.8.8.8	192.168.2.4
Aug 4, 2021 11:00:59.553214073 CEST	56794	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:00:59.581866026 CEST	53	56794	8.8.8.8	192.168.2.4
Aug 4, 2021 11:01:00.608194113 CEST	56534	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:01:00.633081913 CEST	53	56534	8.8.8.8	192.168.2.4
Aug 4, 2021 11:01:01.666240931 CEST	56627	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:01:01.698685884 CEST	53	56627	8.8.8.8	192.168.2.4
Aug 4, 2021 11:01:02.475800037 CEST	56621	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:01:02.500792027 CEST	53	56621	8.8.8.8	192.168.2.4
Aug 4, 2021 11:01:03.513886929 CEST	63116	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:01:03.541677952 CEST	53	63116	8.8.8.8	192.168.2.4
Aug 4, 2021 11:01:04.317537069 CEST	64078	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:01:04.346360922 CEST	53	64078	8.8.8.8	192.168.2.4
Aug 4, 2021 11:01:06.166809082 CEST	64801	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:01:06.201558113 CEST	53	64801	8.8.8.8	192.168.2.4
Aug 4, 2021 11:01:07.287503004 CEST	61721	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:01:07.315426111 CEST	53	61721	8.8.8.8	192.168.2.4
Aug 4, 2021 11:01:08.164916992 CEST	51255	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:01:08.199187994 CEST	53	51255	8.8.8.8	192.168.2.4
Aug 4, 2021 11:01:13.013803005 CEST	61522	53	192.168.2.4	8.8.8.8
Aug 4, 2021 11:01:13.054764032 CEST	53	61522	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 4, 2021 11:00:55.959737062 CEST	192.168.2.4	8.8.8.8	0xb67c	Standard query (0)	static.scp.btoo3.com	A (IP address)	IN (0x0001)
Aug 4, 2021 11:00:55.960536003 CEST	192.168.2.4	8.8.8.8	0x17ec	Standard query (0)	picssl.xunmzone.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 4, 2021 11:00:56.295855999 CEST	8.8.8.8	192.168.2.4	0xb67c	No error (0)	static.scp.btoo3.com		47.111.207.85	A (IP address)	IN (0x0001)
Aug 4, 2021 11:00:56.427577019 CEST	8.8.8.8	192.168.2.4	0x17ec	No error (0)	picssl.xunmzone.com		47.111.207.82	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: winhost.exe PID: 7056 Parent PID: 5912

General

Start time:	11:00:54
Start date:	04/08/2021
Path:	C:\Users\user\Desktop\winhost.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\winhost.exe'
Imagebase:	0x1c0000
File size:	2256384 bytes
MD5 hash:	FCF0F4B709606C50CE6157C044D10B9D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: winhost.exe PID: 7056 Parent PID: 5912 winhost.exeCOMMON

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.8%
Total number of Nodes:	1969
Total number of Limit Nodes:	54

Executed Functions

Function 0032E280, Relevance: 86.6, APIs: 43, Strings: 6, Instructions: 816networksynchronizationfileCOMMON

Download Yara Rule

APIs

InternetCrackUrlW.WININET(?,?,00000000,0000003C), ref: 0032E3AA
GetLastError.KERNEL32 ref: 0032E3B4
InternetOpenW.WININET(003A8C5C,00000000,00000000,00000000,00000000), ref: 0032E40C
InternetConnectW.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0032E440
HttpOpenRequestW.WININET(00000000,?,?,HTTP/1.0,00000000,00000000,800C8200,00000000), ref: 0032E589
HttpAddRequestHeadersW.WININET(00000000,?,000000FF,A0000000), ref: 0032E659
HttpAddRequestHeadersA.WININET(?,?,000000FF,20000000), ref: 0032E72A
InternetQueryOptionW.WININET(00000000,0000001F,00000000), ref: 0032E7AC
InternetSetOptionW.WININET(00000000,0000001F,00003180,00000004), ref: 0032E7CE
InternetSetOptionW.WININET(?,00000002,00003180,00000004), ref: 0032E7F2
InternetSetOptionW.WININET(?,00000005,00003180,00000004), ref: 0032E800
InternetSetOptionW.WININET(?,00000006,00003180,00000004), ref: 0032E80E
InternetSetOptionW.WININET(?,00000007,00003180,00000004), ref: 0032E81C
InternetSetOptionW.WININET(?,00000008,00003180,00000004), ref: 0032E82A
InternetSetOptionW.WININET(?,0000000B,00003180,00000004), ref: 0032E838
InternetSetOptionW.WININET(?,00000006,00003180,00000004), ref: 0032E846
HttpSendRequestW.WININET(00000000,?,?,?,?), ref: 0032E86F
GetLastError.KERNEL32(?,?,?), ref: 0032E87B
InternetQueryOptionW.WININET(?,0000001F,?,00000004), ref: 0032E8A3
InternetSetOptionW.WININET(?,0000001F,00000100,00000004), ref: 0032E8BF
WaitForSingleObject.KERNEL32(?,00000000,?,?,?), ref: 0032E8DC
HttpQueryInfoW.WININET(00000000,00000013,?,00000100,00000000), ref: 0032E932
InternetOpenW.WININET(003A8C5C,00000000,00000000,00000000,00000000), ref: 0032E991
InternetOpenUrlW.WININET(00000000,http://profile.se.360.cn/proxyerr.php,00000000,00000000,84000000,00000000), ref: 0032E9B2
HttpQueryInfoW.WININET(00000000,00000013,?,00000100,00000000), ref: 0032E9F5
GetDesktopWindow.USER32 ref: 0032EA26
InternetErrorDlg.WININET(00000000), ref: 0032EA2D
InternetCloseHandle.WININET(00000000), ref: 0032EA42
InternetCloseHandle.WININET(00000000), ref: 0032EA57
InternetCloseHandle.WININET(?), ref: 0032EA64
InternetCloseHandle.WININET(?), ref: 0032EA6D
InternetCloseHandle.WININET(?), ref: 0032EA84
HttpQueryInfoW.WININET(00000000,00000005,?,00000100,00000000), ref: 0032EAB3
GetLastError.KERNEL32 ref: 0032EAD4
InternetReadFile.WININET(00000000,?,00002000,00000000), ref: 0032EBC4
SetEvent.KERNEL32(?), ref: 0032EC13
WaitForSingleObject.KERNEL32(?,00000000), ref: 0032EC24
InternetCloseHandle.WININET(?), ref: 0032EC5F
HttpQueryInfoA.WININET(00000000,80000016,?,?,00000000), ref: 0032ED04
HttpQueryInfoA.WININET(00000000,00000016,?,00001000,00000000), ref: 0032ED5C
GetLastError.KERNEL32 ref: 0032ED96
InternetCloseHandle.WININET(?), ref: 0032EDD0
InternetCloseHandle.WININET(?), ref: 0032EDDD

Strings

Accept: */*User-Agent: %s, xrefs: 0032E5E9
Accept: */*User-Agent: Mozilla / 5.0 (Windows NT 10.0; WOW64) AppleWebKit / 537.36 (KHTML, like Gecko) Chrome / 55.0.2883.87 Saf, xrefs: 0032E63C
GET, xrefs: 0032E536
HTTP/1.0, xrefs: 0032E578
http://profile.se.360.cn/proxyerr.php, xrefs: 0032E9AC
<, xrefs: 0032E366

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Internet$Option$Http$CloseHandle$Query$ErrorInfo$LastOpenRequest$HeadersObjectSingleWait$ConnectCrackDesktopEventFileReadSendWindow
String ID: <$Accept: */*User-Agent: %s$Accept: */*User-Agent: Mozilla / 5.0 (Windows NT 10.0; WOW64) AppleWebKit / 537.36 (KHTML, like Gecko) Chrome / 55.0.2883.87 Saf$GET$HTTP/1.0$http://profile.se.360.cn/proxyerr.php
API String ID: 1923508826-435462306
Opcode ID: 4e48d90f06b85e663b24c39e9f2118b11cff6d71327f339181c5ecd2ce3cfaab
Instruction ID: 462145c055045d690047fc7033f65aab54a0650e6cae80f667f0b4dbc2b0afa6
Opcode Fuzzy Hash: 4e48d90f06b85e663b24c39e9f2118b11cff6d71327f339181c5ecd2ce3cfaab
Instruction Fuzzy Hash: 7C62C4719002299BEB21DF25DC46BADB7FAFF44700F148295F509A7281DB72AE94CF50

Uniqueness

Uniqueness Score: -1.00%

Function 001E3E60, Relevance: 73.7, APIs: 32, Strings: 9, Instructions: 1975filestringCOMMON

Download Yara Rule

APIs

SHGetValueW.SHLWAPI(80000001,Software\Microsoft\Windows\CurrentVersion\Uninstall\HYLite,003AB900,?,?,?), ref: 001E3F47
SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,?,003A8F14,00000000,00000000), ref: 001E4151
PathAppendW.SHLWAPI(?,003C816C,?,003A8F14,00000000,00000000), ref: 001E4172
PathAppendW.SHLWAPI(?,003C80DC,?,003A8F14,00000000,00000000), ref: 001E4193
PathAppendW.SHLWAPI(?,003C80F4,?,003A8F14,00000000,00000000), ref: 001E41B4
PathAppendW.SHLWAPI(?,003C8124,?,003A8F14,00000000,00000000), ref: 001E41D5
PathFileExistsW.SHLWAPI(?,?,003A8F14,00000000,00000000), ref: 001E41E2
GetFileAttributesW.KERNEL32(?,?,003A8F14,00000000,00000000), ref: 001E41F3
SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000001,?,?,?,?,?,003A8F14,00000000,00000000), ref: 001E4289
PathAppendW.SHLWAPI(?,003C816C,?,?,?,?,003A8F14,00000000,00000000), ref: 001E42AA
PathAppendW.SHLWAPI(?,003C80DC,?,?,?,?,003A8F14,00000000,00000000), ref: 001E42CB
PathAppendW.SHLWAPI(?,003C80F4,?,?,?,?,003A8F14,00000000,00000000), ref: 001E42EC
PathAppendW.SHLWAPI(?,003C8124,?,?,?,?,003A8F14,00000000,00000000), ref: 001E430D
SHGetFolderPathW.SHELL32(00000000,0000001C,00000000,00000000,?,?,003A8F14,00000000,00000000), ref: 001E43AF
PathAppendW.SHLWAPI(?,003C8184,?,003A8F14,00000000,00000000), ref: 001E43D0
PathAppendW.SHLWAPI(?,003C819C,?,003A8F14,00000000,00000000), ref: 001E43F1
PathAppendW.SHLWAPI(?,003C80DC,?,003A8F14,00000000,00000000), ref: 001E4412
PathAppendW.SHLWAPI(?,003C80F4,?,003A8F14,00000000,00000000), ref: 001E4433
PathAppendW.SHLWAPI(?,003C8124,?,003A8F14,00000000,00000000), ref: 001E4454
PathFileExistsW.SHLWAPI(?,003A8F14,00000000), ref: 001E44F7
GetFileAttributesW.KERNEL32(?), ref: 001E451A
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 001E4534
SetCurrentDirectoryW.KERNEL32(?), ref: 001E454F
FindFirstFileW.KERNEL32(*.*,?), ref: 001E4561
FindNextFileW.KERNEL32(00000000,00000010), ref: 001E467F
SetCurrentDirectoryW.KERNEL32(?), ref: 001E4755
lstrcpyW.KERNEL32(?,00000000), ref: 001E4AEE
FindFirstFileW.KERNEL32(?,?), ref: 001E4B27
lstrcmpW.KERNEL32(?,003A8CAC), ref: 001E4B4E
lstrcmpW.KERNEL32(?,003A8CB0), ref: 001E4B64
FindNextFileW.KERNEL32(?,?), ref: 001E4EEF
PathFileExistsW.SHLWAPI(?,?,?,?,00000000,?,?), ref: 001E4FBE

Part of subcall function 001DCC20: __Mtx_init_in_situ.LIBCPMT ref: 001DCC8D
Part of subcall function 001DCC20: __Mtx_init_in_situ.LIBCPMT ref: 001DCC98
Part of subcall function 001DCC20: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?,?,?,?,?,?,?,003A8C5C,00000000), ref: 001DCD45
Part of subcall function 001DCC20: PathAppendW.SHLWAPI(?,Osa,?,?,?,?,?,?,?,?,?,003A8C5C,00000000,CB28B7D0), ref: 001DCD57
Part of subcall function 001DCC20: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,003A8C5C,00000000,CB28B7D0), ref: 001DCD6B
Part of subcall function 001DCC20: GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,003A8C5C,00000000,CB28B7D0), ref: 001DCD7C
Part of subcall function 001DCC20: SHCreateDirectoryExW.SHELL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,003A8C5C,00000000,CB28B7D0), ref: 001DCD91

Part of subcall function 0030B9A0: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,?), ref: 0030BA18
Part of subcall function 0030B9A0: PathAppendW.SHLWAPI(?,Sap), ref: 0030BA30
Part of subcall function 0030B9A0: PathAppendW.SHLWAPI(?,003ACA00), ref: 0030BA3E
Part of subcall function 0030B9A0: PathFileExistsW.SHLWAPI(?), ref: 0030BA4D
Part of subcall function 0030B9A0: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000001,?), ref: 0030BA77
Part of subcall function 0030B9A0: PathAppendW.SHLWAPI(?,Sap), ref: 0030BA89
Part of subcall function 0030B9A0: PathAppendW.SHLWAPI(?,003ACA00), ref: 0030BA97
Part of subcall function 0030B9A0: PathFileExistsW.SHLWAPI(?), ref: 0030BAA0

Strings

exgb, xrefs: 001E488F
exdi, xrefs: 001E47CF
*.*, xrefs: 001E455C
exditc, xrefs: 001E4918
exittc, xrefs: 001E5596
exgbtc, xrefs: 001E49A1
exit, xrefs: 001E543E
x, xrefs: 001E47FE, 001E4835, 001E48BE, 001E48F5, 001E5467, 001E549E, 001E55BF, 001E55F6, 001E58E8, 001E591F
Software\Microsoft\Windows\CurrentVersion\Uninstall\HYLite, xrefs: 001E3F33

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Path$Append$File$ExistsFolder$DirectoryFind$AttributesCurrent$FirstMtx_init_in_situNextlstrcmp$CreateValuelstrcpy
String ID: *.*$Software\Microsoft\Windows\CurrentVersion\Uninstall\HYLite$exdi$exditc$exgb$exgbtc$exit$exittc$x
API String ID: 4169263872-2749957429
Opcode ID: 9111de1a186f51b130fdaff42df283b0b777848d76cc2817e60b2ca3949fa865
Instruction ID: 5da2e9b8804a4fd3e7ddb2a74f7b3fec8e8dcc380297f9ee548d88a0e425f230
Opcode Fuzzy Hash: 9111de1a186f51b130fdaff42df283b0b777848d76cc2817e60b2ca3949fa865
Instruction Fuzzy Hash: E2030131A006A8DBDB29DB24CC45BDEB7B9AF16304F4481D9E04AA7681DB746FC4CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00325460, Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 241
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,ios_base::failbit set,00000000), ref: 00325489
GetModuleHandleW.KERNEL32(kernel32.dll,IsWow64Process), ref: 0032549B
GetProcAddress.KERNEL32(00000000), ref: 003254A2
GetVersionExW.KERNEL32(0000011C), ref: 00325509
GetNativeSystemInfo.KERNEL32(?), ref: 003256BE

Strings

ios_base::failbit set, xrefs: 00325474
kernel32.dll, xrefs: 00325494, 0032576C
Check failed: false. , xrefs: 00325660
GetProductInfo, xrefs: 00325767
minor == 3, xrefs: 00325590
c:\qt\givememoney\base\win\windows_version.cc, xrefs: 003255B7, 0032564D
IsWow64Process, xrefs: 0032548F
_Z2, xrefs: 003257C1

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: AddressCurrentHandleInfoModuleNativeProcProcessSystemVersion
String ID: Check failed: false. $GetProductInfo$IsWow64Process$_Z2$c:\qt\givememoney\base\win\windows_version.cc$ios_base::failbit set$kernel32.dll$minor == 3
API String ID: 1167739923-3154217376
Opcode ID: f298d8931d7b06cc42208b44e84e820f6289cfebbc0cf9602513807a36545337
Instruction ID: 68386894752a263d912d87c0bfa8ef2614064deae731bef2994c92f5d2e834b3
Opcode Fuzzy Hash: f298d8931d7b06cc42208b44e84e820f6289cfebbc0cf9602513807a36545337
Instruction Fuzzy Hash: EA91D170A41A28DFDB329F68EC457EAB7B8EB19300F51449AE546D7680DB34DF848F41

Uniqueness

Uniqueness Score: -1.00%

Function 003271F0, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 178fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,CB28B7D0), ref: 00327254
DeviceIoControl.KERNEL32(00000000,0004D008,?,0000003C,?,0000022D,?,00000000), ref: 00327305
FindCloseChangeNotification.KERNEL32(?,?,?,?,?,?,?,CB28B7D0), ref: 0032746C

Strings

SCSIDISK, xrefs: 00327293
\\.\Scsi%d:, xrefs: 00327225

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ChangeCloseControlCreateDeviceFileFindNotification
String ID: SCSIDISK$\\.\Scsi%d:
API String ID: 1020254441-2176293039
Opcode ID: ee73689df2cc464193f63f3968151bcaa261e2e64c2ae4d8f7cbaa7eccbbdea3
Instruction ID: 00dbcd4d566cd4dd27df6be140ac4efd5a13c45e3f4a91e42b58b57ea827bfcf
Opcode Fuzzy Hash: ee73689df2cc464193f63f3968151bcaa261e2e64c2ae4d8f7cbaa7eccbbdea3
Instruction Fuzzy Hash: 3E71C630A002299AEB22DF24DC45B9977F8FF45704F1582D9E948E7181DB71AF84CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00326FE0, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,CB28B7D0), ref: 00327050
DeviceIoControl.KERNEL32(00000000,00074080,00000000,00000000,?,00000018,?,00000000), ref: 00327099
FindCloseChangeNotification.KERNEL32(00000000,?,?,?,CB28B7D0), ref: 003270A4
CloseHandle.KERNEL32(00000000,?,?,?,CB28B7D0), ref: 003271A6

Strings

\\.\PhysicalDrive%d, xrefs: 00327021

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$ChangeControlCreateDeviceFileFindHandleNotification
String ID: \\.\PhysicalDrive%d
API String ID: 795878117-2935326385
Opcode ID: 6c018854a85cbfb280894158cb94aa2b0be66be4cda4a682f943c93c23ac38a8
Instruction ID: 2426d144a61abad7abd593edfd781039e8335d4a88d0e390125d70bf38764e63
Opcode Fuzzy Hash: 6c018854a85cbfb280894158cb94aa2b0be66be4cda4a682f943c93c23ac38a8
Instruction Fuzzy Hash: 0A510831D403689AEB21DF249C46BE97779FF95304F0143D5F50CAA182EB71ABE48B10

Uniqueness

Uniqueness Score: -1.00%

Function 00327730, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,00000003,00000000,00000003,00000000,00000000), ref: 0032779D
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00002710,?,00000000), ref: 00327810
FindCloseChangeNotification.KERNEL32(00000000,?,?,00002710), ref: 0032786B

Strings

\\.\PhysicalDrive%d, xrefs: 00327771

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ChangeCloseControlCreateDeviceFileFindNotification
String ID: \\.\PhysicalDrive%d
API String ID: 1020254441-2935326385
Opcode ID: 2c6e93a0071061f1813cf37bd69265c3869932710a5e9d30dcc23f325ac5f2c1
Instruction ID: 4fe44763a0e2813b9d9af407434b90c18cc87625d4987cd286754ca68b01a6ec
Opcode Fuzzy Hash: 2c6e93a0071061f1813cf37bd69265c3869932710a5e9d30dcc23f325ac5f2c1
Instruction Fuzzy Hash: FF318571A4022CBAEB21DB64DC8AFAE77BCEB04701F5041A6B908EA1D0D7709F848F51

Uniqueness

Uniqueness Score: -1.00%

Function 0035E2B2, Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,0035E288,00000000,003B7EA8,0000000C,0035E3DF,00000000,00000002,00000000), ref: 0035E2D3
TerminateProcess.KERNEL32(00000000,?,0035E288,00000000,003B7EA8,0000000C,0035E3DF,00000000,00000002,00000000), ref: 0035E2DA
ExitProcess.KERNEL32 ref: 0035E2EC

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 43a3360331e8c36e593c4c4b70cd51b141fc9e530fa40141e5f17ee961fee3a5
Instruction ID: a3c25e2ef11d7cfbaee47ad9d8209f64f2bf5efbb1bf05e54a4af46159dcb7cb
Opcode Fuzzy Hash: 43a3360331e8c36e593c4c4b70cd51b141fc9e530fa40141e5f17ee961fee3a5
Instruction Fuzzy Hash: 65E0B632010548ABCF176F64DE0AE997F6DEB44782F014815FD098B232CB36EE87CA95

Uniqueness

Uniqueness Score: -1.00%

Function 0030B1C0, Relevance: 1.5, Strings: 1, Instructions: 249COMMON

Download Yara Rule

Strings

%d%d%d%d%d%d%d%d, xrefs: 0030B502

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ExistsFilePath
String ID: %d%d%d%d%d%d%d%d
API String ID: 1174141254-2312385079
Opcode ID: c4bd98f4fb6eb5b6059125ca57fa9823b3c41b4af4a6821d8a4eda2046edd72e
Instruction ID: 9ef6e38100af8606775bb59880ac2d004a17374803784865acb20fd63f858af9
Opcode Fuzzy Hash: c4bd98f4fb6eb5b6059125ca57fa9823b3c41b4af4a6821d8a4eda2046edd72e
Instruction Fuzzy Hash: 69B12270C123189EDB09DFA4C8A57EEFB78BF14314F5406AED8162B2D2DBB45A84CB51

Uniqueness

Uniqueness Score: -1.00%

Function 001F4B10, Relevance: 90.0, APIs: 35, Strings: 16, Instructions: 702
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumWindows.USER32(0030CD60,?), ref: 001F4B6B

Strings

7C3963A7-4322-449C-883D-532FED82A905, xrefs: 001F65C9
\HYLite\, xrefs: 001F676C
x, xrefs: 001F2CA0, 001F45A6, 001F6CD6
status, xrefs: 001F3449
\ScreenSaver\, xrefs: 001F6790
Control Panel\Desktop, xrefs: 001F67F4
B0E87BF8-A8DC-4160-B331-54EBDD0DEE93, xrefs: 001F65A9
srtime, xrefs: 001F6CAD
usst, xrefs: 001F65E1, 001F6688
ScreenSaver, xrefs: 001F6A80, 001F6B17, 001F6B1C
data, xrefs: 001F3506
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 001F5FE7
DisplayIcon, xrefs: 001F44C2, 001F72C2
Software\Microsoft\Windows\CurrentVersion\Uninstall\HYLite, xrefs: 001F44C7, 001F72C7
SCRNSAVE.EXE, xrefs: 001F67EF
WSR, xrefs: 001F5FE2

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: EnumWindows
String ID: 7C3963A7-4322-449C-883D-532FED82A905$B0E87BF8-A8DC-4160-B331-54EBDD0DEE93$Control Panel\Desktop$DisplayIcon$SCRNSAVE.EXE$ScreenSaver$Software\Microsoft\Windows\CurrentVersion\Run$Software\Microsoft\Windows\CurrentVersion\Uninstall\HYLite$WSR$\HYLite\$\ScreenSaver\$data$srtime$status$usst$x
API String ID: 1129996299-4100730688
Opcode ID: ab72c7643593b7dd22e05b3dab67df5065172e791ae2b9dfba2224a612782f7f
Instruction ID: 888655b89e441fdec6dac7e181f4655ce76a871c263b5f0990a0d417fae855c6
Opcode Fuzzy Hash: ab72c7643593b7dd22e05b3dab67df5065172e791ae2b9dfba2224a612782f7f
Instruction Fuzzy Hash: E452BF71A00228AFEB21DF64DC45FEEB7B9FB54300F10429AE509A7281DB756E85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 001DCC20, Relevance: 46.0, APIs: 22, Strings: 4, Instructions: 513
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Mtx_init_in_situ.LIBCPMT ref: 001DCC8D

Part of subcall function 0031C257: Concurrency::details::create_stl_critical_section.LIBCPMT ref: 0031C262

__Mtx_init_in_situ.LIBCPMT ref: 001DCC98

Part of subcall function 00325EB0: SHGetValueA.SHLWAPI(80000001,Software\Microsoft\Windows\CurrentVersion\Uninstall\HYJiang,mid,?,?,?,CB28B7D0), ref: 00325F34

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?,?,?,?,?,?,?,003A8C5C,00000000), ref: 001DCD45
PathAppendW.SHLWAPI(?,Osa,?,?,?,?,?,?,?,?,?,003A8C5C,00000000,CB28B7D0), ref: 001DCD57
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,003A8C5C,00000000,CB28B7D0), ref: 001DCD6B
GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,003A8C5C,00000000,CB28B7D0), ref: 001DCD7C
SHCreateDirectoryExW.SHELL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,003A8C5C,00000000,CB28B7D0), ref: 001DCD91
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,003A8C5C,00000000,CB28B7D0), ref: 001DCD9E
GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,003A8C5C,00000000,CB28B7D0), ref: 001DCDAF
SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000001,?,?,?,?,?,?,?), ref: 001DCDDE
PathAppendW.SHLWAPI(?,Osa,?,?,?,?,?,?,?,?,?,?,?,?,003A8C5C,00000000), ref: 001DCDF0
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,003A8C5C,00000000,CB28B7D0), ref: 001DCDFD
GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,003A8C5C,00000000,CB28B7D0), ref: 001DCE0E
SHCreateDirectoryExW.SHELL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,003A8C5C), ref: 001DCE23
PathAppendW.SHLWAPI(?,003A8F98,?,?,?,?,?,?,?,?,?,?,?,?,003A8C5C,00000000), ref: 001DCE35
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,003A8C5C), ref: 001DCE69
GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,003A8C5C,00000000,CB28B7D0), ref: 001DCE7A
SHFileOperationW.SHELL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 001DCF20
SHGetValueW.SHLWAPI(80000001,Software\Microsoft\Windows\CurrentVersion\WSR,InstallDateOur,00000001,?,00000800,?,?,?,?,?,?,?,?,?,?), ref: 001DCFB7
__Mtx_unlock.LIBCPMT ref: 001DD06D
__Mtx_unlock.LIBCPMT ref: 001DD125

Part of subcall function 001DDEE0: std::locale::_Init.LIBCPMT ref: 001DE066

Part of subcall function 0031C278: mtx_do_lock.LIBCPMT ref: 0031C280

__Mtx_unlock.LIBCPMT ref: 001DD1F2

Strings

Software\Microsoft\Windows\CurrentVersion\WSR, xrefs: 001DCFAD
InstallDateOur, xrefs: 001DCFA8
Osa, xrefs: 001DCD4B, 001DCDE4
x, xrefs: 001DD334, 001DD364

