Edit tour

Windows Analysis Report
orderconfirmation.exe

Overview

General Information

Sample name:	orderconfirmation.exe
Analysis ID:	1519505
MD5:	1dfda6fc13c7efab9f6148e7339ab80c
SHA1:	d5c7e9b3bc28e876ae223f9a6dd9b4d7f6cda9fd
SHA256:	47a1bbb47ede2daa62558515a9a4e98410a8b2d7c9e74fe5c45783969c48be39
Tags:	exeuser-N3utralZ0ne
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Found hidden mapped module (file has been removed from disk)

Initial sample is a PE file and has a suspicious name

Injects code into the Windows Explorer (explorer.exe)

LummaC encrypted strings found

Maps a DLL or memory area into another process

Sample uses string decryption to hide its real strings

Switches to a custom stack to bypass stack traces

Writes to foreign memory regions

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

orderconfirmation.exe (PID: 7392 cmdline: "C:\Users\user\Desktop\orderconfirmation.exe" MD5: 1DFDA6FC13C7EFAB9F6148E7339AB80C)

Virtual.exe (PID: 7508 cmdline: "C:\Users\user\AppData\Local\Temp\Virtual.exe" MD5: C8A2DE7077F97D4BCE1A44317B49EF41)

Virtual.exe (PID: 7532 cmdline: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe MD5: C8A2DE7077F97D4BCE1A44317B49EF41)

cmd.exe (PID: 7548 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorer.exe (PID: 7928 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://censys.com/a-beginners-guide-to-hunting-open-directories/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["ghostreedmnu.shop", "vozmeatillu.shop", "drawzhotdog.shop", "stogeneratmns.shop", "teenylogicod.shop", "reinforcenh.shop", "gutterydhowi.shop", "fragnantbui.shop", "offensivedzvju.shop"], "Build id": "DtiPjR--NashTraff"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Proxy Execution Via Explorer.exe

Source: Process started

Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative: Data: Command: C:\Windows\SysWOW64\explorer.exe, CommandLine: C:\Windows\SysWOW64\explorer.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\explorer.exe, NewProcessName: C:\Windows\SysWOW64\explorer.exe, OriginalFileName: C:\Windows\SysWOW64\explorer.exe, ParentCommandLine: C:\Windows\SysWOW64\cmd.exe, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7548, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\SysWOW64\explorer.exe, ProcessId: 7928, ProcessName: explorer.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: stogeneratmns.shop	Avira URL Cloud: Label: malware
Source: reinforcenh.shop	Avira URL Cloud: Label: malware
Source: fragnantbui.shop	Avira URL Cloud: Label: malware
Source: offensivedzvju.shop	Avira URL Cloud: Label: malware
Source: gutterydhowi.shop	Avira URL Cloud: Label: malware
Source: drawzhotdog.shop	Avira URL Cloud: Label: malware
Source: ghostreedmnu.shop	Avira URL Cloud: Label: malware
Source: vozmeatillu.shop	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\ckmfqeimpicbuy

Avira: detection malicious, Label: HEUR/AGEN.1318482

Found malware configuration

Source: explorer.exe.7928.9.memstrmin

Malware Configuration Extractor: LummaC {"C2 url": ["ghostreedmnu.shop", "vozmeatillu.shop", "drawzhotdog.shop", "stogeneratmns.shop", "teenylogicod.shop", "reinforcenh.shop", "gutterydhowi.shop", "fragnantbui.shop", "offensivedzvju.shop"], "Build id": "DtiPjR--NashTraff"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000009.00000002.1681938549.000000000027D000.00000002.00000001.01000000.00000000.sdmp	String decryptor: reinforcenh.shop
Source: 00000009.00000002.1681938549.000000000027D000.00000002.00000001.01000000.00000000.sdmp	String decryptor: stogeneratmns.shop
Source: 00000009.00000002.1681938549.000000000027D000.00000002.00000001.01000000.00000000.sdmp	String decryptor: fragnantbui.shop
Source: 00000009.00000002.1681938549.000000000027D000.00000002.00000001.01000000.00000000.sdmp	String decryptor: drawzhotdog.shop
Source: 00000009.00000002.1681938549.000000000027D000.00000002.00000001.01000000.00000000.sdmp	String decryptor: vozmeatillu.shop
Source: 00000009.00000002.1681938549.000000000027D000.00000002.00000001.01000000.00000000.sdmp	String decryptor: offensivedzvju.shop
Source: 00000009.00000002.1681938549.000000000027D000.00000002.00000001.01000000.00000000.sdmp	String decryptor: ghostreedmnu.shop
Source: 00000009.00000002.1681938549.000000000027D000.00000002.00000001.01000000.00000000.sdmp	String decryptor: gutterydhowi.shop
Source: 00000009.00000002.1681938549.000000000027D000.00000002.00000001.01000000.00000000.sdmp	String decryptor: teenylogicod.shop
Source: 00000009.00000002.1681938549.000000000027D000.00000002.00000001.01000000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000009.00000002.1681938549.000000000027D000.00000002.00000001.01000000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000009.00000002.1681938549.000000000027D000.00000002.00000001.01000000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000009.00000002.1681938549.000000000027D000.00000002.00000001.01000000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000009.00000002.1681938549.000000000027D000.00000002.00000001.01000000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000009.00000002.1681938549.000000000027D000.00000002.00000001.01000000.00000000.sdmp	String decryptor: DtiPjR--NashTraff

Source: orderconfirmation.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\orderconfirmation.exe

File opened: C:\Users\user\AppData\Local\Temp\msvcr100.dll

Jump to behavior

Source:	Binary string: msvcp100.amd64.pdb source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002736000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1417369534.0000000000E2F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmp, Virtual.exe, 00000003.00000002.1477771422.000000006153F000.00000002.00000001.01000000.0000000F.sdmp, msvcp100.dll.2.dr
Source:	Binary string: D:\tinderbox\win-4.2\out\win.amd64\release\obj\VBoxDDU\VBoxDDU.pdb source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002736000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1418137709.0000000000E2F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1423065431.00007FFBAB8E5000.00000002.00000001.01000000.00000006.sdmp, Virtual.exe, 00000003.00000002.1478925227.00007FFBAB885000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: msvcr100.amd64.pdb source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002736000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmp, Virtual.exe, 00000002.00000003.1417587234.0000000000E2F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1477963143.0000000061621000.00000002.00000001.01000000.0000000E.sdmp, msvcr100.dll.2.dr, msvcr100.dll.0.dr
Source:	Binary string: D:\tinderbox\win-4.2\out\win.amd64\release\obj\VBoxSVC\VBoxSVC.pdb source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: ntdll.pdb source: Virtual.exe, 00000002.00000002.1421706058.0000000003519000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1421846022.0000000003910000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1477438432.0000000003E56000.00000004.00000001.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1477068006.000000000385B000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1477228614.0000000003C50000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: cmd.exe, 00000004.00000002.1682634371.000000000500D000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1683019066.0000000005470000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682537513.0000000005500000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682361980.00000000051A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: Virtual.exe, 00000002.00000002.1421706058.0000000003519000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1421846022.0000000003910000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1477438432.0000000003E56000.00000004.00000001.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1477068006.000000000385B000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1477228614.0000000003C50000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\tinderbox\win-4.2\out\win.amd64\release\obj\VBoxRT\VBoxRT.pdb source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422833949.00007FFBAAC45000.00000002.00000001.01000000.00000007.sdmp, Virtual.exe, 00000003.00000002.1478677352.00007FFBAA515000.00000002.00000001.01000000.0000000D.sdmp, VBoxRT.dll.0.dr
Source:	Binary string: wntdll.pdb source: cmd.exe, 00000004.00000002.1682634371.000000000500D000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1683019066.0000000005470000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682537513.0000000005500000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682361980.00000000051A5000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\orderconfirmation.exe	Code function: 0_2_0040301A GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	0_2_0040301A
Source: C:\Users\user\Desktop\orderconfirmation.exe	Code function: 0_2_00402B79 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	0_2_00402B79
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616983E8 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_errno,_errno,_errno,IsRootUNCName,GetDriveTypeW,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	2_2_616983E8
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616963E4 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	2_2_616963E4
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616923A0 FindClose,FindFirstFileExA,FindNextFileA,FindClose,	2_2_616923A0
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616944A8 _errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,SetErrorMode,	2_2_616944A8
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616949E4 _errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,	2_2_616949E4
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6169885C __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_errno,_errno,_errno,IsRootUNCName,GetDriveTypeW,free,free,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	2_2_6169885C
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616968D8 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	2_2_616968D8
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61697B1C __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_errno,_errno,_errno,IsRootUNCName,GetDriveTypeW,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	2_2_61697B1C
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61696DDC __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	2_2_61696DDC
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61692C0C FindClose,FindFirstFileExW,FindNextFileW,FindClose,	2_2_61692C0C
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61693F10 _errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,	2_2_61693F10
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61697F84 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_errno,_errno,_errno,IsRootUNCName,GetDriveTypeW,free,free,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	2_2_61697F84
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61695EE8 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	2_2_61695EE8
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B83E8 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_errno,_errno,_errno,IsRootUNCName,GetDriveTypeW,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	3_2_615B83E8
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B63E4 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	3_2_615B63E4
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B23A0 FindClose,FindFirstFileExA,FindNextFileA,FindClose,	3_2_615B23A0
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B44A8 _errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,SetErrorMode,	3_2_615B44A8
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B49E4 _errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,	3_2_615B49E4
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B885C __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_errno,_errno,_errno,IsRootUNCName,GetDriveTypeW,free,free,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	3_2_615B885C
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B68D8 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	3_2_615B68D8
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B7B1C __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_errno,_errno,_errno,IsRootUNCName,GetDriveTypeW,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	3_2_615B7B1C
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B6DDC __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	3_2_615B6DDC
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B2C0C FindClose,FindFirstFileExW,FindNextFileW,FindClose,	3_2_615B2C0C
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B3F10 _errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,	3_2_615B3F10
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B7F84 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_errno,_errno,_errno,IsRootUNCName,GetDriveTypeW,free,free,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	3_2_615B7F84
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B5EE8 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	3_2_615B5EE8

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: ghostreedmnu.shop
Source: Malware configuration extractor	URLs: vozmeatillu.shop
Source: Malware configuration extractor	URLs: drawzhotdog.shop
Source: Malware configuration extractor	URLs: stogeneratmns.shop
Source: Malware configuration extractor	URLs: teenylogicod.shop
Source: Malware configuration extractor	URLs: reinforcenh.shop
Source: Malware configuration extractor	URLs: gutterydhowi.shop
Source: Malware configuration extractor	URLs: fragnantbui.shop
Source: Malware configuration extractor	URLs: offensivedzvju.shop

Source: Virtual.exe, 00000003.00000002.1476869125.0000000003520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://c0rl.m%L
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: orderconfirmation.exe, 00000000.00000003.1405215894.000000000254A000.00000004.00001000.00020000.00000000.sdmp, orderconfirmation.exe, 00000000.00000003.1404300449.0000000003060000.00000004.00000020.00020000.00000000.sdmp, orderconfirmation.exe, 00000000.00000003.1404300449.0000000002736000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1419101660.000000000330F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1418137709.0000000000E2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Virtual.exe, 00000002.00000002.1421556769.00000000031E0000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476869125.0000000003520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicer
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422833949.00007FFBAAC45000.00000002.00000001.01000000.00000007.sdmp, Virtual.exe, 00000003.00000002.1478677352.00007FFBAA515000.00000002.00000001.01000000.0000000D.sdmp, VBoxRT.dll.0.dr	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: orderconfirmation.exe, 00000000.00000003.1405215894.000000000254A000.00000004.00001000.00020000.00000000.sdmp, orderconfirmation.exe, 00000000.00000003.1404300449.0000000003060000.00000004.00000020.00020000.00000000.sdmp, orderconfirmation.exe, 00000000.00000003.1404300449.0000000002736000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1419101660.000000000330F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1418137709.0000000000E2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: VBoxRT.dll.2.dr	String found in binary or memory: http://relaxng.org/ns/structure/1.0
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422833949.00007FFBAAC45000.00000002.00000001.01000000.00000007.sdmp, Virtual.exe, 00000003.00000002.1478677352.00007FFBAA515000.00000002.00000001.01000000.0000000D.sdmp, VBoxRT.dll.0.dr, VBoxRT.dll.2.dr	String found in binary or memory: http://relaxng.org/ns/structure/1.0allocating
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: orderconfirmation.exe, 00000000.00000003.1405215894.000000000254A000.00000004.00001000.00020000.00000000.sdmp, orderconfirmation.exe, 00000000.00000003.1404300449.0000000003060000.00000004.00000020.00020000.00000000.sdmp, orderconfirmation.exe, 00000000.00000003.1404300449.0000000002736000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1419101660.000000000330F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1418137709.0000000000E2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: orderconfirmation.exe, 00000000.00000003.1405215894.000000000254A000.00000004.00001000.00020000.00000000.sdmp, orderconfirmation.exe, 00000000.00000003.1404300449.0000000003060000.00000004.00000020.00020000.00000000.sdmp, orderconfirmation.exe, 00000000.00000003.1404300449.0000000002736000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1419101660.000000000330F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1418137709.0000000000E2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: orderconfirmation.exe, 00000000.00000003.1405215894.000000000254A000.00000004.00001000.00020000.00000000.sdmp, orderconfirmation.exe, 00000000.00000003.1404300449.0000000003060000.00000004.00000020.00020000.00000000.sdmp, orderconfirmation.exe, 00000000.00000003.1404300449.0000000002736000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1419101660.000000000330F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1418137709.0000000000E2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://virtualbox.org/firmware/VBoxEFI32.fd
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://virtualbox.org/firmware/VBoxEFI32.fdVBoxEFI64.fdhttp://virtualbox.org/firmware/VBoxEFI64.fdVB
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://virtualbox.org/firmware/VBoxEFI64.fd
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://virtualbox.org/firmware/VBoxEFIDual.fd
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: Virtual.exe, 00000002.00000002.1421616749.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.0000000003725000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.0000000005360000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.000000000505B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.innotek.de/VirtualBox-settings
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422833949.00007FFBAAC45000.00000002.00000001.01000000.00000007.sdmp, Virtual.exe, 00000003.00000002.1478677352.00007FFBAA515000.00000002.00000001.01000000.0000000D.sdmp, VBoxRT.dll.0.dr, VBoxRT.dll.2.dr	String found in binary or memory: http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422833949.00007FFBAAC45000.00000002.00000001.01000000.00000007.sdmp, Virtual.exe, 00000003.00000002.1478677352.00007FFBAA515000.00000002.00000001.01000000.0000000D.sdmp, VBoxRT.dll.0.dr, VBoxRT.dll.2.dr	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422833949.00007FFBAAC45000.00000002.00000001.01000000.00000007.sdmp, Virtual.exe, 00000003.00000002.1478677352.00007FFBAA515000.00000002.00000001.01000000.0000000D.sdmp, VBoxRT.dll.0.dr, VBoxRT.dll.2.dr	String found in binary or memory: http://www.openssl.org/support/faq.html....................D:
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.virtualbox.org/ovf/machine
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.vmware.com/interfaces/specifications/vmdk.html#compressed
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.vmware.com/interfaces/specifications/vmdk.html#compressedhttp://www.vmware.com/specificat
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.vmware.com/interfaces/specifications/vmdk.html#streamOptimized
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.vmware.com/schema/ovf/1/envelope
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.vmware.com/specifications/vmdk.html#compressed
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.vmware.com/specifications/vmdk.html#sparse
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.vmware.com/specifications/vmdk.html#sparsehttp://www.vmware.com/interfaces/specifications
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: orderconfirmation.exe

