Edit tour

Windows Analysis Report
Image Quote 011698.exe

Overview

General Information

Sample name:	Image Quote 011698.exe
Analysis ID:	1501083
MD5:	94c86f3cce220982807b72d29661c971
SHA1:	272c1496f143a9100bc98c92871cfd272f053b3b
SHA256:	131e90fc74d13419eca131909b92daab5a260bfbdbb8dfe1c31dafa16d224705
Tags:	exe

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Detected potential crypto function

Found potential string decryption / allocating functions

Program does not show much activity (idle)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Image Quote 011698.exe (PID: 7960 cmdline: "C:\Users\user\Desktop\Image Quote 011698.exe" MD5: 94C86F3CCE220982807B72D29661C971)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Image Quote 011698.exe	ReversingLabs: Detection: 55%
Source: Image Quote 011698.exe	Virustotal: Detection: 33%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for sample

Source: Image Quote 011698.exe

Joe Sandbox ML: detected

Source: Image Quote 011698.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

System Summary

Binary is likely a compiled AutoIt script file

Source: Image Quote 011698.exe, 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_12755b49-8
Source: Image Quote 011698.exe, 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_bb84c96a-b
Source: Image Quote 011698.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_848e5001-e
Source: Image Quote 011698.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_929d7af1-9

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Image Quote 011698.exe

Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FC8060	0_2_00FC8060
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_01032046	0_2_01032046
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_01028298	0_2_01028298
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FFE4FF	0_2_00FFE4FF
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FF676B	0_2_00FF676B
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_01054873	0_2_01054873
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FCCAF0	0_2_00FCCAF0
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FECAA0	0_2_00FECAA0
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FF6DD9	0_2_00FF6DD9
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FDAFAC	0_2_00FDAFAC
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FC91C0	0_2_00FC91C0
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FE1394	0_2_00FE1394
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FDB731	0_2_00FDB731
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FE1706	0_2_00FE1706
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FE781B	0_2_00FE781B
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FE19B0	0_2_00FE19B0
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FD997D	0_2_00FD997D
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FC7920	0_2_00FC7920
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FE7A4A	0_2_00FE7A4A
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FE7CA7	0_2_00FE7CA7
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FE1C77	0_2_00FE1C77
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FF9EEE	0_2_00FF9EEE
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_0104BE44	0_2_0104BE44
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FCBF40	0_2_00FCBF40
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: 0_2_00FE1F32	0_2_00FE1F32

Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: String function: 00FCCFA0 appears 34 times
Source: C:\Users\user\Desktop\Image Quote 011698.exe	Code function: String function: 00FE0A30 appears 46 times

Source: Image Quote 011698.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal64.winEXE@1/0@0/0

Source: Image Quote 011698.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Image Quote 011698.exe	ReversingLabs: Detection: 55%
Source: Image Quote 011698.exe	Virustotal: Detection: 33%

Source: Image Quote 011698.exe

Static file information: File size 1524736 > 1048576

Source: C:\Users\user\Desktop\Image Quote 011698.exe

Code function: 0_2_00FE0A76 push ecx; ret

0_2_00FE0A89

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Image Quote 011698.exe

Code function: 0_2_00FD9339 LdrInitializeThunk,

0_2_00FD9339

Source: C:\Users\user\Desktop\Image Quote 011698.exe

Code function: 0_2_00FE4CE8 mov eax, dword ptr fs:[00000030h]

0_2_00FE4CE8

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: Image Quote 011698.exe

Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\Image Quote 011698.exe

Code function: 0_2_00FE0698 cpuid

0_2_00FE0698

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	1 Process Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Image Quote 011698.exe	55%	ReversingLabs	Win32.Trojan.Generic
Image Quote 011698.exe	33%	Virustotal		Browse
Image Quote 011698.exe	100%	Joe Sandbox ML

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1501083
Start date and time:	2024-08-29 12:10:36 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Image Quote 011698.exe
Detection:	MAL
Classification:	mal64.winEXE@1/0@0/0
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 64
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Image Quote 011698.exe, PID 7960 because there are no executed function
Not all processes where analyzed, report is missing behavior information

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.051078738685901
TrID:	Win32 Executable (generic) a (10002005/4) 99.70% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Image Quote 011698.exe
File size:	1'524'736 bytes
MD5:	94c86f3cce220982807b72d29661c971
SHA1:	272c1496f143a9100bc98c92871cfd272f053b3b
SHA256:	131e90fc74d13419eca131909b92daab5a260bfbdbb8dfe1c31dafa16d224705
SHA512:	6af53b4a481dd56c25ea3dcb29cb135f5dafdbd74df4a19cf6238c5cb10579f79af6d133e25a3a852ff6da86eb6d717ef52c6aa01b7a2075e7ef8fa6d21e441b
SSDEEP:	24576:3qDEvCTbMWu7rQYlBQcBiT6rpFd+zt1F0AsqTiT+n9DGBMXGawu:3TvC/MTQYxsWPkzt1bsqT8+nNGBYG
TLSH:	0265D00273919056FE9B86338F56E1124B78AE260133E52F13993D7ABE701B1563E7B3
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	0f71f8a8b0586917

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66CD1636 [Mon Aug 26 23:56:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	cc2b3e63a50ba98c3412285dee7a8f0b

Entrypoint Preview

Instruction
call 00007F4E0D08FFF3h
jmp 00007F4E0D08F8FFh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F4E0D08FADDh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007F4E0D08FAAAh
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007F4E0D09269Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007F4E0D0926E8h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007F4E0D0926D1h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x9d924	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	8ae61a6e350a533e2f54998957fa045d	False	0.3416281495418848	data	5.6093546346262535	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x9d924	0x9da00	9442baa6265f494057657b59dfa7e366	False	0.797404713521015	data	7.602100947969714	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x172000	0x7594	0x7600	e0469d25efc50f58b71e2d65b015ddb5	False	0.0017213983050847457	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd4608	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xd4730	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xd4858	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd4980	0xea26	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9957959360715358
RT_ICON	0xe33a8	0x70f5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Great Britain	0.9989625479821558
RT_ICON	0xea4a0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	Great Britain	0.1836034543948894
RT_ICON	0xfacc8	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	Great Britain	0.2455854530166071
RT_ICON	0x104170	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	Great Britain	0.29061922365988907
RT_ICON	0x1095f8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	Great Britain	0.2848960793575815
RT_ICON	0x10d820	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	Great Britain	0.3548755186721992
RT_ICON	0x10fdc8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	Great Britain	0.41369606003752346
RT_ICON	0x110e70	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	Great Britain	0.509016393442623
RT_ICON	0x1117f8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	Great Britain	0.6365248226950354
RT_MENU	0x111c60	0x50	data	English	Great Britain	0.9
RT_STRING	0x111cb0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0x112244	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0x1128d0	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0x112d60	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0x11335c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0x1139b8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0x113e20	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0x113f78	0x5d3de	data			1.0003299137511195
RT_GROUP_ICON	0x171358	0x92	data	English	Great Britain	0.7054794520547946
RT_GROUP_ICON	0x1713ec	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x171400	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x171414	0x14	data	English	Great Britain	1.25
RT_VERSION	0x171428	0x10c	data	English	Great Britain	0.5932835820895522
RT_MANIFEST	0x171534	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
KERNEL32.DLL	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture
PSAPI.DLL	GetProcessMemoryInfo
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Target ID:	0
Start time:	06:11:35
Start date:	29/08/2024
Path:	C:\Users\user\Desktop\Image Quote 011698.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Image Quote 011698.exe"
Imagebase:	0xfc0000
File size:	1'524'736 bytes
MD5 hash:	94C86F3CCE220982807B72D29661C971
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Function 00FDB731 Relevance: 16.6, Strings: 9, Instructions: 5385COMMON