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: FilePath$AttributesExists$AppendMtx_unlock$CreateDirectoryFolderMtx_init_in_situValue$Concurrency::details::create_stl_critical_sectionInitOperationmtx_do_lockstd::locale::_
String ID: InstallDateOur$Osa$Software\Microsoft\Windows\CurrentVersion\WSR$x
API String ID: 3892235256-380400929
Opcode ID: 6efb807093b9d24cc0e870c960bc8dc6d6d3d83ebce47771e11eb854e26ec57a
Instruction ID: de7e24275b974cc711237145e4e5760f15f720725f009037f1b557f5fe52786e
Opcode Fuzzy Hash: 6efb807093b9d24cc0e870c960bc8dc6d6d3d83ebce47771e11eb854e26ec57a
Instruction Fuzzy Hash: 4712F771940218ABDF25DBA4DC49BDEB7B9AF14300F0045DBE409AB281EB75AB85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00326250, Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 221
registryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards,00000000,00000008,?,?,?,CB28B7D0), ref: 003262AD
RegEnumKeyExW.KERNEL32 ref: 003262E2
RegOpenKeyExW.KERNEL32(?,?,00000000,00000001,?,?,?,CB28B7D0), ref: 00326308
RegQueryValueExW.KERNEL32(?,ServiceName,00000000,00000001,?,?,?,?,CB28B7D0), ref: 00326348
CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 0032639B
DeviceIoControl.KERNEL32(00000000,00170002,01010101,00000004,?,00000104,?,00000000), ref: 003263E5
FindCloseChangeNotification.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,CB28B7D0), ref: 00326443
lstrcmpA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,CB28B7D0), ref: 0032645E
RegCloseKey.ADVAPI32(?,?,?,CB28B7D0), ref: 003264B6
RegEnumKeyExW.KERNEL32 ref: 003264E4
RegCloseKey.ADVAPI32(?,?,?,CB28B7D0), ref: 003264F4

Strings

ServiceName, xrefs: 0032633D
\\.\%s, xrefs: 0032636C
%02X%02X%02X%02X%02X%02X, xrefs: 00326427
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards, xrefs: 003262A3

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$EnumOpen$ChangeControlCreateDeviceFileFindNotificationQueryValuelstrcmp
String ID: %02X%02X%02X%02X%02X%02X$SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards$ServiceName$\\.\%s
API String ID: 3304030313-836394687
Opcode ID: a65233ac7f86ca38ed7bec127d5f8d025c5b3dc013352ce23f60063aab6dc2eb
Instruction ID: 2588f368c3cb10e93c2d0df488fc311e9730880d24d18d8eb414205dcc436e47
Opcode Fuzzy Hash: a65233ac7f86ca38ed7bec127d5f8d025c5b3dc013352ce23f60063aab6dc2eb
Instruction Fuzzy Hash: EE818271944229ABEF22DB51DC42FEAB7BCEF04704F0541E6F948A7180DB75AE858F60

Uniqueness

Uniqueness Score: -1.00%

Function 00306E70, Relevance: 21.7, APIs: 7, Strings: 5, Instructions: 744
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemParametersInfoW.USER32 ref: 003070DD
SystemParametersInfoW.USER32 ref: 00307102
SystemParametersInfoW.USER32 ref: 0030712D
SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001C,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0030714F
SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001C,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0030715E
SHGetValueW.SHLWAPI(80000001,Control Panel\Desktop,SCRNSAVE.EXE,00000001,?,0000020A,003A8C5C,00000000,00000010,?,?), ref: 0030729C
WaitForSingleObject.KERNEL32(?,000000FF,?,003079A0,?,003C7F5C,00000000,00000002,?,?,?,003C7F8C,?,00000000,?,?), ref: 0030798D

Strings

\HYLite\, xrefs: 003071AA
x, xrefs: 00306FBC, 00306FF0
\ScreenSaver\, xrefs: 00307208
SCRNSAVE.EXE, xrefs: 0030728D
Control Panel\Desktop, xrefs: 00307292

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: InfoParametersSystem$FolderPathSpecial$ObjectSingleValueWait
String ID: Control Panel\Desktop$SCRNSAVE.EXE$\HYLite\$\ScreenSaver\$x
API String ID: 500235438-538041694
Opcode ID: 05c20ccefa894fff94060621d857511cbf6f6c98e6bea81422d6ee16a4a74b96
Instruction ID: 91d06e64f829d3f6f69df2f09e5d13a98da8ea9d3de23141fdef69b1d839204c
Opcode Fuzzy Hash: 05c20ccefa894fff94060621d857511cbf6f6c98e6bea81422d6ee16a4a74b96
Instruction Fuzzy Hash: D952F271A122189BEB26DB24CC95BDEBB75AF45304F5041D8E409AB2C2DB71AFC4CF52

Uniqueness

Uniqueness Score: -1.00%

Function 001D4A90, Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 249
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,003C837C,00000000,00020019,00000000), ref: 001D4B0A
RegOpenKeyExW.ADVAPI32(80000001,003C837C,00000000,00020019,00000000), ref: 001D4B47
RegQueryValueExW.KERNEL32(00000000,Path,00000000,00000000,?,?), ref: 001D4B79
PathFileExistsW.SHLWAPI(00000000,00000000,-00000002), ref: 001D4BE0
RegOpenKeyExW.KERNEL32(80000001,003C8394,00000000,00020019,00000000), ref: 001D4C6B
RegQueryValueExW.ADVAPI32(00000000,InstallLocation,00000000,00000000,?,00000104), ref: 001D4C9D
PathFileExistsW.SHLWAPI(00000000,00000000,-00000002), ref: 001D4D03
RegOpenKeyExW.KERNEL32(80000001,003C83AC,00000000,00020019,00000000), ref: 001D4D8E
RegQueryValueExW.ADVAPI32(00000000,InstallLocation,00000000,00000000,?,00000104), ref: 001D4DC0
PathFileExistsW.SHLWAPI(00000000,00000000,-00000002), ref: 001D4E26

Strings

InstallLocation, xrefs: 001D4C97, 001D4DBA
Path, xrefs: 001D4B73

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Open$ExistsFilePathQueryValue
String ID: InstallLocation$Path
API String ID: 2114160250-647125406
Opcode ID: 41712259d0e2230df153ac51626eea9dc0bf7798c11620c5ae43a8c4f320b149
Instruction ID: d42ef534f7a6d69c5c467e7263cb8d36076bf38d68755c73c584a204edd651b1
Opcode Fuzzy Hash: 41712259d0e2230df153ac51626eea9dc0bf7798c11620c5ae43a8c4f320b149
Instruction Fuzzy Hash: E0A16C75A00218EBEB25DF54CD49FEAB7BAFB54704F400199E509A7280EB72AE94CF50

Uniqueness

Uniqueness Score: -1.00%

Function 003309D0, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(?,?,?), ref: 00330A62
RegCloseKey.ADVAPI32(?,?,?), ref: 00330A76
RegCreateKeyExW.ADVAPI32(CB28B7D0,00020019,00000000,00000000,00000000,00000026,00000000,?,CB28B7D0,?,?), ref: 00330A97
CloseHandle.KERNEL32(?,?,?), ref: 00330B0A
RegCloseKey.ADVAPI32(?,?,?), ref: 00330B1E
RegOpenKeyExW.KERNEL32(CB28B7D0,00020019,00000000,00000026,?,?,?), ref: 00330B35

Strings

Check failed: rootkey && subkey && access && disposition. , xrefs: 00330A32
c:\qt\givememoney\base\win\registry.cc, xrefs: 00330A1F, 00330AC7, 00330B63
Check failed: rootkey && subkey && access. , xrefs: 00330ADA
Check failed: !subkey. , xrefs: 00330B76

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$Handle$CreateOpen
String ID: Check failed: !subkey. $Check failed: rootkey && subkey && access && disposition. $Check failed: rootkey && subkey && access. $c:\qt\givememoney\base\win\registry.cc
API String ID: 348691498-488730054
Opcode ID: 7153a62e237a5763ccf6eac112d0095e3a14427936f02061515f03ac12466506
Instruction ID: 33e1e19efa21e2ab83fc32201d4f29443dd42ed38b2115591b888934f38eb9da
Opcode Fuzzy Hash: 7153a62e237a5763ccf6eac112d0095e3a14427936f02061515f03ac12466506
Instruction Fuzzy Hash: 9951D335640304ABDB269F54ECD7F9AB7ACEF10711F05841AF94897282DB71D980CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0030B9A0, Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,?), ref: 0030BA18
PathAppendW.SHLWAPI(?,Sap), ref: 0030BA30
PathAppendW.SHLWAPI(?,003ACA00), ref: 0030BA3E
PathFileExistsW.SHLWAPI(?), ref: 0030BA4D
SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000001,?), ref: 0030BA77
PathAppendW.SHLWAPI(?,Sap), ref: 0030BA89
PathAppendW.SHLWAPI(?,003ACA00), ref: 0030BA97
PathFileExistsW.SHLWAPI(?), ref: 0030BAA0

Strings

Sap, xrefs: 0030BA2A, 0030BA7D

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Path$Append$ExistsFileFolder
String ID: Sap
API String ID: 1976240064-3176686113
Opcode ID: 7480d681d4340aab21c8219f1c7d6637bc3c47a4d7844ee5cd3c07f8af652965
Instruction ID: 814fb5eda46b604ec4dd312283869bf67e7eb66a2240a05fa05b331c9235567e
Opcode Fuzzy Hash: 7480d681d4340aab21c8219f1c7d6637bc3c47a4d7844ee5cd3c07f8af652965
Instruction Fuzzy Hash: 37D1D071A11218ABDB2ADB24DC99BEDB7BDAB04304F0441D9E109AB2D1DB74ABC4CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00325810, Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00325851
std::_Lockit::_Lockit.LIBCPMT ref: 0032586C
std::_Lockit::~_Lockit.LIBCPMT ref: 0032588C
std::_Facet_Register.LIBCPMT ref: 0032591D
std::_Lockit::~_Lockit.LIBCPMT ref: 00325935

Strings

ios_base::failbit set, xrefs: 00325A08
ios_base::badbit set, xrefs: 003259FF, 00325A27
ios_base::eofbit set, xrefs: 00325A0D

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 459529453-1866435925
Opcode ID: ac347cb92d22d276925b1b72e14da4850ab4b01f7d1616fce7478e54f0ba8b2a
Instruction ID: 54a70db00ea5c4cb3f1262d9bd95cc9e400680bc01680579181dd45a4f509350
Opcode Fuzzy Hash: ac347cb92d22d276925b1b72e14da4850ab4b01f7d1616fce7478e54f0ba8b2a
Instruction Fuzzy Hash: C271EF35A00614DFCB16DF58D885FAAB7F5BF58310F168069E8469B362DB30EE80CB80

Uniqueness

Uniqueness Score: -1.00%

Function 001DC860, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 001DC88D

Part of subcall function 0034ADEF: RaiseException.KERNEL32(?,?,0031B3D9,?,?,?,00000000,?,?,?,?,0031B3D9,?,003B7370,6F8373B0,?), ref: 0034AE4F

__CxxThrowException@8.LIBVCRUNTIME ref: 001DC8D2
std::locale::_Init.LIBCPMT ref: 001DC971

Strings

ios_base::failbit set, xrefs: 001DC7A5, 001DC8A1
V2, xrefs: 001DC7AF, 001DC845
ios_base::badbit set, xrefs: 001DC897, 001DC8C2, 001DC8F1
ios_base::eofbit set, xrefs: 001DC8A6
V2, xrefs: 001DC7BD

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Exception@8Throw$ExceptionInitRaisestd::locale::_
String ID: V2$V2$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 687216407-348020702
Opcode ID: 6a61be404e7d82157e58c7721f82106cf42e6826a7c34fb4031c24712a65a6a1
Instruction ID: ff6393b376d8288407b170ddf8486be10e2c92a5ddfd37936a6ad8f17671c4b9
Opcode Fuzzy Hash: 6a61be404e7d82157e58c7721f82106cf42e6826a7c34fb4031c24712a65a6a1
Instruction Fuzzy Hash: 2D3135B1900B05BBE315DF64D806B96B7E4FB05714F044B2AF9148BBC0EBBAA554CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00367CA2, Relevance: 13.8, APIs: 9, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb195640557882392590365550798888ffa8c10105b7e3f1177b8458321a34f
Instruction ID: c11205898f500833a17d715426978c8cf0dae25362cd3d0aaa81fe27a4ece0b8
Opcode Fuzzy Hash: 2eb195640557882392590365550798888ffa8c10105b7e3f1177b8458321a34f
Instruction Fuzzy Hash: 38C1D270E08349AFDB13DFA8C852FADBBB4BF09314F558588E810AB396C7359945CB61

Uniqueness

Uniqueness Score: -1.00%

Function 003723DC, Relevance: 13.8, APIs: 9, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0037211B: CreateFileW.KERNEL32(00000000,00000000,?,00372485,?,?,00000000,?,00372485,00000000,0000000C), ref: 00372138

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 003724F0
__dosmaperr.LIBCMT ref: 003724F7
GetFileType.KERNEL32(00000000), ref: 00372503
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0037250D
__dosmaperr.LIBCMT ref: 00372516
CloseHandle.KERNEL32(00000000), ref: 00372536
CloseHandle.KERNEL32(0032CC93), ref: 00372680
GetLastError.KERNEL32 ref: 003726B2
__dosmaperr.LIBCMT ref: 003726B9

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 62301aaf906264be3609c784df82feb52f101235e9e9a3a1416b5ab7df7d2772
Instruction ID: 71e33f9ff304c462c96dea5539fbf4423cd51f3965f19f163856eeea29fc351c
Opcode Fuzzy Hash: 62301aaf906264be3609c784df82feb52f101235e9e9a3a1416b5ab7df7d2772
Instruction Fuzzy Hash: 98A15732A142449FCF2ADF78DC92BAE7BA4EB06320F148159F805DF291CB359912DB51

Uniqueness

Uniqueness Score: -1.00%

Function 001DE710, Relevance: 13.1, APIs: 1, Strings: 6, Instructions: 809
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003288E0: SHGetValueW.SHLWAPI(80000001,Software\Microsoft\Windows\CurrentVersion\WSR,NString,00000001,?,00000800), ref: 00328945

SHGetValueW.SHLWAPI(80000001,Software\Microsoft\Windows\CurrentVersion\WSR,InstallDateOur,00000001,?,00000800,?,?,?,?,?,00000000), ref: 001DE894

Strings

Software\Microsoft\Windows\CurrentVersion\WSR, xrefs: 001DE88A
{"n":"%s","uid":"%s","v":"%s","ct":"%s","t":"%s"}, xrefs: 001DEA50
InstallDateOur, xrefs: 001DE885
f=g51&, xrefs: 001DEB0C
info, xrefs: 001DF106
999, xrefs: 001DE99F

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Value
String ID: 999$InstallDateOur$Software\Microsoft\Windows\CurrentVersion\WSR$f=g51&$info${"n":"%s","uid":"%s","v":"%s","ct":"%s","t":"%s"}
API String ID: 3702945584-2899581116
Opcode ID: fefd9cf48799a97828d7ec5c480d2ccea6cbc88187d5bbe5e1c3afda006a18cd
Instruction ID: b945d9e5f99143b287ff3e80f5940538be55cc20fb32df58345ec992416b5c79
Opcode Fuzzy Hash: fefd9cf48799a97828d7ec5c480d2ccea6cbc88187d5bbe5e1c3afda006a18cd
Instruction Fuzzy Hash: 1C62C1719002589BEB29DB68CC98BDDBBB5AF45304F2046D9E009BB382DB755BC4CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0030B530, Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 333
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetValueW.SHLWAPI(80000001,Software\Microsoft\Windows\CurrentVersion\Uninstall\HYLite,003AB900,00000004,00000002,?,003A8F14,00000000), ref: 0030B68F
GetModuleHandleW.KERNEL32(kernel32.dll,GetNativeSystemInfo,003AC9E8,003AC9EC,00000000,003AC9E8,00000000,00000000), ref: 0030B91D
GetProcAddress.KERNEL32(00000000), ref: 0030B924
GetNativeSystemInfo.KERNEL32(?), ref: 0030B932

Strings

kernel32.dll, xrefs: 0030B90D
GetNativeSystemInfo, xrefs: 0030B908
Software\Microsoft\Windows\CurrentVersion\Uninstall\HYLite, xrefs: 0030B685

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: AddressHandleInfoModuleNativeProcSystemValue
String ID: GetNativeSystemInfo$Software\Microsoft\Windows\CurrentVersion\Uninstall\HYLite$kernel32.dll
API String ID: 2162404873-2829805921
Opcode ID: edf341d425e9cb0cebe7c292ad03f0b33ee1760fa300dd5b943d768af00eb6bd
Instruction ID: 3ab41910bbc671425c88ac6cef9ab19c8de9391109d80d7f52dc34309d1b123c
Opcode Fuzzy Hash: edf341d425e9cb0cebe7c292ad03f0b33ee1760fa300dd5b943d768af00eb6bd
Instruction Fuzzy Hash: A2C14270E012489BDF16DBA8CC5ABAEFBBAEF50304F10411DE405AB3C2CB789A45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00306830, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathW.SHELL32(00000000,0000001C,00000000,00000000,?,CB28B7D0,?,00000000), ref: 003068B7

Strings

ScreenSaver, xrefs: 003068FB
Control Panel\Desktop, xrefs: 00306AC9, 00306AE0
SCRNSAVE.EXE, xrefs: 00306AC4, 00306ADB

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: FolderPath
String ID: Control Panel\Desktop$SCRNSAVE.EXE$ScreenSaver
API String ID: 1514166925-345978226
Opcode ID: 066c55d57342022ced7a411d8b3203c81663abb5f7a9b6b93826721e99d1f0bd
Instruction ID: 1655940277ae59608d68fc11a75f5332fa858db9890ab4c40c6ec551c0209f30
Opcode Fuzzy Hash: 066c55d57342022ced7a411d8b3203c81663abb5f7a9b6b93826721e99d1f0bd
Instruction Fuzzy Hash: 4071B271950218EADB25EB64CC9ABEDB7B8FF15300F4041E9E40AA7291DB746F88CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00308850, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 141COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001C,00000000,CB28B7D0,?), ref: 003088A9
SHCreateDirectoryExW.SHELL32(00000000,?,00000000,\ScreenSaver\,0000000D,?,?), ref: 00308929
GetPrivateProfileStringW.KERNEL32 ref: 0030898E

Strings

%General, xrefs: 00308989
SSCI, xrefs: 00308931
\ScreenSaver\, xrefs: 003088F9

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: CreateDirectoryFolderPathPrivateProfileSpecialString
String ID: %General$SSCI$\ScreenSaver\
API String ID: 2200349855-591173976
Opcode ID: 92c2129e3640b8e40209124f1b804888647da0731bd5339059ffd73d27ac12b9
Instruction ID: ff10814d6eeda633d723ef8c5efe8fb2a164f3ca2d8934276a64c04a6b7e3629
Opcode Fuzzy Hash: 92c2129e3640b8e40209124f1b804888647da0731bd5339059ffd73d27ac12b9
Instruction Fuzzy Hash: 75519171911218DBDB24DF54CC89BEAB7B4EF48704F4002DAE809AB290EB746F84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0030D050, Relevance: 9.6, APIs: 6, Instructions: 575COMMON

Download Yara Rule

APIs

PowerGetActiveScheme.POWRPROF(00000000,?,75253BB0), ref: 0030D0E6
PowerReadACValueIndex.POWRPROF(00000000,?,?,?,00000000), ref: 0030D11A
PowerReadDCValueIndex.POWRPROF(00000000,?,?,?,?), ref: 0030D14C
PowerReadACValueIndex.POWRPROF(00000000,?,?,?,?), ref: 0030D19B
PowerReadDCValueIndex.POWRPROF(00000000,?,?,?,?), ref: 0030D1DA
LocalFree.KERNEL32(?), ref: 0030D20B

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Power$IndexReadValue$ActiveFreeLocalScheme
String ID:
API String ID: 3907021037-0
Opcode ID: 59fc48f7c4cddc7a56b3dc919ea8cb2f54ae2f4bfdaf8ec739248389b7d1212f
Instruction ID: 405acb455fe24c87f616fbcd42c59ddd5bad1c23436c6077721aea5b79857206
Opcode Fuzzy Hash: 59fc48f7c4cddc7a56b3dc919ea8cb2f54ae2f4bfdaf8ec739248389b7d1212f
Instruction Fuzzy Hash: CF220671E012088BDB1ACFA8CD547EEFBB5AF55304F108259E415AB3D2EB74AA84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00312920, Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 485COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 003129B8

Strings

FilterWithBufferedInput, xrefs: 00312A17, 00312E40
FilterWithBufferedInput: invalid buffer size, xrefs: 0031298F

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Exception@8Throw
String ID: FilterWithBufferedInput$FilterWithBufferedInput: invalid buffer size
API String ID: 2005118841-1200219513
Opcode ID: 411e32073d3aac7139a713e08144757c4fd490af332150cc1af5a1f31ce8ea5b
Instruction ID: 3212c66b0e9499cd0205a08dc52606d9361208f77166d4ecdd79a1846e27bb36
Opcode Fuzzy Hash: 411e32073d3aac7139a713e08144757c4fd490af332150cc1af5a1f31ce8ea5b
Instruction Fuzzy Hash: DE124B71A006089FCB2ADFA8D984ADFBBF6FF48300F14462DE546A7A40D770B955CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003288E0, Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 200COMMON

Download Yara Rule

APIs

SHGetValueW.SHLWAPI(80000001,Software\Microsoft\Windows\CurrentVersion\WSR,NString,00000001,?,00000800), ref: 00328945
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 003289E2
SHSetValueW.SHLWAPI(80000001,Software\Microsoft\Windows\CurrentVersion\WSR,NString,00000001,?,00000000,?,00000003,?,?), ref: 00328B71

Strings

Software\Microsoft\Windows\CurrentVersion\WSR, xrefs: 0032893B, 00328B67
NString, xrefs: 00328936, 00328B62

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Value$FileModuleName
String ID: NString$Software\Microsoft\Windows\CurrentVersion\WSR
API String ID: 121066068-1594225538
Opcode ID: b45fc834873705875602008681d88e64116674ed8a99ed4e1202f085ca121468
Instruction ID: 26643ecae05b15c0a1ff130aea278d7330debedb3aad291735764b5b3fc6375f
Opcode Fuzzy Hash: b45fc834873705875602008681d88e64116674ed8a99ed4e1202f085ca121468
Instruction Fuzzy Hash: 48818371B103289ADB25DF24DC55BDDB3B8AF19304F4045EAE40AA7641EB746F84CF92

Uniqueness

Uniqueness Score: -1.00%

Function 001D7BC0, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 187registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,003C8A0C,00000000,00020019,00000000,00000000,76564830), ref: 001D7C33
RegQueryValueExW.KERNEL32(00000000,Progid,00000000,00000000,?,?), ref: 001D7C65
RegOpenKeyExW.ADVAPI32(80000000,003C8A24,00000000,00020019,00000000,00000000,76564830), ref: 001D7D94
RegQueryValueExW.ADVAPI32(00000000,003A8C5C,00000000,00000000,?,?), ref: 001D7DC6

Strings

Progid, xrefs: 001D7C5F

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: OpenQueryValue
String ID: Progid
API String ID: 4153817207-3999487396
Opcode ID: 7def55fd1c272de358b756d8ea3630867f631154ebea8bf307e387e793e90054
Instruction ID: 32e1f787b04a75186d4d6f6f2bd9d2e9a9efd8d46443f7841af44b53a0fb3ac9
Opcode Fuzzy Hash: 7def55fd1c272de358b756d8ea3630867f631154ebea8bf307e387e793e90054
Instruction Fuzzy Hash: 4E71C275A41218ABDB25DF54DC89BE9B3B5EF14300F5042DAE80AAA2D0EB706FC5CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00325EB0, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 178COMMON

Download Yara Rule

APIs

SHGetValueA.SHLWAPI(80000001,Software\Microsoft\Windows\CurrentVersion\Uninstall\HYJiang,mid,?,?,?,CB28B7D0), ref: 00325F34

Strings

, xrefs: 00325FD1
mid, xrefs: 00325F25
Software\Microsoft\Windows\CurrentVersion\Uninstall\HYJiang, xrefs: 00325F2A
Mid2Failed, xrefs: 00326041

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Value
String ID: $Mid2Failed$Software\Microsoft\Windows\CurrentVersion\Uninstall\HYJiang$mid
API String ID: 3702945584-1066741863
Opcode ID: e4cde3b0ad37d688fcaa75aa1ccada901ff21b1370f806fd12031976c1dd3e14
Instruction ID: 68f8989b85fdbe867d5579393f7b5fedbd951b2e6e80de7f039f672603ccc234
Opcode Fuzzy Hash: e4cde3b0ad37d688fcaa75aa1ccada901ff21b1370f806fd12031976c1dd3e14
Instruction Fuzzy Hash: E251BB71D04328AAEF22DA60ED46FEE77AD9F15704F4500A9F908DB182F771DA84C761

Uniqueness

Uniqueness Score: -1.00%

Function 0033B760, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?,?,?,?,00328DAC,?,?,?,?), ref: 0033B779
GetFileVersionInfoW.VERSION(?,?,00000000,00000000,?,?,00328DAC,?,?,?,?), ref: 0033B7A3
VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,00000000,?,?,?,00000000,00000000,?,?,00328DAC), ref: 0033B7C5
VerQueryValueW.VERSION(?,003A8C58,00000010,00328DAC,00000000,?,?,00328DAC), ref: 0033B82F

Strings

\VarFileInfo\Translation, xrefs: 0033B7BF

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: FileInfoQueryValueVersion$Size
String ID: \VarFileInfo\Translation
API String ID: 2099394744-675650646
Opcode ID: 3ec09b6015df12ee39a87c3ebd4e1cfcf3b400c6ab20515e5c6d04495fa87ffb
Instruction ID: e0bf3e1b8ec4c7ac8dcc3985c96a35684b3d9ffc16dd108cdf44c7277ddc3fc4
Opcode Fuzzy Hash: 3ec09b6015df12ee39a87c3ebd4e1cfcf3b400c6ab20515e5c6d04495fa87ffb
Instruction Fuzzy Hash: 5D21F272600604ABCB229E58DC81AABF3ECEF44751F14453EFE489A211E775E944C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 0032D9C0, Relevance: 7.7, APIs: 5, Instructions: 169threadsynchronizationinjectionCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 0032D9D4
WaitForSingleObject.KERNEL32(00000000,000001F4), ref: 0032D9EA
SuspendThread.KERNEL32(00000000), ref: 0032DA03
TerminateThread.KERNEL32(00000000,000000F6), ref: 0032DA0E
CloseHandle.KERNEL32(00000000), ref: 0032DA17

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Thread$CloseEventHandleObjectSingleSuspendTerminateWait
String ID:
API String ID: 1454233156-0
Opcode ID: 89fefeefb9b65efc0a05bbd7728e657eb65a1b6734c353ef065083b267b8969d
Instruction ID: fa5628db05e3ab419e30a5005dbf6606e1d654182ef66a8cdfe87907b6c60e1c
Opcode Fuzzy Hash: 89fefeefb9b65efc0a05bbd7728e657eb65a1b6734c353ef065083b267b8969d
Instruction Fuzzy Hash: 6851CE71510B109FD32A9F28DC99B5BBBE5FF44314F14492DE1968BAA1D7B1F884CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0030A810, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 003309D0: CloseHandle.KERNEL32(?,?,?), ref: 00330A62
Part of subcall function 003309D0: RegCloseKey.ADVAPI32(?,?,?), ref: 00330A76
Part of subcall function 003309D0: RegCreateKeyExW.ADVAPI32(CB28B7D0,00020019,00000000,00000000,00000000,00000026,00000000,?,CB28B7D0,?,?), ref: 00330A97