Source: C:\Users\user\Desktop\orderconfirmation.exe	Code function: 0_2_00404FAA	0_2_00404FAA
Source: C:\Users\user\Desktop\orderconfirmation.exe	Code function: 0_2_0041206B	0_2_0041206B
Source: C:\Users\user\Desktop\orderconfirmation.exe	Code function: 0_2_0041022D	0_2_0041022D
Source: C:\Users\user\Desktop\orderconfirmation.exe	Code function: 0_2_00411F91	0_2_00411F91
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616AB1E0	2_2_616AB1E0
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6169A1F0	2_2_6169A1F0
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616A8194	2_2_616A8194
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616C3050	2_2_616C3050
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616F0008	2_2_616F0008
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616AA0EC	2_2_616AA0EC
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6167D0E8	2_2_6167D0E8
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6169C350	2_2_6169C350
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616DA2BC	2_2_616DA2BC
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616EE2B8	2_2_616EE2B8
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616ED2B4	2_2_616ED2B4
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616A0288	2_2_616A0288
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616A9294	2_2_616A9294
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6167B298	2_2_6167B298
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616EF558	2_2_616EF558
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6169F454	2_2_6169F454
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616AA410	2_2_616AA410
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616F74DC	2_2_616F74DC
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616A24D0	2_2_616A24D0
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616944A8	2_2_616944A8
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616A84BC	2_2_616A84BC
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6169A760	2_2_6169A760
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616AA77C	2_2_616AA77C
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6168D73C	2_2_6168D73C
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616DB7E4	2_2_616DB7E4
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6169B7C4	2_2_6169B7C4
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616A27AC	2_2_616A27AC
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6168B624	2_2_6168B624
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616AC6A0	2_2_616AC6A0
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616A56B8	2_2_616A56B8
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616806B0	2_2_616806B0
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616A5958	2_2_616A5958
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6169A92C	2_2_6169A92C
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616949E4	2_2_616949E4
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616A28D4	2_2_616A28D4
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6167D8B4	2_2_6167D8B4
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6168C894	2_2_6168C894
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616A2BF4	2_2_616A2BF4
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616DCBA0	2_2_616DCBA0
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616A5B88	2_2_616A5B88
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616A7AF4	2_2_616A7AF4
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61699AAC	2_2_61699AAC
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616A5A94	2_2_616A5A94
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616A4D40	2_2_616A4D40
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61690DCC	2_2_61690DCC
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616A7DB0	2_2_616A7DB0
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616A9C74	2_2_616A9C74
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61698CF8	2_2_61698CF8
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616C7F74	2_2_616C7F74
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616A9F44	2_2_616A9F44
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616EDF5C	2_2_616EDF5C
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61693F10	2_2_61693F10
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6169BE1C	2_2_6169BE1C
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616A8E10	2_2_616A8E10
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616AAE9C	2_2_616AAE9C
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6178F2D4	2_2_6178F2D4
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6175E5F8	2_2_6175E5F8
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6177B5B8	2_2_6177B5B8
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61779580	2_2_61779580
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6177D46C	2_2_6177D46C
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_617804D0	2_2_617804D0
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_617864B8	2_2_617864B8
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61790740	2_2_61790740
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61794714	2_2_61794714
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6178E638	2_2_6178E638
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_617956E8	2_2_617956E8
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6177692C	2_2_6177692C
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6177A84C	2_2_6177A84C
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6178DB68	2_2_6178DB68
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61779B60	2_2_61779B60
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6176DD3C	2_2_6176DD3C
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6177CD3C	2_2_6177CD3C
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61793E34	2_2_61793E34
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61783E0C	2_2_61783E0C
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61781EF4	2_2_61781EF4
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6177AE88	2_2_6177AE88
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_6152F2D4	3_2_6152F2D4
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_614FE5F8	3_2_614FE5F8
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_61519580	3_2_61519580
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_6151B5B8	3_2_6151B5B8
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_6151D46C	3_2_6151D46C
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615204D0	3_2_615204D0
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615264B8	3_2_615264B8
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_61530740	3_2_61530740
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_61534714	3_2_61534714
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_6152E638	3_2_6152E638
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615356E8	3_2_615356E8
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_6151692C	3_2_6151692C
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_6151A84C	3_2_6151A84C
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_61519B60	3_2_61519B60
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_6152DB68	3_2_6152DB68
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_6150DD3C	3_2_6150DD3C
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_6151CD3C	3_2_6151CD3C
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_61523E0C	3_2_61523E0C
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_61533E34	3_2_61533E34
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_61521EF4	3_2_61521EF4
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_6151AE88	3_2_6151AE88
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615BA1F0	3_2_615BA1F0
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615CB1E0	3_2_615CB1E0
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615C8194	3_2_615C8194
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615E3050	3_2_615E3050
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_61610008	3_2_61610008
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615CA0EC	3_2_615CA0EC
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_6159D0E8	3_2_6159D0E8
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615BC350	3_2_615BC350
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_6159B298	3_2_6159B298
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615C9294	3_2_615C9294
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615C0288	3_2_615C0288
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_6160D2B4	3_2_6160D2B4
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_6160E2B8	3_2_6160E2B8
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615FA2BC	3_2_615FA2BC
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_6160F558	3_2_6160F558
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615BF454	3_2_615BF454
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615CA410	3_2_615CA410
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615C24D0	3_2_615C24D0
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_616174DC	3_2_616174DC
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615C84BC	3_2_615C84BC
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B44A8	3_2_615B44A8
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615CA77C	3_2_615CA77C
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615BA760	3_2_615BA760
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615AD73C	3_2_615AD73C
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615BB7C4	3_2_615BB7C4
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615FB7E4	3_2_615FB7E4
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615C27AC	3_2_615C27AC
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615AB624	3_2_615AB624
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615C56B8	3_2_615C56B8
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615A06B0	3_2_615A06B0
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615CC6A0	3_2_615CC6A0
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615C5958	3_2_615C5958
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615D7938	3_2_615D7938
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615BA92C	3_2_615BA92C
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B49E4	3_2_615B49E4
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615C28D4	3_2_615C28D4
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615AC894	3_2_615AC894
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_6159D8B4	3_2_6159D8B4
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615C2BF4	3_2_615C2BF4
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_6160EBD8	3_2_6160EBD8
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615C5B88	3_2_615C5B88
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615FCBA0	3_2_615FCBA0
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615C7AF4	3_2_615C7AF4
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615C5A94	3_2_615C5A94
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B9AAC	3_2_615B9AAC
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615C4D40	3_2_615C4D40
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B0DCC	3_2_615B0DCC
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615C7DB0	3_2_615C7DB0
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615C9C74	3_2_615C9C74
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B8CF8	3_2_615B8CF8
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615C9F44	3_2_615C9F44
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615E7F74	3_2_615E7F74
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_6160DF5C	3_2_6160DF5C
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B3F10	3_2_615B3F10
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615BBE1C	3_2_615BBE1C
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615C8E10	3_2_615C8E10
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615CAE9C	3_2_615CAE9C

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\Virtual.exe 448402C129A721812FA1C5F279F5CA906B9C8BBCA652A91655D144D20CE5E6B4

Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: String function: 6175F96C appears 38 times
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: String function: 614FF96C appears 38 times
Source: C:\Users\user\Desktop\orderconfirmation.exe	Code function: String function: 0040243B appears 37 times

Source: orderconfirmation.exe, 00000000.00000003.1396839177.000000000244D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7ZSfxMod_x86.exe< vs orderconfirmation.exe
Source: orderconfirmation.exe, 00000000.00000000.1395125620.0000000000432000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename7ZSfxMod_x86.exe< vs orderconfirmation.exe
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002736000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcp100.dll^ vs orderconfirmation.exe
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002736000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcr100_clr0400.dll^ vs orderconfirmation.exe
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameVBoxSVC.exeJ vs orderconfirmation.exe
Source: orderconfirmation.exe	Binary or memory string: OriginalFilename7ZSfxMod_x86.exe< vs orderconfirmation.exe

Source: orderconfirmation.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@10/16@0/0

Source: C:\Users\user\Desktop\orderconfirmation.exe

Code function: 0_2_00407776 wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,??2@YAPAXI@Z,lstrcpyW,lstrcpyW,lstrcpyW,??3@YAXPAX@Z,LocalFree,

0_2_00407776

Source: C:\Users\user\Desktop\orderconfirmation.exe

Code function: 0_2_0040118A GetDiskFreeSpaceExW,SendMessageW,

0_2_0040118A

Source: C:\Users\user\Desktop\orderconfirmation.exe

Code function: 0_2_004034C1 _wtol,_wtol,SHGetSpecialFolderPathW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,CoCreateInstance,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,

0_2_004034C1

Source: C:\Users\user\Desktop\orderconfirmation.exe

Code function: 0_2_00401BDF GetModuleHandleW,FindResourceExA,FindResourceExA,FindResourceExA,SizeofResource,LoadResource,LockResource,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,wsprintfW,LoadLibraryA,GetProcAddress,

0_2_00401BDF

Source: C:\Users\user\AppData\Local\Temp\Virtual.exe

File created: C:\Users\user\AppData\Roaming\fmBrowserumz_test

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7556:120:WilError_03

Source: C:\Users\user\Desktop\orderconfirmation.exe

File created: C:\Users\user\AppData\Local\Temp\Package

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe			Jump to behavior

Source: orderconfirmation.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\orderconfirmation.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\orderconfirmation.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\orderconfirmation.exe

File read: C:\Users\user\Desktop\orderconfirmation.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\orderconfirmation.exe "C:\Users\user\Desktop\orderconfirmation.exe"
Source: C:\Users\user\Desktop\orderconfirmation.exe	Process created: C:\Users\user\AppData\Local\Temp\Virtual.exe "C:\Users\user\AppData\Local\Temp\Virtual.exe"
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Process created: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\Desktop\orderconfirmation.exe	Process created: C:\Users\user\AppData\Local\Temp\Virtual.exe "C:\Users\user\AppData\Local\Temp\Virtual.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Process created: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\orderconfirmation.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: newdev.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: vboxddu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: vboxrt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: msvcp100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: vboxrt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: msvcp100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: newdev.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: vboxddu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: vboxrt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: msvcp100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: vboxrt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: newdev.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: pla.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: tdh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: shdocvw.dll	Jump to behavior

Source: orderconfirmation.exe

Static file information: File size 3678161 > 1048576

Source: C:\Users\user\Desktop\orderconfirmation.exe

File opened: C:\Users\user\AppData\Local\Temp\msvcr100.dll

Jump to behavior

Source:	Binary string: msvcp100.amd64.pdb source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002736000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1417369534.0000000000E2F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmp, Virtual.exe, 00000003.00000002.1477771422.000000006153F000.00000002.00000001.01000000.0000000F.sdmp, msvcp100.dll.2.dr
Source:	Binary string: D:\tinderbox\win-4.2\out\win.amd64\release\obj\VBoxDDU\VBoxDDU.pdb source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002736000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1418137709.0000000000E2F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1423065431.00007FFBAB8E5000.00000002.00000001.01000000.00000006.sdmp, Virtual.exe, 00000003.00000002.1478925227.00007FFBAB885000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: msvcr100.amd64.pdb source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002736000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmp, Virtual.exe, 00000002.00000003.1417587234.0000000000E2F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1477963143.0000000061621000.00000002.00000001.01000000.0000000E.sdmp, msvcr100.dll.2.dr, msvcr100.dll.0.dr
Source:	Binary string: D:\tinderbox\win-4.2\out\win.amd64\release\obj\VBoxSVC\VBoxSVC.pdb source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: ntdll.pdb source: Virtual.exe, 00000002.00000002.1421706058.0000000003519000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1421846022.0000000003910000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1477438432.0000000003E56000.00000004.00000001.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1477068006.000000000385B000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1477228614.0000000003C50000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: cmd.exe, 00000004.00000002.1682634371.000000000500D000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1683019066.0000000005470000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682537513.0000000005500000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682361980.00000000051A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: Virtual.exe, 00000002.00000002.1421706058.0000000003519000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1421846022.0000000003910000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1477438432.0000000003E56000.00000004.00000001.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1477068006.000000000385B000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1477228614.0000000003C50000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: D:\tinderbox\win-4.2\out\win.amd64\release\obj\VBoxRT\VBoxRT.pdb source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422833949.00007FFBAAC45000.00000002.00000001.01000000.00000007.sdmp, Virtual.exe, 00000003.00000002.1478677352.00007FFBAA515000.00000002.00000001.01000000.0000000D.sdmp, VBoxRT.dll.0.dr
Source:	Binary string: wntdll.pdb source: cmd.exe, 00000004.00000002.1682634371.000000000500D000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1683019066.0000000005470000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682537513.0000000005500000.00000004.00001000.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682361980.00000000051A5000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\orderconfirmation.exe

Code function: 0_2_00406D5D LoadLibraryA,GetProcAddress,GetModuleHandleW,GetWindow,GetWindow,LoadIconW,GetWindow,

0_2_00406D5D

Source: VBoxRT.dll.2.dr	Static PE information: real checksum: 0x413417 should be: 0x40d7d0
Source: VBoxRT.dll.0.dr	Static PE information: real checksum: 0x413417 should be: 0x40d7d0
Source: ckmfqeimpicbuy.4.dr	Static PE information: real checksum: 0x0 should be: 0x5e5e1
Source: orderconfirmation.exe	Static PE information: real checksum: 0x33302 should be: 0x3875fb

Source: msvcr100.dll.0.dr	Static PE information: section name: _CONST
Source: msvcr100.dll.0.dr	Static PE information: section name: text
Source: msvcr100.dll.2.dr	Static PE information: section name: _CONST
Source: msvcr100.dll.2.dr	Static PE information: section name: text
Source: ckmfqeimpicbuy.4.dr	Static PE information: section name: uyk

Source: C:\Users\user\Desktop\orderconfirmation.exe	Code function: 0_2_00411C20 push eax; ret	0_2_00411C4E
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_617629CA push rcx; ret	2_2_617629CB
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615029CA push rcx; ret	3_2_615029CB

Source: C:\Users\user\Desktop\orderconfirmation.exe	File created: C:\Users\user\AppData\Local\Temp\Virtual.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	File created: C:\Users\user\AppData\Roaming\fmBrowserumz_test\VBoxDDU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	File created: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\ckmfqeimpicbuy	Jump to dropped file
Source: C:\Users\user\Desktop\orderconfirmation.exe	File created: C:\Users\user\AppData\Local\Temp\VBoxDDU.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	File created: C:\Users\user\AppData\Roaming\fmBrowserumz_test\VBoxRT.dll	Jump to dropped file
Source: C:\Users\user\Desktop\orderconfirmation.exe	File created: C:\Users\user\AppData\Local\Temp\VBoxRT.dll	Jump to dropped file
Source: C:\Users\user\Desktop\orderconfirmation.exe	File created: C:\Users\user\AppData\Local\Temp\msvcr100.dll	Jump to dropped file
Source: C:\Users\user\Desktop\orderconfirmation.exe	File created: C:\Users\user\AppData\Local\Temp\msvcp100.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	File created: C:\Users\user\AppData\Roaming\fmBrowserumz_test\msvcr100.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	File created: C:\Users\user\AppData\Roaming\fmBrowserumz_test\msvcp100.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\ckmfqeimpicbuy

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Windows\SysWOW64\cmd.exe

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\CKMFQEIMPICBUY

Source: C:\Users\user\AppData\Local\Temp\Virtual.exe

Code function: 2_2_6168D73C GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,GetModuleHandleW,GetProcAddress,GetLastError,

2_2_6168D73C

Source: C:\Users\user\Desktop\orderconfirmation.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Windows\SysWOW64\cmd.exe	API/Special instruction interceptor: Address: 6D4C3B54
Source: C:\Windows\SysWOW64\explorer.exe	API/Special instruction interceptor: Address: DFA317

Source: C:\Users\user\AppData\Local\Temp\Virtual.exe

Code function: 2_2_6168B878 rdtsc

2_2_6168B878

Source: C:\Windows\SysWOW64\cmd.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ckmfqeimpicbuy

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	API coverage: 0.5 %
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	API coverage: 0.5 %