Download Yara Rule

Strings

9, xrefs: 00FDB838
\NL, xrefs: 01018B74
", xrefs: 0101A178
{, xrefs: 00FDB810
0, xrefs: 00FDB82E
', xrefs: 00FDB842
], xrefs: 00FDB860
:, xrefs: 00FDB81A
}, xrefs: 0101A6CD

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID: "$'$0$9$:$\NL$]${$}
API String ID: 0-3286379650
Opcode ID: 70b51c61ce3b28379b7168ed3fc1a4dd8ae338b5dc462b43de5506081808ceb2
Instruction ID: 72bd4ece09da317568ce9d309615fe47c41d9703d19c6e5e23a7bacf73ed62e8
Opcode Fuzzy Hash: 70b51c61ce3b28379b7168ed3fc1a4dd8ae338b5dc462b43de5506081808ceb2
Instruction Fuzzy Hash: 1A939035E00215DFDB24CF98C891BADB7F1FF48714F2581AAE985AB385E7789981CB40

Function 00FC8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00FC843C
VUUU, xrefs: 00FC83FA
VUUU, xrefs: 00FC83E8
ERCP, xrefs: 00FC813C
VUUU, xrefs: 01005DF0

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 9353be4427922f656bbdffcd0410a08b7ede3d0ebae8a32ff62f4f36be3f1590
Instruction ID: 1c1acaa8caa0cacf4c872876bc6a22abe838772f63535cded8f8df608b8e57ca
Opcode Fuzzy Hash: 9353be4427922f656bbdffcd0410a08b7ede3d0ebae8a32ff62f4f36be3f1590
Instruction Fuzzy Hash: A0A2C471E0021ACBEF25CF58C941BEEB7B2BF44350F1481AAD855A7281EB719D92DF90

Function 01028298 Relevance: 4.3, Strings: 3, Instructions: 568COMMON

Download Yara Rule

Strings

tbL, xrefs: 010284F4
|, xrefs: 010282DA
(, xrefs: 010282F0

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID: ($tbL$|
API String ID: 0-2980396599
Opcode ID: 50152e8ac8da47ac1839f5971c8c56cb56cfff71f8c3f79802e25eedfd5605fb
Instruction ID: 57308d7d53548bc827baaabb79478c40e568e6879f2f9ae966807c0dcc20c727
Opcode Fuzzy Hash: 50152e8ac8da47ac1839f5971c8c56cb56cfff71f8c3f79802e25eedfd5605fb
Instruction Fuzzy Hash: 87323578A007159FDB28CF19C480AAAB7F0FF48310B15C5AEE59ADB7A1E770E941CB44

Function 01054873 Relevance: 3.6, APIs: 2, Instructions: 566COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f54ba311c610d96a54025d81a285f6d236c62b14a21bbc2dc148556a02803cbf
Instruction ID: 096ea56d277b64cdb0821a20d4b571a44a6243c4e706d973b935f8d9172c7ded
Opcode Fuzzy Hash: f54ba311c610d96a54025d81a285f6d236c62b14a21bbc2dc148556a02803cbf
Instruction Fuzzy Hash: C412DF71600254ABEBA58F28CC49FEF7BF8EF45310F04416AF956DA2E1E7749981CB50

Function 00FECAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b898cec062c48c3280c8f5a9d772e89547b69b2f16a4579907f23802b1c1323
Instruction ID: d08603ae0ca4951b2df1bbf2634cc82bc7e6675d4a60f8f8fdf9b8053ccda9a0
Opcode Fuzzy Hash: 7b898cec062c48c3280c8f5a9d772e89547b69b2f16a4579907f23802b1c1323
Instruction Fuzzy Hash: BE021E72E012599FDF14CFA9C8806ADFBF1EF48324F25416AE919E7380D731A9429BD4

Function 00FFE4FF Relevance: 2.9, APIs: 1, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00FFE645

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 0bef3180ed392ec7568cc5422c85607a23a8d3234994752c1b91499844fb3da8
Instruction ID: 9d912008ef37b07fda3a6981a30ca1a604d8edfb41074375e1ac08bdecfbca8a
Opcode Fuzzy Hash: 0bef3180ed392ec7568cc5422c85607a23a8d3234994752c1b91499844fb3da8
Instruction Fuzzy Hash: ABC22872E046288FDB25CE28DD407EAB7B5EF48314F1441EAD94DE7260E778AE859F40

Function 00FCBF40 Relevance: 2.4, Strings: 1, Instructions: 1168COMMON

Download Yara Rule

Strings

p#M, xrefs: 010107CE

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID: p#M
API String ID: 0-494205710
Opcode ID: fe71273373c28b08c65656d46e4b6e52bc27789db3095068bcab06779e61c9ad
Instruction ID: 6e6cfa72af7dbcd7a0f2c350573ab37e38fc32d552c23d43e9c00d083f154960
Opcode Fuzzy Hash: fe71273373c28b08c65656d46e4b6e52bc27789db3095068bcab06779e61c9ad
Instruction Fuzzy Hash: 50A26A71A083028FD710CF18C581B6ABBE1BF89314F14896DF9CA8B356D775E885DB92

Function 00FCCAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

p#M, xrefs: 00FCCF7F

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID: p#M
API String ID: 0-494205710
Opcode ID: 97830a7c32e45fbbb93f874df01f1415d23e2765525af164336203b38f322224
Instruction ID: a8c8a02831832040d68f928b451d6164a0813093004a4fc76f78aaf1e07ee01a
Opcode Fuzzy Hash: 97830a7c32e45fbbb93f874df01f1415d23e2765525af164336203b38f322224
Instruction Fuzzy Hash: E032B27190021ADFDF14DF94CA82FEDB7B5BF05304F14409DE84AAB286C779A945EBA0

Function 00FE781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00FE798B

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: cc6317bc90d8b2bb5a5e2f697c8bcfbde772c35e873a9d4de18db91b5caa4109
Instruction ID: d3076e0523725e7661ee0f5526f578af9a583801f9a89f118c2c194249c1b9ae
Opcode Fuzzy Hash: cc6317bc90d8b2bb5a5e2f697c8bcfbde772c35e873a9d4de18db91b5caa4109
Instruction Fuzzy Hash: 4E515772E0C7C55ADB38B56B88597BF63899F22360F280519D886C7293C619DF06F352