Part of subcall function 00330BE0: RegQueryValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00330C98

PathFileExistsW.SHLWAPI(?,DisplayIcon,?,80000002,003C7E54,00020119,CB28B7D0,?), ref: 0030A93B

Strings

T~<, xrefs: 0030A876
DisplayIcon, xrefs: 0030A8AC
DisplayVersion, xrefs: 0030A961

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$CreateExistsFileHandlePathQueryValue
String ID: DisplayIcon$DisplayVersion$T~<
API String ID: 2291167148-77127634
Opcode ID: 7a4a99b6d1a51fca3924ac46b921869af2a9af60eb0f23c330e73f670a08af6b
Instruction ID: 5ea7912557376088275e5ff7211703c2c323b28bb73acd5570805d336f927380
Opcode Fuzzy Hash: 7a4a99b6d1a51fca3924ac46b921869af2a9af60eb0f23c330e73f670a08af6b
Instruction Fuzzy Hash: 53515D71D1120CEEDB15DFA4D955BEEBBB8FF14304F60422AE411A7290EB746A48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0030A050, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 003309D0: CloseHandle.KERNEL32(?,?,?), ref: 00330A62
Part of subcall function 003309D0: RegCloseKey.ADVAPI32(?,?,?), ref: 00330A76
Part of subcall function 003309D0: RegCreateKeyExW.ADVAPI32(CB28B7D0,00020019,00000000,00000000,00000000,00000026,00000000,?,CB28B7D0,?,?), ref: 00330A97

Part of subcall function 00330BE0: RegQueryValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00330C98

PathFileExistsW.SHLWAPI(?,DisplayIcon,?,80000002,003C7E24,00020119,CB28B7D0,?), ref: 0030A17B

Strings

DisplayIcon, xrefs: 0030A0EC
DisplayVersion, xrefs: 0030A1A1
$~<, xrefs: 0030A0B6

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$CreateExistsFileHandlePathQueryValue
String ID: $~<$DisplayIcon$DisplayVersion
API String ID: 2291167148-2576702453
Opcode ID: b28cef501c61392d92f8323801fc0c37faef12a7ecbc372c604c824be9851f11
Instruction ID: 5eba21fb78f610375fefbd7425d5149ba30f9cc8fd93bdb21f2894184765b2f8
Opcode Fuzzy Hash: b28cef501c61392d92f8323801fc0c37faef12a7ecbc372c604c824be9851f11
Instruction Fuzzy Hash: 98516E70D15208EFDB15DFA4E995BEEFBB8FF14304F60422AE411A7280EB746A44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0030AA00, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 003309D0: CloseHandle.KERNEL32(?,?,?), ref: 00330A62
Part of subcall function 003309D0: RegCloseKey.ADVAPI32(?,?,?), ref: 00330A76
Part of subcall function 003309D0: RegCreateKeyExW.ADVAPI32(CB28B7D0,00020019,00000000,00000000,00000000,00000026,00000000,?,CB28B7D0,?,?), ref: 00330A97

Part of subcall function 00330BE0: RegQueryValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00330C98

PathFileExistsW.SHLWAPI(?,DisplayIcon,?,80000002,003C7E6C,00020019,CB28B7D0,?), ref: 0030AB2B

Strings

l~<, xrefs: 0030AA66
DisplayIcon, xrefs: 0030AA9C
DisplayVersion, xrefs: 0030AB51

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$CreateExistsFileHandlePathQueryValue
String ID: DisplayIcon$DisplayVersion$l~<
API String ID: 2291167148-786459642
Opcode ID: 4373ac67e19654c3ef963a6590704da7601a57f39ca50f42d6c4aa3d6ccbf92b
Instruction ID: 8d8c642bf102dccc2c58586d4f480354671c6e1e26bdebfbbc829e7fd59a311a
Opcode Fuzzy Hash: 4373ac67e19654c3ef963a6590704da7601a57f39ca50f42d6c4aa3d6ccbf92b
Instruction Fuzzy Hash: 12516E70D15208EFDB15DFA4E995BEEFBB9FF14304F50422AE411A3290EB746A44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0030A240, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 003309D0: CloseHandle.KERNEL32(?,?,?), ref: 00330A62
Part of subcall function 003309D0: RegCloseKey.ADVAPI32(?,?,?), ref: 00330A76
Part of subcall function 003309D0: RegCreateKeyExW.ADVAPI32(CB28B7D0,00020019,00000000,00000000,00000000,00000026,00000000,?,CB28B7D0,?,?), ref: 00330A97

Part of subcall function 00330BE0: RegQueryValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00330C98

PathFileExistsW.SHLWAPI(?,DisplayIcon,?,80000002,003C7E3C,00020019,CB28B7D0,?), ref: 0030A36B

Strings

<~<, xrefs: 0030A2A6
DisplayIcon, xrefs: 0030A2DC
DisplayVersion, xrefs: 0030A391

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$CreateExistsFileHandlePathQueryValue
String ID: <~<$DisplayIcon$DisplayVersion
API String ID: 2291167148-3507452406
Opcode ID: 00f07bb5ae5ad30c5c621c5ade69b971418ffb18ec38b39deb43770c8ab03863
Instruction ID: 897e05310145cc79d80aef5abb95cc22a42ec1e5aa62f6ae38d9c75238bc5235
Opcode Fuzzy Hash: 00f07bb5ae5ad30c5c621c5ade69b971418ffb18ec38b39deb43770c8ab03863
Instruction Fuzzy Hash: 36516D70D15208EFDB15DFA4D955BEEFBB8FF14304F50422AE411A3291EB746A48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0030ABF0, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 003309D0: CloseHandle.KERNEL32(?,?,?), ref: 00330A62
Part of subcall function 003309D0: RegCloseKey.ADVAPI32(?,?,?), ref: 00330A76
Part of subcall function 003309D0: RegCreateKeyExW.ADVAPI32(CB28B7D0,00020019,00000000,00000000,00000000,00000026,00000000,?,CB28B7D0,?,?), ref: 00330A97

Part of subcall function 00330BE0: RegQueryValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00330C98

PathFileExistsW.SHLWAPI(?,DisplayIcon,?,80000002,003C7E6C,00020119,CB28B7D0,?), ref: 0030AD1B

Strings

DisplayIcon, xrefs: 0030AC8C
l~<, xrefs: 0030AC56
DisplayVersion, xrefs: 0030AD41

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$CreateExistsFileHandlePathQueryValue
String ID: DisplayIcon$DisplayVersion$l~<
API String ID: 2291167148-786459642
Opcode ID: 53dc6d95232874b1276b68c265ec7f139ef31c3aa46cc15d0139f25609347b07
Instruction ID: 15ba6acdee828fdcd4a115220b0ff8fe86566ba9f5f50162a0fcb006ef56a780
Opcode Fuzzy Hash: 53dc6d95232874b1276b68c265ec7f139ef31c3aa46cc15d0139f25609347b07
Instruction Fuzzy Hash: 42517C70D11208EFDB15DFA4D951BEEFBB8FF18304F60422AE411A3290EB746A48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0030A430, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 003309D0: CloseHandle.KERNEL32(?,?,?), ref: 00330A62
Part of subcall function 003309D0: RegCloseKey.ADVAPI32(?,?,?), ref: 00330A76
Part of subcall function 003309D0: RegCreateKeyExW.ADVAPI32(CB28B7D0,00020019,00000000,00000000,00000000,00000026,00000000,?,CB28B7D0,?,?), ref: 00330A97

Part of subcall function 00330BE0: RegQueryValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00330C98

PathFileExistsW.SHLWAPI(?,DisplayIcon,?,80000002,003C7E3C,00020119,CB28B7D0,?), ref: 0030A55B

Strings

<~<, xrefs: 0030A496
DisplayIcon, xrefs: 0030A4CC
DisplayVersion, xrefs: 0030A581

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$CreateExistsFileHandlePathQueryValue
String ID: <~<$DisplayIcon$DisplayVersion
API String ID: 2291167148-3507452406
Opcode ID: 3b67a0ad8d44d2a0ada402c60a25ddcb4a409c7a2001b116808b8d0fa193d1e9
Instruction ID: 1198e81c4cf0b1e4bfb5d7a078dd2581d6ebcb231ac19c39a93c28e42da480a5
Opcode Fuzzy Hash: 3b67a0ad8d44d2a0ada402c60a25ddcb4a409c7a2001b116808b8d0fa193d1e9
Instruction Fuzzy Hash: 86518D70D11208EFCB15DFA4D951BEEFBB9FF14304F60422AE411A3291EB74AA48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0030A620, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 003309D0: CloseHandle.KERNEL32(?,?,?), ref: 00330A62
Part of subcall function 003309D0: RegCloseKey.ADVAPI32(?,?,?), ref: 00330A76
Part of subcall function 003309D0: RegCreateKeyExW.ADVAPI32(CB28B7D0,00020019,00000000,00000000,00000000,00000026,00000000,?,CB28B7D0,?,?), ref: 00330A97

Part of subcall function 00330BE0: RegQueryValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00330C98

PathFileExistsW.SHLWAPI(?,DisplayIcon,?,80000002,003C7E54,00020019,CB28B7D0,?), ref: 0030A74B

Strings

DisplayIcon, xrefs: 0030A6BC
DisplayVersion, xrefs: 0030A771
T~<, xrefs: 0030A686

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$CreateExistsFileHandlePathQueryValue
String ID: DisplayIcon$DisplayVersion$T~<
API String ID: 2291167148-77127634
Opcode ID: 21c38568f02909252a6be735aef882021b70aa057d82f78bf85d3d8c43c8a333
Instruction ID: 12a5868f3de3435c50374c5e0eb2dbd26a59bc506d9d255aa899c4eac2553928
Opcode Fuzzy Hash: 21c38568f02909252a6be735aef882021b70aa057d82f78bf85d3d8c43c8a333
Instruction Fuzzy Hash: 3C518D71D11208EFDB15DFA4D995BEEFBB8FF14704F60422AE411A7280EB746A48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00309E60, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 003309D0: CloseHandle.KERNEL32(?,?,?), ref: 00330A62
Part of subcall function 003309D0: RegCloseKey.ADVAPI32(?,?,?), ref: 00330A76
Part of subcall function 003309D0: RegCreateKeyExW.ADVAPI32(CB28B7D0,00020019,00000000,00000000,00000000,00000026,00000000,?,CB28B7D0,?,?), ref: 00330A97

Part of subcall function 00330BE0: RegQueryValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00330C98

PathFileExistsW.SHLWAPI(?,DisplayIcon,?,80000002,003C7E24,00020019,CB28B7D0,?), ref: 00309F8B

Strings

DisplayIcon, xrefs: 00309EFC
$~<, xrefs: 00309EC6
DisplayVersion, xrefs: 00309FB1

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$CreateExistsFileHandlePathQueryValue
String ID: $~<$DisplayIcon$DisplayVersion
API String ID: 2291167148-2576702453
Opcode ID: d962b21f51dfc7f4da68b978ef457f4d45d8b40ba0011a7ef9630dc6e72a45a0
Instruction ID: d7594d4fac54e7e1c1487033001ade5299527f58b9339a603029321fa8e97e0b
Opcode Fuzzy Hash: d962b21f51dfc7f4da68b978ef457f4d45d8b40ba0011a7ef9630dc6e72a45a0
Instruction Fuzzy Hash: 6E518E70D11208EFDB15DFA4D991BEEFBB8FF14304F60422AE415A3281EB746A44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00322D20, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 00320A60: std::locale::_Init.LIBCPMT ref: 00320AB8

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00322EAF

Strings

ins_res.first->second != in_value, xrefs: 00322DF7
c:\qt\givememoney\base\values.cc, xrefs: 00322EC3
vs. , xrefs: 00322DE4

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: InitIos_base_dtorstd::ios_base::_std::locale::_
String ID: vs. $c:\qt\givememoney\base\values.cc$ins_res.first->second != in_value
API String ID: 3469404174-1771313022
Opcode ID: ade1710f3548e5f057b10c28c461a59f52512c00204f855b8ec26103284eb634
Instruction ID: 42bfdbdc3a95ff7885f2a5cff690a3acfddc5e8d2d2f732bf868bb1e9f9607de
Opcode Fuzzy Hash: ade1710f3548e5f057b10c28c461a59f52512c00204f855b8ec26103284eb634
Instruction Fuzzy Hash: 63519275A00318AFDB16EF64DC86FDAB7B4BF09300F0545ADE409AB292DB70E984CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00313860, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 123COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00313951

Strings

InputBuffer, xrefs: 003138CD
4K9, xrefs: 003138C8
StringStore: missing InputBuffer argument, xrefs: 0031392B

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Exception@8Throw
String ID: 4K9$InputBuffer$StringStore: missing InputBuffer argument
API String ID: 2005118841-374151919
Opcode ID: 638cf6bdebea54bde1cb5bb7fdb07c552322dc67547b1dfabf2e73c88e8dd15d
Instruction ID: e4f421f8f7ca1b608ea516b23e6ca2500179e81fff05ba00417ce6d2ddfb147c
Opcode Fuzzy Hash: 638cf6bdebea54bde1cb5bb7fdb07c552322dc67547b1dfabf2e73c88e8dd15d
Instruction Fuzzy Hash: 6E415075A00608EBCB05DFA4D891BDEBBF5FF49310F14826AE405AB241DB71AA44CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00306CF0, Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 0031C278: mtx_do_lock.LIBCPMT ref: 0031C280

__Cnd_signal.LIBCPMT ref: 00306D46
__Mtx_unlock.LIBCPMT ref: 00306D5E
SystemParametersInfoW.USER32 ref: 00306D7E
__Cnd_do_broadcast_at_thread_exit.LIBCPMT ref: 00306D84

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Cnd_do_broadcast_at_thread_exitCnd_signalInfoMtx_unlockParametersSystemmtx_do_lock
String ID:
API String ID: 1329664465-0
Opcode ID: 52b09fd5068b3f3d4f10687ab3e47f4cbf9e4b56fed92ff3d1154c1e8a5f6e0e
Instruction ID: 3e7857b1006f9c87f82d3912bda872bb0c5820ab0bb3bc9d8cb79dc4b4793a48
Opcode Fuzzy Hash: 52b09fd5068b3f3d4f10687ab3e47f4cbf9e4b56fed92ff3d1154c1e8a5f6e0e
Instruction Fuzzy Hash: 1F110AB2D00604BBDB166F61DC02B86F7A8FF09310F044935F81996761E776E560CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00309880, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 003309D0: CloseHandle.KERNEL32(?,?,?), ref: 00330A62
Part of subcall function 003309D0: RegCloseKey.ADVAPI32(?,?,?), ref: 00330A76
Part of subcall function 003309D0: RegCreateKeyExW.ADVAPI32(CB28B7D0,00020019,00000000,00000000,00000000,00000026,00000000,?,CB28B7D0,?,?), ref: 00330A97

Part of subcall function 00330BE0: RegQueryValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00330C98

PathFileExistsW.SHLWAPI(?,DisplayIcon,?,80000002,003C7DF4,00020119,CB28B7D0,?), ref: 003099AB

Strings

DisplayIcon, xrefs: 0030991C
DisplayVersion, xrefs: 003099D1

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$CreateExistsFileHandlePathQueryValue
String ID: DisplayIcon$DisplayVersion
API String ID: 2291167148-3291662071
Opcode ID: 86758105bd565efe5a770ccbce901b0194b7fcf42327569f9b8e007237e8d7c4
Instruction ID: 1bac4946224920fb5ebb220ade489464d882c2efa03c397fd1e656ce7aeecb97
Opcode Fuzzy Hash: 86758105bd565efe5a770ccbce901b0194b7fcf42327569f9b8e007237e8d7c4
Instruction Fuzzy Hash: 51515C70D11208EEDB15DFA8D955BEEFBB8FF14304F60422EE411A3281EB746A44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00309A70, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 003309D0: CloseHandle.KERNEL32(?,?,?), ref: 00330A62
Part of subcall function 003309D0: RegCloseKey.ADVAPI32(?,?,?), ref: 00330A76
Part of subcall function 003309D0: RegCreateKeyExW.ADVAPI32(CB28B7D0,00020019,00000000,00000000,00000000,00000026,00000000,?,CB28B7D0,?,?), ref: 00330A97

Part of subcall function 00330BE0: RegQueryValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00330C98

PathFileExistsW.SHLWAPI(?,DisplayIcon,?,80000002,003C7E0C,00020019,CB28B7D0,?), ref: 00309B9B

Strings

DisplayIcon, xrefs: 00309B0C
DisplayVersion, xrefs: 00309BC1

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$CreateExistsFileHandlePathQueryValue
String ID: DisplayIcon$DisplayVersion
API String ID: 2291167148-3291662071
Opcode ID: 5c156917a369ab072917af2b8ab094af456182dde8cb46b27cd27de8cccae497
Instruction ID: 0635bc4cbb795a2932952c037e6cfacfe67c2b2bfcc236fc626cf0e9a14e03f7
Opcode Fuzzy Hash: 5c156917a369ab072917af2b8ab094af456182dde8cb46b27cd27de8cccae497
Instruction Fuzzy Hash: 35517D70D11208EFDB15DFA4D855BEEFBB8FF18304F60422AE411A3291EB746A44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 003092B0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 003309D0: CloseHandle.KERNEL32(?,?,?), ref: 00330A62
Part of subcall function 003309D0: RegCloseKey.ADVAPI32(?,?,?), ref: 00330A76
Part of subcall function 003309D0: RegCreateKeyExW.ADVAPI32(CB28B7D0,00020019,00000000,00000000,00000000,00000026,00000000,?,CB28B7D0,?,?), ref: 00330A97

Part of subcall function 00330BE0: RegQueryValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00330C98

PathFileExistsW.SHLWAPI(?,DisplayIcon,?,80000002,003C7DDC,00020019,CB28B7D0,?), ref: 003093DB

Strings

DisplayIcon, xrefs: 0030934C
DisplayVersion, xrefs: 00309401

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$CreateExistsFileHandlePathQueryValue
String ID: DisplayIcon$DisplayVersion
API String ID: 2291167148-3291662071
Opcode ID: 04d3434c556c2b89418cb2a6a129d934214d4d153d27dcab65829225461eeb64
Instruction ID: 42f5b103d0c9d4e82b45ebf294aab2afe98f71d60f2adbcd1f39cdd3dc179eba
Opcode Fuzzy Hash: 04d3434c556c2b89418cb2a6a129d934214d4d153d27dcab65829225461eeb64
Instruction Fuzzy Hash: 85518E70D11208EFDB15DFA4D855BEEFBB9FF14304F50422AE415A3281EB746A44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00309C60, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 003309D0: CloseHandle.KERNEL32(?,?,?), ref: 00330A62
Part of subcall function 003309D0: RegCloseKey.ADVAPI32(?,?,?), ref: 00330A76
Part of subcall function 003309D0: RegCreateKeyExW.ADVAPI32(CB28B7D0,00020019,00000000,00000000,00000000,00000026,00000000,?,CB28B7D0,?,?), ref: 00330A97

Part of subcall function 00330BE0: RegQueryValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00330C98

PathFileExistsW.SHLWAPI(?,DisplayIcon,?,80000002,003C7E0C,00020119,CB28B7D0,?), ref: 00309D8B

Strings

DisplayIcon, xrefs: 00309CFC
DisplayVersion, xrefs: 00309DB1

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$CreateExistsFileHandlePathQueryValue
String ID: DisplayIcon$DisplayVersion
API String ID: 2291167148-3291662071
Opcode ID: f81d4bdfddbb1d1f06c6046630ec5524d6297ccdedbbe96ad10570b28154e5a7
Instruction ID: 659c91d1f5e57629a3251fd7ddf8c9edfc3716800611ca7444256becb55d9dfc
Opcode Fuzzy Hash: f81d4bdfddbb1d1f06c6046630ec5524d6297ccdedbbe96ad10570b28154e5a7
Instruction Fuzzy Hash: 5B518D70D11208EFCB15DFA4D891BEEFBB8FF14304F60422AE411A3291EB746A48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 003094A0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 003309D0: CloseHandle.KERNEL32(?,?,?), ref: 00330A62
Part of subcall function 003309D0: RegCloseKey.ADVAPI32(?,?,?), ref: 00330A76
Part of subcall function 003309D0: RegCreateKeyExW.ADVAPI32(CB28B7D0,00020019,00000000,00000000,00000000,00000026,00000000,?,CB28B7D0,?,?), ref: 00330A97

Part of subcall function 00330BE0: RegQueryValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00330C98

PathFileExistsW.SHLWAPI(?,DisplayIcon,?,80000002,003C7DDC,00020119,CB28B7D0,?), ref: 003095CB

Strings

DisplayIcon, xrefs: 0030953C
DisplayVersion, xrefs: 003095F1

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$CreateExistsFileHandlePathQueryValue
String ID: DisplayIcon$DisplayVersion
API String ID: 2291167148-3291662071
Opcode ID: 7078b580204a5446d64d14c8c0f7600ae0276a721d74b6fb24730ce67eca159f
Instruction ID: ea2b043c3207cc82b503fe9cac0fee4115c3ddebe1a339852762e1e6554d22e9
Opcode Fuzzy Hash: 7078b580204a5446d64d14c8c0f7600ae0276a721d74b6fb24730ce67eca159f
Instruction Fuzzy Hash: 78516D70D11208EFDB15DFA4D955BEEFBB8FF18304F60422AE415A3281EB746A48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0030ADE0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 003309D0: CloseHandle.KERNEL32(?,?,?), ref: 00330A62
Part of subcall function 003309D0: RegCloseKey.ADVAPI32(?,?,?), ref: 00330A76
Part of subcall function 003309D0: RegCreateKeyExW.ADVAPI32(CB28B7D0,00020019,00000000,00000000,00000000,00000026,00000000,?,CB28B7D0,?,?), ref: 00330A97

Part of subcall function 00330BE0: RegQueryValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00330C98

PathFileExistsW.SHLWAPI(?,DisplayIcon,?,80000002,003C7E84,00020019,CB28B7D0,?), ref: 0030AF0B

Strings

DisplayIcon, xrefs: 0030AE7C
DisplayVersion, xrefs: 0030AF31

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$CreateExistsFileHandlePathQueryValue
String ID: DisplayIcon$DisplayVersion
API String ID: 2291167148-3291662071
Opcode ID: 040c6ec42d5292eff5b69736880b73643e6661720ff0e4d7c4799965e1911c1f
Instruction ID: ab9da2f7185753f82aabe3dcd0ba5055b54a01bd7a383ba08b02e92238493e3e
Opcode Fuzzy Hash: 040c6ec42d5292eff5b69736880b73643e6661720ff0e4d7c4799965e1911c1f
Instruction Fuzzy Hash: 09516D71D11208EFDB15DFA4D995BEEFBB8FF14304F60422AE411A3290EB746A48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00309690, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 003309D0: CloseHandle.KERNEL32(?,?,?), ref: 00330A62
Part of subcall function 003309D0: RegCloseKey.ADVAPI32(?,?,?), ref: 00330A76
Part of subcall function 003309D0: RegCreateKeyExW.ADVAPI32(CB28B7D0,00020019,00000000,00000000,00000000,00000026,00000000,?,CB28B7D0,?,?), ref: 00330A97

Part of subcall function 00330BE0: RegQueryValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00330C98

PathFileExistsW.SHLWAPI(?,DisplayIcon,?,80000002,003C7DF4,00020019,CB28B7D0,?), ref: 003097BB

Strings

DisplayIcon, xrefs: 0030972C
DisplayVersion, xrefs: 003097E1

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$CreateExistsFileHandlePathQueryValue
String ID: DisplayIcon$DisplayVersion
API String ID: 2291167148-3291662071
Opcode ID: 166a748ef797f389360180b5de63ad0161effb0ad60fbe5c45b354aa5e51baaf
Instruction ID: c8842428eb43d7bdcd22bdd6817b020a8a4b58695c007c6beaf40b1dc7466698
Opcode Fuzzy Hash: 166a748ef797f389360180b5de63ad0161effb0ad60fbe5c45b354aa5e51baaf
Instruction Fuzzy Hash: 43516C71D11208EFDB15DFA4D995BEEFBB8FF14304F60422AE411A7281EB746A48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0030AFD0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 003309D0: CloseHandle.KERNEL32(?,?,?), ref: 00330A62
Part of subcall function 003309D0: RegCloseKey.ADVAPI32(?,?,?), ref: 00330A76
Part of subcall function 003309D0: RegCreateKeyExW.ADVAPI32(CB28B7D0,00020019,00000000,00000000,00000000,00000026,00000000,?,CB28B7D0,?,?), ref: 00330A97

Part of subcall function 00330BE0: RegQueryValueExW.ADVAPI32(?,?,00000000,00000001,?,?), ref: 00330C98

PathFileExistsW.SHLWAPI(?,DisplayIcon,?,80000002,003C7E84,00020119,CB28B7D0,?), ref: 0030B0FB

Strings

DisplayIcon, xrefs: 0030B06C
DisplayVersion, xrefs: 0030B121

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Close$CreateExistsFileHandlePathQueryValue
String ID: DisplayIcon$DisplayVersion
API String ID: 2291167148-3291662071
Opcode ID: 235b0ab63f0dbb48384613c3ffd2ace88f99a8c7d7dbbf93759475b8e943aaa8
Instruction ID: 9126908dd76cf5e35a0c52d90d10b1faa087fa079abd2bf0ce9623d3d03227a8
Opcode Fuzzy Hash: 235b0ab63f0dbb48384613c3ffd2ace88f99a8c7d7dbbf93759475b8e943aaa8
Instruction Fuzzy Hash: 53518D70D11208EFDB15DFA4D951BEEFBB8FF14304F60422AE421A3290EB746A48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0032C5F0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,?,?,?,?), ref: 0032C61E

Part of subcall function 00335FC0: GetLastError.KERNEL32(00000002,00000001,00000000,ios_base::failbit set,0000FFFD,?,ios_base::failbit set,00000000,8BBC7CCF,0032D179,?,?,?,?,?,0033E9A5), ref: 00335FEB

Part of subcall function 003361B0: OutputDebugStringA.KERNEL32(?,?,?), ref: 0033628D
Part of subcall function 003361B0: WaitForSingleObject.KERNEL32(000000FF,?,?), ref: 003362FE

Strings

Check failed: false. , xrefs: 0032C642
c:\qt\givememoney\base\win\scoped_handle.h, xrefs: 0032C62F

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ChangeCloseDebugErrorFindLastNotificationObjectOutputSingleStringWait
String ID: Check failed: false. $c:\qt\givememoney\base\win\scoped_handle.h
API String ID: 2870833451-3059587803
Opcode ID: 80d6e87bdb9452d939d2edac5b597116cb451a3dad1f1d679b83001c71000d9c
Instruction ID: 64c666f65fa359d9030ff9f3c98356043f624be4d915f00bb5ffda7d09e98186
Opcode Fuzzy Hash: 80d6e87bdb9452d939d2edac5b597116cb451a3dad1f1d679b83001c71000d9c
Instruction Fuzzy Hash: E1F02B7090021067DB32BF28FC43F9A779C9F10715F140A69F848D61D2EF715D6086D1