Source: C:\Users\user\Desktop\orderconfirmation.exe	Code function: 0_2_0040301A GetFileAttributesW,SetLastError,FindFirstFileW,FindClose,CompareFileTime,	0_2_0040301A
Source: C:\Users\user\Desktop\orderconfirmation.exe	Code function: 0_2_00402B79 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	0_2_00402B79
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616983E8 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_errno,_errno,_errno,IsRootUNCName,GetDriveTypeW,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	2_2_616983E8
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616963E4 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	2_2_616963E4
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616923A0 FindClose,FindFirstFileExA,FindNextFileA,FindClose,	2_2_616923A0
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616944A8 _errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,SetErrorMode,	2_2_616944A8
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616949E4 _errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,	2_2_616949E4
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_6169885C __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_errno,_errno,_errno,IsRootUNCName,GetDriveTypeW,free,free,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	2_2_6169885C
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616968D8 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	2_2_616968D8
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61697B1C __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_errno,_errno,_errno,IsRootUNCName,GetDriveTypeW,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	2_2_61697B1C
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61696DDC __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	2_2_61696DDC
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61692C0C FindClose,FindFirstFileExW,FindNextFileW,FindClose,	2_2_61692C0C
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61693F10 _errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,	2_2_61693F10
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61697F84 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_errno,_errno,_errno,IsRootUNCName,GetDriveTypeW,free,free,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	2_2_61697F84
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61695EE8 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	2_2_61695EE8
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B83E8 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_errno,_errno,_errno,IsRootUNCName,GetDriveTypeW,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	3_2_615B83E8
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B63E4 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	3_2_615B63E4
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B23A0 FindClose,FindFirstFileExA,FindNextFileA,FindClose,	3_2_615B23A0
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B44A8 _errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,SetErrorMode,	3_2_615B44A8
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B49E4 _errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileW,GetLastError,_errno,_errno,_errno,	3_2_615B49E4
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B885C __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_errno,_errno,_errno,IsRootUNCName,GetDriveTypeW,free,free,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	3_2_615B885C
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B68D8 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	3_2_615B68D8
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B7B1C __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_errno,_errno,_errno,IsRootUNCName,GetDriveTypeW,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	3_2_615B7B1C
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B6DDC __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	3_2_615B6DDC
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B2C0C FindClose,FindFirstFileExW,FindNextFileW,FindClose,	3_2_615B2C0C
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B3F10 _errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindFirstFileExA,GetLastError,_errno,_errno,_errno,_errno,_invalid_parameter_noinfo,FindNextFileA,GetLastError,_errno,_errno,_errno,	3_2_615B3F10
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B7F84 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExW,_errno,_errno,_errno,_errno,_errno,IsRootUNCName,GetDriveTypeW,free,free,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	3_2_615B7F84
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_615B5EE8 __doserrno,_errno,_invalid_parameter_noinfo,_errno,__doserrno,_getdrive,FindFirstFileExA,_errno,_errno,_errno,_errno,_errno,GetDriveTypeA,free,free,_errno,__doserrno,_wsopen_s,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FindClose,GetLastError,FindClose,	3_2_615B5EE8

Source: C:\Users\user\AppData\Local\Temp\Virtual.exe

Code function: 2_2_616799E0 GetSystemInfo,GetVersionExW,GetModuleHandleW,GetProcAddress,GetLastError,GetLogicalProcessorInformation,GetLastError,GetLastError,malloc,GetLogicalProcessorInformation,GetLastError,GetLastError,GetLastError,malloc,GetLastError,free,

2_2_616799E0

Source: Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: http://www.vmware.com/schema/ovf/1/envelope
Source: Virtual.exe, 00000003.00000002.1476869125.0000000003520000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: uuidvbox:uuid%RTuuidovf:formathttp://www.vmware.com/specifications/vmdk.html#sparsehttp://www.vmware.com/interfaces/specifications/vmdk.html#streamOptimizedovf:fileRefovf:diskIdovf:capacityDiskovf:hrefFilefile%RI32VMDKLogical network used by this appliance.ovf:nameExportedVirtualBoxMachinesVirtualSystemCollectionCannot export more than one virtual system with OVF 0.9, use OVF 1.0Logical networks used in the packageNetworkSectionovf:NetworkSection_TypeList of the virtual disks used in the packageDiskSectionovf:DiskSection_TypeReferencesxmlns:vboxhttp://www.virtualbox.org/ovf/machinexmlns:xsihttp://www.w3.org/2001/XMLSchema-instancexmlns:vssdhttp://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_VirtualSystemSettingDataxmlns:rasdhttp://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_ResourceAllocationSettingDataxmlns:ovfxmlnshttp://schemas.dmtf.org/ovf/envelope/1http://www.vmware.com/schema/ovf/1/envelopexml:langen-USovf:version0.92.0Envelope"
Source: Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: %s/VBoxGuestAdditions_%ls.iso
Source: explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: /additions/VBoxGuestAdditions.iso
Source: explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: VBoxRT.dll.2.dr	Binary or memory string: using the native ring-0 loaderpLoadReq->u.In.cbStrTab == CalcArgs.cbStrings(size_t)(CreateArgs.pSym - (PSUPLDRSYM)&pLoadReq->u.In.abImage[offSymTab]) <= CalcArgs.cSymbols(size_t)(CreateArgs.psz - CreateArgs.pszBase) <= CalcArgs.cbStringsint __cdecl supLoadModule(const char ,const char ,const char ,void *)ModuleTermModuleInitVMMR0EntryExVMMR0EntryFastVMMR0EntryIntsupLoadModule returned %RrcVBoxDrvVBox Support Driver\VBoxDrv.sys\\.\VBoxDrvVBoxNetDHCP.dllVBoxNetDHCP.exevboxwebsrv.exeVBoxBFE.dllVBoxBFE.exeVBoxSDL.dllVBoxSDL.exeVirtualBox.dllVirtualBox.exeVBoxVideoRecFB.dllVBoxHeadless.dllVBoxHeadless.exeVBoxVRDP.dllVBoxAuth.dllVRDPAuth.dllVBoxC.dllVBoxSVC.exeVBoxManage.exeVBoxOGLrenderspu.dllVBoxOGLhosterrorspu.dllVBoxOGLhostcrutil.dllVBoxSharedCrOpenGL.dllVBoxHostChannel.dllVBoxGuestControlSvc.dllVBoxGuestPropSvc.dllVBoxDragAndDropSvc.dllVBoxSharedFolders.dllVBoxSharedClipboard.dllVBoxDbg3.dllVBoxDbg.dllVBoxDDU.dllVBoxDD2.dllVBoxDD.dllVBoxREM.dllVBoxVMM.dllVBoxRT.dllVBoxDD2GC.gcVBoxDDGC.gcVMMGC.gcVBoxDD2R0.r0VBoxDDR0.r0
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1419101660.00000000032AD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413508072.00007FF605E53000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000002.1478387442.00007FF6AEB43000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: AdditionsFacilityType_VBoxTrayClient
Source: Virtual.exe, 00000003.00000002.1478387442.00007FF6AEB43000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: aVmNetTx
Source: Virtual.exe, 00000003.00000002.1478387442.00007FF6AEB43000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: aVmNetRx
Source: explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: VBoxRT.dll.2.dr	Binary or memory string: The service was disabled on the host. Returned by pfnInit in VBoxService to indicated a non-fatal error that should results in the particular service being disabled.
Source: explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: VBoxRT.dll.2.dr	Binary or memory string: VBoxGuestPropSvc.dll
Source: Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: /VBoxGuestAdditions.iso
Source: Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: Given default machine Guest Additions ISO file '%s' does not existGiven default machine Guest Additions ISO file '%s' is not fully qualifiedCannot determine default Guest Additions ISO location. Most likely they are not available%s/VBoxGuestAdditions_%ls.iso/additions/VBoxGuestAdditions.iso/VBoxGuestAdditions.iso
Source: Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: Importing virtual disk image '%s'Could not find a valid medium format for the source disk '%s'http://www.vmware.com/interfaces/specifications/vmdk.html#compressedhttp://www.vmware.com/specifications/vmdk.html#compressedVDICreating disk image '%s'%s%c%sCould not find a valid medium format for the target disk '%s'"
Source: Virtual.exe, 00000003.00000002.1478387442.00007FF6AEB43000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: AdditionsFacilityType_VBoxGuestDriverWWW
Source: explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: Virtual.exe, 00000003.00000002.1478387442.00007FF6AEB43000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: !0R4AdditionsFacilityType_VBoxServiceWWW
Source: VBoxRT.dll.2.dr	Binary or memory string: VBoxGuestControlSvc.dll
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422833949.00007FFBAAC45000.00000002.00000001.01000000.00000007.sdmp, Virtual.exe, 00000003.00000002.1478677352.00007FFBAA515000.00000002.00000001.01000000.0000000D.sdmp, VBoxRT.dll.0.dr, VBoxRT.dll.2.dr	Binary or memory string: VBoxTray.exe
Source: VBoxRT.dll.2.dr	Binary or memory string: IOCtl to VBoxGuest driver failed.
Source: Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: http://www.vmware.com/specifications/vmdk.html#compressed
Source: Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: http://www.vmware.com/specifications/vmdk.html#sparse
Source: Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: http://www.vmware.com/interfaces/specifications/vmdk.html#streamOptimized
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422833949.00007FFBAAC45000.00000002.00000001.01000000.00000007.sdmp, Virtual.exe, 00000003.00000002.1478677352.00007FFBAA515000.00000002.00000001.01000000.0000000D.sdmp, VBoxRT.dll.0.dr, VBoxRT.dll.2.dr	Binary or memory string: VBoxTray.exeexplorer.exeint __cdecl rtProcWinCreateAsUser1(unsigned short ,unsigned short ,unsigned short ,unsigned short ,struct RTENVINTERNAL ,unsigned long,struct _STARTUPINFOW ,struct _PROCESS_INFORMATION *,unsigned int)pfnCreateProcessWithLogonW (%p) failed: dwErr=%u (%#x), rc=%Rrc
Source: orderconfirmation.exe, 00000000.00000003.1404300449.0000000002736000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422833949.00007FFBAAC45000.00000002.00000001.01000000.00000007.sdmp, Virtual.exe, 00000003.00000002.1478677352.00007FFBAA515000.00000002.00000001.01000000.0000000D.sdmp, VBoxRT.dll.0.dr, VBoxRT.dll.2.dr	Binary or memory string: Virtual HDD is not opened.
Source: Virtual.exe, 00000003.00000002.1476869125.0000000003520000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mvmware
Source: Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: http://www.vmware.com/interfaces/specifications/vmdk.html#compressed
Source: Virtual.exe, 00000003.00000002.1478387442.00007FF6AEB43000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: b!0R4AdditionsFacilityType_VBoxServiceWWW

Source: C:\Users\user\AppData\Local\Temp\Virtual.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Virtual.exe

Code function: 2_2_6168B878 rdtsc

2_2_6168B878

Source: C:\Users\user\AppData\Local\Temp\Virtual.exe

Code function: 2_2_616E02A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_616E02A4

Source: C:\Users\user\Desktop\orderconfirmation.exe

Code function: 0_2_00406D5D LoadLibraryA,GetProcAddress,GetModuleHandleW,GetWindow,GetWindow,LoadIconW,GetWindow,

0_2_00406D5D

Source: C:\Users\user\AppData\Local\Temp\Virtual.exe

Code function: 2_2_616DECC8 GetProcessHeap,HeapAlloc,_errno,_errno,__doserrno,_errno,GetProcessHeap,HeapFree,SetEndOfFile,_errno,__doserrno,GetLastError,

2_2_616DECC8

Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616E02A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_616E02A4
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_616E06B0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_616E06B0
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: 2_2_61796BB0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,__crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,__crt_debugger_hook,GetCurrentProcess,TerminateProcess,	2_2_61796BB0
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_61536BB0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,__crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,__crt_debugger_hook,GetCurrentProcess,TerminateProcess,	3_2_61536BB0
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_616002A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_616002A4
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: 3_2_616006B0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_616006B0

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	NtAllocateVirtualMemory: Direct from: 0x7FFBAA718E14	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	NtQuerySystemInformation: Direct from: 0x7FFBAA702143	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	NtCreateFile: Direct from: 0x35466DEF	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	NtCreateNamedPipeFile: Direct from: 0x2D2683C	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	NtQuerySystemInformation: Direct from: 0x9AE230	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	NtAllocateVirtualMemory: Direct from: 0xA0A76ACB	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	NtReadFile: Direct from: 0x110	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	NtClose: Direct from: 0x154BB10
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	NtClose: Direct from: 0x2
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	NtAllocateVirtualMemory: Direct from: 0x7FFBAA719635	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	NtProtectVirtualMemory: Direct from: 0x3	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	NtProtectVirtualMemory: Direct from: 0x6C006C	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	NtAllocateVirtualMemory: Direct from: 0x1542C10	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	NtQuerySystemInformation: Direct from: 0x7FFB40CB21D3	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	NtProtectVirtualMemory: Direct from: 0x7FFBAA7194F5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	NtProtectVirtualMemory: Direct from: 0x7FFBCB7626A1	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 7928 base: DF79C0 value: 55			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: PID: 7928 base: 230000 value: 00			Jump to behavior

LummaC encrypted strings found

Source: cmd.exe, 00000004.00000002.1682478050.0000000003330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: reinforcenh.shop
Source: cmd.exe, 00000004.00000002.1682478050.0000000003330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: stogeneratmns.shop
Source: cmd.exe, 00000004.00000002.1682478050.0000000003330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: fragnantbui.shop
Source: cmd.exe, 00000004.00000002.1682478050.0000000003330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: drawzhotdog.shop
Source: cmd.exe, 00000004.00000002.1682478050.0000000003330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: vozmeatillu.shop
Source: cmd.exe, 00000004.00000002.1682478050.0000000003330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: offensivedzvju.shop
Source: cmd.exe, 00000004.00000002.1682478050.0000000003330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: ghostreedmnu.shop
Source: cmd.exe, 00000004.00000002.1682478050.0000000003330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: gutterydhowi.shop
Source: cmd.exe, 00000004.00000002.1682478050.0000000003330000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: teenylogicod.shop

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: NULL target: C:\Windows\SysWOW64\explorer.exe protection: read write			Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: DF79C0			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 230000			Jump to behavior

Source: C:\Users\user\Desktop\orderconfirmation.exe	Process created: C:\Users\user\AppData\Local\Temp\Virtual.exe "C:\Users\user\AppData\Local\Temp\Virtual.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\orderconfirmation.exe

Code function: 0_2_0040D72E cpuid

0_2_0040D72E

Source: C:\Users\user\Desktop\orderconfirmation.exe	Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,	0_2_00401F9D
Source: C:\Users\user\AppData\Local\Temp\Virtual.exe	Code function: ___lc_handle_func,GetLocaleInfoW,	2_2_61789460
Source: C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	Code function: ___lc_handle_func,GetLocaleInfoW,	3_2_61529460

Source: C:\Users\user\Desktop\orderconfirmation.exe

Code function: 0_2_00401626 ??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetLocalTime,SystemTimeToFileTime,??2@YAPAXI@Z,GetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,GetLastError,??3@YAXPAX@Z,GetLastError,??3@YAXPAX@Z,??3@YAXPAX@Z,

0_2_00401626

Source: C:\Users\user\AppData\Local\Temp\Virtual.exe

Code function: 2_2_616A7DB0 _errno,_invalid_parameter_noinfo,__tzset,_get_daylight,GetSystemTimeAsFileTime,GetTimeZoneInformation,_ftime64_s,

2_2_616A7DB0

Source: C:\Users\user\Desktop\orderconfirmation.exe

Code function: 0_2_00404FAA GetVersionExW,GetCommandLineW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetModuleFileNameW,_wtol,??2@YAPAXI@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,wsprintfW,_wtol,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,CoInitialize,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetKeyState,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,GetFileAttributesW,??3@YAXPAX@Z,??3@YAXPAX@Z,_wtol,memset,ShellExecuteExW,WaitForSingleObject,CloseHandle,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetCurrentDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,MessageBoxA,