Function 01032046 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

0&M, xrefs: 01032053

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID: 0&M
API String ID: 0-278495883
Opcode ID: c32e3fc8385f568c32938d2280db9929dc4b1fa9f2a4dd4730763afb1ea23267
Instruction ID: fd366827f55da656aa30b63f373d96ead645108135cbc1019051bc4e3b175bfe
Opcode Fuzzy Hash: c32e3fc8385f568c32938d2280db9929dc4b1fa9f2a4dd4730763afb1ea23267
Instruction Fuzzy Hash: 2E21EE322216118BD728CF79C91267EB3E5A754310F14852FE4A7C33D1DE75E904C744

Function 00FDAFAC Relevance: .9, Instructions: 881COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bda1bef9456331f75c71545df57f8250ad6df8efdbdb96c881304aaddbd26f52
Instruction ID: 03dae6a58a65386613bd1c77f23e9271becdf4a38ac05fd5009fc703de530a3c
Opcode Fuzzy Hash: bda1bef9456331f75c71545df57f8250ad6df8efdbdb96c881304aaddbd26f52
Instruction Fuzzy Hash: 9A72A071E00219CBDB55CF58C8407AEB7F6EF44310F1581ABE949EB285EB789A81DB90

Function 00FF6DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17ddb9ff0a2cf66dafba2a4f174e9dfcd52e6dbbcf633c554e47d961472dc0aa
Instruction ID: bc8a91a5323eba69c1fd1b6dc0b986bf2604096038b8d45c75505e428b176d01
Opcode Fuzzy Hash: 17ddb9ff0a2cf66dafba2a4f174e9dfcd52e6dbbcf633c554e47d961472dc0aa
Instruction Fuzzy Hash: FD323622D29F054DD723A638CD22336A649AFB73D5F15C737E81AB5DA6EB28C4C36100

Function 00FC7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e02dd3e382dd74b1354a9ce9f9622f16ddc629c650c56ba59a3a027342d3fc
Instruction ID: d5ecd56f1353c54d22ecefeebe1010c00cb25b2dbf1ce6ae85747b7b09fb5777
Opcode Fuzzy Hash: 76e02dd3e382dd74b1354a9ce9f9622f16ddc629c650c56ba59a3a027342d3fc
Instruction Fuzzy Hash: E922B170A0420A9FEF14DF64CD42BAEB7F6FF44300F144569E856A7291EB3AA914DF50

Function 00FC91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25956fc5bfea20bdd036dcb75c4f1a271b1f179591a399dc50be3bb9f383f354
Instruction ID: 7d368a8d6e762d1248a48ee706a3470527d66c40a9136800b5097a16a2684e3b
Opcode Fuzzy Hash: 25956fc5bfea20bdd036dcb75c4f1a271b1f179591a399dc50be3bb9f383f354
Instruction Fuzzy Hash: 7B02F6B1E0020AEBDB05DF54D981FAEB7B1FF44300F108569E846AB3D1EB35AA55DB90

Function 0104BE44 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 8a102234217cb8fc5e12fb5b6e35db5449b99f49e6866c8df089dfd82f192649
Instruction ID: 09288dab32db54968cd296b66b2bf46f01fc06913e53e84611ee266582808458
Opcode Fuzzy Hash: 8a102234217cb8fc5e12fb5b6e35db5449b99f49e6866c8df089dfd82f192649
Instruction Fuzzy Hash: 0E024DB16042019FD754DF28C9D5E2ABBE5AF89314F08C4ADF88ACB2A2D731ED45CB51

Function 00FD997D Relevance: .4, Instructions: 375COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 008d7f4966374fd70fc10806bddab33b900210bcee92a512a1071b2935ce9feb
Instruction ID: 509c974ab5d93946d63065012bfc1a41cba097327a423f6557e72df80d715d0d
Opcode Fuzzy Hash: 008d7f4966374fd70fc10806bddab33b900210bcee92a512a1071b2935ce9feb
Instruction Fuzzy Hash: FFA16072108000FEE765AABC8C58E7F3A9FEB86314F19025BF542C7795C6AD9D01E275

Function 00FF9EEE Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a3ac8471f91f87413cf2040edfb0e0a623f0fab5818d86c8d40d2451d7a50e
Instruction ID: 2e4118aef584536c7d3e1f2a175314f7c57d861f7c7e86796553df0499292421
Opcode Fuzzy Hash: d7a3ac8471f91f87413cf2040edfb0e0a623f0fab5818d86c8d40d2451d7a50e
Instruction Fuzzy Hash: 57B1E420D2AF404DD6239A398831336FA5C6FBB6D6F91D72BFC1674D62FB2285834244

Function 00FF676B Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 198a520ea869a35980b3f78eccd319767a6126f68f47798b27a54d549f42ff15
Instruction ID: 2ec65074bb58b662c0e161efe79b8c25d50046672709f521e89c28c3da24052b
Opcode Fuzzy Hash: 198a520ea869a35980b3f78eccd319767a6126f68f47798b27a54d549f42ff15
Instruction Fuzzy Hash: 1EB15B32A106089FD715CF28C48AB657BE0FF05364F25865CE999CF2B2CB35E981DB40

Function 00FE1C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 43484d9248cd1a29405e2a6242537ee91be5855fa17e774d44db07b80a65266d
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: B4915773A080E349DB29463F857457EFFE16A923B131A079EE4F2CA1C5EE349954F620

Function 00FE1F32 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 7be6fdec552788ff537ed4737b04b4cdb89a206e0b443f1f6d4955877d888cb8
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 3B916573A090E349DB69463B887413EFFE55A923B131A079ED4F2CB1C5FE248A54F620

Function 00FE19B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: a437e2e9f4909046052c1998d455bbe8649adfc48c261b100111ff3f8ffcda7e
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 709122736090E34ADB69467B857407EFFE16A927B131A07AED4F2CA1C1FE348564F620

Function 00FE7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e3d0bc900cf1b892d14c28e0ffe1d7d887a8a211ac8b23e48eb025ee859e12e
Instruction ID: 0975bb14c8b21e96e26049437a2172e0bf44dbe3f18fc3f68a50810d8d2e8de7
Opcode Fuzzy Hash: 2e3d0bc900cf1b892d14c28e0ffe1d7d887a8a211ac8b23e48eb025ee859e12e
Instruction Fuzzy Hash: 01617D31E087C956DA34B92F4C55BBF3394DF81B60F20092EE843CB2A5D6199E43B315

Function 00FE7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62de30cbe308c2b2cb8d72c6a4f5f113deb5d1fc96455593ad16d38271f3c341
Instruction ID: d79848334a36c64df0730165a682acebbf3352590e36b33af230adff11e47df0
Opcode Fuzzy Hash: 62de30cbe308c2b2cb8d72c6a4f5f113deb5d1fc96455593ad16d38271f3c341
Instruction Fuzzy Hash: 77618C71E087C966DE387A2B4C91BBF338ADF41760F10095AE943CB281DA16AD42B315

Function 00FE1706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 6727b7b9ac030c156ceb72b34f2f726604f9acb74b6c09738b10ced8660034f6
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: A4813173A090E349DB69463B857447EFFE17A923B131A079DD4F2CA1C1EE349654F620