Uniqueness

Uniqueness Score: -1.00%

Function 001D66C0, Relevance: 4.7, APIs: 3, Instructions: 163registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,?,00000000,00020019,00000000), ref: 001D6736
RegQueryValueExW.ADVAPI32(00000000,?,00000000,00000000,?,?), ref: 001D676F
PathFileExistsW.SHLWAPI(?,00000000,00000000,-00000002), ref: 001D68E4

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ExistsFileOpenPathQueryValue
String ID:
API String ID: 1170695514-0
Opcode ID: 24f56614ed29b4981b59d57abe033d9c36d910e8e8c9aa089fba93e762f3119f
Instruction ID: 778dc51cf2247fd5acdf0ed92a0590bf222c9e854b5b804ff3a882eb6a53de29
Opcode Fuzzy Hash: 24f56614ed29b4981b59d57abe033d9c36d910e8e8c9aa089fba93e762f3119f
Instruction Fuzzy Hash: 1E711771900258EADF24DF54CC99BEAB7B8EF18304F5002DAE409A6291DB74AA89CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003669FA, Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(00000000,?,00000000,?,003725F7,0032CC93), ref: 00366A50
GetLastError.KERNEL32(?,00000000,?,003725F7,0032CC93), ref: 00366A5A
__dosmaperr.LIBCMT ref: 00366A85

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: dbeaa8c373515f61f3545449c60ad72a8554e29b2d8264f97ea6c1aa444794fc
Instruction ID: 4552967ed86be379b99d1ea7514c8562acddd02e5fae161ed064fa623f66bb5d
Opcode Fuzzy Hash: dbeaa8c373515f61f3545449c60ad72a8554e29b2d8264f97ea6c1aa444794fc
Instruction Fuzzy Hash: A6016B72A1811016C22353B4EC47F7DAB6E8B917B4F2AC259FC16EF1C5DE31DC814290

Uniqueness

Uniqueness Score: -1.00%

Function 0035DD87, Relevance: 4.6, APIs: 3, Instructions: 54threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateThread.KERNEL32(00306BCC,?,Function_0019DC33,00000000,001F0240,00306BCC), ref: 0035DDD0
GetLastError.KERNEL32(?,0031DC52,00000000,00000000,?,00000000,00000000,00306BD0,003AC8CC,?,001F01F4,00306BCC,001F0240,003AC8CC), ref: 0035DDDC
__dosmaperr.LIBCMT ref: 0035DDE3

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: 5ce0d99be3f9ceb40026412411c633082eac6d7c9cb9fda3d7485628b2142f29
Instruction ID: e4549e744547d2254d6bbe56b760c7362ec508a2e331a6698e7e185350d48f24
Opcode Fuzzy Hash: 5ce0d99be3f9ceb40026412411c633082eac6d7c9cb9fda3d7485628b2142f29
Instruction Fuzzy Hash: 87019E36504209ABCB27AFA5DC05DDF7BB9EF85322F010024FC048A260DA328959DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0035DCE7, Relevance: 4.5, APIs: 3, Instructions: 31threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00364C3B: GetLastError.KERNEL32(?,?,?,0035CB89,003680A9,?,00364BE5,00000001,00000364,?,003548F1,?,?,00000000,00000000), ref: 00364C40
Part of subcall function 00364C3B: _free.LIBCMT ref: 00364C75
Part of subcall function 00364C3B: SetLastError.KERNEL32(00000000,?,00000000,00000000), ref: 00364CA9

ExitThread.KERNEL32 ref: 0035DCF9
CloseHandle.KERNEL32(?,?,?,0035DE19,?,?,0035DC90,00000000), ref: 0035DD21
FreeLibraryAndExitThread.KERNEL32(?,?,?,?,0035DE19,?,?,0035DC90,00000000), ref: 0035DD37

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary_free
String ID:
API String ID: 1198197534-0
Opcode ID: b4d476af63e599c2fdfec71d25beaf4a56643207ab6be3a0c88f8aa06ba5c976
Instruction ID: 0799d10c3455b125fe8cebd3efab60c5032942d4925bac6b39579a0fe83e0a5c
Opcode Fuzzy Hash: b4d476af63e599c2fdfec71d25beaf4a56643207ab6be3a0c88f8aa06ba5c976
Instruction Fuzzy Hash: 7EF05E704006067BDB335B75C848E5A3AACAF00362F1A8615FC64CB1B4EB61EC8AC650

Uniqueness

Uniqueness Score: -1.00%

Function 00328CC0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,1.0.0.0,00000007,?), ref: 00328D2A

Strings

1.0.0.0, xrefs: 00328CEB

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: FileModuleName
String ID: 1.0.0.0
API String ID: 514040917-1185392965
Opcode ID: 9aa0cd8bf1ce429f0ccfda33e0f6dbcbf19b5577a415bad38ba9fcf93aba29f0
Instruction ID: 2a052bfe97f1c6fe190d4d0206dd0af5281d4097b5d6828be1cf96548051c790
Opcode Fuzzy Hash: 9aa0cd8bf1ce429f0ccfda33e0f6dbcbf19b5577a415bad38ba9fcf93aba29f0
Instruction Fuzzy Hash: 55515E70D0122D9ACB21EF64DD497E9B3B4AF68304F1042DAD40DA6281EB746BC4CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0032F750, Relevance: 3.2, APIs: 2, Instructions: 176COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0032F7AA
__fread_nolock.LIBCMT ref: 0032F940

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: e926ec8fb7fcdf9098c4d3f605acf815c3416cda92894003d9e4b0d596bf945c
Instruction ID: f840772eb357f7cc91c01849dfc68b7921b3adc786a0d359514b1fae37f457d0
Opcode Fuzzy Hash: e926ec8fb7fcdf9098c4d3f605acf815c3416cda92894003d9e4b0d596bf945c
Instruction Fuzzy Hash: F251B671A002189FCB279F28DC81FEDB3B9AF49340F1001B9F4999B251DBB09AC59F91

Uniqueness

Uniqueness Score: -1.00%

Function 001EE3F0, Relevance: 3.1, APIs: 2, Instructions: 136COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000004), ref: 001EE45A
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 001EE4CC

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: CriticalFileInitializeModuleNameSection
String ID:
API String ID: 867279363-0
Opcode ID: 6181fcf023444593086d347d1686db1e851d8a913b00b78a9a4479372b165e27
Instruction ID: 31a2169d7945c561d2fbf9b2665288709c787fae95c058de7e0d26bd483adcee
Opcode Fuzzy Hash: 6181fcf023444593086d347d1686db1e851d8a913b00b78a9a4479372b165e27
Instruction Fuzzy Hash: 3E518074800659EADB11DF64CC49BDEFBF8EF14304F00469AE449A7291EB746B88CF51

Uniqueness

Uniqueness Score: -1.00%

Function 001EA570, Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 001EA681

Part of subcall function 0031C278: mtx_do_lock.LIBCPMT ref: 0031C280

__Mtx_unlock.LIBCPMT ref: 001EA616

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Concurrency::cancel_current_taskMtx_unlockmtx_do_lock
String ID:
API String ID: 3762464901-0
Opcode ID: ce8f8e9a7296bbe73573814f8b1547283892d1f842033324a9a7d56c364b91cf
Instruction ID: ea4aa6c2eb94cceb07bdf304bbff8f1f39f7d8a4428214760609ff60acd4d26c
Opcode Fuzzy Hash: ce8f8e9a7296bbe73573814f8b1547283892d1f842033324a9a7d56c364b91cf
Instruction Fuzzy Hash: D43135B0D00289AFDF15DB64D805BAFFBF4EF09300F14416DE416A7281DB74AA44CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0032CD10, Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,001DD51A,00000000,00000000,00000000,?,003A8F14), ref: 0032CD30
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,001DD51A,00000000,00000000), ref: 0032CD7E

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: File$CreateWrite
String ID:
API String ID: 2263783195-0
Opcode ID: c9e7697566988ae17c86d566826378a3f9c080f0f36ba0d9eaacfb8214f22177
Instruction ID: a83fedeba6bab53b9027fdd2871e491aca65091c537f6c39a8eb99a9f6c780a8
Opcode Fuzzy Hash: c9e7697566988ae17c86d566826378a3f9c080f0f36ba0d9eaacfb8214f22177
Instruction Fuzzy Hash: 5B115A71610228BBDB22DF58EC85F9E7B68AB05750F154224FD18AB1D0D770EE5087D4

Uniqueness

Uniqueness Score: -1.00%

Function 0035DC33, Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(003B7E48,00000010), ref: 0035DC46
ExitThread.KERNEL32 ref: 0035DC4D

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 784589c172154b60d4929fecef5ed04e90a0e3120fce209b4c4dfb6e2f21f02c
Instruction ID: 27de7320355a0193c3498e6fe3243efe3ed11637eb354910703957dde870d173
Opcode Fuzzy Hash: 784589c172154b60d4929fecef5ed04e90a0e3120fce209b4c4dfb6e2f21f02c
Instruction Fuzzy Hash: 7CF0C271900204AFDB17AFB0D80AFAD3B74FF84705F114189F801AF2A2CB75A905DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 001EC500, Relevance: 1.7, APIs: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 001DC860: std::locale::_Init.LIBCPMT ref: 001DC971

std::locale::_Init.LIBCPMT ref: 001EC603

Part of subcall function 001DC860: __CxxThrowException@8.LIBVCRUNTIME ref: 001DC88D
Part of subcall function 001DC860: __CxxThrowException@8.LIBVCRUNTIME ref: 001DC8D2

Part of subcall function 001ED9A0: std::_Lockit::_Lockit.LIBCPMT ref: 001ED9D5
Part of subcall function 001ED9A0: std::_Lockit::_Lockit.LIBCPMT ref: 001ED9F7
Part of subcall function 001ED9A0: std::_Lockit::~_Lockit.LIBCPMT ref: 001EDA17
Part of subcall function 001ED9A0: std::_Lockit::~_Lockit.LIBCPMT ref: 001EDAFF

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Lockitstd::_$Exception@8InitLockit::_Lockit::~_Throwstd::locale::_
String ID:
API String ID: 3818760586-0
Opcode ID: afe4b19c67cc568727f7fe38e6b9989320fafc58612c7b8b19e5c18947ba0c13
Instruction ID: 2e5f3f0fa09e0e8052e8b3f109daf4a9b32f07938e1764e5a0af9e08aecb16d6
Opcode Fuzzy Hash: afe4b19c67cc568727f7fe38e6b9989320fafc58612c7b8b19e5c18947ba0c13
Instruction Fuzzy Hash: E7A1E2B4A00244CFDB05CF59C894B9ABBE4FF09314F1581AAE9099F392D776E945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 001E1280, Relevance: 1.7, APIs: 1, Instructions: 160COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 001E13FE

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 2b14b271d89e891cb470059760887a25a40abfa2ceed17b9dae969d8e27fbe43
Instruction ID: 9bafa6f5bcd793de9ff7465866a7f3a017220d5fb294d77595d9c6aac09c5dbf
Opcode Fuzzy Hash: 2b14b271d89e891cb470059760887a25a40abfa2ceed17b9dae969d8e27fbe43
Instruction Fuzzy Hash: E4411472A00559AFCB15DFADDC806AEB7E9FF44360F140269E815EB341E770ED508B91

Uniqueness

Uniqueness Score: -1.00%

Function 0035EC35, Relevance: 1.6, APIs: 1, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0035ED0B

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 113a54f6a9eda870a95d62c258958f172d03b6211dc4b6cc582c5ffae7200faa
Instruction ID: 643adc84470c6ad73a94293ff852c0a3d91fed2503110f93d365a14af61b8aaf
Opcode Fuzzy Hash: 113a54f6a9eda870a95d62c258958f172d03b6211dc4b6cc582c5ffae7200faa
Instruction Fuzzy Hash: A5419136A10614CFCB29CF69D88096DBBF5EF8D310B1682AAE915DB3B0D730AD44CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00306B20, Relevance: 1.6, APIs: 1, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 001F0110: __Cnd_init.LIBCPMT ref: 001F0140
Part of subcall function 001F0110: __Mtx_init.LIBCPMT ref: 001F0173

Part of subcall function 001F01E0: __Thrd_start.LIBCPMT ref: 001F01EF

__Mtx_unlock.LIBCPMT ref: 00306BE9

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Cnd_initMtx_initMtx_unlockThrd_start
String ID:
API String ID: 2901745279-0
Opcode ID: 5dbcbfcc4cdb353644dfeb4388792a6793f2bf9e30648b28bc5958aa8c9d8eb2
Instruction ID: e97400adb947300a49f2530d7fa4a78087c17d26f5cb2b830e1a588bbd1a7a56
Opcode Fuzzy Hash: 5dbcbfcc4cdb353644dfeb4388792a6793f2bf9e30648b28bc5958aa8c9d8eb2
Instruction Fuzzy Hash: 4F3199B1D0120CABDF01DFA4DD467DEB7B8EF18310F144129E845BB281E775AA54CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00310810, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00310881

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: c509f8493b547c1b5f7ba4448122242ec91fe584adf58bf440ba6e23446788b1
Instruction ID: 1a6c2594229945533f2b201fc9bde8cdda6836aaf3fe9aeddca2e77d1346df61
Opcode Fuzzy Hash: c509f8493b547c1b5f7ba4448122242ec91fe584adf58bf440ba6e23446788b1
Instruction Fuzzy Hash: C0113432504208EFCB06DF90D844FDABBB9FB08710F108669FA159B661C775E960DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0036D669, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0036D622

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: b2ed81b5f0c7bea08eac976a63ec47ee20640bb953c828c4f16f98ae0b4ed3cd
Instruction ID: ea8e886a06d2168cde98f26123c328751f7b6d14d5222b06fff63684e52fb0dc
Opcode Fuzzy Hash: b2ed81b5f0c7bea08eac976a63ec47ee20640bb953c828c4f16f98ae0b4ed3cd
Instruction Fuzzy Hash: 04118C71A04209AFCF06DF98E941DAB7BF8EF48310F118059F809AB301D671ED21CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0035A4DC, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47d8fcbfbfc79f68c000c94ae1462f508f5b61fb2fbeafa1462d6cec1990a93e
Instruction ID: dc02c89344efd6223c96cdc38f51ed126fc9bd918aae1b678b730be02419f744
Opcode Fuzzy Hash: 47d8fcbfbfc79f68c000c94ae1462f508f5b61fb2fbeafa1462d6cec1990a93e
Instruction Fuzzy Hash: 0CF0F932501E105AC6233A6ADC06F6A32A89F43376F114715FC609B1E1EBB0DD099593

Uniqueness

Uniqueness Score: -1.00%

Function 00311FF0, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00389769: std::_Lockit::_Lockit.LIBCPMT ref: 00389792
Part of subcall function 00389769: std::_Lockit::~_Lockit.LIBCPMT ref: 003897BA

__CxxThrowException@8.LIBVCRUNTIME ref: 00312044

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Lockitstd::_$Exception@8Lockit::_Lockit::~_Throw
String ID:
API String ID: 2653793986-0
Opcode ID: 27d1987c1e73653aff1062b257b035fa82163a1846aa4b8482528d68c5754421
Instruction ID: 161ebea551624f8f6e4c6b96c1e6191fa4725423e8844f46cb3cb7a20d995580
Opcode Fuzzy Hash: 27d1987c1e73653aff1062b257b035fa82163a1846aa4b8482528d68c5754421
Instruction Fuzzy Hash: 95F0EC22D4121822DA2777B5AD03FEF775C4E59791F080176FD089E152FA50BA59C1E3

Uniqueness

Uniqueness Score: -1.00%

Function 001E2240, Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Concurrency::details::_Release_chore.LIBCPMT ref: 001E2286

Part of subcall function 0031D539: ___crtAcquireSRWLockExclusive.LIBCPMT ref: 0031D554

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: AcquireConcurrency::details::_ExclusiveLockRelease_chore___crt
String ID:
API String ID: 4271677666-0
Opcode ID: ae7548d9a1cb17d88d60a8a572e2ce3a08be91655a9c9d993eaac99d0163e286
Instruction ID: e793ae34280248904ce15d077432110d7b8fed6fdea7c77348e5393644bda01a
Opcode Fuzzy Hash: ae7548d9a1cb17d88d60a8a572e2ce3a08be91655a9c9d993eaac99d0163e286
Instruction Fuzzy Hash: 04F08171901618EFCB11EF54DC01BEEBBB8EF09710F10466AE815AB781D7746A008B91

Uniqueness

Uniqueness Score: -1.00%

Function 001DDCD0, Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 0031C278: mtx_do_lock.LIBCPMT ref: 0031C280

__Mtx_unlock.LIBCPMT ref: 001DDD06

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Mtx_unlockmtx_do_lock
String ID:
API String ID: 147572093-0
Opcode ID: 472d1bcc87c64ebe71dd7b8c42baf5fbe08ebbda7317c2ef368ad655b54160af
Instruction ID: 206f85805defd8ec6325e685932c6a4409490fee5cad06b0bc90815d8136bfd7
Opcode Fuzzy Hash: 472d1bcc87c64ebe71dd7b8c42baf5fbe08ebbda7317c2ef368ad655b54160af
Instruction Fuzzy Hash: B3E0E5F390020037ED1536A0BC03AEB726C8A65310F04053AFD029A252FFA1F95691F3

Uniqueness

Uniqueness Score: -1.00%

Function 001DDD30, Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 0031C278: mtx_do_lock.LIBCPMT ref: 0031C280

__Mtx_unlock.LIBCPMT ref: 001DDD67

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Mtx_unlockmtx_do_lock
String ID:
API String ID: 147572093-0
Opcode ID: 8bdb4449e8ef7b24ef28e2961593cf71b2a654f3b4d58c046deba551e9f77f98
Instruction ID: ac1624db9a3609afd56d7ed27ac23d9be74214700554c036f1455c71eacc8624
Opcode Fuzzy Hash: 8bdb4449e8ef7b24ef28e2961593cf71b2a654f3b4d58c046deba551e9f77f98
Instruction Fuzzy Hash: 48E0A0F290021037DE1A3AA0BC038AF736D8965320B04053AFD069A262FB61F95681B2

Uniqueness

Uniqueness Score: -1.00%

Function 001F01E0, Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

__Thrd_start.LIBCPMT ref: 001F01EF

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Thrd_start
String ID:
API String ID: 2176944979-0
Opcode ID: 57c93b4e31c2a1a8c3336ab4267fc22d46700b5df6d1800701c542a72f667914
Instruction ID: d2a5d9feac45e9c137b51cd9058bbbc8676be087bf928b4ff7f179f6450aebac
Opcode Fuzzy Hash: 57c93b4e31c2a1a8c3336ab4267fc22d46700b5df6d1800701c542a72f667914
Instruction Fuzzy Hash: 76F0A7B190020836EF3B16159C0ABB77A884F19350F048439EA0B54552E7A6EC908AB1

Uniqueness

Uniqueness Score: -1.00%

Function 00364D40, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0036D689,?,00000000,?,00000003,00364C3A), ref: 00364D72

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 707277bb576dc6fb65b46c7585613a7d21b11ba806505062eea20d2885f31c03
Instruction ID: e1b86e44e4617f77583c125fde83d7010e563e6d793c33c170c567de1dc4fd4f
Opcode Fuzzy Hash: 707277bb576dc6fb65b46c7585613a7d21b11ba806505062eea20d2885f31c03
Instruction Fuzzy Hash: 32E06D35E006259AEB3327B69D09F9B3A5D9B417A1F168121EC159A1AADB20DC0086E1

Uniqueness

Uniqueness Score: -1.00%

Function 001F0260, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 001F0272

Part of subcall function 0031BE66: std::system_error::system_error.LIBCPMT ref: 0031BE87
Part of subcall function 0031BE66: __CxxThrowException@8.LIBVCRUNTIME ref: 0031BE95
Part of subcall function 0031BE66: ___crtInitializeCriticalSectionEx.LIBCPMT ref: 0031BEAF

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Cpp_errorCriticalException@8InitializeSectionThrowThrow____crtstd::_std::system_error::system_error
String ID:
API String ID: 25672295-0
Opcode ID: c3e3068a391bbf9d0a76813924d160b6e70678e035ee53e318a0987d3d9ce2f6
Instruction ID: e327f1a0cd1e1c3bdaa346d4006b3ba056115ae44f51c934765ad470fe13d065
Opcode Fuzzy Hash: c3e3068a391bbf9d0a76813924d160b6e70678e035ee53e318a0987d3d9ce2f6
Instruction Fuzzy Hash: CAE0D8F28113049AEF351B109C06792B2C89B18721F04452CE99A46291FBB2E55086F2

Uniqueness

Uniqueness Score: -1.00%

Function 0037211B, Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00372485,?,?,00000000,?,00372485,00000000,0000000C), ref: 00372138

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 091dbfe637eb903029eccf4657fc63c4efe30c60c59593ee2ef8500b69a90308
Instruction ID: cc68679eff82a61e280d3dbefd198cc86954478d8747049d623d1270389eb667
Opcode Fuzzy Hash: 091dbfe637eb903029eccf4657fc63c4efe30c60c59593ee2ef8500b69a90308
Instruction Fuzzy Hash: 24D06C3200010DBBDF028F84DD06EDA3BAAFB48714F014100BA5856020C732E862AB90

Uniqueness

Uniqueness Score: -1.00%

Function 0032DDD0, Relevance: 1.5, APIs: 1, Instructions: 14threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0016E280,00000000,00000000,00000000), ref: 0032DDE1

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: b44fd4b3f84e1a25dedd2b9ead14b457e735235f835affdb099a779e88eb0722
Instruction ID: f913050a4046b1a81b86b6795198bf2dc8d0ae0106d5327952df1dc4fc10a733
Opcode Fuzzy Hash: b44fd4b3f84e1a25dedd2b9ead14b457e735235f835affdb099a779e88eb0722
Instruction Fuzzy Hash: 67C08C30381320BAF3B09B116D0BF872E88EF02FA0F01891AF289AE0C0D1D0680082A4

Uniqueness

Uniqueness Score: -1.00%

Function 0032CCF0, Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,?,?,76564830,00000000,?,?,?,0032F789,76564830,00395868,003A8ED4), ref: 0032CCFF

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9f866e9cb23ca7d7d3e53b2caaa9ba6a265f2015c6ae13bc70a56d6bb170bae3
Instruction ID: fdc3eb6e4cf657743cd6d23db082f2ce6de489d14b2f2ebb9f6919a71e246cd1
Opcode Fuzzy Hash: 9f866e9cb23ca7d7d3e53b2caaa9ba6a265f2015c6ae13bc70a56d6bb170bae3
Instruction Fuzzy Hash: D2C012340202288B8A008BACE88D84A37AEAA013257404255F429CB2A0C330EAA18AA0

Uniqueness

Uniqueness Score: -1.00%

Function 0031DB9E, Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,?,001F0284,?,?,?,?,?,00306C1F,?,?,?), ref: 0031DBA4

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 170d07973c60e34b68aaeace916801c46ab990c3564ddbd0578fa72f745f2e15
Instruction ID: 80ff32eaa372904951f4445dfd83f1693b519af269a2074bc5f5a4acfb378649
Opcode Fuzzy Hash: 170d07973c60e34b68aaeace916801c46ab990c3564ddbd0578fa72f745f2e15
Instruction Fuzzy Hash: 45C092335E451D67DB011AB9EC07E543B9C9B2267AB188322F42AC51E0E72BE5D58580