0_2_00404FAA

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	11 DLL Side-Loading	311 Process Injection	11 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	311 Process Injection	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Abuse Elevation Control Mechanism	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	125 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
orderconfirmation.exe	5%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\ckmfqeimpicbuy	100%	Avira	HEUR/AGEN.1318482
C:\Users\user\AppData\Local\Temp\VBoxDDU.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Virtual.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\msvcp100.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\msvcr100.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\fmBrowserumz_test\VBoxDDU.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\fmBrowserumz_test\msvcp100.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\fmBrowserumz_test\msvcr100.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.symauth.com/cps0(	0%	URL Reputation	safe
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
http://crl3.digicer	0%	Avira URL Cloud	safe
http://virtualbox.org/firmware/VBoxEFI64.fd	0%	Avira URL Cloud	safe
http://www.vmware.com/interfaces/specifications/vmdk.html#compressedhttp://www.vmware.com/specificat	0%	Avira URL Cloud	safe
http://www.vmware.com/schema/ovf/1/envelope	0%	Avira URL Cloud	safe
http://www.vmware.com/0/	0%	Avira URL Cloud	safe
http://www.vmware.com/0	0%	Avira URL Cloud	safe
http://virtualbox.org/firmware/VBoxEFIDual.fd	0%	Avira URL Cloud	safe
http://www.virtualbox.org/ovf/machine	0%	Avira URL Cloud	safe
stogeneratmns.shop	100%	Avira URL Cloud	malware
http://www.openssl.org/support/faq.html....................D:	0%	Avira URL Cloud	safe
reinforcenh.shop	100%	Avira URL Cloud	malware
http://virtualbox.org/firmware/VBoxEFI32.fdVBoxEFI64.fdhttp://virtualbox.org/firmware/VBoxEFI64.fdVB	0%	Avira URL Cloud	safe
http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd	0%	Avira URL Cloud	safe
http://c0rl.m%L	0%	Avira URL Cloud	safe
http://relaxng.org/ns/structure/1.0allocating	0%	Avira URL Cloud	safe
fragnantbui.shop	100%	Avira URL Cloud	malware
teenylogicod.shop	0%	Avira URL Cloud	safe
http://virtualbox.org/firmware/VBoxEFI32.fd	0%	Avira URL Cloud	safe
offensivedzvju.shop	100%	Avira URL Cloud	malware
gutterydhowi.shop	100%	Avira URL Cloud	malware
http://www.symauth.com/rpa00	0%	Avira URL Cloud	safe
drawzhotdog.shop	100%	Avira URL Cloud	malware
http://www.innotek.de/VirtualBox-settings	0%	Avira URL Cloud	safe
http://www.vmware.com/specifications/vmdk.html#compressed	0%	Avira URL Cloud	safe
http://www.info-zip.org/	0%	Avira URL Cloud	safe
ghostreedmnu.shop	100%	Avira URL Cloud	malware
http://relaxng.org/ns/structure/1.0	0%	Avira URL Cloud	safe
http://curl.haxx.se/rfc/cookie_spec.html	0%	Avira URL Cloud	safe
http://www.vmware.com/interfaces/specifications/vmdk.html#streamOptimized	0%	Avira URL Cloud	safe
http://www.vmware.com/specifications/vmdk.html#sparse	0%	Avira URL Cloud	safe
http://www.vmware.com/interfaces/specifications/vmdk.html#compressed	0%	Avira URL Cloud	safe
vozmeatillu.shop	100%	Avira URL Cloud	malware
http://www.vmware.com/specifications/vmdk.html#sparsehttp://www.vmware.com/interfaces/specifications	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
stogeneratmns.shop	true	Avira URL Cloud: malware	unknown
reinforcenh.shop	true	Avira URL Cloud: malware	unknown
fragnantbui.shop	true	Avira URL Cloud: malware	unknown
gutterydhowi.shop	true	Avira URL Cloud: malware	unknown
teenylogicod.shop	true	Avira URL Cloud: safe	unknown
offensivedzvju.shop	true	Avira URL Cloud: malware	unknown
drawzhotdog.shop	true	Avira URL Cloud: malware	unknown
ghostreedmnu.shop	true	Avira URL Cloud: malware	unknown
vozmeatillu.shop	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.vmware.com/schema/ovf/1/envelope	orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: safe	unknown
http://virtualbox.org/firmware/VBoxEFI64.fd	orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html....................D:	orderconfirmation.exe, 00000000.00000003.1404300449.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422833949.00007FFBAAC45000.00000002.00000001.01000000.00000007.sdmp, Virtual.exe, 00000003.00000002.1478677352.00007FFBAA515000.00000002.00000001.01000000.0000000D.sdmp, VBoxRT.dll.0.dr, VBoxRT.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/0	Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/interfaces/specifications/vmdk.html#compressedhttp://www.vmware.com/specificat	orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: safe	unknown
http://crl3.digicer	Virtual.exe, 00000002.00000002.1421556769.00000000031E0000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476869125.0000000003520000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	orderconfirmation.exe, 00000000.00000003.1405215894.000000000254A000.00000004.00001000.00020000.00000000.sdmp, orderconfirmation.exe, 00000000.00000003.1404300449.0000000003060000.00000004.00000020.00020000.00000000.sdmp, orderconfirmation.exe, 00000000.00000003.1404300449.0000000002736000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1419101660.000000000330F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1418137709.0000000000E2F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://virtualbox.org/firmware/VBoxEFIDual.fd	orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: safe	unknown
http://www.virtualbox.org/ovf/machine	orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/0/	Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd	orderconfirmation.exe, 00000000.00000003.1404300449.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422833949.00007FFBAAC45000.00000002.00000001.01000000.00000007.sdmp, Virtual.exe, 00000003.00000002.1478677352.00007FFBAA515000.00000002.00000001.01000000.0000000D.sdmp, VBoxRT.dll.0.dr, VBoxRT.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://c0rl.m%L	Virtual.exe, 00000003.00000002.1476869125.0000000003520000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://virtualbox.org/firmware/VBoxEFI32.fdVBoxEFI64.fdhttp://virtualbox.org/firmware/VBoxEFI64.fdVB	orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	orderconfirmation.exe, 00000000.00000003.1404300449.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422833949.00007FFBAAC45000.00000002.00000001.01000000.00000007.sdmp, Virtual.exe, 00000003.00000002.1478677352.00007FFBAA515000.00000002.00000001.01000000.0000000D.sdmp, VBoxRT.dll.0.dr, VBoxRT.dll.2.dr	false	URL Reputation: safe	unknown
http://relaxng.org/ns/structure/1.0allocating	orderconfirmation.exe, 00000000.00000003.1404300449.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422833949.00007FFBAAC45000.00000002.00000001.01000000.00000007.sdmp, Virtual.exe, 00000003.00000002.1478677352.00007FFBAA515000.00000002.00000001.01000000.0000000D.sdmp, VBoxRT.dll.0.dr, VBoxRT.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	orderconfirmation.exe, 00000000.00000003.1405215894.000000000254A000.00000004.00001000.00020000.00000000.sdmp, orderconfirmation.exe, 00000000.00000003.1404300449.0000000003060000.00000004.00000020.00020000.00000000.sdmp, orderconfirmation.exe, 00000000.00000003.1404300449.0000000002736000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1419101660.000000000330F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000003.1418137709.0000000000E2F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://virtualbox.org/firmware/VBoxEFI32.fd	orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	Virtual.exe, 00000002.00000002.1421616749.000000000343F000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.000000000377B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.00000000053A8000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.00000000050A3000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.innotek.de/VirtualBox-settings	Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: safe	unknown
http://www.info-zip.org/	Virtual.exe, 00000002.00000002.1421616749.00000000033E9000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000003.00000002.1476960455.0000000003725000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.1682925278.0000000005360000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.1682172865.000000000505B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/specifications/vmdk.html#compressed	orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: safe	unknown
http://relaxng.org/ns/structure/1.0	VBoxRT.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://curl.haxx.se/rfc/cookie_spec.html	orderconfirmation.exe, 00000000.00000003.1404300449.0000000002B58000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000002.1422833949.00007FFBAAC45000.00000002.00000001.01000000.00000007.sdmp, Virtual.exe, 00000003.00000002.1478677352.00007FFBAA515000.00000002.00000001.01000000.0000000D.sdmp, VBoxRT.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/interfaces/specifications/vmdk.html#streamOptimized	orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/specifications/vmdk.html#sparse	orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/interfaces/specifications/vmdk.html#compressed	orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/specifications/vmdk.html#sparsehttp://www.vmware.com/interfaces/specifications	orderconfirmation.exe, 00000000.00000003.1404300449.0000000002CFD000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 00000002.00000000.1413404481.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000002.00000002.1422515618.00007FF605D77000.00000002.00000001.01000000.00000005.sdmp, Virtual.exe, 00000003.00000000.1420725570.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp, Virtual.exe, 00000003.00000002.1478289432.00007FF6AEA67000.00000002.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519505
Start date and time:	2024-09-26 16:02:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	orderconfirmation.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@10/16@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 45 Number of non-executed functions: 379
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: orderconfirmation.exe

Simulations

Behavior and APIs

Time	Type	Description
10:03:27	API Interceptor	1x Sleep call for process: cmd.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\Virtual.exe	SecuriteInfo.com.FileRepMalware.32132.13137.exe	Get hash	malicious	DanaBot	Browse
	Advanced_IP_Scanner.exe	Get hash	malicious	DanaBot	Browse
	Advanced_IP_Scanner.exe	Get hash	malicious	DanaBot	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\35453018

Download File

Process:	C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe
File Type:	data
Category:	dropped
Size (bytes):	1102032
Entropy (8bit):	7.57927547257599
Encrypted:	false
SSDEEP:	24576:d4IUFcZ/0gD/COw3sTm95KbEcGm8MjN0L2ZNq8m/Ki1pBxgAC+06D:d4NcigD/COPTO5U8MjI2ZNqb/Ki1pBx7
MD5:	C0F73EC5259183FAE3EF1BF0865E2BDB
SHA1:	AC594FC8B07EED381A005F2A83813AC3A30DC99A
SHA-256:	FD9AB546C6BC4A0856D27AD42C7C0A17462BEE4F66E46906E00D25AD2E4F7E1E
SHA-512:	7508B6FFE777CAB7B084D3DA3DB064F0391AB91E9915788CCBACC23739ECEC821B4E34B6D49AFB11F6A67410698EADB49F078AFB0E082C1454A79CFBCF05E3BF
Malicious:	false
Reputation:	low
Preview:	......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................F..B...[..y..b..x..e..w...[..J..q..e..w...f..............................................._.....l..........................................................................................U..b...e..u......................................................................................._..D.....e..8..J..{..d.......................................................................8..&.............................................

C:\Users\user\AppData\Local\Temp\VBoxDDU.dll

Download File

Process:	C:\Users\user\Desktop\orderconfirmation.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	380176
Entropy (8bit):	6.432472275317664
Encrypted:	false
SSDEEP:	6144:TTKw9G2rivrR7YR+euVO05XMog3N0++++I333O333qj333MEq333h3333f92333O:CcN3u++++I333O333qj333MJ333h333r
MD5:	496DF6AD1A158ED5037138E397713EF0
SHA1:	287BD2219C955687BAA399DED57E9AB64334C63C
SHA-256:	07C04290F53AAAAA7DF6B6EA3A53103B6E3EF8FF658D8097617A9C48DFC6E90A
SHA-512:	422DA26A8F50C1F02C1CC7C4BED37CDB33732039BBA82F32C2A14BAA8C6A7BC5544856AB26A2071B5EA8E731A296E2C69071DA2F067312D05763AA3A9928BB3A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........O.L.!.L.!.L.!.E...F.!.WX..N.!.k.Z.N.!....M.!.#...O.!.L. ...!.#...N.!.#...F.!.#...N.!.WX..T.!.WX..M.!.WX..M.!.RichL.!.................PE..d.....)R.........." .....2...z.......:....................................................@.........................................@Y..D...t@..................\|A.......#...........W...............................................P..X............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data........p.......L..............@....pdata..\|A.......B...`..............@..@.reloc..P...........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VBoxRT.dll

Download File

Process:	C:\Users\user\Desktop\orderconfirmation.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4242944
Entropy (8bit):	6.558861714917866
Encrypted:	false
SSDEEP:	49152:CaNFpHwVfZqJru0K1kLo7RrObviwkZcrA2P16szn0uyIeOGTrLvQb8FN7J:uVfZq+1kLRGIn0uy7wb8
MD5:	17CBAEDCC796DC92A5A7A4AE53999B8D
SHA1:	D9DE37A9624DDB576BF5DDE24EF52A10A67C6B79
SHA-256:	1C58B2449D28A6F15C5C7299C83E51A4C0AA9C86F39F6C77B323EF383E0C972A
SHA-512:	EE7D96EDFFE0F9E24C74A335508B5BE97A296617BB229BF8E1DD15208AB8085E8D335A75E8F52586F660AF15DA6D06D8C0E3E4AC504138712B96D7D3E7705BE9
Malicious:	true
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=..\x..\x..\x....\x..$.\x......\x...\x..\y..]x.8....\x...\x....\x....\x.....]x..\x..\x.....]x....\x....\x.Rich.\x.........PE..d.....)R.........." .....:#..................................................pA......4A...@..........................................89.3...l.9......`@.......=.p............p@......[#..............................................P#.h............................text...i8#......:#................. ..`.rdata......P#......>#.............@..@.data.........<..^....;.............@....pdata..p.....=......>=.............@..@.rsrc........`@.......?.............@..@.reloc.......p@.......?.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Virtual.exe

Download File

Process:	C:\Users\user\Desktop\orderconfirmation.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3559696
Entropy (8bit):	6.200307727314802
Encrypted:	false
SSDEEP:	49152:AQ902GYI12BpN8G/i6Hdw2u68X5RPrftuX9wZcQm2J9FjdH0pdTrRBlkG0BjMEgr:H9DGYIob9wp68pRzVsiHI9atBjMEY
MD5:	C8A2DE7077F97D4BCE1A44317B49EF41
SHA1:	6CB3212EC9BE08CB5A29BF8D37E9CA845EFC18C9
SHA-256:	448402C129A721812FA1C5F279F5CA906B9C8BBCA652A91655D144D20CE5E6B4
SHA-512:	9815EBA1566A8E33734F6A218071EC501DD1F799B1535E25D87C2B416B928AE8D15F8218CF20E685F9907EC39C202CBFC4728FE6AB9D87B3DE345109F626845E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecuriteInfo.com.FileRepMalware.32132.13137.exe, Detection: malicious, Browse Filename: Advanced_IP_Scanner.exe, Detection: malicious, Browse Filename: Advanced_IP_Scanner.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$................<...D......#.....'.....!.........D#...8..............,.....C..D.....D%...D"...Rich...........................PE..d.....)R.........."......R ..........\|.........@..............................6.....)$7...@.................................................0.,.T....`0......0..`"....6..#... 6..:.... ..............................................p .H............................text....P ......R ................. ..`.rdata..H....p ......V .............@..@.data...h....0-.......-.............@....pdata..`"...0...$....-.............@..@.rsrc........`0.......0.............@..@.reloc...Y... 6..Z....5.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ckmfqeimpicbuy

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	370688
Entropy (8bit):	6.659939192156715
Encrypted:	false
SSDEEP:	6144:CJdHU1vR3RO5NSdLcHUPnAGrV1GdauIgmxmbsWeSI7ifLW3NNj:CJS1vRhOfX0PA61Gig0mQ6ej
MD5:	6FC1AD9CBF97F491FE57D8936253E6A4
SHA1:	3CF580FDEC66C17AAB1E565A319A4A3FA5F54091
SHA-256:	4E186579D36A915C263E20616B1201314ABB42917959760EF03573F20EB2596F
SHA-512:	36CD5B9942EF6B0057999087AAA003A7621E8FD4244AFBD83485934E69634F87D7F1BF5AF4BC99D839D43CD02CC2CE50E62BC71AB16DE45FC40171B22E290FE5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...,.X..........................................@..........................p............@.....................................x................................J...................................................................................text...~........................... ..`.rdata...).......*..................@..@.data............b..................@....reloc...J.......L...D..............@..Buyk...... ...P......................@...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\msvcp100.dll

Download File

Process:	C:\Users\user\Desktop\orderconfirmation.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.297676823354886
Encrypted:	false
SSDEEP:	12288:koBFUsQ1H5FH3YUTd/df0RA7XkNvEKZm+aWodEEiblHN/:dFUsQ1H5FHdGKkNvEKZm+aWodEEcHN/
MD5:	D029339C0F59CF662094EDDF8C42B2B5
SHA1:	A0B6DE44255CE7BFADE9A5B559DD04F2972BFDC8
SHA-256:	934D882EFD3C0F3F1EFBC238EF87708F3879F5BB456D30AF62F3368D58B6AA4C
SHA-512:	021D9AF52E68CB7A3B0042D9ED6C9418552EE16DF966F9CCEDD458567C47D70471CB8851A69D3982D64571369664FAEEAE3BE90E2E88A909005B9CDB73679C82
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$..-`..~`..~`..~i.4~b..~{.;~c..~`..~...~..?~a..~{.9~a..~{..~P..~{..~Y..~{..~e..~{.<~a..~{.=~a..~{.:~a..~Rich`..~........................PE..d.....M.........." .........f.......q........cy..........................................@.............................................m......<....P...........=...0..P....`.......................................................................................text............................... ..`.rdata..-...........................@..@.data...0L.......8..................@....pdata...=.......>..................@..@.rsrc........P......................@..@.reloc..R....`......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\msvcr100.dll

Download File

Process:	C:\Users\user\Desktop\orderconfirmation.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	829264
Entropy (8bit):	6.553848816796836
Encrypted:	false
SSDEEP:	12288:QgzGPEett9Mw9HfBCddjMb2NQVmTW75JfmyyKWeHQGoko+1:HzJetPMw9HfBCrMb2Kc6dmyyKWewGzB1
MD5:	366FD6F3A451351B5DF2D7C4ECF4C73A
SHA1:	50DB750522B9630757F91B53DF377FD4ED4E2D66
SHA-256:	AE3CB6C6AFBA9A4AA5C85F66023C35338CA579B30326DD02918F9D55259503D5
SHA-512:	2DE764772B68A85204B7435C87E9409D753C2196CF5B2F46E7796C99A33943E167F62A92E8753EAA184CD81FB14361E83228EB1B474E0C3349ED387EC93E6130
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........pm...>...>...>..>...>...>F..>...>...>...>..>...>..>...>D..>...>...>...>...>...>...>Rich...>........................PE..d......M.........." ..........................sy............................. ......A.....@.........................................pt.......`..(...............pb......P............................................................................................text...F........................... ..`.rdata..............................@..@.data...L}... ...R..................@....pdata..pb.......d...Z..............@..@_CONST..............................@...text.....2... ...4..................@.. data.........`......................@..@.rsrc................v..............@..@.reloc...............z..............@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\orvhk