Function 00FD9339 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29b856aa891f46509bffec7be35ac170eeb0fa49bd29953e7633f231f8175f38
Instruction ID: d2899c222b43b5c6ffd813263e5c000ced03490a8edf21464d8e5945436442b6
Opcode Fuzzy Hash: 29b856aa891f46509bffec7be35ac170eeb0fa49bd29953e7633f231f8175f38
Instruction Fuzzy Hash: D8416471904209EFCB15DFD8CC80AAEB7BAFF45320F18816AE45597391D770AE42AF50

Function 00FE4CE8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3ed0285c6e52cee7524dfd973407d59620e763262137f49430a60038039f5c0
Instruction ID: 286752ea0d25f080c2d68881109e1896d369d802d92f8ad672d33b71d5a265a1
Opcode Fuzzy Hash: f3ed0285c6e52cee7524dfd973407d59620e763262137f49430a60038039f5c0
Instruction Fuzzy Hash: 7AE0B631400188BBCF21AF55DE4AA583B69EF91791F104429FD05DB633CB39ED42EE94

Function 01050241 Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 391COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0105031F
_wcslen.LIBCMT ref: 01050389
_wcslen.LIBCMT ref: 010503F1
_wcslen.LIBCMT ref: 01050475

Part of subcall function 00FDF9F2: _wcslen.LIBCMT ref: 00FDF9FD

Strings

P|L, xrefs: 0105048B
}L, xrefs: 01050627
@|L, xrefs: 01050407
@}L, xrefs: 01050675
|L, xrefs: 0105039F
0{L, xrefs: 010505E1
|L, xrefs: 0105057E

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _wcslen
String ID: |L$ }L$0{L$@|L$@}L$P|L$|L
API String ID: 176396367-3207688415
Opcode ID: 8807b4f69262fba17d8f9ff17325311a2a919ab90b44a527380ca82cee991e05
Instruction ID: 4a1b2820b3b4fd92664cadc41311272d5ada9db06c954285b4c54cfcc96f9d07
Opcode Fuzzy Hash: 8807b4f69262fba17d8f9ff17325311a2a919ab90b44a527380ca82cee991e05
Instruction Fuzzy Hash: C3E18F352082018FC794DF28C95192FB7E6BF88314B1489ADF8D69B3AADB34ED45CB51

Function 00FFDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00FFDA96
___free_lconv_mon.LIBCMT ref: 00FFDAA1

Part of subcall function 00FFD63C: _free.LIBCMT ref: 00FFD659
Part of subcall function 00FFD63C: _free.LIBCMT ref: 00FFD66B
Part of subcall function 00FFD63C: _free.LIBCMT ref: 00FFD67D
Part of subcall function 00FFD63C: _free.LIBCMT ref: 00FFD68F
Part of subcall function 00FFD63C: _free.LIBCMT ref: 00FFD6A1
Part of subcall function 00FFD63C: _free.LIBCMT ref: 00FFD6B3
Part of subcall function 00FFD63C: _free.LIBCMT ref: 00FFD6C5
Part of subcall function 00FFD63C: _free.LIBCMT ref: 00FFD6D7
Part of subcall function 00FFD63C: _free.LIBCMT ref: 00FFD6E9
Part of subcall function 00FFD63C: _free.LIBCMT ref: 00FFD6FB
Part of subcall function 00FFD63C: _free.LIBCMT ref: 00FFD70D
Part of subcall function 00FFD63C: _free.LIBCMT ref: 00FFD71F
Part of subcall function 00FFD63C: _free.LIBCMT ref: 00FFD731

_free.LIBCMT ref: 00FFDAB8
_free.LIBCMT ref: 00FFDACD
_free.LIBCMT ref: 00FFDAD8
_free.LIBCMT ref: 00FFDAFA
_free.LIBCMT ref: 00FFDB0D
_free.LIBCMT ref: 00FFDB1B
_free.LIBCMT ref: 00FFDB26
_free.LIBCMT ref: 00FFDB5E
_free.LIBCMT ref: 00FFDB65
_free.LIBCMT ref: 00FFDB82
_free.LIBCMT ref: 00FFDB9A

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _free$___free_lconv_mon
String ID:
API String ID: 3658870901-0
Opcode ID: ba9ecef691faa970056ea1d3866dd1f1132379091b2b346f906a9454ef583009
Instruction ID: 8ef35b0613934bea075f813697ff99b9ec52330e122382fe720aee97414e8f86
Opcode Fuzzy Hash: ba9ecef691faa970056ea1d3866dd1f1132379091b2b346f906a9454ef583009
Instruction Fuzzy Hash: 77316B31A442099FEB72AA38EC45B7A77EAFF40321F104519E248D71B2DB79AC40B724

Function 0105091E Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 372COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 01050A01
_wcslen.LIBCMT ref: 01050A8A
_wcslen.LIBCMT ref: 01050B06
_wcslen.LIBCMT ref: 01050B81

Part of subcall function 00FDF9F2: _wcslen.LIBCMT ref: 00FDF9FD

Strings

0{L, xrefs: 01050C4E
`}L, xrefs: 01050A17
@|L, xrefs: 01050C97
{L, xrefs: 01050D3E
lgL, xrefs: 01050B97

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _wcslen
String ID: {L$0{L$@|L$`}L$lgL
API String ID: 176396367-1937145518
Opcode ID: 0d706242c2a0dbafdc1c0f9a3adb8007824529ebefb0d02c43683025eda856c5
Instruction ID: c18734bb2c707d65a77594bd5848ad0509a22fafdd768566b0ed67eb742c810c
Opcode Fuzzy Hash: 0d706242c2a0dbafdc1c0f9a3adb8007824529ebefb0d02c43683025eda856c5
Instruction Fuzzy Hash: C4E17E352083028FC794EF28C991A6EB7E1BF88314B04899DF8D69B366D735ED45CB91

Function 0104C998 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 242COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0104C9F1
_wcslen.LIBCMT ref: 0104CA68
_wcslen.LIBCMT ref: 0104CA9E
_wcslen.LIBCMT ref: 0104CAF9
_wcslen.LIBCMT ref: 0104CB2F
_wcslen.LIBCMT ref: 0104CB7F

Strings

hwL, xrefs: 0104CBAC
@wL, xrefs: 0104CB79
4wL, xrefs: 0104CB29

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _wcslen
String ID: 4wL$@wL$hwL
API String ID: 176396367-462698015
Opcode ID: 14acc0bdb987110b7d5a089c68d16b417f5c68108f78ca02a8b0f493d2635f26
Instruction ID: 74d968dfd74f03f0cd2d6a68eb33289e4c6548221e7b4a3f224b59a1f01ba3fd
Opcode Fuzzy Hash: 14acc0bdb987110b7d5a089c68d16b417f5c68108f78ca02a8b0f493d2635f26
Instruction Fuzzy Hash: DA7137B260202A8BEB51DE3CCEC0ABE33D19F50658F1441B9FCD2A7282EA34DD549794