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 002BF5E0, Relevance: 291.0, APIs: 150, Strings: 15, Instructions: 2230keyboardclipboardwindowCOMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(?,CB28B7D0), ref: 002BF619
OpenClipboard.USER32(00000000), ref: 002BF8E9
EmptyClipboard.USER32 ref: 002BF8F3
CloseClipboard.USER32 ref: 002BF8F9
MapVirtualKeyW.USER32(0000004C,00000000), ref: 002BF92E
SendInput.USER32(00000001,00000001,0000001C), ref: 002BF949
MapVirtualKeyW.USER32(00000041,00000000), ref: 002BF95E
SendInput.USER32(00000001,00000001,0000001C), ref: 002BF973
MapVirtualKeyW.USER32(00000056,00000000), ref: 002BF988
SendInput.USER32(00000001,00000001,0000001C), ref: 002BF99D
MapVirtualKeyW.USER32(00000043,00000000), ref: 002BF9B2
SendInput.USER32(00000001,00000001,0000001C), ref: 002BF9C7
MapVirtualKeyW.USER32(00000011,00000000), ref: 002BF9DC
SendInput.USER32(00000001,00000001,0000001C), ref: 002BF9F1
MapVirtualKeyW.USER32(00000010,00000000), ref: 002BFA06
SendInput.USER32(00000001,00000001,0000001C), ref: 002BFA1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 002BFA30
SendInput.USER32(00000001,00000001,0000001C), ref: 002BFA45
MapVirtualKeyW.USER32(00000009,00000000), ref: 002BFA5A
SendInput.USER32(00000001,00000001,0000001C), ref: 002BFA6F
MapVirtualKeyW.USER32(00000020,00000000), ref: 002BFA84
SendInput.USER32(00000001,00000001,0000001C), ref: 002BFA99
MapVirtualKeyW.USER32(0000000D,00000000), ref: 002BFAAE
SendInput.USER32(00000001,00000001,0000001C), ref: 002BFAC3
PostMessageW.USER32(003C7ADC,00000403,00000000,00000000), ref: 002BFAE1
OpenClipboard.USER32(00000000), ref: 002BFB18
EmptyClipboard.USER32 ref: 002BFB22
CloseClipboard.USER32 ref: 002BFB28
MapVirtualKeyW.USER32(0000004C,00000000), ref: 002BFB5D
SendInput.USER32(00000001,00000001,0000001C), ref: 002BFB78
MapVirtualKeyW.USER32(00000041,00000000), ref: 002BFB8D
SendInput.USER32(00000001,00000001,0000001C), ref: 002BFBA2
MapVirtualKeyW.USER32(00000056,00000000), ref: 002BFBB7
SendInput.USER32(00000001,00000001,0000001C), ref: 002BFBCC
MapVirtualKeyW.USER32(00000043,00000000), ref: 002BFBE1
SendInput.USER32(00000001,00000001,0000001C), ref: 002BFBF6
MapVirtualKeyW.USER32(00000011,00000000), ref: 002BFC0B
SendInput.USER32(00000001,00000001,0000001C), ref: 002BFC20
MapVirtualKeyW.USER32(00000010,00000000), ref: 002BFC35
SendInput.USER32(00000001,00000001,0000001C), ref: 002BFC4A
MapVirtualKeyW.USER32(00000012,00000000), ref: 002BFC5F
SendInput.USER32(00000001,00000001,0000001C), ref: 002BFC74
MapVirtualKeyW.USER32(00000009,00000000), ref: 002BFC89
SendInput.USER32(00000001,00000001,0000001C), ref: 002BFC9E
MapVirtualKeyW.USER32(00000020,00000000), ref: 002BFCB3
SendInput.USER32(00000001,00000001,0000001C), ref: 002BFCC8
MapVirtualKeyW.USER32(0000000D,00000000), ref: 002BFCDD
SendInput.USER32(00000001,00000001,0000001C), ref: 002BFCF2
PostMessageW.USER32(?,00000403,00000000,00000000), ref: 002BFD10
OpenClipboard.USER32(00000000), ref: 002C0099
EmptyClipboard.USER32 ref: 002C00A3
CloseClipboard.USER32 ref: 002C00A9
PostMessageW.USER32(00000006,00000403,00000000,00000000), ref: 002C0158
OpenClipboard.USER32(00000000), ref: 002C01FF
EmptyClipboard.USER32 ref: 002C0209
CloseClipboard.USER32 ref: 002C020F
MapVirtualKeyW.USER32(0000004C,00000000), ref: 002C024D
SendInput.USER32(00000001,00000001,0000001C), ref: 002C0268
MapVirtualKeyW.USER32(00000041,00000000), ref: 002C027D
SendInput.USER32(00000001,00000001,0000001C), ref: 002C0292
MapVirtualKeyW.USER32(00000056,00000000), ref: 002C02A7
SendInput.USER32(00000001,00000001,0000001C), ref: 002C02BC
MapVirtualKeyW.USER32(00000043,00000000), ref: 002C02D1
SendInput.USER32(00000001,00000001,0000001C), ref: 002C02E6
MapVirtualKeyW.USER32(00000011,00000000), ref: 002C02FB
SendInput.USER32(00000001,00000001,0000001C), ref: 002C0310
MapVirtualKeyW.USER32(00000010,00000000), ref: 002C0325
SendInput.USER32(00000001,00000001,0000001C), ref: 002C033A
MapVirtualKeyW.USER32(00000012,00000000), ref: 002C034F
SendInput.USER32(00000001,00000001,0000001C), ref: 002C0364
MapVirtualKeyW.USER32(00000009,00000000), ref: 002C0379
SendInput.USER32(00000001,00000001,0000001C), ref: 002C038E
MapVirtualKeyW.USER32(00000020,00000000), ref: 002C03A3
SendInput.USER32(00000001,00000001,0000001C), ref: 002C03B8
MapVirtualKeyW.USER32(0000000D,00000000), ref: 002C03CD
SendInput.USER32(00000001,00000001,0000001C), ref: 002C03E2
PostMessageW.USER32(00000000,00000403,00000000,00000000), ref: 002C0400
GetTempPathW.KERNEL32(00000104,?), ref: 002C0501
PathAppendW.SHLWAPI(?,003C7AC4), ref: 002C0522
DeleteFileW.KERNEL32(?), ref: 002C0535
PathFileExistsW.SHLWAPI(?), ref: 002C0644
DeleteFileW.KERNEL32(?), ref: 002C0660
MoveFileW.KERNEL32(?,?), ref: 002C0672
SHSetValueW.SHLWAPI(80000001,003C7ADC,003C7AF4,00000001,?,?), ref: 002C095C
SHSetValueW.SHLWAPI(80000001,003C7ADC,003C7B0C,00000001,?,?), ref: 002C09AD
SHSetValueW.SHLWAPI(80000001,003C7ADC,003C7B24,00000004,?,00000004), ref: 002C09ED
SHSetValueW.SHLWAPI(80000001,003C7ADC,003C7B3C,00000004,?,00000004), ref: 002C0A29
OpenClipboard.USER32(00000000), ref: 002C0A78
EmptyClipboard.USER32 ref: 002C0A82
CloseClipboard.USER32 ref: 002C0A88
PostMessageW.USER32(00000006,00000403,00000000,00000000), ref: 002C0B37
OpenClipboard.USER32(00000000), ref: 002C0B92
EmptyClipboard.USER32 ref: 002C0B9C
CloseClipboard.USER32 ref: 002C0BA2
PostMessageW.USER32(00000006,00000403,00000000,00000000), ref: 002C0C51
OpenClipboard.USER32(00000000), ref: 002C0D63
EmptyClipboard.USER32 ref: 002C0D6D
CloseClipboard.USER32 ref: 002C0D73
PostMessageW.USER32(00000006,00000403,00000000,00000000), ref: 002C0E22
OpenClipboard.USER32(00000000), ref: 002C0E67
EmptyClipboard.USER32 ref: 002C0E71
CloseClipboard.USER32 ref: 002C0E77
OpenClipboard.USER32(00000000), ref: 002C0F2C
EmptyClipboard.USER32 ref: 002C0F36
CloseClipboard.USER32 ref: 002C0F3C
MapVirtualKeyW.USER32 ref: 002C0F80
SendInput.USER32(00000001,00000001,0000001C), ref: 002C0FA4
MapVirtualKeyW.USER32(00000041,00000000), ref: 002C0FBF
SendInput.USER32(00000001,00000001,0000001C), ref: 002C0FDD
MapVirtualKeyW.USER32(00000056,00000000), ref: 002C0FF8
SendInput.USER32(00000001,00000001,0000001C), ref: 002C1016
MapVirtualKeyW.USER32(00000043,00000000), ref: 002C1031
SendInput.USER32(00000001,00000001,0000001C), ref: 002C104F
MapVirtualKeyW.USER32(00000011,00000000), ref: 002C106A
SendInput.USER32(00000001,00000001,0000001C), ref: 002C1088
MapVirtualKeyW.USER32(00000010,00000000), ref: 002C10A3
SendInput.USER32(00000001,00000001,0000001C), ref: 002C10C1
MapVirtualKeyW.USER32(00000012,00000000), ref: 002C10DC
SendInput.USER32(00000001,00000001,0000001C), ref: 002C10FA
MapVirtualKeyW.USER32(00000009,00000000), ref: 002C1115
SendInput.USER32(00000001,00000001,0000001C), ref: 002C1133
MapVirtualKeyW.USER32(00000020,00000000), ref: 002C114E
SendInput.USER32(00000001,00000001,0000001C), ref: 002C116C
MapVirtualKeyW.USER32(0000000D,00000000), ref: 002C1187
SendInput.USER32(00000001,00000001,0000001C), ref: 002C11A5
PostMessageW.USER32(00000006,00000403,00000000,00000000), ref: 002C11C3
OpenClipboard.USER32(00000000), ref: 002C11FD
EmptyClipboard.USER32 ref: 002C1207
CloseClipboard.USER32 ref: 002C120D
MapVirtualKeyW.USER32 ref: 002C1251
SendInput.USER32(00000001,00000001,0000001C), ref: 002C1275
MapVirtualKeyW.USER32(00000041,00000000), ref: 002C1290
SendInput.USER32(00000001,00000001,0000001C), ref: 002C12AE
MapVirtualKeyW.USER32(00000056,00000000), ref: 002C12C9
SendInput.USER32(00000001,00000001,0000001C), ref: 002C12E7
MapVirtualKeyW.USER32(00000043,00000000), ref: 002C1302
SendInput.USER32(00000001,00000001,0000001C), ref: 002C1320
MapVirtualKeyW.USER32(00000011,00000000), ref: 002C133B
SendInput.USER32(00000001,00000001,0000001C), ref: 002C1359
MapVirtualKeyW.USER32(00000010,00000000), ref: 002C1374
SendInput.USER32(00000001,00000001,0000001C), ref: 002C1392
MapVirtualKeyW.USER32(00000012,00000000), ref: 002C13AD
SendInput.USER32(00000001,00000001,0000001C), ref: 002C13CB
MapVirtualKeyW.USER32(00000009,00000000), ref: 002C13E6
SendInput.USER32(00000001,00000001,0000001C), ref: 002C1404
MapVirtualKeyW.USER32(00000020,00000000), ref: 002C141F
SendInput.USER32(00000001,00000001,0000001C), ref: 002C143D
MapVirtualKeyW.USER32(0000000D,00000000), ref: 002C1458
SendInput.USER32(00000001,00000001,0000001C), ref: 002C1476
PostMessageW.USER32(00000006,00000403,00000000,00000000), ref: 002C1494

Strings

0u, xrefs: 002C05F5
<{<, xrefs: 002BF6DC
${<, xrefs: 002C082A
${<, xrefs: 002BFE78
d, xrefs: 002C021B
|, xrefs: 002C073B
d, xrefs: 002C1219
<{<, xrefs: 002C09FF
d, xrefs: 002BFB31
${<, xrefs: 002BF6B9
<{<, xrefs: 002BFE9B
d, xrefs: 002C0A94
${<, xrefs: 002C09BF
<{<, xrefs: 002C0850
$, xrefs: 002C11EF

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: InputSendVirtual$Clipboard$CloseEmptyOpen$MessagePost$File$PathValue$DeleteExists$AppendMoveTemp
String ID: $$${<$${<$${<$${<$0u$<{<$<{<$<{<$<{<$d$d$d$d$|
API String ID: 3902815121-3627863322
Opcode ID: 26cc3a879e4da3cc2e436c5f1dbb40eb5b1a263109d8553ec5f74219941dc2d4
Instruction ID: 71ecca1522cd7d87194166b9c15127be736dd9722f525b96f58ea6542d307881
Opcode Fuzzy Hash: 26cc3a879e4da3cc2e436c5f1dbb40eb5b1a263109d8553ec5f74219941dc2d4
Instruction Fuzzy Hash: 2B139270A50318AEEB15DFA4CC8AFDDB7B8AF14704F004199F504AB2D2DBB56A84CF65

Uniqueness

Uniqueness Score: -1.00%

Function 001FC4C0, Relevance: 49.2, APIs: 27, Strings: 1, Instructions: 245keyboardclipboardtimeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,00000006,CB28B7D0), ref: 001FC500
mouse_event.USER32 ref: 001FC536
GetTickCount.KERNEL32 ref: 001FC53C
OpenClipboard.USER32(00000000), ref: 001FC5EE
EmptyClipboard.USER32 ref: 001FC5F8
CloseClipboard.USER32 ref: 001FC5FE
MapVirtualKeyW.USER32(0000004C,00000000), ref: 001FC633
SendInput.USER32(00000001,00000001,0000001C), ref: 001FC64E
MapVirtualKeyW.USER32(00000041,00000000), ref: 001FC663
SendInput.USER32(00000001,00000001,0000001C), ref: 001FC678
MapVirtualKeyW.USER32(00000056,00000000), ref: 001FC68D
SendInput.USER32(00000001,00000001,0000001C), ref: 001FC6A2
MapVirtualKeyW.USER32(00000043,00000000), ref: 001FC6B7
SendInput.USER32(00000001,00000001,0000001C), ref: 001FC6CC
MapVirtualKeyW.USER32(00000011,00000000), ref: 001FC6E1
SendInput.USER32(00000001,00000001,0000001C), ref: 001FC6F6
MapVirtualKeyW.USER32(00000010,00000000), ref: 001FC70B
SendInput.USER32(00000001,00000001,0000001C), ref: 001FC720
MapVirtualKeyW.USER32(00000012,00000000), ref: 001FC735

Part of subcall function 001FFDD0: ShowWindow.USER32(?,00000001,?,?,00000000), ref: 001FFDE3
Part of subcall function 001FFDD0: GetWindowLongW.USER32(?,000000EC), ref: 001FFDEE
Part of subcall function 001FFDD0: SetWindowLongW.USER32(?,000000EC,00000000), ref: 001FFDFD
Part of subcall function 001FFDD0: FindWindowW.USER32(Qt5QWindowOwnDCIcon,003AC118), ref: 001FFEAB
Part of subcall function 001FFDD0: GetWindowLongW.USER32(00000000,000000EC), ref: 001FFEBA
Part of subcall function 001FFDD0: SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 001FFEC7
Part of subcall function 001FFDD0: BeginDeferWindowPos.USER32 ref: 001FFED3
Part of subcall function 001FFDD0: DeferWindowPos.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,0000001B), ref: 001FFEEF
Part of subcall function 001FFDD0: DeferWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0000001B), ref: 001FFF03
Part of subcall function 001FFDD0: DeferWindowPos.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,0000001B), ref: 001FFF18
Part of subcall function 001FFDD0: EndDeferWindowPos.USER32(00000000,?,?,00000000), ref: 001FFF1B

Strings

d, xrefs: 001FC607

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Window$Virtual$InputSend$Defer$Long$Clipboard$BeginCloseCountEmptyFindKillOpenShowTickTimermouse_event
String ID: d
API String ID: 3265710587-2564639436
Opcode ID: eee1890fc110c6d1c26b10338fc72639e4e977af291adfe71482733d1ea18430
Instruction ID: 4c37b0ce6f9e1f153f150fa76aea2b1192a73efb3c4b91ae0bc87e5c4aded051
Opcode Fuzzy Hash: eee1890fc110c6d1c26b10338fc72639e4e977af291adfe71482733d1ea18430
Instruction Fuzzy Hash: 29A11174A5030CAAEB11DFA4CC85FDDBBB8EF08714F10416AE914BB2D2D7B598448F69

Uniqueness

Uniqueness Score: -1.00%

Function 003060B0, Relevance: 40.7, APIs: 19, Strings: 4, Instructions: 497stringfileCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,?,?), ref: 00306113
PathAppendW.SHLWAPI(?,003C792C), ref: 00306136
PathFileExistsW.SHLWAPI(?), ref: 00306145
SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000001,?), ref: 0030616F
PathAppendW.SHLWAPI(?,003C792C), ref: 0030618C
PathFileExistsW.SHLWAPI(?), ref: 00306195
lstrcpyW.KERNEL32(?,00000000), ref: 00306261
FindFirstFileW.KERNEL32(?,?), ref: 003062A8
lstrcmpW.KERNEL32(?,003A8CAC), ref: 003062CF
lstrcmpW.KERNEL32(?,003A8CB0), ref: 003062E5
PathAppendW.SHLWAPI(?,?,?,?), ref: 0030636C
PathAppendW.SHLWAPI(?,003C7944), ref: 00306389
PathFileExistsW.SHLWAPI(?), ref: 00306392
lstrcpyW.KERNEL32(?,00000000), ref: 00306408
FindFirstFileW.KERNEL32(?,?), ref: 0030644F
lstrcmpW.KERNEL32(?,003A8CAC), ref: 003064EC
lstrcmpW.KERNEL32(?,003A8CB0), ref: 00306502
FindNextFileW.KERNEL32(?,?), ref: 00306749
FindNextFileW.KERNEL32(?,?), ref: 00306773

Strings

%d-%02d-%02d, xrefs: 003064CC
,y<, xrefs: 0030611C
Dy<, xrefs: 00306375
,y<, xrefs: 00306178

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Path$File$AppendFindlstrcmp$Exists$FirstFolderNextlstrcpy
String ID: %d-%02d-%02d$,y<$,y<$Dy<
API String ID: 3155479202-2107139703
Opcode ID: 250b6b88664c6aaf1d1f16670693ae7c6b70921abb8ba80aca2fbbba160d6a87
Instruction ID: 4764ce87f2180e9e0cbb29ac1ea3fb55af380ac55c8f47c219cef30f7343302d
Opcode Fuzzy Hash: 250b6b88664c6aaf1d1f16670693ae7c6b70921abb8ba80aca2fbbba160d6a87
Instruction Fuzzy Hash: 2C12D4719012289BDB26EB64CCA5FEDB7B9BF44318F4401D9E409A7281EB31AF94CF51

Uniqueness

Uniqueness Score: -1.00%

Function 001FD150, Relevance: 39.4, APIs: 26, Instructions: 354keyboardclipboardwindowCOMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(?,003A8C5C,00000000,CB28B7D0,?,?,?,?,DisplayIcon,0000000B,?,003C78B4,?,80000002,?,DisplayIcon), ref: 001FD34D
PostMessageW.USER32(00000000,00000406,00000000,00000000), ref: 001FD5F7

Part of subcall function 003090A0: RegOpenKeyExW.ADVAPI32(?,001FD25E,00000000,-00020019,00000000,00000000), ref: 0030911C
Part of subcall function 003090A0: RegQueryValueExW.ADVAPI32(00000000,?,00000000,00000000,?,?), ref: 00309155

OpenClipboard.USER32(00000000), ref: 001FD399
EmptyClipboard.USER32(?,?,DisplayIcon,0000000B,?,003C78B4,?,80000002,?,DisplayIcon,0000000B,?,003C789C,?,80000002,?), ref: 001FD3A3
CloseClipboard.USER32(?,?,DisplayIcon,0000000B,?,003C78B4,?,80000002,?,DisplayIcon,0000000B,?,003C789C,?,80000002,?), ref: 001FD3A9
MapVirtualKeyW.USER32(0000004C,00000000), ref: 001FD3DE
SendInput.USER32(00000001,00000001,0000001C), ref: 001FD3F9
MapVirtualKeyW.USER32(00000041,00000000), ref: 001FD40E
SendInput.USER32(00000001,00000001,0000001C), ref: 001FD423
MapVirtualKeyW.USER32(00000056,00000000), ref: 001FD438
SendInput.USER32(00000001,00000001,0000001C), ref: 001FD44D
MapVirtualKeyW.USER32(00000043,00000000), ref: 001FD462
SendInput.USER32(00000001,00000001,0000001C), ref: 001FD477
MapVirtualKeyW.USER32(00000011,00000000), ref: 001FD48C
SendInput.USER32(00000001,00000001,0000001C), ref: 001FD4A1
MapVirtualKeyW.USER32(00000010,00000000), ref: 001FD4B6
SendInput.USER32(00000001,00000001,0000001C), ref: 001FD4CB

Part of subcall function 003090A0: PathFileExistsW.SHLWAPI(?), ref: 0030922E

MapVirtualKeyW.USER32(00000012,00000000), ref: 001FD4E0
SendInput.USER32(00000001,00000001,0000001C), ref: 001FD4F5
MapVirtualKeyW.USER32(00000009,00000000), ref: 001FD50A
SendInput.USER32(00000001,00000001,0000001C), ref: 001FD51F
MapVirtualKeyW.USER32(00000020,00000000), ref: 001FD534
SendInput.USER32(00000001,00000001,0000001C), ref: 001FD549
MapVirtualKeyW.USER32(0000000D,00000000), ref: 001FD55E
SendInput.USER32(00000001,00000001,0000001C), ref: 001FD573
PostMessageW.USER32(?,00000403,00000000,00000000), ref: 001FD591

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: InputSendVirtual$Clipboard$ExistsFileMessageOpenPathPost$CloseEmptyQueryValue
String ID:
API String ID: 3223571943-0
Opcode ID: f1dcb761f3b2c744a89ee57e60d1f325b52a57c13a2da212da2a85bb01c7f6d1
Instruction ID: e92a73799c60e88fe2671050a73d750a07e333604e32f28ca90c5da35885b74e
Opcode Fuzzy Hash: f1dcb761f3b2c744a89ee57e60d1f325b52a57c13a2da212da2a85bb01c7f6d1
Instruction Fuzzy Hash: 29D1A170A403089BEB24DFB8CC85BEEF7F9EF08704F004519E655AB2C1D7B5A9448B69

Uniqueness

Uniqueness Score: -1.00%

Function 0033D380, Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 263COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0033D638

Strings

histogram->histogram_name() == "PlatformFile.UnknownErrors.Windows", xrefs: 0033D561
vs. , xrefs: 0033D597
", xrefs: 0033D517
c:\qt\givememoney\base\platform_file_win.cc, xrefs: 0033D694
PlatformFile.UnknownErrors.Windows, xrefs: 0033D469, 0033D51D, 0033D592

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: vs. $"$PlatformFile.UnknownErrors.Windows$c:\qt\givememoney\base\platform_file_win.cc$histogram->histogram_name() == "PlatformFile.UnknownErrors.Windows"
API String ID: 323602529-3948446703
Opcode ID: c0ec66a61ab764af5406bdcb2cebdecf561bca383e5de49fde4bd8baaeb56b6d
Instruction ID: ad3c727913b6047727f7e3197fc783c35e09b341f43f85362fd78ec5e058d661
Opcode Fuzzy Hash: c0ec66a61ab764af5406bdcb2cebdecf561bca383e5de49fde4bd8baaeb56b6d
Instruction Fuzzy Hash: F891E871A001089BCF15DFA8ECC6BADB7B5EF49314F5042A9F819AB2D2DB319E44CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00370196, Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 003702DC

Strings

1#QNAN, xrefs: 003714E2
1#IND, xrefs: 003714D4
1#SNAN, xrefs: 003714DB
1#INF, xrefs: 003714E9

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 227760530200e0e1faa45e7a98770720cb0784ced0eaa7eda9a6ff0abaeba594
Instruction ID: 40ebc85faf0df099a882b5e6e7917af936182e35d5877e6f2dd0ee1ebfeb4c87
Opcode Fuzzy Hash: 227760530200e0e1faa45e7a98770720cb0784ced0eaa7eda9a6ff0abaeba594
Instruction Fuzzy Hash: BFC25072E046288FDB3ACE28DD407E9B7B9EB44305F1585EAD44DE7241E778AE858F40

Uniqueness

Uniqueness Score: -1.00%

Function 003274A0, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000003,00000000,00000000,?,?,?,CB28B7D0), ref: 00327502
DeviceIoControl.KERNEL32(00000000,00074080,00000000,00000000,?,00000018,?,00000000), ref: 0032754F
DeviceIoControl.KERNEL32(?,0007C088,00000000,00000021,00000000,00000221,?,00000000), ref: 0032759D
CloseHandle.KERNEL32(?,?,?,?,?,CB28B7D0), ref: 003276E5

Strings

\\.\PhysicalDrive%d, xrefs: 003274D3

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ControlDevice$CloseCreateFileHandle
String ID: \\.\PhysicalDrive%d
API String ID: 1375849437-2935326385
Opcode ID: b698c7e1a794d69773d1cd3c071586685eb83e8fc450f60d3f81e29a0a7b0a0b
Instruction ID: 95c4ed5a6f8ed40ae68d936b823c00deb53ad2d895fc7aba91c9f6ae3e7c43a4
Opcode Fuzzy Hash: b698c7e1a794d69773d1cd3c071586685eb83e8fc450f60d3f81e29a0a7b0a0b
Instruction Fuzzy Hash: CE610971E447259BEB22CF38DC45BA9B7B6BF95300F1543A9E408E7181EB71AA948F40

Uniqueness

Uniqueness Score: -1.00%

Function 0036C206, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,0036C525,?,00000000), ref: 0036C29F
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,0036C525,?,00000000), ref: 0036C2C8
GetACP.KERNEL32(?,?,0036C525,?,00000000), ref: 0036C2DD

Strings

ACP, xrefs: 0036C224
OCP, xrefs: 0036C25A

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: b797e8a3338f46398b290c45221eefef992a5c771c6ccd2c9e837837ab640610
Instruction ID: c5ef8abea6522e825ad0b290c32424af0ed369f57f3ae940900a0a4c94fa2273
Opcode Fuzzy Hash: b797e8a3338f46398b290c45221eefef992a5c771c6ccd2c9e837837ab640610
Instruction Fuzzy Hash: 0221A322A20104AADF268BD4D921AB772AABB54F54B57D924EC8AD7118E732DD41C390

Uniqueness

Uniqueness Score: -1.00%

Function 0036C3DA, Relevance: 7.7, APIs: 5, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 00364BB7: GetLastError.KERNEL32(?,00000000,00355AE9,00000000,?,?,003548F1,?,?,00000000,00000000), ref: 00364BBB
Part of subcall function 00364BB7: _free.LIBCMT ref: 00364BEE
Part of subcall function 00364BB7: SetLastError.KERNEL32(00000000,?,00000000,00000000), ref: 00364C2F

Part of subcall function 00364BB7: _free.LIBCMT ref: 00364C16
Part of subcall function 00364BB7: SetLastError.KERNEL32(00000000,?,00000000,00000000), ref: 00364C23

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0036C4E6
IsValidCodePage.KERNEL32(00000000), ref: 0036C541
IsValidLocale.KERNEL32(?,00000001), ref: 0036C550
GetLocaleInfoW.KERNEL32(?,00001001,0035F99D,00000040,?,0035FABD,00000055,00000000,?,?,00000055,00000000), ref: 0036C598
GetLocaleInfoW.KERNEL32(?,00001002,0035FA1D,00000040), ref: 0036C5B7

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser
String ID:
API String ID: 2287132625-0
Opcode ID: 0f93932adb1ef4cd559e316ab525318ac050694d6d37accc1972b55ea14950ae
Instruction ID: 4b218308346a4d5351a5a06ef6d4642cbde36b432bbdb4adb47028ad9c70f308
Opcode Fuzzy Hash: 0f93932adb1ef4cd559e316ab525318ac050694d6d37accc1972b55ea14950ae
Instruction Fuzzy Hash: 7951B371910209AFEF23EFA6CC55EBE73B8BF49700F059029E995EB154EB7099408B61

Uniqueness

Uniqueness Score: -1.00%

Function 0030D9F0, Relevance: 6.0, APIs: 4, Instructions: 50comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0030DA09
CoCreateInstance.OLE32(00394B20,00000000,00000001,00394B10,?,?,?,?,?,CB28B7D0,?), ref: 0030DA21
GetWindowLongW.USER32(?,000000EC), ref: 0030DA4A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 0030DA5E

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: LongWindow$CreateInitializeInstance
String ID:
API String ID: 511273899-0
Opcode ID: 7b41e790df0553c9e1e78b4456a650649ec046b18e3c2cfa06e35540656c0806
Instruction ID: fe4a2aff0d01921ae54c0402d1a3feae8439526d3b22cf5f3c1be7a740838b6e
Opcode Fuzzy Hash: 7b41e790df0553c9e1e78b4456a650649ec046b18e3c2cfa06e35540656c0806
Instruction Fuzzy Hash: E6018035605114BFCB11DBA4DC55FAE7BACEF0A716F100295F505DB1D0CB719906CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0032F0D0, Relevance: 4.3, Strings: 3, Instructions: 517COMMON

Download Yara Rule

Strings

Check failed: c < 0x7F. , xrefs: 0032F639
c:\qt\givememoney\base\strings\string_split.cc, xrefs: 0032F5CC, 0032F623
Check failed: c >= 0. , xrefs: 0032F5DF

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID:
String ID: Check failed: c < 0x7F. $Check failed: c >= 0. $c:\qt\givememoney\base\strings\string_split.cc
API String ID: 0-2914168844
Opcode ID: e2326817020f6e892d0c2f6c0495a499194f5b6361528c4961b4d7d1f2e4586a
Instruction ID: 42a7a1a95068248a5614d33000e815198dc63ff3db547810401c584e3c8f9490
Opcode Fuzzy Hash: e2326817020f6e892d0c2f6c0495a499194f5b6361528c4961b4d7d1f2e4586a
Instruction Fuzzy Hash: AC028E75E002199FCF15EF68EC81AAEBBB6EF48300F548579E805AB355DB34D941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0036640D, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,0035F3FB,?,00000004), ref: 00366460

Strings

GetLocaleInfoEx, xrefs: 0036641E, 00366428

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 51eda2a15caaaf1585993deff83a1d6bf8a22f1a4c6607e2fea80dc5eebe2583
Instruction ID: c7930d1c6193dc42d1419d19fb2c9f8da8291a96d03a45d1ca294645139b211b
Opcode Fuzzy Hash: 51eda2a15caaaf1585993deff83a1d6bf8a22f1a4c6607e2fea80dc5eebe2583
Instruction Fuzzy Hash: 32F02431A04208BBCF136F61DC02EAE7F29EF08B50F018129FC04AA294CF328D20D691

Uniqueness

Uniqueness Score: -1.00%

Function 00338610, Relevance: 3.5, Strings: 2, Instructions: 975COMMON

Download Yara Rule

Strings

NaN, xrefs: 0033868A
Infinity, xrefs: 00338671

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID:
String ID: Infinity$NaN
API String ID: 0-4285296124
Opcode ID: f0d4d48fd496e752e1409c4cff5a6997d28ec17672ff71f4a56923ddbc95e9f4
Instruction ID: 6607959af8e3ce89ab987d1defa83c7103a0955a45f71ec99b3f3d56780c9383
Opcode Fuzzy Hash: f0d4d48fd496e752e1409c4cff5a6997d28ec17672ff71f4a56923ddbc95e9f4
Instruction Fuzzy Hash: 9A82DC71D00709DFDB17CF68C8917AEB7B5AF55340F15822AF806BB241EB759982CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003268A0, Relevance: 3.2, Strings: 2, Instructions: 708COMMON