Download File

Process:	C:\Users\user\Desktop\orderconfirmation.exe
File Type:	data
Category:	dropped
Size (bytes):	860518
Entropy (8bit):	7.899823409435636
Encrypted:	false
SSDEEP:	24576:g5+W/5WF2Trqt4YUszzkWUnSAf68ZBL/Ppi:g5Hlszz1URxBi
MD5:	77F356E9CA520BEC31272D7A4749957F
SHA1:	A9158606D300C5BE8436D45792B0694B86F2171D
SHA-256:	AFD1FC4AE69BE1A700E2DB7719A6D9CA178F312D9F5A03FE125E822F71C246C8
SHA-512:	F7BE6A991CF4220D759922D38FFFBD141E20F89047AF1CA25E0BED71B115EF4DA916128EBD12F54AD81F69A524AFAFEA9C7772755F1326DC674E55948F6B76EE
Malicious:	false
Preview:	.sP.B...BqmiGUQ...o.i.eChQD..r.\Z.wY.E.kA...Oh.mJ.Z.^...........k...re.ar......e..vrI.c.KRH....u.C.......B.....FO.UU]xRG.[..Bj..e..pdy.X.UU..x...uSl..PRG.KYg.t.gO.j.D..I.DX.\...[.h..I....W....p.Il..xBp...dTDul.baX].C.mPHvu_.x..oQ..^.i...tTOIwr.A..Oi^EFo....I..uVR...O..k.g._..m.....DYm..g..p.WQ.oe....j_...x\P..oXu.s..y.g......l..sq..kc...CK.K.n.oF.`.o.G....oY...WiOM.UG.EZw...P.f..D...Xm..WE.Pmyw[......CY.V.TA^C.Wv.Qf..Kd..f...^pV.q..X.d..IR.NVIu.uQ..P.BTd...v........`Ulj....Uf^R...r.bv..g...Xy..UA.A.W....X[brw....X.N...j.y]r\..L....C..p.U..sO.h.wST..qt.K.to..w.Kj....kpZI.S..._.JY.R.Nsiew.Ou.k.w...Y`Bs....w..D.r.B..B..K.[..E.gJT.I..cQ..I.WJy.ACt..eyo.xc[...yGV.I..DWB...f..HUb\.B..em.MYS.Y...n......K..a...N.V..[`..`.D..rU.yfA..x...j.DV.heG.`AA.f.B...v.N.X^.h..n.xcPT.p_R..X...A..dhx.ywKJ.q..s.e.PR\I...QQbjnV.k..WIL..X..YxaNC_un.OCC.....Mns[a.MvhXO.Imn[..N..c.......\.jm...U...Z..tb..Bn.I.l....ndb......r...fjN.c..C.W.L.D.l.....^Ou...l....pZ.HfG..ZE.....fC.m.iY....Y..........e...ckM..F.BQ..Jf

C:\Users\user\AppData\Local\Temp\qtu

Download File

Process:	C:\Users\user\Desktop\orderconfirmation.exe
File Type:	data
Category:	dropped
Size (bytes):	34981
Entropy (8bit):	5.197542327627124
Encrypted:	false
SSDEEP:	768:wnL9pPW6C5GjCPJJVuTlX0/GE/URJk+ZNM3Oqc/QyJ:jG2xWp2/UXk+d1/QY
MD5:	1D24ED1F75EF5FBB15CF6CA92CF3F8E9
SHA1:	6AE0680522A0A1B10ED842A9403C3CAD3502A789
SHA-256:	A2C1F93EDCA83080F8768722B224D6DCD84530537DEC326B84850A3B00C7E3B9
SHA-512:	16166077CE5EFD445DBC111DA787827640C438A8F46D7B69CE72E5BD83F5BF46847B984009BFE36D985DEADB1F7F364B6B0D95B4C5C3EEC225763AF387CEA85A
Malicious:	false
Preview:	[MM..a..X.YcuFA..Z^^ME...c].e..w....Af.V...wU..f..y.^F.....K...G....D.I..U.P.df..kL.y.....[r.e....S.kx.t.......Y..I...xj.o.........L..]B...iO..r..........urF..cDqNIMM....S.xf......RtF.NJ.O.D.bY`n..d...Qa.f...Qxa..A...H......\..._.E.sTl.CDV.Gun..MV...U.O`.w.q....wK....p..Sq...NSc..b...Uv..LAjdN..KRMmC..uQKTrN.oGiy.TGC.....r.hh._Dwv.f...nB...T^_..V.Y..\E..RURn.ZB...d..^....Jm.K.arPq.]x..g.o..j....mW.Jgf..n.p...cJ...pG.h....s...j...c..R.H.xl.Y.Ek\pA.f.PM_J`bs...gNvm[b..P........aX.w]FDA....Y..F]...m..\m..f...MDWU.dG.bwaM.Ao...g._w...Q^I..a..kv......s...T..ou.`..H.d.W..DV.L......Tv.W.LbN..W..ojklAOv..W..nOCLVWxht.Vxi.F.W.bxeC.H.M...B.tSD..a...I...w.U.V.vc....Em.K...n..Xsn.ON...d.C.T...T..P...O.et..^.....OPntI.cC.....e..^.b..I...]......Er.i.KB.X]Hoivai..G.qY..IUB..Jy.M..G..d....u.xv..a.Qaya\WyGJ....A...OHJm.Gqe.wB..kl.NH..n.NwN.i.S.i.K.YqfO.F..UZFi...A.C..I..T.s..B...Dpw.R.....JM.....\.o.kFN.J..[T.yLFdZO..Ol..j...dcY..Nget\.IAC.....v....V..Uh....D...m...R......eE..iH.Ahx...e.JC....U..x.h.F.

C:\Users\user\AppData\Roaming\fmBrowserumz_test\VBoxDDU.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Virtual.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	380176
Entropy (8bit):	6.432472275317664
Encrypted:	false
SSDEEP:	6144:TTKw9G2rivrR7YR+euVO05XMog3N0++++I333O333qj333MEq333h3333f92333O:CcN3u++++I333O333qj333MJ333h333r
MD5:	496DF6AD1A158ED5037138E397713EF0
SHA1:	287BD2219C955687BAA399DED57E9AB64334C63C
SHA-256:	07C04290F53AAAAA7DF6B6EA3A53103B6E3EF8FF658D8097617A9C48DFC6E90A
SHA-512:	422DA26A8F50C1F02C1CC7C4BED37CDB33732039BBA82F32C2A14BAA8C6A7BC5544856AB26A2071B5EA8E731A296E2C69071DA2F067312D05763AA3A9928BB3A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........O.L.!.L.!.L.!.E...F.!.WX..N.!.k.Z.N.!....M.!.#...O.!.L. ...!.#...N.!.#...F.!.#...N.!.WX..T.!.WX..M.!.WX..M.!.RichL.!.................PE..d.....)R.........." .....2...z.......:....................................................@.........................................@Y..D...t@..................\|A.......#...........W...............................................P..X............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data........p.......L..............@....pdata..\|A.......B...`..............@..@.reloc..P...........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fmBrowserumz_test\VBoxRT.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Virtual.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4242944
Entropy (8bit):	6.558861714917866
Encrypted:	false
SSDEEP:	49152:CaNFpHwVfZqJru0K1kLo7RrObviwkZcrA2P16szn0uyIeOGTrLvQb8FN7J:uVfZq+1kLRGIn0uy7wb8
MD5:	17CBAEDCC796DC92A5A7A4AE53999B8D
SHA1:	D9DE37A9624DDB576BF5DDE24EF52A10A67C6B79
SHA-256:	1C58B2449D28A6F15C5C7299C83E51A4C0AA9C86F39F6C77B323EF383E0C972A
SHA-512:	EE7D96EDFFE0F9E24C74A335508B5BE97A296617BB229BF8E1DD15208AB8085E8D335A75E8F52586F660AF15DA6D06D8C0E3E4AC504138712B96D7D3E7705BE9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=..\x..\x..\x....\x..$.\x......\x...\x..\y..]x.8....\x...\x....\x....\x.....]x..\x..\x.....]x....\x....\x.Rich.\x.........PE..d.....)R.........." .....:#..................................................pA......4A...@..........................................89.3...l.9......`@.......=.p............p@......[#..............................................P#.h............................text...i8#......:#................. ..`.rdata......P#......>#.............@..@.data.........<..^....;.............@....pdata..p.....=......>=.............@..@.rsrc........`@.......?.............@..@.reloc.......p@.......?.............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Virtual.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3559696
Entropy (8bit):	6.200307727314802
Encrypted:	false
SSDEEP:	49152:AQ902GYI12BpN8G/i6Hdw2u68X5RPrftuX9wZcQm2J9FjdH0pdTrRBlkG0BjMEgr:H9DGYIob9wp68pRzVsiHI9atBjMEY
MD5:	C8A2DE7077F97D4BCE1A44317B49EF41
SHA1:	6CB3212EC9BE08CB5A29BF8D37E9CA845EFC18C9
SHA-256:	448402C129A721812FA1C5F279F5CA906B9C8BBCA652A91655D144D20CE5E6B4
SHA-512:	9815EBA1566A8E33734F6A218071EC501DD1F799B1535E25D87C2B416B928AE8D15F8218CF20E685F9907EC39C202CBFC4728FE6AB9D87B3DE345109F626845E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$................<...D......#.....'.....!.........D#...8..............,.....C..D.....D%...D"...Rich...........................PE..d.....)R.........."......R ..........\|.........@..............................6.....)$7...@.................................................0.,.T....`0......0..`"....6..#... 6..:.... ..............................................p .H............................text....P ......R ................. ..`.rdata..H....p ......V .............@..@.data...h....0-.......-.............@....pdata..`"...0...$....-.............@..@.rsrc........`0.......0.............@..@.reloc...Y... 6..Z....5.............@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fmBrowserumz_test\msvcp100.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Virtual.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.297676823354886
Encrypted:	false
SSDEEP:	12288:koBFUsQ1H5FH3YUTd/df0RA7XkNvEKZm+aWodEEiblHN/:dFUsQ1H5FHdGKkNvEKZm+aWodEEcHN/
MD5:	D029339C0F59CF662094EDDF8C42B2B5
SHA1:	A0B6DE44255CE7BFADE9A5B559DD04F2972BFDC8
SHA-256:	934D882EFD3C0F3F1EFBC238EF87708F3879F5BB456D30AF62F3368D58B6AA4C
SHA-512:	021D9AF52E68CB7A3B0042D9ED6C9418552EE16DF966F9CCEDD458567C47D70471CB8851A69D3982D64571369664FAEEAE3BE90E2E88A909005B9CDB73679C82
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$..-`..~`..~`..~i.4~b..~{.;~c..~`..~...~..?~a..~{.9~a..~{..~P..~{..~Y..~{..~e..~{.<~a..~{.=~a..~{.:~a..~Rich`..~........................PE..d.....M.........." .........f.......q........cy..........................................@.............................................m......<....P...........=...0..P....`.......................................................................................text............................... ..`.rdata..-...........................@..@.data...0L.......8..................@....pdata...=.......>..................@..@.rsrc........P......................@..@.reloc..R....`......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fmBrowserumz_test\msvcr100.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Virtual.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	829264
Entropy (8bit):	6.553848816796836
Encrypted:	false
SSDEEP:	12288:QgzGPEett9Mw9HfBCddjMb2NQVmTW75JfmyyKWeHQGoko+1:HzJetPMw9HfBCrMb2Kc6dmyyKWewGzB1
MD5:	366FD6F3A451351B5DF2D7C4ECF4C73A
SHA1:	50DB750522B9630757F91B53DF377FD4ED4E2D66
SHA-256:	AE3CB6C6AFBA9A4AA5C85F66023C35338CA579B30326DD02918F9D55259503D5
SHA-512:	2DE764772B68A85204B7435C87E9409D753C2196CF5B2F46E7796C99A33943E167F62A92E8753EAA184CD81FB14361E83228EB1B474E0C3349ED387EC93E6130
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........pm...>...>...>..>...>...>F..>...>...>...>..>...>..>...>D..>...>...>...>...>...>...>Rich...>........................PE..d......M.........." ..........................sy............................. ......A.....@.........................................pt.......`..(...............pb......P............................................................................................text...F........................... ..`.rdata..............................@..@.data...L}... ...R..................@....pdata..pb.......d...Z..............@..@_CONST..............................@...text.....2... ...4..................@.. data.........`......................@..@.rsrc................v..............@..@.reloc...............z..............@..B................................................................................................................................

C:\Users\user\AppData\Roaming\fmBrowserumz_test\orvhk

Download File

Process:	C:\Users\user\AppData\Local\Temp\Virtual.exe
File Type:	data
Category:	dropped
Size (bytes):	860518
Entropy (8bit):	7.899823409435636
Encrypted:	false
SSDEEP:	24576:g5+W/5WF2Trqt4YUszzkWUnSAf68ZBL/Ppi:g5Hlszz1URxBi
MD5:	77F356E9CA520BEC31272D7A4749957F
SHA1:	A9158606D300C5BE8436D45792B0694B86F2171D
SHA-256:	AFD1FC4AE69BE1A700E2DB7719A6D9CA178F312D9F5A03FE125E822F71C246C8
SHA-512:	F7BE6A991CF4220D759922D38FFFBD141E20F89047AF1CA25E0BED71B115EF4DA916128EBD12F54AD81F69A524AFAFEA9C7772755F1326DC674E55948F6B76EE
Malicious:	false
Preview:	.sP.B...BqmiGUQ...o.i.eChQD..r.\Z.wY.E.kA...Oh.mJ.Z.^...........k...re.ar......e..vrI.c.KRH....u.C.......B.....FO.UU]xRG.[..Bj..e..pdy.X.UU..x...uSl..PRG.KYg.t.gO.j.D..I.DX.\...[.h..I....W....p.Il..xBp...dTDul.baX].C.mPHvu_.x..oQ..^.i...tTOIwr.A..Oi^EFo....I..uVR...O..k.g._..m.....DYm..g..p.WQ.oe....j_...x\P..oXu.s..y.g......l..sq..kc...CK.K.n.oF.`.o.G....oY...WiOM.UG.EZw...P.f..D...Xm..WE.Pmyw[......CY.V.TA^C.Wv.Qf..Kd..f...^pV.q..X.d..IR.NVIu.uQ..P.BTd...v........`Ulj....Uf^R...r.bv..g...Xy..UA.A.W....X[brw....X.N...j.y]r\..L....C..p.U..sO.h.wST..qt.K.to..w.Kj....kpZI.S..._.JY.R.Nsiew.Ou.k.w...Y`Bs....w..D.r.B..B..K.[..E.gJT.I..cQ..I.WJy.ACt..eyo.xc[...yGV.I..DWB...f..HUb\.B..em.MYS.Y...n......K..a...N.V..[`..`.D..rU.yfA..x...j.DV.heG.`AA.f.B...v.N.X^.h..n.xcPT.p_R..X...A..dhx.ywKJ.q..s.e.PR\I...QQbjnV.k..WIL..X..YxaNC_un.OCC.....Mns[a.MvhXO.Imn[..N..c.......\.jm...U...Z..tb..Bn.I.l....ndb......r...fjN.c..C.W.L.D.l.....^Ou...l....pZ.HfG..ZE.....fC.m.iY....Y..........e...ckM..F.BQ..Jf