Function 00FF2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00FF2C94
_free.LIBCMT ref: 00FF2CA0
_free.LIBCMT ref: 00FF2CAB
_free.LIBCMT ref: 00FF2CB6
_free.LIBCMT ref: 00FF2CC1
_free.LIBCMT ref: 00FF2CCC
_free.LIBCMT ref: 00FF2CD7
_free.LIBCMT ref: 00FF2CE2
_free.LIBCMT ref: 00FF2CED
_free.LIBCMT ref: 00FF2CFB

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: b89e3fc481ae3e176462e99b8a7668b8f79c4b48a0d814554b3974eba80e6475
Instruction ID: 717e9c25a57a8719d691ca27ef8332167f29c3cb6073008a6c9291530e2a2162
Opcode Fuzzy Hash: b89e3fc481ae3e176462e99b8a7668b8f79c4b48a0d814554b3974eba80e6475
Instruction Fuzzy Hash: CA11927654010DAFCB92EF98DC82CED3BB5BF05350F4144A5FA489B232DA75EA50AB90

Function 010230F7 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0102318D
_wcslen.LIBCMT ref: 010231F8

Strings

[L, xrefs: 01023346
[L, xrefs: 0102339A

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _wcslen
String ID: [L$[L
API String ID: 176396367-175131883
Opcode ID: 52fb84ed20a601a6362a334e9d3866de97d3c6e346f7c12375178c5f42add9b6
Instruction ID: 79c7313702854f3708b3f74e4951dacafe61470b7bfbfb173064def03ff71375
Opcode Fuzzy Hash: 52fb84ed20a601a6362a334e9d3866de97d3c6e346f7c12375178c5f42add9b6
Instruction Fuzzy Hash: 6FE11731A005369BCB599F68C841BEDFBB0BF08710F54819AE596FB241DF38B989D790

Function 0102B5C8 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0102B608
_wcslen.LIBCMT ref: 0102B64D
_wcslen.LIBCMT ref: 0102B68C
_wcslen.LIBCMT ref: 0102B6C7

Strings

|gL, xrefs: 0102B6C1
PgL, xrefs: 0102B602
lgL, xrefs: 0102B686
`gL, xrefs: 0102B647

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _wcslen
String ID: PgL$`gL$lgL$|gL
API String ID: 176396367-1235675864
Opcode ID: 04272a9f8043bf6173aa3c4bb54a4197faccdf722e489701af1eeecaaa0ab55d
Instruction ID: 9954cf14e2f61d25e86ada42923f24b6e3978723bc3e92778c8bb73b8afd8449
Opcode Fuzzy Hash: 04272a9f8043bf6173aa3c4bb54a4197faccdf722e489701af1eeecaaa0ab55d
Instruction Fuzzy Hash: 51413932A000378BCB706F7DCC945BE7BF5BF54654B1541AAE4A2D7281E739C881C390

Function 00FFCE90 Relevance: 12.2, APIs: 8, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00FFCEB7
_free.LIBCMT ref: 00FFCF22
_free.LIBCMT ref: 00FFCF48
_free.LIBCMT ref: 00FFCF71
_free.LIBCMT ref: 00FFCFA9
_free.LIBCMT ref: 00FFCFDA
_free.LIBCMT ref: 00FFD01B
_free.LIBCMT ref: 00FFD0B5

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 9f0f20281c48753d05d8944911a4b82861b6959897dfc66cfb2c70a3aa9a6715
Instruction ID: 3d79702b938859f82f0b99ab6413f728e9bef36906a2d57914ee89f976f8085e
Opcode Fuzzy Hash: 9f0f20281c48753d05d8944911a4b82861b6959897dfc66cfb2c70a3aa9a6715
Instruction Fuzzy Hash: 22613771D0522DABDB31AFB49D81779BBA6EF05320F04016EEB41972E1D7359900F7A4

Function 01025622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 01025637
_memcmp.LIBVCRUNTIME ref: 01025659
_memcmp.LIBVCRUNTIME ref: 01025671
_memcmp.LIBVCRUNTIME ref: 01025684
_memcmp.LIBVCRUNTIME ref: 0102569E
_memcmp.LIBVCRUNTIME ref: 010256B1
_memcmp.LIBVCRUNTIME ref: 010256C9
_memcmp.LIBVCRUNTIME ref: 010256E4

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: f574267dd208e8414daf43423a911871f3c4da1cc2f54f3bbf8c3215cc0c872d
Instruction ID: c328d9eb8781578e5603e8f06343e8d26a5098eabcb0697732f462231ed7c2c9
Opcode Fuzzy Hash: f574267dd208e8414daf43423a911871f3c4da1cc2f54f3bbf8c3215cc0c872d
Instruction Fuzzy Hash: D621D4716402697BE6245A26AE86FFE379CBF14384F144031FD44AB681F738ED2481AD

Function 010344C0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 309COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0103453B
_wcslen.LIBCMT ref: 01034599
_wcslen.LIBCMT ref: 010345F4
_wcslen.LIBCMT ref: 0103463F
_wcslen.LIBCMT ref: 010346A7

Part of subcall function 00FDF9F2: _wcslen.LIBCMT ref: 00FDF9FD

Strings

kL, xrefs: 01034708

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _wcslen
String ID: kL
API String ID: 176396367-491924299
Opcode ID: af21e6dbd2784cd6d5626297cf3271b9bc62aafdf5b90b252190d31c0118e202
Instruction ID: 32d1c248008ba15547db0b6d10b5a7b7e6c8ca364ff4995f8153e72dbefa753f
Opcode Fuzzy Hash: af21e6dbd2784cd6d5626297cf3271b9bc62aafdf5b90b252190d31c0118e202
Instruction Fuzzy Hash: 78B1E1316083029BC750DF28C891A6EB7E9BFD9760F50895DF5D6CB292E734E844CB92

Function 01048CD3 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 01028E54: _wcslen.LIBCMT ref: 01028E77

_wcslen.LIBCMT ref: 01048D4E
_wcslen.LIBCMT ref: 01048D9C
_wcslen.LIBCMT ref: 01048DDC
_wcslen.LIBCMT ref: 01048E6E

Strings

P`L, xrefs: 01048E65
D`L, xrefs: 01048D48

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _wcslen
String ID: D`L$P`L
API String ID: 176396367-3785639107
Opcode ID: 4b3cc491f6bc5946fd9330b71a4f55c5b5638de3ed32a007bc476e749d4c12ad
Instruction ID: cbab812d14bb75432672a072108a9d2b596094c4672bf3109f89913b0fb3ae4e
Opcode Fuzzy Hash: 4b3cc491f6bc5946fd9330b71a4f55c5b5638de3ed32a007bc476e749d4c12ad
Instruction Fuzzy Hash: 7451D3B1A000169BCB64EFADC9809BEB7E5BF54324B20867AE5A6E7281D734DD40C790

Function 0102ED19 Relevance: 10.6, APIs: 7, Instructions: 137COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0102ED3B
_wcslen.LIBCMT ref: 0102ED79
_wcslen.LIBCMT ref: 0102EDAF
_wcslen.LIBCMT ref: 0102EDDF
_wcslen.LIBCMT ref: 0102EDEF
_wcslen.LIBCMT ref: 0102EE2B
_wcslen.LIBCMT ref: 0102EE5A