Download Yara Rule

Strings

e2, xrefs: 003268B8
|h2, xrefs: 003269BF, 00326B55, 00326DEF, 00326F38

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID:
String ID: |h2$e2
API String ID: 0-2719990233
Opcode ID: 876fd60b069216ed52d8d6b238dcff939897a816e111d731dbb70adcf26c3237
Instruction ID: d1ab88d268c40936602d24338cdedaea54a4c9212de5620ede2ce9e625f2b514
Opcode Fuzzy Hash: 876fd60b069216ed52d8d6b238dcff939897a816e111d731dbb70adcf26c3237
Instruction Fuzzy Hash: 88324EB7F505145BDB0CCA5DCCA27ECB2E3AFD8214B0E813DA81AE7345EA78D9158644

Uniqueness

Uniqueness Score: -1.00%

Function 00324240, Relevance: 3.1, Strings: 2, Instructions: 584COMMON

Download Yara Rule

Strings

Check failed: components. , xrefs: 0032429B
c:\qt\givememoney\base\files\file_path.cc, xrefs: 00324288

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ErrorLast
String ID: Check failed: components. $c:\qt\givememoney\base\files\file_path.cc
API String ID: 1452528299-888752659
Opcode ID: 741e86a5f2d3bd489abb17ba3a76ce448350a278d0500b3003d5cc0b78109066
Instruction ID: bde2efc995c14a6c8fcd6acc208a5dbea9387e71d30b1f71e2987db631901134
Opcode Fuzzy Hash: 741e86a5f2d3bd489abb17ba3a76ce448350a278d0500b3003d5cc0b78109066
Instruction Fuzzy Hash: 50220731E002199FCF15DFA4DC81AEEB7B9FF94300F65422DE415A7291EB34AA45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0033F9D0, Relevance: 2.7, Strings: 2, Instructions: 212COMMON

Download Yara Rule

Strings

Check failed: CBU16_IS_SINGLE(code_unit16_high). , xrefs: 0033FB92
c:\qt\givememoney\base\json\json_parser.cc, xrefs: 0033FB7F

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID:
String ID: Check failed: CBU16_IS_SINGLE(code_unit16_high). $c:\qt\givememoney\base\json\json_parser.cc
API String ID: 0-3558754076
Opcode ID: bbb48b528bacfae9d182fd14310be3e7babe006e644c77ff05ba575daf631eeb
Instruction ID: 42b4d38e66922a0e4e5c0b0d59d9890a69d29a285a3ca2d4de88edb1f9461822
Opcode Fuzzy Hash: bbb48b528bacfae9d182fd14310be3e7babe006e644c77ff05ba575daf631eeb
Instruction Fuzzy Hash: 76715771E4010D9FEF16DBA4C8926FEBB64DF11300F50857AD912AB382C638AF45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0030C820, Relevance: 2.5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

hXMV, xrefs: 0030C861
hXMV, xrefs: 0030C876

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID:
String ID: hXMV$hXMV
API String ID: 0-400149659
Opcode ID: 69d18cfd9bcbbec0520dc5d80fe568113c1f1711dd77b6a6ee19b3ac6b9ae868
Instruction ID: e93f797896eb448383e8732e91d13442c47427cb5b0f041fa1da890c46c75b4e
Opcode Fuzzy Hash: 69d18cfd9bcbbec0520dc5d80fe568113c1f1711dd77b6a6ee19b3ac6b9ae868
Instruction Fuzzy Hash: CD012672A08789AFD700CB59DC91BAFFBF8EB45B24F20422AF404932C0D636180086A0

Uniqueness

Uniqueness Score: -1.00%

Function 0036D9F2, Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0036D9ED,?,?,00000008,?,?,003727E6,00000000), ref: 0036DC1F

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: fe14f1072ff779d6c1b05ee1c82c38c042b957339191f4fa7b82619d801b401a
Instruction ID: ac2679eabc838149f4ad10b264d5ae73c31d4426d4481658191c0912b50988b8
Opcode Fuzzy Hash: fe14f1072ff779d6c1b05ee1c82c38c042b957339191f4fa7b82619d801b401a
Instruction Fuzzy Hash: 17B15E31A10609DFD716CF28C48AB657BE0FF45364F26C658E89ACF2A9C375D991CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0036C0DD, Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00364BB7: GetLastError.KERNEL32(?,00000000,00355AE9,00000000,?,?,003548F1,?,?,00000000,00000000), ref: 00364BBB
Part of subcall function 00364BB7: _free.LIBCMT ref: 00364BEE
Part of subcall function 00364BB7: SetLastError.KERNEL32(00000000,?,00000000,00000000), ref: 00364C2F

Part of subcall function 00364BB7: _free.LIBCMT ref: 00364C16
Part of subcall function 00364BB7: SetLastError.KERNEL32(00000000,?,00000000,00000000), ref: 00364C23

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0036C131

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ErrorLast$_free$InfoLocale
String ID:
API String ID: 2955987475-0
Opcode ID: 952d703f8083e049c2e0bfc8adb76541685652d8a9121afdad079103c6e22eb3
Instruction ID: cf297b2b2563dd9e0d2750a5215f22347694bc033068ea644372d49e11b34bdb
Opcode Fuzzy Hash: 952d703f8083e049c2e0bfc8adb76541685652d8a9121afdad079103c6e22eb3
Instruction Fuzzy Hash: 3821C572520206ABEB26AB24DC45FBA73ACEB05310F11917AFD41CA14AEB75DD41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0036C30D, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00364BB7: GetLastError.KERNEL32(?,00000000,00355AE9,00000000,?,?,003548F1,?,?,00000000,00000000), ref: 00364BBB
Part of subcall function 00364BB7: _free.LIBCMT ref: 00364BEE
Part of subcall function 00364BB7: SetLastError.KERNEL32(00000000,?,00000000,00000000), ref: 00364C2F

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0036C188,00000000,00000000,?), ref: 0036C339

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ErrorLast$InfoLocale_free
String ID:
API String ID: 787680540-0
Opcode ID: 9bc772cd88983d93689a4b39e2c48f8ce7c356227c68fdca0fd24dcfb63060a6
Instruction ID: 1578359bb615dd5dd1566b1328168681b098b0c987624f27d893fa679cfc624d
Opcode Fuzzy Hash: 9bc772cd88983d93689a4b39e2c48f8ce7c356227c68fdca0fd24dcfb63060a6
Instruction Fuzzy Hash: 85F07D36920111BBDB265B24CC09BFA7768EB01754F26C529EC85A3248EA38FD41CAE0

Uniqueness

Uniqueness Score: -1.00%

Function 00357429, Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00357599

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 438c2294c82739902094e5352324f3ed750ea9a0ff417eebb8205ce52ffb9b1b
Instruction ID: 6c3df50c63a160c0289238d7082eabadae88176f5dba4dd9480768d91be883a1
Opcode Fuzzy Hash: 438c2294c82739902094e5352324f3ed750ea9a0ff417eebb8205ce52ffb9b1b
Instruction Fuzzy Hash: 01516CE030CA4597DB37496DA555FFE2BDA9B02343F194D1AEC82CB6B2E604DD0E8352

Uniqueness

Uniqueness Score: -1.00%

Function 00357658, Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 003577C8

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 942e5e18b644e4b8d0c090becf828d985cbb5046b9587b6edf9ecd6ca3f3d25f
Instruction ID: 07eec715b7d73a437ecac9c3c1c442aa22b778cc9dc99c854635213753eef3f1
Opcode Fuzzy Hash: 942e5e18b644e4b8d0c090becf828d985cbb5046b9587b6edf9ecd6ca3f3d25f
Instruction Fuzzy Hash: 2551776130CB4597DB3B8A7CB45AFBE23998B0A307F1A091ADC42CB6B2C605ED0D8751

Uniqueness

Uniqueness Score: -1.00%

Function 00318550, Relevance: .7, Instructions: 737COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dc6a591acad2cd4fddd0da2c0a0cb9388a6edf955a0676533c9897af9d02896
Instruction ID: 5b9c86a3202961e3bf2e6a736898552a5c88809b9576f5ae9ecc0f25d6636364
Opcode Fuzzy Hash: 6dc6a591acad2cd4fddd0da2c0a0cb9388a6edf955a0676533c9897af9d02896
Instruction Fuzzy Hash: 5E424175B016068FDB19CF69C890AAAB3E5FF8D354B2A456DD806DB350DB30EC81CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00357887, Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1096db417e84a4403589431f5c324504f6c7ab920c64b858dd6b92e514e723a0
Instruction ID: 94afc07f84d0900aaaa63ccffa211258b2150fcc419073970b0b559f7b1d5888
Opcode Fuzzy Hash: 1096db417e84a4403589431f5c324504f6c7ab920c64b858dd6b92e514e723a0
Instruction Fuzzy Hash: F251697260C6495ADF378568A45AFFE63899B02303F16050ADC86DB7B2D701DE4EC372

Uniqueness

Uniqueness Score: -1.00%

Function 003305D0, Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa9dabe6d6c7580ec63fbc790bf147b46d3a9a96e7fa6bfc58885200c49436d
Instruction ID: 0d4832602ed6b266b3916a6fe383859ad7ec820a7307c4124ef1858156b92e6e
Opcode Fuzzy Hash: 6aa9dabe6d6c7580ec63fbc790bf147b46d3a9a96e7fa6bfc58885200c49436d
Instruction Fuzzy Hash: 13711B719141998FDB1ECF28C8A03F8BFB1EB45308F5941EDC88ADB287D6349A85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00343620, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9933dcc899219181f9779e3b09e0280b74be02be9940f998c21bb7812a2e0f9
Instruction ID: c738a164eb7654494adbceb4a1b9185ce6d5bd1118245e0fb42738d0e2ce1d87
Opcode Fuzzy Hash: e9933dcc899219181f9779e3b09e0280b74be02be9940f998c21bb7812a2e0f9
Instruction Fuzzy Hash: 6441E4716241058BE70ACE1DECD04B9B7D6FF92320B59425ED486CB791C736FA22C790

Uniqueness

Uniqueness Score: -1.00%

Function 001F0790, Relevance: 58.1, APIs: 25, Strings: 8, Instructions: 340windowCOMMON

Download Yara Rule

APIs

GetWindowDC.USER32(?,731CDE00,731C4380,?,?,001F076B), ref: 001F085C
CreateCompatibleDC.GDI32(00000000), ref: 001F086B
CreateCompatibleBitmap.GDI32(00000000,?,731CDE00), ref: 001F0886
SelectObject.GDI32(00000000,00000000), ref: 001F0894
GdipCreateFromHDC.GDIPLUS(00000000,?), ref: 001F08AC
GdipSetTextRenderingHint.GDIPLUS(00000000,00000003), ref: 001F08BB
GdipSetSmoothingMode.GDIPLUS(00000000,00000002), ref: 001F08C4
GdipSetInterpolationMode.GDIPLUS(00000000,00000007), ref: 001F08CD
GdipSetPixelOffsetMode.GDIPLUS(00000000,00000002), ref: 001F08D6
GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 001F08F2
GdipCreateSolidFill.GDIPLUS(000000FF,?), ref: 001F0911
GdipDrawString.GDIPLUS(00000000,?,000000FF,00000000,?,?,?), ref: 001F0AA0
GdipDrawString.GDIPLUS(00000000,003ABF08,000000FF,00000000,?,?,?), ref: 001F0B10
GdipDrawString.GDIPLUS(00000000,?,000000FF,00000000,?,?,?), ref: 001F0B82
GdipDrawString.GDIPLUS(00000000,?,000000FF,00000000,?,?,?), ref: 001F0BF4
GetWindowDC.USER32(?), ref: 001F0C06
UpdateLayeredWindow.USER32(?,00000000,?,003C6DB0,?,?,00000000,01FF0000,00000002), ref: 001F0C71
GdipReleaseDC.GDIPLUS(00000000,?), ref: 001F0C7E
ReleaseDC.USER32 ref: 001F0C91
ReleaseDC.USER32 ref: 001F0C9F
DeleteObject.GDI32(?), ref: 001F0CA7
DeleteDC.GDI32(?), ref: 001F0CB3
GdipDeleteBrush.GDIPLUS(?), ref: 001F0CBA
GdipDeleteStringFormat.GDIPLUS(?), ref: 001F0CC6
GdipDeleteGraphics.GDIPLUS(00000000), ref: 001F0CCD

Strings

%02d, xrefs: 001F09EA
%02d, xrefs: 001F0A3A
%02d, xrefs: 001F0A26
%02d, xrefs: 001F09FE
%02d, xrefs: 001F0A4E
%02d, xrefs: 001F09D6
%02d, xrefs: 001F098C, 001F09A6
%02d, xrefs: 001F0A12

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Gdip$String$CreateDelete$Draw$ModeReleaseWindow$CompatibleFormatObject$BitmapBrushFillFromGraphicsHintInterpolationLayeredOffsetPixelRenderingSelectSmoothingSolidTextUpdate
String ID: %02d$%02d$%02d$%02d$%02d$%02d$%02d$%02d
API String ID: 1311691735-426798172
Opcode ID: 7413928e00e9f4643ce36d532633b9bbe248b4d4ca6c502e3b72cc3cb9d5c8cc
Instruction ID: 329e867f832a0b103f22d53a2c8e5ce94c4c73ba9c6e04806b06d1356f803a35
Opcode Fuzzy Hash: 7413928e00e9f4643ce36d532633b9bbe248b4d4ca6c502e3b72cc3cb9d5c8cc
Instruction Fuzzy Hash: 19E11C75A00218EFDB23DB64EC8AEF9B7BCEB49340F048196F509E2161DB716E858F51

Uniqueness

Uniqueness Score: -1.00%

Function 001FB650, Relevance: 51.2, APIs: 28, Strings: 1, Instructions: 421keyboardclipboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0032D880: CreateEventW.KERNEL32(00000000,00000000), ref: 0032D9A6

OpenClipboard.USER32(00000000), ref: 001FB977
EmptyClipboard.USER32(?,?,?,?,00000000,0038D304,000000FF,?,002C18E0,?,?,?,?), ref: 001FB981
CloseClipboard.USER32(?,?,?,?,00000000,0038D304,000000FF,?,002C18E0,?,?,?,?), ref: 001FB987
PostMessageW.USER32(?,00000403,00000000,00000000), ref: 001FBA2D
OpenClipboard.USER32(00000000), ref: 001FBA5C
EmptyClipboard.USER32(?,?,?,?,00000000,0038D304,000000FF,?,002C18E0,?,?,?,?), ref: 001FBA66
CloseClipboard.USER32(?,?,?,?,00000000,0038D304,000000FF,?,002C18E0,?,?,?,?), ref: 001FBA6C
MapVirtualKeyW.USER32(0000004C,00000000), ref: 001FBAA1
SendInput.USER32(00000001,00000001,0000001C), ref: 001FBABC
MapVirtualKeyW.USER32(00000041,00000000), ref: 001FBAD1
SendInput.USER32(00000001,00000001,0000001C), ref: 001FBAE6
MapVirtualKeyW.USER32(00000056,00000000), ref: 001FBAFB
SendInput.USER32(00000001,00000001,0000001C), ref: 001FBB10
MapVirtualKeyW.USER32(00000043,00000000), ref: 001FBB25
SendInput.USER32(00000001,00000001,0000001C), ref: 001FBB3A
MapVirtualKeyW.USER32(00000011,00000000), ref: 001FBB4F
SendInput.USER32(00000001,00000001,0000001C), ref: 001FBB64
MapVirtualKeyW.USER32(00000010,00000000), ref: 001FBB79
SendInput.USER32(00000001,00000001,0000001C), ref: 001FBB8E
MapVirtualKeyW.USER32(00000012,00000000), ref: 001FBBA3
SendInput.USER32(00000001,00000001,0000001C), ref: 001FBBB8
MapVirtualKeyW.USER32(00000009,00000000), ref: 001FBBCD
SendInput.USER32(00000001,00000001,0000001C), ref: 001FBBE2
MapVirtualKeyW.USER32(00000020,00000000), ref: 001FBBF7
SendInput.USER32(00000001,00000001,0000001C), ref: 001FBC0C
MapVirtualKeyW.USER32(0000000D,00000000), ref: 001FBC21
SendInput.USER32(00000001,00000001,0000001C), ref: 001FBC36
PostMessageW.USER32(?,00000403,00000000,00000000), ref: 001FBC54

Strings

about:blank, xrefs: 001FB912

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: InputSendVirtual$Clipboard$CloseEmptyMessageOpenPost$CreateEvent
String ID: about:blank
API String ID: 3502652839-258612819
Opcode ID: d77cf4e78b8c8e1c8ff847daa86a9c347e4ff09f24ef2f9c0eaaeadd3495c48f
Instruction ID: a451acb2d41bffa96499f46c00fdc631d079b37d88c1b9059527c63bc5b4e830
Opcode Fuzzy Hash: d77cf4e78b8c8e1c8ff847daa86a9c347e4ff09f24ef2f9c0eaaeadd3495c48f
Instruction Fuzzy Hash: 1B0271B0941348EEEF11DFA4C889BD9BBB8AF14704F14406AE908AF2D2D7F59548CB75

Uniqueness

Uniqueness Score: -1.00%

Function 001FC810, Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 311keyboardclipboardwindowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000019), ref: 001FC849
Sleep.KERNEL32(000003E8), ref: 001FC854
PostMessageW.USER32(?,00000403,00000000,00000000), ref: 001FC9CA
OpenClipboard.USER32(00000000), ref: 001FC9F2
EmptyClipboard.USER32 ref: 001FC9FC
CloseClipboard.USER32 ref: 001FCA02
MapVirtualKeyW.USER32(0000004C,00000000), ref: 001FCA37
SendInput.USER32(00000001,00000001,0000001C), ref: 001FCA52
MapVirtualKeyW.USER32(00000041,00000000), ref: 001FCA67
SendInput.USER32(00000001,00000001,0000001C), ref: 001FCA7C
MapVirtualKeyW.USER32(00000056,00000000), ref: 001FCA91
SendInput.USER32(00000001,00000001,0000001C), ref: 001FCAA6
MapVirtualKeyW.USER32(00000043,00000000), ref: 001FCABB
SendInput.USER32(00000001,00000001,0000001C), ref: 001FCAD0
MapVirtualKeyW.USER32(00000011,00000000), ref: 001FCAE5
SendInput.USER32(00000001,00000001,0000001C), ref: 001FCAFA
MapVirtualKeyW.USER32(00000010,00000000), ref: 001FCB0F
SendInput.USER32(00000001,00000001,0000001C), ref: 001FCB24
MapVirtualKeyW.USER32(00000012,00000000), ref: 001FCB39
SendInput.USER32(00000001,00000001,0000001C), ref: 001FCB4E
MapVirtualKeyW.USER32(00000009,00000000), ref: 001FCB63
SendInput.USER32(00000001,00000001,0000001C), ref: 001FCB78
MapVirtualKeyW.USER32(00000020,00000000), ref: 001FCB8D
SendInput.USER32(00000001,00000001,0000001C), ref: 001FCBA2
MapVirtualKeyW.USER32(0000000D,00000000), ref: 001FCBB7
SendInput.USER32(00000001,00000001,0000001C), ref: 001FCBCC
PostMessageW.USER32(?,00000403,00000000,00000000), ref: 001FCBEA

Strings

d, xrefs: 001FCA0B

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: InputSendVirtual$Clipboard$MessagePost$CloseEmptyOpenSleepWindow
String ID: d
API String ID: 854906261-2564639436
Opcode ID: 56bf7ddde07fd95a8584c275e7fe06f4d37c99ad883d89b83eeaaaa463b43d8c
Instruction ID: 0e2ec4ac9d5b34d3c19a6c9e249997c7831ca980c09985c85d29bfb29e767abc
Opcode Fuzzy Hash: 56bf7ddde07fd95a8584c275e7fe06f4d37c99ad883d89b83eeaaaa463b43d8c
Instruction Fuzzy Hash: 44C16374E4034CAAEF11DFA8C845FEDBBB8AF08714F14405AE905BB2D2D7B59844CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 001F12F0, Relevance: 34.8, APIs: 23, Instructions: 261memorywindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 001F1322
GetWindowDC.USER32(?,?,?,CB28B7D0), ref: 001F133B
CreateCompatibleDC.GDI32(00000000), ref: 001F1347
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 001F1359
SelectObject.GDI32(00000000,00000000), ref: 001F1364
GdipCreateFromHDC.GDIPLUS(00000000,?,?,?,?,CB28B7D0), ref: 001F137E
GdipGraphicsClear.GDIPLUS(00000000,FF000000,?,?,?,CB28B7D0), ref: 001F1399
GdipAlloc.GDIPLUS(00000008,?,?,?,CB28B7D0), ref: 001F1463
GdipCreatePen1.GDIPLUS(01000000,?,00000000,00000000,?,?,?,CB28B7D0), ref: 001F149E
GdipAlloc.GDIPLUS(00000008,?,?,?,CB28B7D0), ref: 001F14AB
GdipCreatePen1.GDIPLUS(FF000000,?,00000000,00000000,?,?,?,CB28B7D0), ref: 001F14E6
GdipDrawRectangleI.GDIPLUS(00000000,00000000,00000000,00000000,?,?,?,?,?,CB28B7D0), ref: 001F1502
GdipDeletePen.GDIPLUS(00000000,?,?,?,CB28B7D0), ref: 001F1512
GdipFree.GDIPLUS(00000000,?,?,?,CB28B7D0), ref: 001F1519
GdipDrawImagePointRectI.GDIPLUS(00000000,?,-003C693A,-003C6A36,00000000,00000000,00000028,00000028,00000002), ref: 001F157A
GetWindowDC.USER32(?,?,?,?,CB28B7D0), ref: 001F1598
UpdateLayeredWindow.USER32(?,00000000,?,?,?,?,00000000,01FF0000,00000002), ref: 001F15D4
GdipReleaseDC.GDIPLUS(00000000,?,?,00000000,?,?,?,?,00000000,01FF0000,00000002,?,?,?,?,CB28B7D0), ref: 001F15DF
ReleaseDC.USER32 ref: 001F15ED
ReleaseDC.USER32 ref: 001F15F3
DeleteObject.GDI32(?), ref: 001F15F8
DeleteDC.GDI32(?), ref: 001F1601
GdipDeleteGraphics.GDIPLUS(00000000,?,?,?,00000000,?,00000000,?,?,?,?,00000000,01FF0000,00000002), ref: 001F1608

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Gdip$Create$DeleteWindow$Release$AllocCompatibleDrawGraphicsObjectPen1Rect$BitmapClearFreeFromImageLayeredPointRectangleSelectUpdate
String ID:
API String ID: 3881143532-0
Opcode ID: 0b3278b09d5eb940b05fc9a2f8049cd31a4c5f7817a29b4474d0c2a00ab01b37
Instruction ID: af4ab8a48c500e5a7cc532eb35e54e6d51da93796453e43a7392c5c20c3e8e38
Opcode Fuzzy Hash: 0b3278b09d5eb940b05fc9a2f8049cd31a4c5f7817a29b4474d0c2a00ab01b37
Instruction Fuzzy Hash: 58A14D75E00218EFCB26CFA4DD48FAEBBB9FF89710F15411AE906A7254D771A842CB50

Uniqueness

Uniqueness Score: -1.00%

Function 002C1860, Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 318COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 002C1960
PathAppendW.SHLWAPI(?,003C786C), ref: 002C1983
PathAppendW.SHLWAPI(?,003C7884), ref: 002C19A0
PathFileExistsW.SHLWAPI(?), ref: 002C19A9
SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000001,?), ref: 002C19D7
PathAppendW.SHLWAPI(?,003C786C), ref: 002C19F4
PathAppendW.SHLWAPI(?,003C7884), ref: 002C1A11

Strings

<x<, xrefs: 002C1901
Tx<, xrefs: 002C1910
lx<, xrefs: 002C19E0
DisplayIcon, xrefs: 002C1AAE, 002C1B51, 002C1BF4, 002C1C97
lx<, xrefs: 002C1969
sogou.com, xrefs: 002C1925

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Path$Append$Folder$ExistsFile
String ID: <x<$DisplayIcon$Tx<$lx<$lx<$sogou.com
API String ID: 2743330544-1836181221
Opcode ID: 985c5b50d558e0c26164e8f82d7fc108750315de3d8c024ae787c2b1ab9cf9dc
Instruction ID: e029bac3a8a9f72a2d5f81b9e0adb6cbf11fcd3c6d4b46ac3e8ddadc9eda3579
Opcode Fuzzy Hash: 985c5b50d558e0c26164e8f82d7fc108750315de3d8c024ae787c2b1ab9cf9dc
Instruction Fuzzy Hash: 77D1B271911305EBDF11DF64CC8AF99B7B8EF14300F5041AEE90AA7282DB74AA94CF51

Uniqueness

Uniqueness Score: -1.00%

Function 001F0400, Relevance: 22.7, APIs: 15, Instructions: 240COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 001F0417
EnumDisplayMonitors.USER32(00000000,00000000,Function_00030360,003C6DE8), ref: 001F0454
ReleaseDC.USER32 ref: 001F045D
GdipCreatePath.GDIPLUS(00000000,?), ref: 001F04F3
GdipCreateStringFormat.GDIPLUS(00000000,00000000,?), ref: 001F050C
GdipAddPathString.GDIPLUS(?,003ABF14,000000FF,00000000,00000000,?,?,?), ref: 001F0574
GdipGetPathWorldBounds.GDIPLUS(?,00000000,00000000,00000000), ref: 001F0592
GdipResetPath.GDIPLUS(?), ref: 001F05F2
GdipAddPathString.GDIPLUS(?,003ABF08,000000FF,00000000,00000000,?,?,?), ref: 001F065C
GdipGetPathWorldBounds.GDIPLUS(?,00000000,00000000,00000000), ref: 001F0674
GdipResetPath.GDIPLUS(?), ref: 001F0697
GdipAddPathString.GDIPLUS(?,003ABF1C,000000FF,00000000,00000000,?,?,?), ref: 001F0701
GdipGetPathWorldBounds.GDIPLUS(?,00000000,00000000,00000000), ref: 001F0719
GdipDeleteStringFormat.GDIPLUS(?), ref: 001F076E
GdipDeletePath.GDIPLUS(?), ref: 001F0777

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Gdip$Path$String$BoundsWorld$CreateDeleteFormatReset$DisplayEnumMonitorsRelease
String ID:
API String ID: 2988191496-0
Opcode ID: c3d14baa6fc6aa3215f23afbcd674505e957e6bcd412f5efd2f8dc1815234567
Instruction ID: a24e9e8ea1f755b27caa4b62d0dada40f376fe8864abf56ea3206ba165cccbc3
Opcode Fuzzy Hash: c3d14baa6fc6aa3215f23afbcd674505e957e6bcd412f5efd2f8dc1815234567
Instruction Fuzzy Hash: 03B1FC70E14209EFDB06DFB5ED45BADBBB9AF49310F10825AE402F62A1E7716984CF50