C:\Users\user\AppData\Roaming\fmBrowserumz_test\qtu

Download File

Process:	C:\Users\user\AppData\Local\Temp\Virtual.exe
File Type:	data
Category:	dropped
Size (bytes):	34981
Entropy (8bit):	5.197542327627124
Encrypted:	false
SSDEEP:	768:wnL9pPW6C5GjCPJJVuTlX0/GE/URJk+ZNM3Oqc/QyJ:jG2xWp2/UXk+d1/QY
MD5:	1D24ED1F75EF5FBB15CF6CA92CF3F8E9
SHA1:	6AE0680522A0A1B10ED842A9403C3CAD3502A789
SHA-256:	A2C1F93EDCA83080F8768722B224D6DCD84530537DEC326B84850A3B00C7E3B9
SHA-512:	16166077CE5EFD445DBC111DA787827640C438A8F46D7B69CE72E5BD83F5BF46847B984009BFE36D985DEADB1F7F364B6B0D95B4C5C3EEC225763AF387CEA85A
Malicious:	false
Preview:	[MM..a..X.YcuFA..Z^^ME...c].e..w....Af.V...wU..f..y.^F.....K...G....D.I..U.P.df..kL.y.....[r.e....S.kx.t.......Y..I...xj.o.........L..]B...iO..r..........urF..cDqNIMM....S.xf......RtF.NJ.O.D.bY`n..d...Qa.f...Qxa..A...H......\..._.E.sTl.CDV.Gun..MV...U.O`.w.q....wK....p..Sq...NSc..b...Uv..LAjdN..KRMmC..uQKTrN.oGiy.TGC.....r.hh._Dwv.f...nB...T^_..V.Y..\E..RURn.ZB...d..^....Jm.K.arPq.]x..g.o..j....mW.Jgf..n.p...cJ...pG.h....s...j...c..R.H.xl.Y.Ek\pA.f.PM_J`bs...gNvm[b..P........aX.w]FDA....Y..F]...m..\m..f...MDWU.dG.bwaM.Ao...g._w...Q^I..a..kv......s...T..ou.`..H.d.W..DV.L......Tv.W.LbN..W..ojklAOv..W..nOCLVWxht.Vxi.F.W.bxeC.H.M...B.tSD..a...I...w.U.V.vc....Em.K...n..Xsn.ON...d.C.T...T..P...O.et..^.....OPntI.cC.....e..^.b..I...]......Er.i.KB.X]Hoivai..G.qY..IUB..Jy.M..G..d....u.xv..a.Qaya\WyGJ....A...OHJm.Gqe.wB..kl.NH..n.NwN.i.S.i.K.YqfO.F..UZFi...A.C..I..T.s..B...Dpw.R.....JM.....\.o.kFN.J..[T.yLFdZO..Ol..j...dcY..Nget\.IAC.....v....V..Uh....D...m...R......eE..iH.Ahx...e.JC....U..x.h.F.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.981226018947743
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	orderconfirmation.exe
File size:	3'678'161 bytes
MD5:	1dfda6fc13c7efab9f6148e7339ab80c
SHA1:	d5c7e9b3bc28e876ae223f9a6dd9b4d7f6cda9fd
SHA256:	47a1bbb47ede2daa62558515a9a4e98410a8b2d7c9e74fe5c45783969c48be39
SHA512:	36a68f46939c9ef4818368bd9c55e5bd85c9bbaa4a49040dfa208eacee375c541a4a20b5a4906c82b8c98d814fbe4e0825d968722abba7a0113eb5a7819554ac
SSDEEP:	49152:+pz3iNJsAL41DAd5HF9rE1CNcwpXwC4wvNys3qPbaNraNZGDniQgWHGXUTuSq:+pCsA8q/HFZEoNBpXoijL5cWmR
TLSH:	7406330637C9C5F2C924CA729F17EF994632F36639C44BC726968E465CE32A183437E9
File Content Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...~.&L.....................................0....@..........................0.......3.......................................P.............................

File Icon


Icon Hash:	d292fcd8f2f2fe1c

Static PE Info

General

Entrypoint:	0x411def
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4C26F87E [Sun Jun 27 07:06:38 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b5a014d7eeb4c2042897567e1288a095

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00414C50h
push 00411F80h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [00413184h]
pop ecx
or dword ptr [00419924h], FFFFFFFFh
or dword ptr [00419928h], FFFFFFFFh
call dword ptr [00413188h]
mov ecx, dword ptr [0041791Ch]
mov dword ptr [eax], ecx
call dword ptr [0041318Ch]
mov ecx, dword ptr [00417918h]
mov dword ptr [eax], ecx
mov eax, dword ptr [00413190h]
mov eax, dword ptr [eax]
mov dword ptr [00419920h], eax
call 00007F22A4B9F0A2h
cmp dword ptr [00417710h], ebx
jne 00007F22A4B9EF8Eh
push 00411F78h
call dword ptr [00413194h]
pop ecx
call 00007F22A4B9F074h
push 00417048h
push 00417044h
call 00007F22A4B9F05Fh
mov eax, dword ptr [00417914h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [00417910h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0041319Ch]
push 00417040h
push 00417000h
call 00007F22A4B9F02Ch

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x150dc	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x18d04	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x13000	0x310	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11317	0x11400	797279c5ab1a163aed1f2a528f9fe3ce	False	0.6174988677536232	data	6.576987441854239	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x13000	0x30ea	0x3200	1359639b02bcb8f0a8743e6ead1c0030	False	0.43828125	data	5.549434098115495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x17000	0x292c	0x800	9415c9c8dea3245d6d73c23393e27d8e	False	0.431640625	data	3.6583182363171756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1a000	0x18d04	0x18e00	9dee09854e79aa987e5336a4defda540	False	0.2433358197236181	data	5.382874846103129	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x1a1f0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Russian	Russia	0.6781914893617021
RT_ICON	0x1a658	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Russian	Russia	0.47068480300187615
RT_ICON	0x1b700	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Russian	Russia	0.41161825726141077
RT_ICON	0x1dca8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	Russian	Russia	0.3213863958431743
RT_ICON	0x21ed0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	Russian	Russia	0.1865609842659411
RT_GROUP_ICON	0x326f8	0x4c	data	Russian	Russia	0.7763157894736842
RT_VERSION	0x32744	0x350	data	English	United States	0.47523584905660377
RT_MANIFEST	0x32a94	0x270	ASCII text, with very long lines (624), with no line terminators	English	United States	0.5144230769230769

Imports

DLL	Import
COMCTL32.dll
KERNEL32.dll	GetFileAttributesW, CreateDirectoryW, WriteFile, GetStdHandle, VirtualFree, GetModuleHandleW, GetProcAddress, LoadLibraryA, LockResource, LoadResource, SizeofResource, FindResourceExA, MulDiv, GlobalFree, GlobalAlloc, lstrcmpiA, GetSystemDefaultLCID, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, MultiByteToWideChar, GetLocaleInfoW, lstrlenA, lstrcmpiW, GetEnvironmentVariableW, lstrcmpW, GlobalMemoryStatusEx, VirtualAlloc, WideCharToMultiByte, ExpandEnvironmentStringsW, RemoveDirectoryW, FindClose, FindNextFileW, DeleteFileW, FindFirstFileW, SetThreadLocale, GetLocalTime, GetSystemTimeAsFileTime, lstrlenW, GetTempPathW, SetEnvironmentVariableW, CloseHandle, CreateFileW, GetDriveTypeW, SetCurrentDirectoryW, GetModuleFileNameW, GetCommandLineW, GetVersionExW, CreateEventW, SetEvent, ResetEvent, InitializeCriticalSection, TerminateThread, ResumeThread, SuspendThread, IsBadReadPtr, LocalFree, lstrcpyW, FormatMessageW, GetSystemDirectoryW, DeleteCriticalSection, GetFileSize, SetFilePointer, ReadFile, SetFileTime, SetEndOfFile, EnterCriticalSection, LeaveCriticalSection, WaitForMultipleObjects, GetModuleHandleA, SystemTimeToFileTime, GetLastError, CreateThread, WaitForSingleObject, GetExitCodeThread, Sleep, SetLastError, SetFileAttributesW, GetDiskFreeSpaceExW, lstrcatW, ExitProcess, CompareFileTime, GetStartupInfoA
USER32.dll	CharUpperW, EndDialog, DestroyWindow, KillTimer, ReleaseDC, DispatchMessageW, GetMessageW, SetTimer, CreateWindowExW, ScreenToClient, GetWindowRect, wsprintfW, GetParent, GetSystemMenu, EnableMenuItem, EnableWindow, MessageBeep, LoadIconW, LoadImageW, wvsprintfW, IsWindow, DefWindowProcW, CallWindowProcW, DrawIconEx, DialogBoxIndirectParamW, GetWindow, ClientToScreen, GetDC, DrawTextW, ShowWindow, SystemParametersInfoW, SetFocus, SetWindowLongW, GetSystemMetrics, GetClientRect, GetDlgItem, GetKeyState, MessageBoxA, wsprintfA, SetWindowTextW, GetSysColor, GetWindowTextLengthW, GetWindowTextW, GetClassNameA, GetWindowLongW, GetMenu, SetWindowPos, CopyImage, SendMessageW, GetWindowDC
GDI32.dll	GetCurrentObject, StretchBlt, SetStretchBltMode, CreateCompatibleBitmap, SelectObject, CreateCompatibleDC, GetObjectW, GetDeviceCaps, DeleteObject, CreateFontIndirectW, DeleteDC
SHELL32.dll	SHGetFileInfoW, SHBrowseForFolderW, SHGetPathFromIDListW, SHGetMalloc, ShellExecuteExW, SHGetSpecialFolderPathW, ShellExecuteW
ole32.dll	CoInitialize, CreateStreamOnHGlobal, CoCreateInstance
OLEAUT32.dll	VariantClear, OleLoadPicture, SysAllocString
MSVCRT.dll	__set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, ??1type_info@@UAE@XZ, _onexit, __dllonexit, _CxxThrowException, _beginthreadex, _EH_prolog, memset, _wcsnicmp, strncmp, malloc, memmove, _wtol, memcpy, free, memcmp, _purecall, ??2@YAPAXI@Z, ??3@YAXPAX@Z, _except_handler3, _controlfp

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Target ID:	0
Start time:	10:02:58
Start date:	26/09/2024
Path:	C:\Users\user\Desktop\orderconfirmation.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\orderconfirmation.exe"
Imagebase:	0x400000
File size:	3'678'161 bytes
MD5 hash:	1DFDA6FC13C7EFAB9F6148E7339AB80C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:03:00
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Local\Temp\Virtual.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Virtual.exe"
Imagebase:	0x7ff605b70000
File size:	3'559'696 bytes
MD5 hash:	C8A2DE7077F97D4BCE1A44317B49EF41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:03:01
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe
Imagebase:	0x7ff6ae860000
File size:	3'559'696 bytes
MD5 hash:	C8A2DE7077F97D4BCE1A44317B49EF41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:03:01
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:03:01
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:03:21
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xd10000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	25.9%
Total number of Nodes:	1474
Total number of Limit Nodes:	20

Executed Functions

Function 00404FAA Relevance: 250.2, APIs: 103, Strings: 39, Instructions: 1671keyboardsynchronizationwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00401B37: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,00404FBD,?,?,00000000), ref: 00401B43
Part of subcall function 00401B37: CreateWindowExW.USER32(00000000,Static,0041335C,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00401B60
Part of subcall function 00401B37: SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00401B72
Part of subcall function 00401B37: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00401B7F
Part of subcall function 00401B37: DispatchMessageW.USER32(?), ref: 00401B89
Part of subcall function 00401B37: KillTimer.USER32(00000000,00000001,?,?,?,?,?,00404FBD,?,?,00000000), ref: 00401B92
Part of subcall function 00401B37: KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,00404FBD,?,?,00000000), ref: 00401B99

GetVersionExW.KERNEL32(?,?,?,00000000), ref: 00404FCE
GetCommandLineW.KERNEL32(?,00000020,?,?,00000000), ref: 0040505C

Part of subcall function 00402A69: ??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,0040507C,?,00000000), ref: 00402ADC
Part of subcall function 00402A69: ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,0040507C,?), ref: 00402AF7
Part of subcall function 00402A69: ??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,0040507C), ref: 00402AFF
Part of subcall function 00402A69: ??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000020,?,?,?,?,?,?,?,?,0040507C,?,00000000), ref: 00402B6F

Part of subcall function 00403D71: lstrlenW.KERNEL32(?,00000000,00000020,?,0040508F,?,?,00000000,?,00000000), ref: 00403DA5
Part of subcall function 00403D71: lstrlenW.KERNEL32(?,?,00000000), ref: 00403DAD

_wtol.MSVCRT ref: 0040509F
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 004050F1
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 00405102
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 0040510A
GetModuleFileNameW.KERNEL32(00000000,00000208,00000000,?,00000000), ref: 00405138
_wtol.MSVCRT ref: 00405217
??2@YAPAXI@Z.MSVCRT(00000010,004177C4,004177C4,?,00000000), ref: 0040538F

Part of subcall function 00404E3F: ??3@YAXPAX@Z.MSVCRT(004177C4,004177C4,004177C4,00000000,0000002C,;!@InstallEnd@!,;!@Install@!UTF-8!,00000000,00000000), ref: 00404E85
Part of subcall function 00404E3F: ??3@YAXPAX@Z.MSVCRT(004177C4,004177C4,004177C4,00000000,0000002C,004177C4,004177C4,00000000,0000002C,;!@InstallEnd@!,;!@Install@!UTF-8!,00000000,00000000), ref: 00404EAB
Part of subcall function 00404E3F: wsprintfA.USER32 ref: 00404EBC

Part of subcall function 00402844: lstrlenA.KERNEL32(?,?,00000000), ref: 00402876
Part of subcall function 00402844: lstrlenA.KERNEL32(?,?,00000000), ref: 0040287E
Part of subcall function 00402844: memcmp.MSVCRT(?,?,?), ref: 004028E4
Part of subcall function 00402844: memcmp.MSVCRT(?,?,?,?,00000000), ref: 00402921
Part of subcall function 00402844: memmove.MSVCRT(?,?,00000000,?,00000000), ref: 00402953

??3@YAXPAX@Z.MSVCRT(?,00000000,00000009,?,?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 00405453
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000009,?,?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 0040545B
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000009,?,?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 00405463
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000A,?,?,00000000,004177C4,004177C4,?,00000000), ref: 004054DD
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000A,?,?,00000000,004177C4,004177C4,?,00000000), ref: 004054E5
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0000000A,?,?,00000000,004177C4,004177C4,?,00000000), ref: 004054ED
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 00405509
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 00405511
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 00405519

Part of subcall function 00403093: ??3@YAXPAX@Z.MSVCRT(0040414C,?), ref: 00403347

??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 00405559
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 00405561
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000,004177C4,004177C4,?,00000000), ref: 00405569

Part of subcall function 00403B94: lstrlenW.KERNEL32(?,00000020,?,?,00405650,?,00414668,?,00000000,?), ref: 00403BA1
Part of subcall function 00403B94: lstrlenW.KERNEL32(?,?,?,?,?,?,?,004177C4,004177C4,?,00000000), ref: 00403BAA
Part of subcall function 00403B94: _wcsnicmp.MSVCRT ref: 00403BB6

wsprintfW.USER32 ref: 00405595
_wtol.MSVCRT ref: 004057DE
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?,?,?,?,?,004177C4,004177C4,?,00000000), ref: 0040587B
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?,?,?,?,?,?,004177C4,004177C4,?,00000000), ref: 00405883
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?,?,?,?,?,?,004177C4,004177C4,?,00000000), ref: 0040588B
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,0000003D,00000000,00000000,?,?,00000000,?), ref: 00405913
??3@YAXPAX@Z.MSVCRT(?,0000003D,00000000,00000000,?,?,00000000,?,?,?,?,?,?,?,004177C4,004177C4), ref: 00405938
??3@YAXPAX@Z.MSVCRT(?,00000011,00000000,00000000,0000003D,00000000,00000000,?,?,00000000,?), ref: 004059AA
??3@YAXPAX@Z.MSVCRT(?,?,00000011,00000000,00000000,0000003D,00000000,00000000,?,?,00000000,?), ref: 004059B2
??3@YAXPAX@Z.MSVCRT(?,?,?,00000011,00000000,00000000,0000003D,00000000,00000000,?,?,00000000,?), ref: 004059BA
CoInitialize.OLE32(00000000), ref: 004059E9
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,004177C4), ref: 00405A30
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000,?), ref: 00405A38
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00405A40
GetKeyState.USER32(00000010), ref: 00405AA1
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,004177C4), ref: 00405BCD
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00405BDB
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00405BE3
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00405C16
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00405C1E
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00405C26
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,0000000E,?,?,?,00000000,AutoInstall), ref: 00405C2E
memset.MSVCRT ref: 004060AE
ShellExecuteExW.SHELL32(?), ref: 0040617E
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?), ref: 0040619A
CloseHandle.KERNEL32(?,?,?,?), ref: 004061A6
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?), ref: 004061D4
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?), ref: 004061DC
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?,?), ref: 004061E4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?,?), ref: 004061EA
??3@YAXPAX@Z.MSVCRT(?,00000000,AutoInstall,?,?,00417788,?,?,?,?,?,?,?,?,00000000,?), ref: 004061FD
??3@YAXPAX@Z.MSVCRT(?,?,00000000,AutoInstall,?,?,00417788,?,?,?,?,?,?,?,?,00000000), ref: 00406205
??3@YAXPAX@Z.MSVCRT(?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,00417788), ref: 00406222
??3@YAXPAX@Z.MSVCRT(?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,00417788), ref: 0040622A
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,00417788), ref: 00406232
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,00417788), ref: 0040623A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall,?,?,00417788), ref: 00406242
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall), ref: 0040624A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000,0000000F,?,?,?,?,00000000,AutoInstall), ref: 00406252
??3@YAXPAX@Z.MSVCRT(?,?,?,00417788,?,?,?,?,?,?,?,?,00000000,?), ref: 0040626E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00417788,?,?,?,?,?,?,?,?,00000000,?), ref: 00406276
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00405BEB