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: d03df3173b9aea2476220ea7b25a46e51c2860381b7c24efb530bb94b21ae5d6
Instruction ID: f68f98736638e07d5cbb6d9262d0e95d45a2630f703b39dadba459c9899b49d2
Opcode Fuzzy Hash: d03df3173b9aea2476220ea7b25a46e51c2860381b7c24efb530bb94b21ae5d6
Instruction Fuzzy Hash: 4C41C365C1026875CB11EBF5CC8A9CFB7A8AF45310F408466E618F3122FB38E245D3E6

Function 00FE2D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00FE2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 00FE2D53
_ValidateLocalCookies.LIBCMT ref: 00FE2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 00FE2E0C
_ValidateLocalCookies.LIBCMT ref: 00FE2E61

Strings

csm, xrefs: 00FE2DF6

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 17a0005c6933a5144f9f8d8205935f8b0f75e75d15b2970b1a508403548e2111
Instruction ID: b2fa1d4749da8aba781d840e7e46407eab03e02dfb020add89e2a58f1b8c2fdb
Opcode Fuzzy Hash: 17a0005c6933a5144f9f8d8205935f8b0f75e75d15b2970b1a508403548e2111
Instruction Fuzzy Hash: 65411A35E002489BCF60DF6ACC84A9EBBB9BF44324F148165E9146B352E735DA01DFD0

Function 00FFD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00FFD7A3: _free.LIBCMT ref: 00FFD7CC

_free.LIBCMT ref: 00FFD82D
_free.LIBCMT ref: 00FFD838
_free.LIBCMT ref: 00FFD843
_free.LIBCMT ref: 00FFD897
_free.LIBCMT ref: 00FFD8A2
_free.LIBCMT ref: 00FFD8AD
_free.LIBCMT ref: 00FFD8B8

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 9de7b4f6082d016ce59511fa0de5f8da0c18a91d7f817d19722c6b279839e9c0
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 1C115172580B0CAAD531BFB0CC47FEB7BED6F00700F400825B399AA0B2DA69B505B650

Function 00FF01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00FF00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FF00D6
__allrem.LIBCMT ref: 00FF00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FF010B
__allrem.LIBCMT ref: 00FF0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FF0140

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: df71b17c2ba2a5636abf643135a9e3dba29a5334d18f6972d526577056c5dcaf
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: D8812772A00B4A9BE7209F29CC41B7A73E8AF41330F24463AF651D62E2EF74D904A750

Function 00FCBBE0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 232COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00FCBEB3

Strings

D%MD%M, xrefs: 00FCBCA5
D%M, xrefs: 00FCBCA2
D%M, xrefs: 00FCBDED, 00FCBD91, 00FCBD1B
D%M, xrefs: 00FCBE9A

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: Init_thread_footer
String ID: D%M$D%M$D%M$D%MD%M
API String ID: 1385522511-4071987705
Opcode ID: 704af88bb10ac0a95ef641293cb67e0680fab3b8c6544be95fb9a40e23f24687
Instruction ID: 60dfb66d10ddf0446e63dee347509ee2fb133339ff2fc98b35102f8b3be13685
Opcode Fuzzy Hash: 704af88bb10ac0a95ef641293cb67e0680fab3b8c6544be95fb9a40e23f24687
Instruction Fuzzy Hash: B6913C79E00216DFCB18CF59C292BA9B7F1FF58310F24816ED946AB350D771A981EB90

Function 01047B7E Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00FC9CB3: _wcslen.LIBCMT ref: 00FC9CBD

Part of subcall function 00FE00A3: __onexit.LIBCMT ref: 00FE00A9

__Init_thread_footer.LIBCMT ref: 01047BFB

Strings

5, xrefs: 01047C78
Gp#M, xrefs: 01047CD4, 01047D73, 01047D05, 01047E05
Gp#M, xrefs: 01047C96
p#M, xrefs: 01047D5C, 01047C50

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: Init_thread_footer__onexit_wcslen
String ID: 5$Gp#M$Gp#M$p#M
API String ID: 1352291845-2426839514
Opcode ID: 52af77334cb74d662cbee44ec2f3bb6619df7e121b38913d574f9a33a2bb1dd2
Instruction ID: 6d9d6e12c645fb9db116f486f76647318c510b7a6780620352e07738a8e65784
Opcode Fuzzy Hash: 52af77334cb74d662cbee44ec2f3bb6619df7e121b38913d574f9a33a2bb1dd2
Instruction Fuzzy Hash: AB919DB1A00209EFCB15EF58D9D0DADBBB1BF44300F1080ADF886AB291DB71AE45CB55

Function 0104AFF9 Relevance: 7.9, APIs: 5, Instructions: 418COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0104B198
_wcslen.LIBCMT ref: 0104B200
_wcslen.LIBCMT ref: 0104B332
_wcslen.LIBCMT ref: 0104B34B
_wcslen.LIBCMT ref: 0104B366

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: 8bb47df1574b82508a8568e42ad549eacc8411e96a2d4b59b127870c91da2114
Instruction ID: c1e86a34ab1a879c246338fb6cdacf33c67dee74a8d983bba11bf6514cf1070d
Opcode Fuzzy Hash: 8bb47df1574b82508a8568e42ad549eacc8411e96a2d4b59b127870c91da2114
Instruction Fuzzy Hash: 6BF1C1715083419FD714EF28C981B6EBBE5AF85310F1889ADF8D59B2A2CB35EC04DB52

Function 00FF2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00FF20C3
_free.LIBCMT ref: 00FF20E3

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 3890d703f7ea146fcb4efc749df72bd74b23163155a5f2f9b3b7e357d1c9b5e8
Instruction ID: 9d52ac9e40600c26d079de63c4c439026c8fcd4a0b85d68c34773c820ac31077
Opcode Fuzzy Hash: 3890d703f7ea146fcb4efc749df72bd74b23163155a5f2f9b3b7e357d1c9b5e8
Instruction Fuzzy Hash: DB41B637E002089FCB24DF79C881A6DB7B5EF89324F154569E616EB361DB31AD01EB80

Function 01025711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 01025726
_memcmp.LIBVCRUNTIME ref: 01025744
_memcmp.LIBVCRUNTIME ref: 01025757
_memcmp.LIBVCRUNTIME ref: 0102576F
_memcmp.LIBVCRUNTIME ref: 01025787

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: b3e1830291eea80dcf21e65ab2d8b536b7e6a0cb8c488699daa5d9a5a3874387
Instruction ID: 4b96e9f89dcaf366659e24ce6d0643108e05be9fed28e6bfe0c54d24c56900d9
Opcode Fuzzy Hash: b3e1830291eea80dcf21e65ab2d8b536b7e6a0cb8c488699daa5d9a5a3874387
Instruction Fuzzy Hash: E201F571281269BFE6085516AD82FFB738CBB103A4F004071FD04AA642F734ED2492A8

Function 00FFD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00FFD752
_free.LIBCMT ref: 00FFD764
_free.LIBCMT ref: 00FFD776
_free.LIBCMT ref: 00FFD788
_free.LIBCMT ref: 00FFD79A