Uniqueness

Uniqueness Score: -1.00%

Function 002810D0, Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 205COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,0000001C,00000000,00000000,?,?,?,001FC13F), ref: 0028122D
PathAppendW.SHLWAPI(?,003C7A64,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00281254
PathAppendW.SHLWAPI(?,003C7A7C,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00281271
PathAppendW.SHLWAPI(?,003C7A94,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0028128E
PathAppendW.SHLWAPI(?,003C7AAC,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 002812AB
PathAppendW.SHLWAPI(?,003C7AC4,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 002812C8

Strings

Exe, xrefs: 00281363
dz<, xrefs: 0028123A
4z<, xrefs: 002811D4
baidu.com, xrefs: 002811F8
|z<, xrefs: 0028125D
Lz<, xrefs: 002811E3

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Path$Append$Folder
String ID: 4z<$Exe$Lz<$baidu.com$dz<$|z<
API String ID: 2044587772-1636441062
Opcode ID: 5a296eab4c186a021881c6e9c8785cb004dff0d6ce9eb1616081da00558f7f7b
Instruction ID: 034e0b345a1b7ea98600821cf970d87553f8fa4c78ed54d744fc73c768e4f477
Opcode Fuzzy Hash: 5a296eab4c186a021881c6e9c8785cb004dff0d6ce9eb1616081da00558f7f7b
Instruction Fuzzy Hash: CF91AE75A04209EBDB15EF64DC49F9EBBB8FF18300F10029AE81997281DB74AA54CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00310060, Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 402COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 003100EB
__CxxThrowException@8.LIBVCRUNTIME ref: 0031022A
__CxxThrowException@8.LIBVCRUNTIME ref: 003102E3

Strings

is less than the minimum of , xrefs: 003101E9
: this object requires an IV, xrefs: 0031049A
exceeds the maximum of , xrefs: 003102A2
4K9, xrefs: 003103F1
4K9, xrefs: 0031036F
: this object cannot use a null IV, xrefs: 003100BC
: IV length , xrefs: 003101C1, 0031027A

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Exception@8Throw
String ID: exceeds the maximum of $ is less than the minimum of $4K9$4K9$: IV length $: this object cannot use a null IV$: this object requires an IV
API String ID: 2005118841-1564923227
Opcode ID: fb8ce44e2c0c0787e0890f5da34f432331c66138dee389e19ea1a62aa909b144
Instruction ID: c1fde82a54e65f1e0be75f39442a8fdfa62c678ffe10b4463f12394ab770889a
Opcode Fuzzy Hash: fb8ce44e2c0c0787e0890f5da34f432331c66138dee389e19ea1a62aa909b144
Instruction Fuzzy Hash: C6E16B71A00248AFDB06DBA8C885FDEBBF9EF5D310F1041A9E505A7381DB75AE44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0036B090, Relevance: 19.6, APIs: 13, Instructions: 114COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0036B0D4

Part of subcall function 0036A306: _free.LIBCMT ref: 0036A323
Part of subcall function 0036A306: _free.LIBCMT ref: 0036A335
Part of subcall function 0036A306: _free.LIBCMT ref: 0036A347
Part of subcall function 0036A306: _free.LIBCMT ref: 0036A359
Part of subcall function 0036A306: _free.LIBCMT ref: 0036A36B
Part of subcall function 0036A306: _free.LIBCMT ref: 0036A37D
Part of subcall function 0036A306: _free.LIBCMT ref: 0036A38F
Part of subcall function 0036A306: _free.LIBCMT ref: 0036A3A1
Part of subcall function 0036A306: _free.LIBCMT ref: 0036A3B3
Part of subcall function 0036A306: _free.LIBCMT ref: 0036A3C5
Part of subcall function 0036A306: _free.LIBCMT ref: 0036A3D7
Part of subcall function 0036A306: _free.LIBCMT ref: 0036A3E9
Part of subcall function 0036A306: _free.LIBCMT ref: 0036A3FB

_free.LIBCMT ref: 0036B0C9

Part of subcall function 00364D06: RtlFreeHeap.NTDLL(00000000,00000000,?,0036AA73,?,00000000,?,00000000,?,0036AD17,?,00000007,?,?,0036B228,?), ref: 00364D1C
Part of subcall function 00364D06: GetLastError.KERNEL32(?,?,0036AA73,?,00000000,?,00000000,?,0036AD17,?,00000007,?,?,0036B228,?,?), ref: 00364D2E

_free.LIBCMT ref: 0036B0EB
_free.LIBCMT ref: 0036B100
_free.LIBCMT ref: 0036B10B
_free.LIBCMT ref: 0036B12D
_free.LIBCMT ref: 0036B140
_free.LIBCMT ref: 0036B14E
_free.LIBCMT ref: 0036B159
_free.LIBCMT ref: 0036B191
_free.LIBCMT ref: 0036B198
_free.LIBCMT ref: 0036B1B5
_free.LIBCMT ref: 0036B1CD

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 348180ce9b34d1ad48e436efa6d10b63f1f8a168e5af69bd29a6b3a7895ba4d2
Instruction ID: 3a00552ee7ef340a81b4f0d6b9a6b22a7e1648e705a1a5fc062bd541b5a375fe
Opcode Fuzzy Hash: 348180ce9b34d1ad48e436efa6d10b63f1f8a168e5af69bd29a6b3a7895ba4d2
Instruction Fuzzy Hash: 2D314B31A00204AFEB32AF39D845B5AB7E9EF02750F15D429E459DB25ADF31ACC08B60

Uniqueness

Uniqueness Score: -1.00%

Function 00336730, Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 250threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?), ref: 003367B2
GetCurrentThreadId.KERNEL32 ref: 003367D6
_Smanip.LIBCPMT ref: 00336837
_Smanip.LIBCPMT ref: 00336856
_Smanip.LIBCPMT ref: 003368F6
GetTickCount.KERNEL32 ref: 00336945
_Smanip.LIBCPMT ref: 003368C6

Part of subcall function 00325810: std::_Facet_Register.LIBCPMT ref: 0032591D

_Smanip.LIBCPMT ref: 0033688B

Part of subcall function 00325810: std::_Lockit::_Lockit.LIBCPMT ref: 00325851
Part of subcall function 00325810: std::_Lockit::_Lockit.LIBCPMT ref: 0032586C
Part of subcall function 00325810: std::_Lockit::~_Lockit.LIBCPMT ref: 0032588C
Part of subcall function 00325810: std::_Lockit::~_Lockit.LIBCPMT ref: 00325935

Strings

)] , xrefs: 00336990
VERBOSE, xrefs: 0033697B

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Smanipstd::_$Lockit$CurrentLockit::_Lockit::~_$CountFacet_ProcessRegisterThreadTick
String ID: )] $VERBOSE
API String ID: 3257458002-2781469043
Opcode ID: 5c25c1c89d785a0389ddd531bb4ce3f6015a6a45b81ea8644c42c315807ec3c9
Instruction ID: 3e997591621133f5cce300db003c97b4f9f6a35de94c30a064014e422c02034c
Opcode Fuzzy Hash: 5c25c1c89d785a0389ddd531bb4ce3f6015a6a45b81ea8644c42c315807ec3c9
Instruction Fuzzy Hash: 6B81D871E00204BFDB16EBB4EC86FADB7B9AF45304F048529F445AB292EB71A954C750

Uniqueness

Uniqueness Score: -1.00%

Function 001FC280, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 181clipboardtimewindowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 001FC2AC
KillTimer.USER32(?,00000005), ref: 001FC2DA
SetTimer.USER32(?,00000006,000001F4,00000000), ref: 001FC2F0
OpenClipboard.USER32(00000000), ref: 001FC3E5
EmptyClipboard.USER32 ref: 001FC3EF
CloseClipboard.USER32 ref: 001FC3F5
PostMessageW.USER32(?,00000403,00000000,00000000), ref: 001FC49E

Part of subcall function 00308D80: CreateToolhelp32Snapshot.KERNEL32 ref: 00308DAE
Part of subcall function 00308D80: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00308DC7
Part of subcall function 00308D80: Process32NextW.KERNEL32(00000000,0000022C), ref: 00308E16
Part of subcall function 00308D80: Process32NextW.KERNEL32(00000000,0000022C), ref: 00308E67
Part of subcall function 00308D80: CloseHandle.KERNEL32(00000000,?,00000000), ref: 00308E6E

Strings

d, xrefs: 001FC3FF

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ClipboardProcess32$CloseNextTimer$CreateEmptyFirstHandleKillMessageOpenPostSnapshotToolhelp32Window
String ID: d
API String ID: 3452913711-2564639436
Opcode ID: f66fab49ef2369279a0b763c7a74a9a480bfbaa25035a1b969f365e22f4ea6fa
Instruction ID: 3b043221cca2cd29416feca15d0667d4b4d32f7863e1b7e41b72792dbe1e88dc
Opcode Fuzzy Hash: f66fab49ef2369279a0b763c7a74a9a480bfbaa25035a1b969f365e22f4ea6fa
Instruction Fuzzy Hash: A05126B0294B0DAEF7359F61DD4BF767798AB10700F04850DF399461D2EBE16C05A7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0034F957, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBVCRUNTIME ref: 0034F977

Part of subcall function 0034F861: Replicator::operator[].LIBVCRUNTIME ref: 0034F8CD
Part of subcall function 0034F861: DName::operator+=.LIBVCRUNTIME ref: 0034F8D5

DName::operator+.LIBCMT ref: 0034F9CE
DName::DName.LIBVCRUNTIME ref: 0034FA17

Strings

void, xrefs: 0034FA0F
,<ellipsis>, xrefs: 0034F9C2, 0034F9C7
..., xrefs: 0034F9FA
<ellipsis>, xrefs: 0034FA01, 0034FA06
,..., xrefs: 0034F9BB

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 834187326-2211150622
Opcode ID: baa3c7e010143260d8278d179e8727ba572868e52ab6184a25432adfc4ffa666
Instruction ID: a6a44c356c697bf5eae53161a2d429f188f12a5511e14e27634dcdadcaf357da
Opcode Fuzzy Hash: baa3c7e010143260d8278d179e8727ba572868e52ab6184a25432adfc4ffa666
Instruction Fuzzy Hash: D7213B74600108AFCB0BDF5ED956F653BE8EB05348F098165E94ADF262DB32F9018B51

Uniqueness

Uniqueness Score: -1.00%

Function 003600AA, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMON

Download Yara Rule

APIs

Part of subcall function 00364BB7: GetLastError.KERNEL32(?,00000000,00355AE9,00000000,?,?,003548F1,?,?,00000000,00000000), ref: 00364BBB
Part of subcall function 00364BB7: _free.LIBCMT ref: 00364BEE
Part of subcall function 00364BB7: SetLastError.KERNEL32(00000000,?,00000000,00000000), ref: 00364C2F

_memcmp.LIBVCRUNTIME ref: 00360354
_free.LIBCMT ref: 003603C5
_free.LIBCMT ref: 003603DE
_free.LIBCMT ref: 00360410
_free.LIBCMT ref: 00360419
_free.LIBCMT ref: 00360425

Strings

C, xrefs: 00360212

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: _free$ErrorLast$_memcmp
String ID: C
API String ID: 4275183328-1037565863
Opcode ID: 8c58f61e9ea296d96164b05ef728efa88ab09525d7b0a0c68de711028f7bb671
Instruction ID: 5fcafe96afa4f59965610e1401072f4aa7a963f8cbb7d09d51e4971f2723996d
Opcode Fuzzy Hash: 8c58f61e9ea296d96164b05ef728efa88ab09525d7b0a0c68de711028f7bb671
Instruction Fuzzy Hash: 26B14D75901219DFDB2ADF18C885BAEB7B4FF09304F5085AAD949A7354E731AE90CF40

Uniqueness

Uniqueness Score: -1.00%

Function 003361B0, Relevance: 10.7, APIs: 7, Instructions: 227synchronizationfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001E0E20: std::_Lockit::_Lockit.LIBCPMT ref: 001E0E69
Part of subcall function 001E0E20: std::_Lockit::_Lockit.LIBCPMT ref: 001E0E8B
Part of subcall function 001E0E20: std::_Lockit::~_Lockit.LIBCPMT ref: 001E0EAB
Part of subcall function 001E0E20: std::_Lockit::~_Lockit.LIBCPMT ref: 001E0F78

OutputDebugStringA.KERNEL32(?,?,?), ref: 0033628D
WaitForSingleObject.KERNEL32(000000FF,?,?), ref: 003362FE
SetFilePointer.KERNEL32(00000000,00000000,00000002,?,?), ref: 00336326
WriteFile.KERNEL32(?,?,?,00000000), ref: 00336356
ReleaseMutex.KERNEL32(?,?), ref: 0033636B
SetLastError.KERNEL32(?,?,?), ref: 00336471
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 003364BF

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Lockitstd::_$FileLockit::_Lockit::~_$DebugErrorIos_base_dtorLastMutexObjectOutputPointerReleaseSingleStringWaitWritestd::ios_base::_
String ID:
API String ID: 2828274881-0
Opcode ID: 5284f2af97ca1ea3841e3dcd4547290dfb37cfe29a72eddc1e492a5ed97b28eb
Instruction ID: 7a5c589f7e340e333fb4266b135302dc5bb6100fcb236f559031985356a63ad0
Opcode Fuzzy Hash: 5284f2af97ca1ea3841e3dcd4547290dfb37cfe29a72eddc1e492a5ed97b28eb
Instruction Fuzzy Hash: 3E918370600208AFDB26DF55DC86F99B7F8EF04304F5084A9E64A9B162DB31BE89CF15

Uniqueness

Uniqueness Score: -1.00%

Function 003208F0, Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 201COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 0032098C
std::ios_base::_Addstd.LIBCPMT ref: 00320A0F
std::locale::_Init.LIBCPMT ref: 00320AB8

Strings

ios_base::failbit set, xrefs: 00320A31
ios_base::badbit set, xrefs: 00320A27, 00320A50, 00320A68
ios_base::eofbit set, xrefs: 00320A36

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Initstd::locale::_$Addstdstd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2938473529-1866435925
Opcode ID: 8ea3dd5cad68b7341e1c098acd30fc94ef27148b97ae02fdda8f204739e85dd9
Instruction ID: 52d7e18aefc0f88edcff4b6cbe52f8af26e60ee824a89a219ccb3cc784e618ca
Opcode Fuzzy Hash: 8ea3dd5cad68b7341e1c098acd30fc94ef27148b97ae02fdda8f204739e85dd9
Instruction Fuzzy Hash: C881A9B46007069FE715CF68D884B96BBE0FF09304F44852AE94A8BB42D7B5E858CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0030C070, Relevance: 10.7, APIs: 7, Instructions: 152windowthreadCOMMON

Download Yara Rule

APIs

GetTopWindow.USER32(00000000), ref: 0030C0C7
IsWindowVisible.USER32(00000000), ref: 0030C0D3
GetWindowLongW.USER32(00000000,000000EC), ref: 0030C0E0
GetAncestor.USER32(00000000,00000003), ref: 0030C0FE
GetLastActivePopup.USER32(00000000), ref: 0030C113
GetWindow.USER32(00000000,00000002), ref: 0030C14E
GetWindowThreadProcessId.USER32(00000000,?), ref: 0030C179

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Window$ActiveAncestorLastLongPopupProcessThreadVisible
String ID:
API String ID: 1964951579-0
Opcode ID: 6297477c6a7cd5617f42bfe92072ff9cb2d6582c4a8e7dd33f2892ab91929ab3
Instruction ID: 1a5fddb503a7be85c229483e0038be3dcd1e2decedd274cdb994ec13a28d2ec4
Opcode Fuzzy Hash: 6297477c6a7cd5617f42bfe92072ff9cb2d6582c4a8e7dd33f2892ab91929ab3
Instruction Fuzzy Hash: 15516F71D11219EBDF19DFA8D895BEEBBB9EF08714F21021AF815A3281D7309E41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003260D0, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 111COMMON

Download Yara Rule

APIs

Netbios.NETAPI32(00000037), ref: 00326120
Netbios.NETAPI32(00000037), ref: 0032615C
Netbios.NETAPI32(00000033), ref: 003261D6

Strings

* , xrefs: 0032617E
3, xrefs: 00326177
%02X%02X%02X%02X%02X%02X, xrefs: 00326211

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Netbios
String ID: %02X%02X%02X%02X%02X%02X$* $3
API String ID: 544444789-3860363367
Opcode ID: fda629d06e396b824b85c5fe3ac45459aa6b3aafb34f2f1fd8e4129ddf6631b6
Instruction ID: 5f5fb6dd3aeb9f5cc3b2f09e13f8f9aa9d98a393c0c968119302e22196eda310
Opcode Fuzzy Hash: fda629d06e396b824b85c5fe3ac45459aa6b3aafb34f2f1fd8e4129ddf6631b6
Instruction Fuzzy Hash: 0741F771A052A85BDF23DB649C02BE97BFC9F49304F0440EAE58CEB192D675AF44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00308710, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 89COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001C,00000000,CB28B7D0), ref: 0030874F
SHCreateDirectoryExW.SHELL32(00000000,?,00000000,\ScreenSaver\,0000000D,?,?), ref: 003087D4
WritePrivateProfileStringW.KERNEL32(%General,?,003ABBA4,?), ref: 00308818

Strings

%General, xrefs: 00308813
SSCI, xrefs: 003087DC
\ScreenSaver\, xrefs: 003087A4

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: CreateDirectoryFolderPathPrivateProfileSpecialStringWrite
String ID: %General$SSCI$\ScreenSaver\
API String ID: 3291460349-591173976
Opcode ID: 736220626bb3ba0547068bbe1ccff889a78e5d2356eda4be2f487728e902477b
Instruction ID: c3326c6cc29d9cb42b4e39bdf3ce5d0660ba856888b837359915b7b423bd59ba
Opcode Fuzzy Hash: 736220626bb3ba0547068bbe1ccff889a78e5d2356eda4be2f487728e902477b
Instruction Fuzzy Hash: BC316031950218EBDB21DF54DC99FDAB7B8FF15711F4001AAE509A7280DB74AB44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 001FA450, Relevance: 9.3, APIs: 6, Instructions: 261windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 001FA609
SendMessageW.USER32(00000000,0000000C,00000000,000000FF), ref: 001FA633
GetDlgItem.USER32 ref: 001FA6A9
SendMessageW.USER32(00000000,0000000C,00000000,000000FF), ref: 001FA6D3
GetDlgItem.USER32 ref: 001FA74D
SendMessageW.USER32(00000000,0000000C,00000000,000000FF), ref: 001FA777

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ItemMessageSend
String ID:
API String ID: 3015471070-0
Opcode ID: ca7a84ed89b7dc5d9e7fca65e15e37124d54893ae8e8f8c95a4693beb4d798e3
Instruction ID: 1ccb254ef9860a9580fd530e466045ad1ebab3d318a511926735d9d5fe0667d2
Opcode Fuzzy Hash: ca7a84ed89b7dc5d9e7fca65e15e37124d54893ae8e8f8c95a4693beb4d798e3
Instruction Fuzzy Hash: D5912576B00209CBCB1A9B24CC55BBE3776EF55310F90422DEA066B684EF759D428791

Uniqueness

Uniqueness Score: -1.00%

Function 0036D37C, Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00358657,00358657,?,?,?,0036D5CD,00000001,00000001,49E85006), ref: 0036D3D6
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0036D5CD,00000001,00000001,49E85006,?,?,?), ref: 0036D45C
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,49E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0036D556
__freea.LIBCMT ref: 0036D563

Part of subcall function 00364D40: RtlAllocateHeap.NTDLL(00000000,?,00000000,?,0036D689,?,00000000,?,00000003,00364C3A), ref: 00364D72

__freea.LIBCMT ref: 0036D56C
__freea.LIBCMT ref: 0036D591

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 2224f20136a6b3214c34741469278c18e93eacd6537bc68b3f84168507438739
Instruction ID: dacf9d779b226452299da1bc3267e9f569d8754b8da853594e0b9841132029d6
Opcode Fuzzy Hash: 2224f20136a6b3214c34741469278c18e93eacd6537bc68b3f84168507438739
Instruction Fuzzy Hash: 45511172F00206AFDB279F60DC81EBB77A9EB45754F168629FE06DB158DB30DC5086A0

Uniqueness

Uniqueness Score: -1.00%

Function 003605C2, Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 003605EE
__cftoe.LIBCMT ref: 00360620

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 33a4e11dca0f8a4477a2fee9199f62b9c5a90c57e2f32302021e150d444baa2a
Instruction ID: b7cdf0240b2b1908cedbdc831bb41fc00fc93e7048d6c75ad9a7f4204c7bb25c
Opcode Fuzzy Hash: 33a4e11dca0f8a4477a2fee9199f62b9c5a90c57e2f32302021e150d444baa2a
Instruction Fuzzy Hash: 17512D32900205ABDB2B9F68CC43EAF77B8DF89360F15C219F815DA19ADB31D9108A64

Uniqueness

Uniqueness Score: -1.00%

Function 001ED9A0, Relevance: 9.1, APIs: 6, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001ED9D5
std::_Lockit::_Lockit.LIBCPMT ref: 001ED9F7
std::_Lockit::~_Lockit.LIBCPMT ref: 001EDA17
__Getcvt.LIBCPMT ref: 001EDAB0
std::_Facet_Register.LIBCPMT ref: 001EDAE7
std::_Lockit::~_Lockit.LIBCPMT ref: 001EDAFF

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcvtRegister
String ID:
API String ID: 3552396256-0
Opcode ID: 3bb4e872f7bd7ebe8f42d05e6b72e147b327df7359f1a22441b87b8477a6e31e
Instruction ID: f21ab1452300b29f6a26baedac4dcf8c28e2211d84bb4c8653f78f0c87185d08
Opcode Fuzzy Hash: 3bb4e872f7bd7ebe8f42d05e6b72e147b327df7359f1a22441b87b8477a6e31e
Instruction Fuzzy Hash: 6E411171904655CFCB16CF55E841AAEB7F4FF58300F1581ADE846AB392EB30BA84CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0034D0D5, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0034D0CC,0034AB44,0031CC4C,00000008,0031CF71,?,?,?,?,001E1F97,?,?,CB28B7D0), ref: 0034D0E3
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0034D0F1
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0034D10A
SetLastError.KERNEL32(00000000,?,0034D0CC,0034AB44,0031CC4C,00000008,0031CF71,?,?,?,?,001E1F97,?,?,CB28B7D0), ref: 0034D15C

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 738f28e5d20f852e452503904cb7bd1653bb092979b75369e72976c1a09690bf
Instruction ID: 4ca501f7a918166b42529ded343b1f9078293cddbcc5b856e882fba4744ac68a
Opcode Fuzzy Hash: 738f28e5d20f852e452503904cb7bd1653bb092979b75369e72976c1a09690bf
Instruction Fuzzy Hash: 6401F7761093115EE6672B787C8BA1A27DCEF013BAF71073AFA204E6E4EF526C019544

Uniqueness

Uniqueness Score: -1.00%

Function 0032C6B0, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(003081F3,00000000,00000000), ref: 0032C6E3
CreateDirectoryW.KERNEL32(?,00000000,?,?), ref: 0032C7F2
GetLastError.KERNEL32 ref: 0032C7FC

Part of subcall function 0032CBB0: GetFileAttributesW.KERNEL32(?,?,0032C812,003081F3), ref: 0032CBBF

Strings

Check failed: *error != base::PLATFORM_FILE_OK. , xrefs: 0032C7C2
c:\qt\givememoney\base\file_util_win.cc, xrefs: 0032C7AF

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: AttributesFile$CreateDirectoryErrorLast
String ID: Check failed: *error != base::PLATFORM_FILE_OK. $c:\qt\givememoney\base\file_util_win.cc
API String ID: 3262623940-3979710063
Opcode ID: e90a3c965f8ecb6072956d2ef0bba05fae0d265cedfc19a60d10691072be3886
Instruction ID: f1a325fdf2b738eda95f1cca93ae57cc1f60d7c247251cb3be5a9f55ec53308f
Opcode Fuzzy Hash: e90a3c965f8ecb6072956d2ef0bba05fae0d265cedfc19a60d10691072be3886
Instruction Fuzzy Hash: 7B412736E102249FCF229F68FC466FDB3B8EF55311F10616AE8416B281EB319D45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001FC1E0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47timeCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 001FC21F
ShellExecuteW.SHELL32(00000000,open,00000054,00000200,00000000,00000000), ref: 001FC251
KillTimer.USER32(?,00000005), ref: 001FC263
SetTimer.USER32(?,00000005,00000032,00000000), ref: 001FC272

Part of subcall function 00308EB0: CreateToolhelp32Snapshot.KERNEL32 ref: 00308EDB
Part of subcall function 00308EB0: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00308EF4
Part of subcall function 00308EB0: Process32NextW.KERNEL32(00000000,0000022C), ref: 00308F4D
Part of subcall function 00308EB0: OpenProcess.KERNEL32(00100001,00000000,?,?,?,00000000), ref: 00308FB1
Part of subcall function 00308EB0: TerminateProcess.KERNEL32(00000000,00000000,?,?,00000000), ref: 00308FC0
Part of subcall function 00308EB0: CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 00308FC7
Part of subcall function 00308EB0: Process32NextW.KERNEL32(00000000,0000022C), ref: 00308FD7
Part of subcall function 00308EB0: CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 00308FE2

Strings

open, xrefs: 001FC24A

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Process32$CloseHandleNextProcessTimer$CountCreateExecuteFirstKillOpenShellSnapshotTerminateTickToolhelp32
String ID: open
API String ID: 271766535-2758837156
Opcode ID: 078e50f12e6048e8f2b82bd4d14399065b10c24e1a87395b68dc40fd3f74d93b
Instruction ID: 5129e764d49e7d8f197c95d682f1796e344d73670b51cbfc1a34167ecf00cdce
Opcode Fuzzy Hash: 078e50f12e6048e8f2b82bd4d14399065b10c24e1a87395b68dc40fd3f74d93b
Instruction Fuzzy Hash: 68118230181B08EFE726DBA0CD4AFA27BE9EB02705F00055EE296561E1D7B17844CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0035E337, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0035E2E8,00000000,?,0035E288,00000000,003B7EA8,0000000C,0035E3DF,00000000,00000002), ref: 0035E357
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0035E36A
FreeLibrary.KERNEL32(00000000,?,?,?,0035E2E8,00000000,?,0035E288,00000000,003B7EA8,0000000C,0035E3DF,00000000,00000002), ref: 0035E38D

Strings

mscoree.dll, xrefs: 0035E350
CorExitProcess, xrefs: 0035E362

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d395b0281d4aa3dc4b708e23633e3c47bbf3c9bda936cfe9d48a37251acd8194
Instruction ID: d9240d2ea15bbe25a12408d77155ddc0256e5a332ab9249a1fa4ccae03a9060b
Opcode Fuzzy Hash: d395b0281d4aa3dc4b708e23633e3c47bbf3c9bda936cfe9d48a37251acd8194
Instruction Fuzzy Hash: CAF04475605208BBCB165F90DC09FDDBFB8EF04716F010166FC05A2160DB358A45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0036A7C0, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0036A7D8

Part of subcall function 00364D06: RtlFreeHeap.NTDLL(00000000,00000000,?,0036AA73,?,00000000,?,00000000,?,0036AD17,?,00000007,?,?,0036B228,?), ref: 00364D1C
Part of subcall function 00364D06: GetLastError.KERNEL32(?,?,0036AA73,?,00000000,?,00000000,?,0036AD17,?,00000007,?,?,0036B228,?,?), ref: 00364D2E