Part of subcall function 00407776: wvsprintfW.USER32(?,00000000,?), ref: 0040779A
Part of subcall function 00407776: GetLastError.KERNEL32(?,00000000,0000FDE9), ref: 004077AB
Part of subcall function 00407776: FormatMessageW.KERNEL32(00001100,00000000,00000000,00402A50,00402A50,00000000,00000000,?,00000000,0000FDE9), ref: 004077D3
Part of subcall function 00407776: FormatMessageW.KERNEL32(00001100,00000000,00402A50,00000000,00402A50,00000000,00000000,?,00000000,0000FDE9), ref: 004077E8
Part of subcall function 00407776: lstrlenW.KERNEL32(?,?,00000000,0000FDE9), ref: 004077FB
Part of subcall function 00407776: lstrlenW.KERNEL32(00402A50,?,00000000,0000FDE9), ref: 00407802
Part of subcall function 00407776: ??2@YAPAXI@Z.MSVCRT(00000000,?,00000000,0000FDE9), ref: 00407817
Part of subcall function 00407776: lstrcpyW.KERNEL32(00000000,?,?,00000000,0000FDE9), ref: 0040782D
Part of subcall function 00407776: lstrcpyW.KERNEL32(-00000002,00402A50,?,00000000,0000FDE9), ref: 0040783E
Part of subcall function 00407776: ??3@YAXPAX@Z.MSVCRT(00000000,00000000,?,00000000,0000FDE9), ref: 00407847
Part of subcall function 00407776: LocalFree.KERNEL32(00402A50,?,00000000,0000FDE9), ref: 00407851

??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,004177C4), ref: 00405C4A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000,?), ref: 00405C52
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00405C5A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00405C62
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,?,?,?,?,?,00000000,?), ref: 00405C94
??3@YAXPAX@Z.MSVCRT(?,00417788,?,?,?,?,?,?,?,?,00000000,?), ref: 00405CD4
??3@YAXPAX@Z.MSVCRT(?,00417788,?,?,?,?,?,?,?,?,00000000,?), ref: 00405D41
??3@YAXPAX@Z.MSVCRT(?,?,00417788,?,?,?,?,?,?,?,?,00000000,?), ref: 00405D49
??3@YAXPAX@Z.MSVCRT(?,?,?,00417788,?,?,?,?,?,?,?,?,00000000,?), ref: 00405D51
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00417788,?,?,?,?,?,?,?,?,00000000,?), ref: 00405D59
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,00417788), ref: 00405E20
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?,?,00000000,AutoInstall,?,?,00417788), ref: 00405E28
GetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,00000000,AutoInstall,?,?,00417788), ref: 00405E32
??3@YAXPAX@Z.MSVCRT(?,00000000,AutoInstall,?,?,00417788,?,?,?,?,?,?,?,?,00000000,?), ref: 00405EEC
??3@YAXPAX@Z.MSVCRT(?,?,00000000,AutoInstall,?,?,00417788,?,?,?,?,?,?,?,?,00000000), ref: 00405EF4
_wtol.MSVCRT ref: 00405F65
??3@YAXPAX@Z.MSVCRT(?,00000001,00000010,?,?,?,?), ref: 00406294
??3@YAXPAX@Z.MSVCRT(?,?,00000001,00000010,?,?,?,?), ref: 0040629C
??3@YAXPAX@Z.MSVCRT(?,?,?,00000001,00000010,?,?,?,?), ref: 004062A4
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000001,00000010,?,?,?,?), ref: 004062AA
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000001,00000010,?,?,?,?), ref: 004062B2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000001,00000010,?,?,?,?), ref: 004062BA
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000001,00000010,?,?,?,?), ref: 004062C2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000001,00000010,?,?,?,?), ref: 004062CA
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000001,00000010,?,?,?,?), ref: 004062D2
??3@YAXPAX@Z.MSVCRT(?,00000000,?,?,?), ref: 004062F1
??3@YAXPAX@Z.MSVCRT(?,?,00000000,?,?,?), ref: 004062F9
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,?,?,?), ref: 00406301
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?,?), ref: 00406307
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00406343
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?,?), ref: 0040636D
??3@YAXPAX@Z.MSVCRT(?,00000011,00000000,00000000,?,?,?,?,?,?,00000000,?,?,?), ref: 004063E6
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00000000,?,?,?), ref: 0040643D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00000000,?,?,?), ref: 00406445
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,00000000,?,?,?), ref: 0040644D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,00000000,?,?,?), ref: 00406455
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 0040646A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 0040647B
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00406483
MessageBoxA.USER32(00000000,Sorry, this program requires Microsoft Windows 2000 or later.,7-Zip SFX,00000010), ref: 0040649C

Strings

SetEnvironment, xrefs: 0040586E, 0040591F
MiscFlags, xrefs: 0040573F
x64, xrefs: 00405FF7
ExecuteParameters, xrefs: 0040605D
GUIFlags, xrefs: 0040571F
SelfDelete, xrefs: 0040577C, 0040640B
ExecuteFile, xrefs: 00405A61, 00405B47, 00405B55
Sorry, this program requires Microsoft Windows 2000 or later., xrefs: 00406495
7ZipSfx.%03x, xrefs: 00405C77
4DA, xrefs: 00406034
amd64, xrefs: 00405FE4
GUIMode, xrefs: 004056FF
OverwriteMode, xrefs: 004056BB
AutoInstall, xrefs: 00405AC1, 00405B1C, 00405ECC
4AA, xrefs: 0040504C
sfxconfig, xrefs: 0040527C, 00405488
RunProgram, xrefs: 00405A66, 00405B6B, 00405B79
;!@Install@!UTF-8!, xrefs: 00405436
Shortcut, xrefs: 0040632A
7zSfxString%d, xrefs: 0040558F
@DA, xrefs: 00405699
Delete, xrefs: 00406352
7-Zip SFX, xrefs: 00406490
x86, xrefs: 00405FBE
IA, xrefs: 004055D2, 004058FB
sfxversion, xrefs: 004050D6
XpA, xrefs: 00405581
;!@InstallEnd@!, xrefs: 00405431
del, xrefs: 00405F9A
forcenowait, xrefs: 00405F25
nowait, xrefs: 00405F03
setup.exe, xrefs: 00405DE5, 00405DEA, 00405E45
FinishMessage, xrefs: 00406399
shc, xrefs: 00405F7A
i386, xrefs: 00405FD1
BeginPrompt, xrefs: 00405A71
HelpText, xrefs: 0040595E
hidcon, xrefs: 00405E5E
InstallPath, xrefs: 004059F3

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@$lstrlen$Message$_wtol$??2@FileFormatHandleModuleTimerlstrcpymemcmpwsprintf$AttributesCallbackCloseCommandCreateCurrentDirectoryDispatchDispatcherErrorExecuteFreeInitializeKillLastLineLocalNameObjectShellSingleStateUserVersionWaitWindow_wcsnicmpmemmovememsetwvsprintf
String ID: 4AA$4DA$7-Zip SFX$7ZipSfx.%03x$7zSfxString%d$;!@Install@!UTF-8!$;!@InstallEnd@!$@DA$AutoInstall$BeginPrompt$Delete$ExecuteFile$ExecuteParameters$FinishMessage$GUIFlags$GUIMode$HelpText$InstallPath$MiscFlags$OverwriteMode$RunProgram$SelfDelete$SetEnvironment$Shortcut$Sorry, this program requires Microsoft Windows 2000 or later.$XpA$amd64$del$forcenowait$hidcon$i386$nowait$setup.exe$sfxconfig$sfxversion$shc$x64$x86$IA
API String ID: 154539431-3058303289
Opcode ID: 926e16e0d72d3398af4091c0d2fb4f0e89ce66b1218389f87f1cbe10f28a7287
Instruction ID: bd55e9a5e2f2b8c77b34d16bce6880ff8bafa7c96c93ceffa7f521d25999041e
Opcode Fuzzy Hash: 926e16e0d72d3398af4091c0d2fb4f0e89ce66b1218389f87f1cbe10f28a7287
Instruction Fuzzy Hash: 65C2E231904619AADF21AF61DC45AEF3769EF00708F54403BF906B61E2EB7C9981CB5D

Function 00401626 Relevance: 22.8, APIs: 15, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4e185761910bab2b3e9b4b194fe0f2484e14367d7febfa53cbc10b96610557
Instruction ID: 8ae67fe93764504dd4472983a8ee98937692ca3eac7777145cc28303e79798ac
Opcode Fuzzy Hash: bc4e185761910bab2b3e9b4b194fe0f2484e14367d7febfa53cbc10b96610557
Instruction Fuzzy Hash: 8DB17C71900205EFCB14EFA5D8849AEB7B5FF44304B24842BF512BB2F1EB39A945CB58

Function 0040301A Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,-00000001), ref: 00403028
SetLastError.KERNEL32(00000010), ref: 0040303D

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: 611e1059d124648bfa8909f45edfa8144be0e8992cd1f43fa13480e02f084d79
Instruction ID: 32a2c072cbeca167af0ba40feded167abd8377b8b15159977275e4e23b0806bf
Opcode Fuzzy Hash: 611e1059d124648bfa8909f45edfa8144be0e8992cd1f43fa13480e02f084d79
Instruction Fuzzy Hash: 42018B30102004AADF206F749C4CAAB3BACAB0136BF108632F621F11D8D738DB46965E

Function 0040118A Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNELBASE(?,00000000,00000000), ref: 004011A6
SendMessageW.USER32(00008001,00000000,?), ref: 004011FF

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: DiskFreeMessageSendSpace
String ID:
API String ID: 696007252-0
Opcode ID: 3a86173e64e6b0f12d7b84feb59694df1deaa45c142369f31f6b7a0286f107e3
Instruction ID: 9edb1a80411cac00ba33afe52a6c86c35bfa08927eae57e7515b94cd88b359ae
Opcode Fuzzy Hash: 3a86173e64e6b0f12d7b84feb59694df1deaa45c142369f31f6b7a0286f107e3
Instruction Fuzzy Hash: 1C014B30654209ABEB18EB90DD85F9A3BE9EB05704F108436F611F91F0CB79BA408B1D

Function 00411DEF Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 00411E1C
__p__fmode.MSVCRT ref: 00411E31
__p__commode.MSVCRT ref: 00411E3F
__setusermatherr.MSVCRT ref: 00411E6B
_initterm.MSVCRT ref: 00411E81
__getmainargs.MSVCRT ref: 00411EA4
_initterm.MSVCRT ref: 00411EB4
GetStartupInfoA.KERNEL32(?), ref: 00411EF3
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00411F17
exit.KERNELBASE ref: 00411F27
_XcptFilter.MSVCRT ref: 00411F39

Strings

HpA, xrefs: 00411E9C, 00411E9F

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID: HpA
API String ID: 801014965-2938899866
Opcode ID: 9fb10d9e3a65800a4f5e1ed226729125e22e54dc21e3b7cab0738d928573cc55
Instruction ID: 158ffaedae0d42993a529c42e252781da09b2560f8e529a8c548a3e081932a5e
Opcode Fuzzy Hash: 9fb10d9e3a65800a4f5e1ed226729125e22e54dc21e3b7cab0738d928573cc55
Instruction Fuzzy Hash: 254192B0944344AFDB20DFA4DC45AEA7BB8FB09711F20452FFA51973A1D7784981CB58

Function 00401B37 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47
timewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,00404FBD,?,?,00000000), ref: 00401B43
CreateWindowExW.USER32(00000000,Static,0041335C,00000000,000000F6,000000F6,00000005,00000005,00000000,00000000,00000000), ref: 00401B60
SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 00401B72
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00401B7F
DispatchMessageW.USER32(?), ref: 00401B89
KillTimer.USER32(00000000,00000001,?,?,?,?,?,00404FBD,?,?,00000000), ref: 00401B92
KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,00404FBD,?,?,00000000), ref: 00401B99

Strings

Static, xrefs: 00401B5A

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: MessageTimer$CallbackCreateDispatchDispatcherHandleKillModuleUserWindow
String ID: Static
API String ID: 2479445380-2272013587
Opcode ID: 3628b680e9888d51f3ede5b7fd431ea4f93bb964a28f818be4a598c22db00f11
Instruction ID: f02a6d563a0a994406544e3b77250aae51f77c8b940714b819f60fd1d37dc764
Opcode Fuzzy Hash: 3628b680e9888d51f3ede5b7fd431ea4f93bb964a28f818be4a598c22db00f11
Instruction Fuzzy Hash: 10F03C3250212476CA203FA69C4DEEF7E6CDB86BA2F008160B615A10D1DAB88241C6B9

Function 0040B163 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT(00000000,?,0000001F,00010000), ref: 0040B1C5
memmove.MSVCRT(00000000,-000000C1,00000020,?,00010000), ref: 0040B289
??3@YAXPAX@Z.MSVCRT(00000000), ref: 0040B298

Strings

, xrefs: 0040B22D

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@memcpymemmove
String ID:
API String ID: 3549172513-3916222277
Opcode ID: 5bad17cc77e2d39d7f6897ae69eb46f7fe1422127806d73b42e5b41d987a673b
Instruction ID: 201babb0cc669d9fea5df8a163075e687156198648327345136f7fe875bf0058
Opcode Fuzzy Hash: 5bad17cc77e2d39d7f6897ae69eb46f7fe1422127806d73b42e5b41d987a673b
Instruction Fuzzy Hash: 495181B1A00205ABDF14DB95C889AAE7BB4EF49354F1441BAE905B7381D338DD81CB9D

Function 00403354 Relevance: 10.6, APIs: 7, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00404AC6,?,?,00000000,?,?,?,?,00404AC6,?), ref: 00403361
GetSystemTimeAsFileTime.KERNEL32(?,00404AC6,?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?), ref: 004033D7
GetFileAttributesW.KERNELBASE(?,?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?,00000000), ref: 004033DE
??3@YAXPAX@Z.MSVCRT(?,00404AC6,?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?), ref: 0040349D

Part of subcall function 0040112B: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,00401425,00000003,?,0040502D,?,?,00000000), ref: 0040114B
Part of subcall function 0040112B: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,00401425,00000003,?,0040502D,?,?,00000000), ref: 00401171

memcpy.MSVCRT(-00000001,00404AC6,?,?,?,?,?,00404AC6,?), ref: 0040342F
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?,00000000), ref: 0040346C
??3@YAXPAX@Z.MSVCRT(?,00000001,0000000C,00404AC6,00404AC6,?,?,?,?,00404AC6,?), ref: 004034B2

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@$FileTime$??2@AttributesSystemlstrlenmemcpy
String ID:
API String ID: 846840743-0
Opcode ID: 59d4a2ad1293f13bca9fbc2cc36a10c810479fd21a5ed498f46fbcb1fa619914
Instruction ID: c1b9adc2f16cc45d244a7c0b75b8b4a4f89234fa72cd4c12ee41ca3d86f3c48f
Opcode Fuzzy Hash: 59d4a2ad1293f13bca9fbc2cc36a10c810479fd21a5ed498f46fbcb1fa619914
Instruction Fuzzy Hash: 8F41C836904611AADB216F998881ABF7F6CEF40716F80403BED01B61D5DB3C9B4282DD

Function 00404405 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401F47: GetUserDefaultUILanguage.KERNEL32(00404416,00000000,00000020,?), ref: 00401F51

Part of subcall function 00401F9D: GetLastError.KERNEL32(00000000,00000020,?), ref: 00401FEC
Part of subcall function 00401F9D: wsprintfW.USER32 ref: 00401FFD
Part of subcall function 00401F9D: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00402012
Part of subcall function 00401F9D: GetLastError.KERNEL32 ref: 00402017
Part of subcall function 00401F9D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402032
Part of subcall function 00401F9D: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402045
Part of subcall function 00401F9D: GetLastError.KERNEL32 ref: 0040204C
Part of subcall function 00401F9D: lstrcmpiW.KERNEL32(00000000,00000020), ref: 00402061
Part of subcall function 00401F9D: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00402071
Part of subcall function 00401F9D: SetLastError.KERNEL32(00000000), ref: 00402098
Part of subcall function 00401F9D: lstrlenA.KERNEL32(00413FD0), ref: 004020CC
Part of subcall function 00401F9D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004020E7
Part of subcall function 00401F9D: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 00402119