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 80a46d3f4cdf48cc1f4cb3fd7009116c9b0e75df3a7578b7af18df310060968e
Instruction ID: 04e177146f0831afe992a67584a333edbec36f4616b49b0ec331a2e9924c9806
Opcode Fuzzy Hash: 80a46d3f4cdf48cc1f4cb3fd7009116c9b0e75df3a7578b7af18df310060968e
Instruction Fuzzy Hash: A8F0FF7394420DAB86A5FB68F9C5C3A7BEEBF447217A40815F248DB521C774FC80A678

Function 00FF22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00FF22BE
_free.LIBCMT ref: 00FF22D0
_free.LIBCMT ref: 00FF22E3
_free.LIBCMT ref: 00FF22F4
_free.LIBCMT ref: 00FF2305

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4123fa34cb97fe27cc116b7268a18f97c13ccf456534f8fabfb79b2512b9f43b
Instruction ID: 197bc35be4a6d879baf95555b39b46e2fe8e75b1f5e2c198d9c9ae92d271343f
Opcode Fuzzy Hash: 4123fa34cb97fe27cc116b7268a18f97c13ccf456534f8fabfb79b2512b9f43b
Instruction Fuzzy Hash: AAF05E748821259B86A2BF58BC41D2D3B74FB18761B10056FF914E72B1C7B90812BFEC

Function 010461D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 324COMMON

Download Yara Rule

APIs

Part of subcall function 00FE00A3: __onexit.LIBCMT ref: 00FE00A9

__Init_thread_footer.LIBCMT ref: 01046238

Strings

x#M, xrefs: 0104636F
x#M, xrefs: 0104633A
x#M, xrefs: 01046353

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: Init_thread_footer__onexit
String ID: x#M$x#M$x#M
API String ID: 1881088180-3829861524
Opcode ID: c993cd85d4cb7fcfa16d8338dd849fd7bda11aea73c75cc1440591dd505b9bff
Instruction ID: 2339ccca85b4a34ef7f06e8780f93d8c64535da8124fd0b42e4df8dd075783c6
Opcode Fuzzy Hash: c993cd85d4cb7fcfa16d8338dd849fd7bda11aea73c75cc1440591dd505b9bff
Instruction Fuzzy Hash: 5FC191B1A00105AFDB15DF98C990EBEB7F9FF49300F04806AE9459B291EB75E945CB90

Function 0100065B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 272COMMON

Download Yara Rule

APIs

__dosmaperr.LIBCMT ref: 01000776
__dosmaperr.LIBCMT ref: 01000795
__dosmaperr.LIBCMT ref: 01000938

Strings

H, xrefs: 010008BD

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: __dosmaperr
String ID: H
API String ID: 2332233096-2852464175
Opcode ID: 7e821adffe91cbc9713f8d52b49a87b3260336805fc21dec40f5ae5b36cdbdbf
Instruction ID: 054ea254c064fa885312d2e5fdc01a3a7b033315f986e8abedf7fb0eaca32225
Opcode Fuzzy Hash: 7e821adffe91cbc9713f8d52b49a87b3260336805fc21dec40f5ae5b36cdbdbf
Instruction Fuzzy Hash: 94A12732A041448FEF1AAF68DC51BAE3BE1EB06360F2441AEF8559B2D1D7758902CB91

Function 00FFB952 Relevance: 6.4, APIs: 4, Instructions: 370COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00FFB9D4
_free.LIBCMT ref: 00FFB9F8
_free.LIBCMT ref: 00FFBB7F
_free.LIBCMT ref: 00FFBD4B

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 6afa368cd3e7c4108598805dd3060fa638451578f9be81892b4bfe554b6441f4
Instruction ID: 39826a57b858fc479cd61ebb58f373ecea66466773764b3b663ba99a6a1f5f0f
Opcode Fuzzy Hash: 6afa368cd3e7c4108598805dd3060fa638451578f9be81892b4bfe554b6441f4
Instruction Fuzzy Hash: EBC12672E0420DAFDB209F69DC41BBA7BB8EF41320F1441AAEA94D7271E7358E41E754

Function 00FF3E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00FF3F0B
__alldvrm.LIBCMT ref: 00FF410C
__alldvrm.LIBCMT ref: 00FF412E

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 2b7027e846b0f6f2f0bc2e31333edb290ec2d9565d66f1d30de4da68da649eef
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: A8A15972D0038A9FEB26DF18C8917BFBBE4EF61360F14416DE6859B2A1C638A941D750

Function 00FF8D45 Relevance: 6.3, APIs: 4, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a429c879d0e0c11a062f5037e8e0557d84ca674edd92bd5450c4b7a15ab3dcd
Instruction ID: 10f1e23c47b1193a3983884cde62cd9000f1ee3d9b7206b9b31d2e2c3199d6e4
Opcode Fuzzy Hash: 1a429c879d0e0c11a062f5037e8e0557d84ca674edd92bd5450c4b7a15ab3dcd
Instruction Fuzzy Hash: 8EC1E775D0824DAFDF11DFA9CC41BBD7BB0AF09320F144099E614A73A2CBB59941EB61

Function 0105833C Relevance: 6.2, APIs: 4, Instructions: 196COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 0105835A
_wcslen.LIBCMT ref: 0105836E
_wcslen.LIBCMT ref: 01058391
_wcslen.LIBCMT ref: 010583B4

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _wcslen
String ID:
API String ID: 176396367-0
Opcode ID: c3e9567cea0411148a6a70b0996802892ed174e2126378ff82080f9ce06fe4ae
Instruction ID: de04a8f6587352e64ab00ae521048e76f258cfed3be40a8dad7239e5eb7e4e4a
Opcode Fuzzy Hash: c3e9567cea0411148a6a70b0996802892ed174e2126378ff82080f9ce06fe4ae
Instruction Fuzzy Hash: 5C61F071900215BBEB54CF69CC81FBF7BA8BB04720F10865AFD55E60D1DB78A980DBA0

Function 00FFB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92300467f74a8ce655cf74ca6bdaee5cc0430d91273f78a41d58d6439cffd922
Instruction ID: 7510a93e8ac26a0b871478ccd68d3cca9bd9f84b61cc7bbfe7e266b1d2f70be4
Opcode Fuzzy Hash: 92300467f74a8ce655cf74ca6bdaee5cc0430d91273f78a41d58d6439cffd922
Instruction Fuzzy Hash: 3C410B72900748AFD724DF38CC41BBA7BA9EF84720F10452AF251DB691D77599019790

Function 00FE00C6 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 00FE00C6

Part of subcall function 00FE00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00FE0195
Part of subcall function 00FE00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 00FE01A0

___scrt_fastfail.LIBCMT ref: 00FE00E7

Part of subcall function 00FE00A3: __onexit.LIBCMT ref: 00FE00A9

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: __crt_fast_encode_pointer$___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID:
API String ID: 3435762107-0
Opcode ID: 7b55b6850c899a45e1c1216e6022cda955ea3dce2ceb4d0304ac77cf41e12fec
Instruction ID: ea36b91eab26c5e1036919216a6f9db49041d23bb7819a1622f24f3894cdf800
Opcode Fuzzy Hash: 7b55b6850c899a45e1c1216e6022cda955ea3dce2ceb4d0304ac77cf41e12fec
Instruction Fuzzy Hash: 3C210B32A457506FEB105BB5AC46F6937A4DB05B61F240237F902EB291DFFC9C409A9C