_free.LIBCMT ref: 0036A7EA
_free.LIBCMT ref: 0036A7FC
_free.LIBCMT ref: 0036A80E
_free.LIBCMT ref: 0036A820

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 663c868889810892037d02a3f697f673e0701d4b43d6418176b963a54f731363
Instruction ID: 4ee24c79141ee48c4be68a4a7672f71b464c00b25aa85dd6fca544b2a379c71e
Opcode Fuzzy Hash: 663c868889810892037d02a3f697f673e0701d4b43d6418176b963a54f731363
Instruction Fuzzy Hash: 7BF01232D046046BC633EF58F8C2C1A77EDEA05B14B65E815F144EB606CB34FCC18AA5

Uniqueness

Uniqueness Score: -1.00%

Function 00328070, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00328141

Strings

null, xrefs: 0032808A
Check failed: it != outbuf.begin(). , xrefs: 00327F2F, 00327FC0, 00328115, 003281B5
c:\qt\givememoney\base\strings\string_number_conversions.cc, xrefs: 00327F19, 00327FAA, 00328105, 0032819F

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: __aulldiv
String ID: Check failed: it != outbuf.begin(). $c:\qt\givememoney\base\strings\string_number_conversions.cc$null
API String ID: 3732870572-2671372734
Opcode ID: 300692b87b2c6d6a052134f809c47146ebe11eff1599e5c7495d605a3b14e0d1
Instruction ID: 13ae5aff1e18e39c3ae9c19debe5016363ba3bf6f8540f402e34819d3a1481bf
Opcode Fuzzy Hash: 300692b87b2c6d6a052134f809c47146ebe11eff1599e5c7495d605a3b14e0d1
Instruction Fuzzy Hash: F7511871E002189FDF16DFA8DCC2BEDB7B0EF54300F148559E511AB282DB74A946CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00341700, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00341871

Part of subcall function 00340F90: InitializeCriticalSectionAndSpinCount.KERNEL32(00000000,000007D0,?,00336B7E), ref: 00340F99

Strings

vs. , xrefs: 003417A7
c:\qt\givememoney\base\metrics\sparse_histogram.cc, xrefs: 00341882
SPARSE_HISTOGRAM == histogram->GetHistogramType(), xrefs: 003417B9

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: CountCriticalInitializeIos_base_dtorSectionSpinstd::ios_base::_
String ID: vs. $SPARSE_HISTOGRAM == histogram->GetHistogramType()$c:\qt\givememoney\base\metrics\sparse_histogram.cc
API String ID: 1183622951-3267471456
Opcode ID: 9a610fb0ab2fec01832237a5e72bb4734edfdd4554d3af4c1cbcf02633961d93
Instruction ID: f46f671fbfac730224da1f42e5b442f345665c2920d22c6b3ea98fa9d6c6e57b
Opcode Fuzzy Hash: 9a610fb0ab2fec01832237a5e72bb4734edfdd4554d3af4c1cbcf02633961d93
Instruction Fuzzy Hash: D841D375A006145BCB26EB74DC46FDEB7E4AF45700F004464F80DAF352EE71AA898B91

Uniqueness

Uniqueness Score: -1.00%

Function 001D4130, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 001D4175
GetFileVersionInfoW.VERSION(?,00000000,00000000,?,?,?), ref: 001D41A1
VerQueryValueW.VERSION(?,003A8C58,?,?,?,00000000,00000000,?,?,?), ref: 001D41C9

Strings

%d.%d.%d.%d, xrefs: 001D4200

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID: %d.%d.%d.%d
API String ID: 2179348866-3491811756
Opcode ID: 1300cbf564b048acb8090dd61b9fd68d72062eb87f2b744b61abe9caad01686b
Instruction ID: b0570324d81693bc2a6343bd33a1693286f12eb92363abf4f2ebb486b9ad1043
Opcode Fuzzy Hash: 1300cbf564b048acb8090dd61b9fd68d72062eb87f2b744b61abe9caad01686b
Instruction Fuzzy Hash: F431D6B16012189BCB24DB55DC45EBAB3BCEF44700F4445AAFA19D7181DB30EE85CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 00336650, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,ios_base::failbit set), ref: 00336676
SimpleUString::operator=.MSOBJ140-MSVCRT ref: 00336698

Strings

debug.log, xrefs: 003366F2
ios_base::badbit set, xrefs: 00336663

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: FileModuleNameSimpleString::operator=
String ID: debug.log$ios_base::badbit set
API String ID: 912069222-3077188659
Opcode ID: 58e9ecca9f72d93b495cd3e05c64ec01f0ff4e2eb440bbcb9698d810c771593b
Instruction ID: 1c375f3fec7b46903f6e3053e968a262f275ac3e7644391da8db658b06d9b04f
Opcode Fuzzy Hash: 58e9ecca9f72d93b495cd3e05c64ec01f0ff4e2eb440bbcb9698d810c771593b
Instruction Fuzzy Hash: D3210830710704AFCB31DF28C896A6EB3F9FF84744F11866ED551CB290DBB0A9458791

Uniqueness

Uniqueness Score: -1.00%

Function 00332620, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 74networkCOMMON

Download Yara Rule

APIs

InternetCrackUrlW.WININET(?,?,N3,0000003C), ref: 003326CA

Strings

, xrefs: 00332667
<, xrefs: 00332657
N3, xrefs: 003326C3

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: CrackInternet
String ID: N3$ $<
API String ID: 1381609488-3874681948
Opcode ID: 3071fb918a6da631e689a022570c3bceb496cb493d0ccfbb3b584240bc3a85ef
Instruction ID: 7abf71e1f06ec175358d9e0bb0b3d9cac18949adc006a95136f63d5b09b75842
Opcode Fuzzy Hash: 3071fb918a6da631e689a022570c3bceb496cb493d0ccfbb3b584240bc3a85ef
Instruction Fuzzy Hash: E63118748003099ADB24DF99D8887EEBBF8FF04314F10851AE85AA7290D7B569898F90

Uniqueness

Uniqueness Score: -1.00%

Function 0031F93E, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000D,?,0031C54D,00000001,00320A49,?,00000000,?,001DC447,003C6D54,001E1650,003C6D58,?,00320A49,00000001,00000001), ref: 0031F9C2

Strings

ios_base::failbit set, xrefs: 0031F941
Xm<, xrefs: 0031F99E, 0031F950

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ErrorLast
String ID: Xm<$ios_base::failbit set
API String ID: 1452528299-3145023179
Opcode ID: 5b1ecab0d34602022fbd0a816ae34a8040e1cc0d63572fa0575dd354fa099587
Instruction ID: 26f932516814f7de8c34fbca21725c19d1c961eca28dbfe8812ccbca02086656
Opcode Fuzzy Hash: 5b1ecab0d34602022fbd0a816ae34a8040e1cc0d63572fa0575dd354fa099587
Instruction Fuzzy Hash: C6118232210215BFCF176F64DC44AAEB769BF4C755F028039F945D6220DB319851CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003650C4, Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0036514F
__alldvrm.LIBCMT ref: 00365350
__alldvrm.LIBCMT ref: 00365372

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 28f0e84ff7fb5002b5d8c937d361d8b050d2cdb14eb25cf1cfcc1d772b7d27b0
Instruction ID: 750ae9af7f5712fdfdc73491fb4b027afc32f0962d501932c6f86009fdfc3a84
Opcode Fuzzy Hash: 28f0e84ff7fb5002b5d8c937d361d8b050d2cdb14eb25cf1cfcc1d772b7d27b0
Instruction Fuzzy Hash: 4DA16936A00B869FDB23CF18C8917AEBBE5EF16350F2985BDE4859B386C2748D41C750

Uniqueness

Uniqueness Score: -1.00%

Function 001E8790, Relevance: 6.2, APIs: 4, Instructions: 194COMMON

Download Yara Rule

APIs

Part of subcall function 0031C278: mtx_do_lock.LIBCPMT ref: 0031C280

__Mtx_unlock.LIBCPMT ref: 001E8883

Part of subcall function 0031D7CA: std::future_error::future_error.LIBCPMT ref: 0031D7DB
Part of subcall function 0031D7CA: __CxxThrowException@8.LIBVCRUNTIME ref: 0031D7E9

std::_Rethrow_future_exception.LIBCPMT ref: 001E88D7

Part of subcall function 0031D7A7: __EH_prolog3.LIBCMT ref: 0031D7AE

std::_Rethrow_future_exception.LIBCPMT ref: 001E88E7
__Mtx_unlock.LIBCPMT ref: 001E899F

Part of subcall function 0031BE39: std::_Throw_Cpp_error.LIBCPMT ref: 0031BE60

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: std::_$Mtx_unlockRethrow_future_exception$Cpp_errorException@8H_prolog3ThrowThrow_mtx_do_lockstd::future_error::future_error
String ID:
API String ID: 1557590360-0
Opcode ID: d00f515d91e44facf17255a8e250fcd73bcae764c168d7d97dfd444218f53134
Instruction ID: 7eda30aa4cf157ce5b942817394b73ff5cb77987cdfd6b1ba0603900a4d643cb
Opcode Fuzzy Hash: d00f515d91e44facf17255a8e250fcd73bcae764c168d7d97dfd444218f53134
Instruction Fuzzy Hash: 2561F8B1C00688ABDF26DBA5D805BEFFBF49F15304F04056DE90667281EB759A48C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 001E24B0, Relevance: 6.1, APIs: 4, Instructions: 133threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 001E255A
GetCurrentThreadId.KERNEL32 ref: 001E257E
__Mtx_unlock.LIBCPMT ref: 001E25D5
__Cnd_broadcast.LIBCPMT ref: 001E25F5

Part of subcall function 0031C278: mtx_do_lock.LIBCPMT ref: 0031C280

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThreadmtx_do_lock
String ID:
API String ID: 3471820992-0
Opcode ID: 45c4d9def8f70d433a6c0267ee0ebf17d26c9f5030f8ad428c91d5cae7e6a9f8
Instruction ID: 9a67dc0881501b84c1ed08c70154f590250fd80f2a454705cbc92f32e7f81f53
Opcode Fuzzy Hash: 45c4d9def8f70d433a6c0267ee0ebf17d26c9f5030f8ad428c91d5cae7e6a9f8
Instruction Fuzzy Hash: 2A41E1B1A00601AFDB15DF65CD51B9AB7E8EF19310F044639E81ACB390EB75EA04CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 001E97A0, Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 0031C278: mtx_do_lock.LIBCPMT ref: 0031C280

__Mtx_unlock.LIBCPMT ref: 001E97F7
__Mtx_unlock.LIBCPMT ref: 001E9833
__Cnd_broadcast.LIBCPMT ref: 001E9880
__Mtx_unlock.LIBCPMT ref: 001E989D

Part of subcall function 0031BE39: std::_Throw_Cpp_error.LIBCPMT ref: 0031BE60

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Mtx_unlock$Cnd_broadcastCpp_errorThrow_mtx_do_lockstd::_
String ID:
API String ID: 3303054500-0
Opcode ID: 4216563b01085c31aae961cc2205fd06b0b6e4ee7266d85bfd3d619e495c81e2
Instruction ID: 1ec15d8ffeae3ee4d559a268c7554afb377aca9ece64a5c67442e0f03fb64443
Opcode Fuzzy Hash: 4216563b01085c31aae961cc2205fd06b0b6e4ee7266d85bfd3d619e495c81e2
Instruction Fuzzy Hash: E231E3F2D00644ABEB119F659D06BCAF7ACEB15310F044175EC1597351E771EA18C6B2

Uniqueness

Uniqueness Score: -1.00%

Function 0031D080, Relevance: 6.1, APIs: 4, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0031D0D8
__Xtime_diff_to_millis2.LIBCPMT ref: 0031D0F2
_xtime_get.LIBCPMT ref: 0031D115
__Xtime_diff_to_millis2.LIBCPMT ref: 0031D121

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: a2c590563f17a1f21fbfbbf0b99384b043d93111454ea3ed7dbaece0c4f976d4
Instruction ID: bfb08dc484a10073248ff2b2a89b1b7ad5bcf739a3aac61c751e8ac6caf5fbb8
Opcode Fuzzy Hash: a2c590563f17a1f21fbfbbf0b99384b043d93111454ea3ed7dbaece0c4f976d4
Instruction Fuzzy Hash: 81215171A10219AFDF0AEFA4DC819FEB7B9EF0D714F100066F901AB251DB749D418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 001FA3B0, Relevance: 6.1, APIs: 4, Instructions: 60windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00308A70: GetModuleHandleW.KERNEL32(00000000,00000000,00000000,?,CB28B7D0), ref: 00308A8C
Part of subcall function 00308A70: FindResourceW.KERNEL32(00000000,?,PNG), ref: 00308A9E
Part of subcall function 00308A70: GetLastError.KERNEL32(?,PNG), ref: 00308AAA

GetDlgItem.USER32 ref: 001FA3EA
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,00000000,00000000), ref: 001FA406
SendMessageW.USER32(00000000,000000F7,00000000,00000000), ref: 001FA423
DeleteObject.GDI32(00000000), ref: 001FA42C

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: BitmapCreateDeleteErrorFindFromGdipHandleItemLastMessageModuleObjectResourceSend
String ID:
API String ID: 3303639060-0
Opcode ID: 2e30afda20455dfdbce2591e953032961df56900a8061e495ac48aac73a9fc87
Instruction ID: c7d50a96ab69952475b947657b1da85486f17ac74cc911969fadedbb56f2073e
Opcode Fuzzy Hash: 2e30afda20455dfdbce2591e953032961df56900a8061e495ac48aac73a9fc87
Instruction Fuzzy Hash: CF119175A00208AFDB219F64DC89FBEBBBCEF48700F544069E909E7290DB71DD419751

Uniqueness

Uniqueness Score: -1.00%

Function 001FB530, Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 0031C278: mtx_do_lock.LIBCPMT ref: 0031C280

__Cnd_signal.LIBCPMT ref: 001FB586
__Mtx_unlock.LIBCPMT ref: 001FB59E
SystemParametersInfoW.USER32 ref: 001FB5BB
__Cnd_do_broadcast_at_thread_exit.LIBCPMT ref: 001FB5C1

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Cnd_do_broadcast_at_thread_exitCnd_signalInfoMtx_unlockParametersSystemmtx_do_lock
String ID:
API String ID: 1329664465-0
Opcode ID: f836c2c5227227e4d6c57ca15403b9b64e96b0a6636f3359794e166c256bdf42
Instruction ID: 0354cff67f1ff51673a4945cdbb22bddce15d41ee1ab91007647cbd58c2afa35
Opcode Fuzzy Hash: f836c2c5227227e4d6c57ca15403b9b64e96b0a6636f3359794e166c256bdf42
Instruction Fuzzy Hash: 08112CB1D04704BBE7226F61EC02B97B7ACEF05710F040935FD1A967A1F775E5148A62

Uniqueness

Uniqueness Score: -1.00%

Function 00366156, Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,003548F1,00000000,00000000,?,003660FD,003548F1,00000000,00000000,00000000,?,003663DB,00000006,FlsSetValue), ref: 00366188
GetLastError.KERNEL32(?,003660FD,003548F1,00000000,00000000,00000000,?,003663DB,00000006,FlsSetValue,0039FAD4,FlsSetValue,00000000,00000364,?,00364C89), ref: 00366194
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,003660FD,003548F1,00000000,00000000,00000000,?,003663DB,00000006,FlsSetValue,0039FAD4,FlsSetValue,00000000), ref: 003661A2

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 2ab77dde35f3bfb4049ddbddc7890fb8abe3d140e9a6370398d3a692a9829c61
Instruction ID: 2e3606f03ab1075009bba840d223f13703c0f2362078d79c28cfe6c2e64e41fc
Opcode Fuzzy Hash: 2ab77dde35f3bfb4049ddbddc7890fb8abe3d140e9a6370398d3a692a9829c61
Instruction Fuzzy Hash: 3B012B32211222ABC7334B78AC46E567B9CAF177E1F224625F906E7141D722DC11C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00335460, Relevance: 6.0, APIs: 4, Instructions: 19sleepsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,73BCF7F0,002C063D), ref: 0033546D
CloseHandle.KERNEL32(?,73BCF7F0,002C063D), ref: 00335477
CloseHandle.KERNEL32(?), ref: 0033548A
Sleep.KERNEL32(0000000A), ref: 0033549C

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: CloseHandle$ObjectSingleSleepWait
String ID:
API String ID: 2593906732-0
Opcode ID: bad3ee672808b93cfc29affce6055efe117dfd7de827426e82e178cf35f61172
Instruction ID: 88a6e91ef6026f756192c66086fbcb83ed187dfd56518a06db6673cd18f1a31d
Opcode Fuzzy Hash: bad3ee672808b93cfc29affce6055efe117dfd7de827426e82e178cf35f61172
Instruction Fuzzy Hash: 2FE0BF71204601ABDB155F65EC4CF45FBACFB55322F01C306F129C22A4CB769455CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00325210, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 003208F0: std::locale::_Init.LIBCPMT ref: 0032098C
Part of subcall function 003208F0: std::ios_base::_Addstd.LIBCPMT ref: 00320A0F

std::locale::_Init.LIBCPMT ref: 00325292

Part of subcall function 0031B684: __EH_prolog3.LIBCMT ref: 0031B68B
Part of subcall function 0031B684: std::_Lockit::_Lockit.LIBCPMT ref: 0031B696
Part of subcall function 0031B684: std::locale::_Setgloballocale.LIBCPMT ref: 0031B6B1
Part of subcall function 0031B684: _Yarn.LIBCPMT ref: 0031B6C7
Part of subcall function 0031B684: std::_Lockit::~_Lockit.LIBCPMT ref: 0031B707

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00325449

Strings

vs. , xrefs: 003252CF

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: std::locale::_$InitLockitstd::_std::ios_base::_$AddstdH_prolog3Ios_base_dtorLockit::_Lockit::~_SetgloballocaleYarn
String ID: vs.
API String ID: 3379718361-795465908
Opcode ID: dc614da3c6f019eec55a1039415fad6180ada233ccf74f821b3b094a2947df12
Instruction ID: d04d588f666dd6dba9f3717127503ad1b268c12e9425a7ad613e739a2a336a5b
Opcode Fuzzy Hash: dc614da3c6f019eec55a1039415fad6180ada233ccf74f821b3b094a2947df12
Instruction Fuzzy Hash: 71612A75E00218CFDB25DFA4D885BDEB7B4BB45704F1081A9E90DAB342DB71AA49CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0036B901, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,0036BB5C,?,00000050,?,?,?,?,?), ref: 0036B9DC

Strings

ACP, xrefs: 0036B91F
OCP, xrefs: 0036B955

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: d1f273c745bb2ff963dde1a1280705dbed82a467eab16c28bcfaeef284c7b631
Instruction ID: 9b2a984c021027518a77d988b416693e7debec3fb3df44c8d524b922d132275e
Opcode Fuzzy Hash: d1f273c745bb2ff963dde1a1280705dbed82a467eab16c28bcfaeef284c7b631
Instruction Fuzzy Hash: 4721B663A00105A6DB278B65C901BA7F3EAEF50B64F57C424EB4AD7208E732DD81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0030F850, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0030F89E

Part of subcall function 0034ADEF: RaiseException.KERNEL32(?,?,0031B3D9,?,?,?,00000000,?,?,?,?,0031B3D9,?,003B7370,6F8373B0,?), ref: 0034AE4F

___std_exception_copy.LIBVCRUNTIME ref: 0030F8F2

Strings

BufferedTransformation: this object is not attachable, xrefs: 0030F875

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow___std_exception_copy
String ID: BufferedTransformation: this object is not attachable
API String ID: 640887848-3944187330
Opcode ID: 2252698b4a76fd76183c3602f4dc04f77287b968c63bf6be3dc8d5362458049e
Instruction ID: 184c9aad6e013a2179f6712f3037dd49b106c8ae0bee03a57a49e79ca50849fb
Opcode Fuzzy Hash: 2252698b4a76fd76183c3602f4dc04f77287b968c63bf6be3dc8d5362458049e
Instruction Fuzzy Hash: 722150B6910609EFC701DF55D841FDAF7FCFB15710F10862AE511A7640EB74AA04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0030F570, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0030F5BE

Part of subcall function 0034ADEF: RaiseException.KERNEL32(?,?,0031B3D9,?,?,?,00000000,?,?,?,?,0031B3D9,?,003B7370,6F8373B0,?), ref: 0034AE4F

___std_exception_copy.LIBVCRUNTIME ref: 0030F612

Strings

Clone() is not implemented yet., xrefs: 0030F595

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow___std_exception_copy
String ID: Clone() is not implemented yet.
API String ID: 640887848-226299721
Opcode ID: 8b91e06dd8e6141347182760907408569c2a5d22c7495d6cf57b34835712ee4f
Instruction ID: 97f56f7c915c1447806f40acec82db76b7ce8a90f069e75c946aa06a44ac42ff
Opcode Fuzzy Hash: 8b91e06dd8e6141347182760907408569c2a5d22c7495d6cf57b34835712ee4f
Instruction Fuzzy Hash: B32150B6910609EFC701DF55D841FDAF7FCFB15710F10862AE511A7640EB74AA04CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0033D790, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0033D88D

Strings

vs. , xrefs: 0033D7CB
pa<, xrefs: 0033D799

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: vs. $pa<
API String ID: 323602529-118028726
Opcode ID: 9a0b73658f9c7370f880fb090ac3030eae5188f539b31341a7b526568d01179e
Instruction ID: 143207a499120d09644990f6c32d9bcebdbf5110008dbcecbbf88b3b6c407ecc
Opcode Fuzzy Hash: 9a0b73658f9c7370f880fb090ac3030eae5188f539b31341a7b526568d01179e
Instruction Fuzzy Hash: 73219575A002189BCF56EF78EC46FD9B7A4AF05314F0044A5F80CAB342DA71A9898F90

Uniqueness

Uniqueness Score: -1.00%

Function 001DC020, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001DC03D
std::_Lockit::~_Lockit.LIBCPMT ref: 001DC059

Strings

Be3, xrefs: 001DC03A, 001DC056

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: Be3
API String ID: 593203224-721780296
Opcode ID: 3e2f96bbdf377c313bd9f3943463a665f8d8e9158586d50794fa8314c23f8059
Instruction ID: 61d63b4f1bc326d24e818b53fc13fc3f39f94b7fde399e5a6b9f09d8fb08d578
Opcode Fuzzy Hash: 3e2f96bbdf377c313bd9f3943463a665f8d8e9158586d50794fa8314c23f8059
Instruction Fuzzy Hash: 8FF08C30910209EBDB29EF54EC41AA8B7F8EB18300F5004AEE48197381EF706E88CB85

Uniqueness

Uniqueness Score: -1.00%

Function 003533BA, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 003533EB
DName::DName.LIBVCRUNTIME ref: 003533F7

Strings

{flat}, xrefs: 003533E1

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: NameName::
String ID: {flat}
API String ID: 1333004437-2606204563
Opcode ID: 4a668298a4574ad5a022e019bfc572fc21d93fee6ad13257d6450d439687214f
Instruction ID: 9c1ffca5a2fd0c4d58d5ffc6659d4fd49bed7da0ad3d77a08658284b894a8164
Opcode Fuzzy Hash: 4a668298a4574ad5a022e019bfc572fc21d93fee6ad13257d6450d439687214f
Instruction Fuzzy Hash: 44F065751402089FD706CF59D556FB53BD8EF01756F05C044E94D4F262CB75E9448791

Uniqueness

Uniqueness Score: -1.00%

Function 003278B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

SHSetValueA.SHLWAPI(80000001,Software\Microsoft\Windows\CurrentVersion\Uninstall\HYJiang,mid,00000001,?,?,?,?,0032609B,?,00001000,?,00001000,?,003A8C5C), ref: 003278DC

Strings

mid, xrefs: 003278CD
Software\Microsoft\Windows\CurrentVersion\Uninstall\HYJiang, xrefs: 003278D2

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: Value
String ID: Software\Microsoft\Windows\CurrentVersion\Uninstall\HYJiang$mid
API String ID: 3702945584-2448618358
Opcode ID: 27d8e1844bd0d75535a0abba15e9e2986eb12837f0e235a3cf6c3df208dfb256
Instruction ID: 6700515e03d07dd8383fc3700ea94026998bad0f561c49a507b6ad13f0a965e3
Opcode Fuzzy Hash: 27d8e1844bd0d75535a0abba15e9e2986eb12837f0e235a3cf6c3df208dfb256
Instruction Fuzzy Hash: 96E0C271240314AFDA020B546C19DF37BACDB86B41F048040FE8C9B103CA61980082D4

Uniqueness

Uniqueness Score: -1.00%

Function 0031B3DA, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0031B3E6
__CxxThrowException@8.LIBVCRUNTIME ref: 0031B3F4

Part of subcall function 0034ADEF: RaiseException.KERNEL32(?,?,0031B3D9,?,?,?,00000000,?,?,?,?,0031B3D9,?,003B7370,6F8373B0,?), ref: 0034AE4F

Strings

bad function call, xrefs: 0031B3FA

Memory Dump Source

Source File: 00000000.00000002.669225094.00000000001C1000.00000020.00020000.sdmp, Offset: 001C0000, based on PE: true

Associated: 00000000.00000002.669218827.00000000001C0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669437430.0000000000394000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.669462546.00000000003BC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669470292.00000000003C1000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.669476147.00000000003C3000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669480865.00000000003C6000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.669487575.00000000003CC000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1c0000_winhost.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::invalid_argument::invalid_argument
String ID: bad function call
API String ID: 4038826145-3612616537
Opcode ID: baca73a6b7349c38724b346b41ee95f30e7b0f9167dda76894ed3dea4f15cb44
Instruction ID: 7c44079f103047c448f30bc890efa9c18fb310a2e90ba2d30a2d11ac2ec51f82
Opcode Fuzzy Hash: baca73a6b7349c38724b346b41ee95f30e7b0f9167dda76894ed3dea4f15cb44
Instruction Fuzzy Hash: A6C0122DC0410C77CF0AF6E4DC17DCD77AC9A04300B844460BA20964D1E7B0A61686D1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	API monitoring, MBR, VBR
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report winhost.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

CPU Usage

Memory Usage

Function 00325460, Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 241
libraryloaderCOMMON

Function 001F4B10, Relevance: 90.0, APIs: 35, Strings: 16, Instructions: 702
COMMON

Function 001DCC20, Relevance: 46.0, APIs: 22, Strings: 4, Instructions: 513
COMMON

Function 00326250, Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 221
registryfilestringCOMMON

Function 00306E70, Relevance: 21.7, APIs: 7, Strings: 5, Instructions: 744
synchronizationCOMMON

Function 001D4A90, Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 249
registryCOMMON

Function 003309D0, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156
registryCOMMON

Function 0030B9A0, Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 362
COMMON

Function 00325810, Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 202
COMMON

Function 001DC860, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 98
COMMON

Function 00367CA2, Relevance: 13.8, APIs: 9, Instructions: 300
COMMONLIBRARYCODE

Function 003723DC, Relevance: 13.8, APIs: 9, Instructions: 272
COMMONLIBRARYCODE

Function 001DE710, Relevance: 13.1, APIs: 1, Strings: 6, Instructions: 809
COMMON

Function 0030B530, Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 333
libraryloaderCOMMON

Function 00306830, Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 201
COMMON