Function 00FE3382 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00FE339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00FE33B7

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 946f278fc3e31e727c81028ebb0495bff9378def4856718e2f28f762550e10d8
Instruction ID: 033463d63a98a7dc845fef7bc8e4bbd7100db35add42e4c5a9adf23336b3530b
Opcode Fuzzy Hash: 946f278fc3e31e727c81028ebb0495bff9378def4856718e2f28f762550e10d8
Instruction Fuzzy Hash: 0201F133A09351AEAB2527B76CCDE762A94EB15379720023AF410831F0EF514D027559

Function 00FE3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00FE3B56

Part of subcall function 00FE3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00FE3AD2
Part of subcall function 00FE3AA3: ___AdjustPointer.LIBCMT ref: 00FE3AED

_UnwindNestedFrames.LIBCMT ref: 00FE3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00FE3B7C
CallCatchBlock.LIBVCRUNTIME ref: 00FE3BA4

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: 825e645a79ac3ece8169eb8bd2b9bb841a3d90a7b004d782c84c51b6eb440ce7
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: 54014032500189BBDF125E96CC4ADEB3F6DFF88754F044058FE4896121C736E961EBA0

Function 0103910C Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 00FC7620: _wcslen.LIBCMT ref: 00FC7625

Part of subcall function 00FC6B57: _wcslen.LIBCMT ref: 00FC6B6A

_wcslen.LIBCMT ref: 01039506
_wcslen.LIBCMT ref: 0103952D

Strings

X, xrefs: 01039412

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _wcslen
String ID: X
API String ID: 176396367-3081909835
Opcode ID: 2cd2e29e906c3bffebd332faea78e62c59c39445b1535c3da010f19e2b38c6d9
Instruction ID: 2657d242076f8b0b377c1b176b4340f878022a5dd572321ebae5cbde066fcb1f
Opcode Fuzzy Hash: 2cd2e29e906c3bffebd332faea78e62c59c39445b1535c3da010f19e2b38c6d9
Instruction Fuzzy Hash: 41E1A0315083418FD714EF24C982F6AB7E4BF85314F04896DF9899B2A2DB75ED44CB92

Function 00FC7778 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 273COMMON

Download Yara Rule

Strings

', xrefs: 01005169
", xrefs: 01005153

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID: "$'
API String ID: 0-2422873937
Opcode ID: d93b0d9a50323905c636a341ba488681d99ee594726b78776deaff5ddd4a418f
Instruction ID: 8817960e6b0fb09ab628ebc26465ee83ba29c33d8e0b24bfc4438b3c024c1079
Opcode Fuzzy Hash: d93b0d9a50323905c636a341ba488681d99ee594726b78776deaff5ddd4a418f
Instruction Fuzzy Hash: 4D811871A04306BBEF11BF64CE43FAE3BA5AF15340F144029F905AA1D2EB78D915EB91

Function 01021201 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241COMMON

Download Yara Rule

Strings

, xrefs: 0102125A
ZL, xrefs: 01021392

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID:
String ID: $ZL
API String ID: 0-3552672294
Opcode ID: 5f4b0bf46cdb33aff3f6cf388ae02dd567b21fd811a3edf0408685ce73b227fd
Instruction ID: 4aacac94fd6fc82ade81d109461ce6d86503e1f80a78130fdc96259cf6ae9508
Opcode Fuzzy Hash: 5f4b0bf46cdb33aff3f6cf388ae02dd567b21fd811a3edf0408685ce73b227fd
Instruction Fuzzy Hash: C881DF71900219AFEF219FA8CC89FEE7FB9EF04704F04416AFA54A61A0CB759944CB64

Function 00FC344D Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 01003277
_wcslen.LIBCMT ref: 01003286

Strings

\, xrefs: 0100328C

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _wcslen
String ID: \
API String ID: 176396367-2967466578
Opcode ID: 787807e1afe6a33cfab8ca21ee33a923b567645059f81b4a1e8a0612646f87ea
Instruction ID: 15f8b9978993d886875617fcd14b6b9b4fe48721f84749f68c551ee3ceb67dc1
Opcode Fuzzy Hash: 787807e1afe6a33cfab8ca21ee33a923b567645059f81b4a1e8a0612646f87ea
Instruction Fuzzy Hash: A871AD714093019EC305DF69DE82E9BBBE8BFA5340F40483FF985871A0DBB89548DB66

Function 01033D1E Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 01033D6D

Strings

:, xrefs: 01033D82
\, xrefs: 01033D77

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: _wcslen
String ID: :$\
API String ID: 176396367-1166558509
Opcode ID: 8393664a22464e4253d7eab9e567e7331e947b0021ede9ca1273046c13f8be72
Instruction ID: 0a762bfcce7b9b46a3a0c398206c75ab2557dcd7753ff8667163ee1b98a58506
Opcode Fuzzy Hash: 8393664a22464e4253d7eab9e567e7331e947b0021ede9ca1273046c13f8be72
Instruction Fuzzy Hash: 5731A671900149ABDB21AFA4DC89FEF37BDFF88700F1041B6F645D6151E77492448B64

Function 00FDE398 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00FDE3D5

Strings

8%M, xrefs: 00FDE3CA
0%M, xrefs: 00FDE3B5

Memory Dump Source

Source File: 00000000.00000002.2579095928.0000000000FC1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000000.00000002.2579082488.0000000000FC0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.000000000105C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579153279.0000000001082000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.000000000108C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579196536.0000000001090000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2579227329.0000000001094000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fc0000_Image Quote 011698.jbxd

Similarity

API ID: Init_thread_footer
String ID: 0%M$8%M
API String ID: 1385522511-666571738
Opcode ID: 36b27be9e0a83e9aa98581938c918848fc8ca54e9c586360ab56cc84b83fe9f2
Instruction ID: fcdcefbebc3ec591b4f471fd8d4d99c39a9946206bf0ffbdc3b5cbcf9470c7aa
Opcode Fuzzy Hash: 36b27be9e0a83e9aa98581938c918848fc8ca54e9c586360ab56cc84b83fe9f2
Instruction Fuzzy Hash: F7E02631801910EBCE04B758FE74EAE3752AB24330B9402B7E1028F3D19FFC2881A64C

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Image Quote 011698.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Image Quote 011698.exePID: 7960, Parent PID: 2592

General

Chronological Activities

Disassembly

Analysis Process: Image Quote 011698.exePID: 7960, Parent PID: 2592COMMON

Non-executed Functions

Function 00FDB731 Relevance: 16.6, Strings: 9, Instructions: 5385COMMON

Function 00FC8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Function 01028298 Relevance: 4.3, Strings: 3, Instructions: 568COMMON

Function 01054873 Relevance: 3.6, APIs: 2, Instructions: 566COMMON

Function 00FECAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Function 00FFE4FF Relevance: 2.9, APIs: 1, Instructions: 1381COMMON

Windows Analysis Report
Image Quote 011698.exe