Part of subcall function 00401F9D: ??3@YAXPAX@Z.MSVCRT(00000020), ref: 0040208F
Part of subcall function 00401F9D: _wtol.MSVCRT ref: 0040212A
Part of subcall function 00401F9D: MultiByteToWideChar.KERNEL32(00000000,00413FD0,00000001,00000000,00000002), ref: 0040214A

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,?,?,00000000,00000020,?), ref: 0040448C
wsprintfW.USER32 ref: 004044A7

Part of subcall function 00402F6C: ??2@YAPAXI@Z.MSVCRT(00000018,00000000,004044E9,?,?,?,?,?,?,?,?,?,?,00000000,00000020,?), ref: 00402F71

#17.COMCTL32(?,?,?,?,00000000,00000020,?), ref: 00404533

Strings

7zSfxFolder%02d, xrefs: 004044A1
IA, xrefs: 0040447B

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ErrorLast$??2@$??3@EnvironmentVariablewsprintf$ByteCharDefaultFolderInfoLanguageLocaleMultiPathSpecialUserWide_wtollstrcmpilstrlen
String ID: 7zSfxFolder%02d$IA
API String ID: 3387708999-1317665167
Opcode ID: 205a0074c49e5804c32477661e2015f4351efd6e14d5df67bf5bfd9f1882f569
Instruction ID: c443879f351b6d6d2b07c84fde6f3777072453d7374e8d7fc75fcfd2f507d9dd
Opcode Fuzzy Hash: 205a0074c49e5804c32477661e2015f4351efd6e14d5df67bf5bfd9f1882f569
Instruction Fuzzy Hash: E03140B19042199BDB10FFA2DC86AEE7B78EB44308F40407FF619B21E1EB785644DB58

Function 00408EA4 Relevance: 8.0, APIs: 3, Strings: 2, Instructions: 464
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000018,?,?,00000000,?), ref: 00408F0F
??2@YAPAXI@Z.MSVCRT(00000028,00000000,?,?,00000000,?), ref: 00408F59

Strings

IA, xrefs: 00409225
IA, xrefs: 00409391

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??2@
String ID: IA$IA
API String ID: 1033339047-1400641299
Opcode ID: ade758c57321b25e9a53a0c33f99253ab3068af0158966582580042e8f9f7447
Instruction ID: ddcf9de22f7a46eeefc4975c1fab543939f34ce9f972055b0c78c556d294e1f5
Opcode Fuzzy Hash: ade758c57321b25e9a53a0c33f99253ab3068af0158966582580042e8f9f7447
Instruction Fuzzy Hash: EF123671A00209DFCB14EFA5C98489ABBB5FF48304B10456EF95AA7392DB39ED85CF44

Function 00410CD0 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 23
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 00410D0D

Strings

HKA, xrefs: 00410CE9
4KA, xrefs: 00410CF0
$KA, xrefs: 00410CF7
\KA, xrefs: 00410CE2

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: free
String ID: $KA$4KA$HKA$\KA
API String ID: 1294909896-3316857779
Opcode ID: 376fb7dfafd84c32bde4dd83858b4f8e2c6f0d8f0efa40633e7013e4dd95691d
Instruction ID: 889df95fe732b3a4b2d84b4ab476e7a54c7f97cead7299b76f73e2708a1c6c0a
Opcode Fuzzy Hash: 376fb7dfafd84c32bde4dd83858b4f8e2c6f0d8f0efa40633e7013e4dd95691d
Instruction Fuzzy Hash: C5F09271409B109FC7319F55E405AC6B7F4AE447183058A2EA89A5BA11D3B8F989CB9C

Function 004096C7 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 388
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004096D0
??2@YAPAXI@Z.MSVCRT(00000038,00000001), ref: 0040986E
??2@YAPAXI@Z.MSVCRT(00000038,?,00000000,00000000,00000001), ref: 00409941

Part of subcall function 00409C13: ??2@YAPAXI@Z.MSVCRT(00000020,?,00000000,?,00409952,?,00000000,00000000,00000001), ref: 00409C3B

Strings

HIA, xrefs: 0040978B

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??2@$H_prolog
String ID: HIA
API String ID: 3431946709-2712174624
Opcode ID: 5664c2804fe39f9fee2805cb412b18014b96d9821453edab9864f4d5d9c1b48b
Instruction ID: da3614a8b55b1d80bdf53177d95d0cff5abf3d9c279f99a440b99522f39c568d
Opcode Fuzzy Hash: 5664c2804fe39f9fee2805cb412b18014b96d9821453edab9864f4d5d9c1b48b
Instruction Fuzzy Hash: 53F13971610249DFCB24DF69C884AAA77F4BF48314F24416AF829AB392DB39ED41CF54

Function 00402844 Relevance: 6.4, APIs: 5, Instructions: 118
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?,?,00000000), ref: 00402876
lstrlenA.KERNEL32(?,?,00000000), ref: 0040287E
memcmp.MSVCRT(?,?,?), ref: 004028E4
memcmp.MSVCRT(?,?,?,?,00000000), ref: 00402921
memmove.MSVCRT(?,?,00000000,?,00000000), ref: 00402953

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: lstrlenmemcmp$memmove
String ID:
API String ID: 3251180759-0
Opcode ID: 67daa449d30d113f3b3b6daec82bd49862eba03341b4cd8aae73257779b8cae6
Instruction ID: d4955105e7b234ce255a009ef61331e6eb412850de833d0a73495bfba1f32545
Opcode Fuzzy Hash: 67daa449d30d113f3b3b6daec82bd49862eba03341b4cd8aae73257779b8cae6
Instruction Fuzzy Hash: 4A417F72E00209AFCF01DFA4C9889EEBBB5EF08344F04447AE945B3291D3B49E55CB55

Function 0040150B Relevance: 6.1, APIs: 4, Instructions: 100
synchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE(00000000,00000000,0040129C,00000000,00000000,?), ref: 0040154F
WaitForSingleObject.KERNEL32(000000FF,?,00404AFB,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00401570

Part of subcall function 00407776: wvsprintfW.USER32(?,00000000,?), ref: 0040779A
Part of subcall function 00407776: GetLastError.KERNEL32(?,00000000,0000FDE9), ref: 004077AB
Part of subcall function 00407776: FormatMessageW.KERNEL32(00001100,00000000,00000000,00402A50,00402A50,00000000,00000000,?,00000000,0000FDE9), ref: 004077D3
Part of subcall function 00407776: FormatMessageW.KERNEL32(00001100,00000000,00402A50,00000000,00402A50,00000000,00000000,?,00000000,0000FDE9), ref: 004077E8
Part of subcall function 00407776: lstrlenW.KERNEL32(?,?,00000000,0000FDE9), ref: 004077FB
Part of subcall function 00407776: lstrlenW.KERNEL32(00402A50,?,00000000,0000FDE9), ref: 00407802
Part of subcall function 00407776: ??2@YAPAXI@Z.MSVCRT(00000000,?,00000000,0000FDE9), ref: 00407817
Part of subcall function 00407776: lstrcpyW.KERNEL32(00000000,?,?,00000000,0000FDE9), ref: 0040782D
Part of subcall function 00407776: lstrcpyW.KERNEL32(-00000002,00402A50,?,00000000,0000FDE9), ref: 0040783E
Part of subcall function 00407776: ??3@YAXPAX@Z.MSVCRT(00000000,00000000,?,00000000,0000FDE9), ref: 00407847
Part of subcall function 00407776: LocalFree.KERNEL32(00402A50,?,00000000,0000FDE9), ref: 00407851

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@CreateErrorFreeLastLocalObjectSingleThreadWaitwvsprintf
String ID:
API String ID: 359084233-0
Opcode ID: bfd7be960afb110040db1d822841385e4bb8395790a59903d21b295a7462948d
Instruction ID: 87277f5b9ffc23463226fd0df2644328d4cfb3d5af9d6e9341eee715f5e270ad
Opcode Fuzzy Hash: bfd7be960afb110040db1d822841385e4bb8395790a59903d21b295a7462948d
Instruction Fuzzy Hash: 8231F171644200BBDA305B15DC86EBB37B9EBC5350F24843BF522F92F0CA79A941DA5E

Function 00401986 Relevance: 6.0, APIs: 4, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(004033CE,00000000,-00000001,004033CE,?,00404AC6,?,?,?,?,00404AC6,?), ref: 0040198D
GetLastError.KERNEL32(?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00401997
SetLastError.KERNEL32(000000B7,?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?,00000000), ref: 004019A7
GetFileAttributesW.KERNELBASE(?,?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?,00000000), ref: 004019B5

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ErrorLast$AttributesCreateDirectoryFile
String ID:
API String ID: 635176117-0
Opcode ID: 393c5bca226d6deeec728b25f224b431065b6bfcdefbc0a9fd36f7f362ffe78b
Instruction ID: 5ae0be16486f509c6b40768ba71a6c1c2cea9be4331c5fc90c1b41dbeb0419e3
Opcode Fuzzy Hash: 393c5bca226d6deeec728b25f224b431065b6bfcdefbc0a9fd36f7f362ffe78b
Instruction Fuzzy Hash: D5E09AB0518250AFDE142BB4BD187DB3AA5AF46362F508932F495E02F0C33888428A89

Function 00404A44 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(000001E8,00000000,?,ExecuteFile,00000021,?,00405D20,?,00417788,00417788), ref: 00404A5A
??2@YAPAXI@Z.MSVCRT(00000040,?,?,?,?,?,?,?,?,00000000,?), ref: 00404ADC

Strings

ExecuteFile, xrefs: 00404A48

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??2@
String ID: ExecuteFile
API String ID: 1033339047-323923146
Opcode ID: fa0511c003ccdb3ab72568a6a3a656966613ea7ca94b66f833361549b4052979
Instruction ID: 446d0bd8c70a379003bbf02419fa435b46014474c8a02eb0da5acec479ce97d7
Opcode Fuzzy Hash: fa0511c003ccdb3ab72568a6a3a656966613ea7ca94b66f833361549b4052979
Instruction Fuzzy Hash: EA1184B5340104BFD710AB659C85D6B73A8EF80355724443FF602B72D1DA789D418A6D

Function 0040ADC3 Relevance: 4.5, APIs: 3, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(?,?,?,?,0040B1B6,00010000), ref: 0040ADD6
memmove.MSVCRT(00000000,?,?,?,?,?,0040B1B6,00010000), ref: 0040ADF0
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0040B1B6,00010000), ref: 0040AE00

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??2@??3@memmove
String ID:
API String ID: 3828600508-0
Opcode ID: 681e1b0d226f40fe4ab8b8450f07d9ff2e75d0d2427af455dbd11f2bdce48d51
Instruction ID: a8ce0a3cb4653ecb547b1a3698f229d81d6147035ad3680bc60947505803a3f4
Opcode Fuzzy Hash: 681e1b0d226f40fe4ab8b8450f07d9ff2e75d0d2427af455dbd11f2bdce48d51
Instruction Fuzzy Hash: 74F089763047016FC3205B1ADC80857BBABDFC4715311883FE55E93A50D634F891965A

Function 0040245A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 0040247E

Strings

@, xrefs: 00402471

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID: @
API String ID: 1890195054-2766056989
Opcode ID: e165e649a9da5613d175048000a137ea24de4513e4899c41680211bbe6bcf060
Instruction ID: 9ce3ff159218229c34eda893c3d8d64f83397f3f2cddac743d7c565554413103
Opcode Fuzzy Hash: e165e649a9da5613d175048000a137ea24de4513e4899c41680211bbe6bcf060
Instruction Fuzzy Hash: AAF0AF30A042048ADF15AB719E8DA5A37A4BB00348F10853AF516F52D4D7BCE9048B5D

Function 0040C9FC Relevance: 3.2, APIs: 2, Instructions: 184COMMON

Download Yara Rule

APIs

Part of subcall function 0040AAAB: _CxxThrowException.MSVCRT(?,00414EF8), ref: 0040AAC5

Part of subcall function 0040ADC3: ??2@YAPAXI@Z.MSVCRT(?,?,?,?,0040B1B6,00010000), ref: 0040ADD6
Part of subcall function 0040ADC3: memmove.MSVCRT(00000000,?,?,?,?,?,0040B1B6,00010000), ref: 0040ADF0
Part of subcall function 0040ADC3: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,0040B1B6,00010000), ref: 0040AE00

??3@YAXPAX@Z.MSVCRT(?,?,?,?,004149F0,?,004149B0), ref: 0040CAF2
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,004149F0,?,004149B0), ref: 0040CC4A

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@$??2@ExceptionThrowmemmove
String ID:
API String ID: 4269121280-0
Opcode ID: 55a34ad2a1bb823cdc9ec8962d94a78352b48210c79ef81d7d99dd1713e8f51f
Instruction ID: 88480e7f7e551c391a26326ce122d220a9eefc885560dc6ed21150e7f5ba8ef6
Opcode Fuzzy Hash: 55a34ad2a1bb823cdc9ec8962d94a78352b48210c79ef81d7d99dd1713e8f51f
Instruction Fuzzy Hash: 00712571A00209EFCB24DFA5C8D1AAEBBB1FF08314F10463AE545A3291D739A945CF99

Function 0040A62F Relevance: 3.1, APIs: 2, Instructions: 135COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040A634
??3@YAXPAX@Z.MSVCRT(?), ref: 0040A729

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@H_prolog
String ID:
API String ID: 1329742358-0
Opcode ID: 6656e43d2981dee3a96cb881ff7527404ad10ce0abe68b4cdaafc38c009261e5
Instruction ID: 956102545b91a7c0cba0a64d671320761176ea25dc816e9057e3d4af94f09eda
Opcode Fuzzy Hash: 6656e43d2981dee3a96cb881ff7527404ad10ce0abe68b4cdaafc38c009261e5
Instruction Fuzzy Hash: 0D411F32800204AFCB09DB65CD45EBE7B35EF50304B18883BF402B72E2D63E9E21965B

Function 0040112B Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,00401425,00000003,?,0040502D,?,?,00000000), ref: 0040114B
??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,00401425,00000003,?,0040502D,?,?,00000000), ref: 00401171

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??2@??3@
String ID:
API String ID: 1936579350-0
Opcode ID: 453a3e3f1ff100c9dcfb77a92201942aa697f3f866fb972755d4e05e551f17b9
Instruction ID: 063e94d8e06ff9613a5b681c15dc067c338ae4066a9753272274ce5f9f11bd0f
Opcode Fuzzy Hash: 453a3e3f1ff100c9dcfb77a92201942aa697f3f866fb972755d4e05e551f17b9
Instruction Fuzzy Hash: 71F0A476210612ABC334DF2DC581867B3E4EF88711710893FE6C7C72B1DA31A881C754

Function 004022B0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(?,00000000,?,00000024,004025DB,00000001,00000020,00402AB6,00000000,00000000,00000000,00000020), ref: 004022C0
??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000024,004025DB,00000001,00000020,00402AB6,00000000,00000000,00000000,00000020), ref: 004022E4

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??2@??3@
String ID:
API String ID: 1936579350-0
Opcode ID: 161b1d3c566106e9ad65e75d5d4507556b29aa609190ea75727e2c569a68f83b
Instruction ID: 09ebe67ff45b08f81c36141d9c2dc2e417a159b47c448e0a3757dda97e47d19e
Opcode Fuzzy Hash: 161b1d3c566106e9ad65e75d5d4507556b29aa609190ea75727e2c569a68f83b
Instruction Fuzzy Hash: 8CF030351046529FC330DF69C584853F7E4EB59715721887FE1D6D36A2C674A880CB64

Function 0040D9F0 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 0040DA0B
GetLastError.KERNEL32(?,?,?,?), ref: 0040DA19

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: d304dccc413f9fbc2375b0c992bb18d0fa27bc648f40137314f68655dcdcf89d
Instruction ID: d86f9e507f4e039952bd1031b0dc001be1b0661bb6f0ed5f18f0f7cd7a7605a3
Opcode Fuzzy Hash: d304dccc413f9fbc2375b0c992bb18d0fa27bc648f40137314f68655dcdcf89d
Instruction Fuzzy Hash: FCF0B2B8A04208FFCB04CFA8D8448AE7BB9EB49314B2085A9F815A7390D735DA04DF64

Function 0040ECED Relevance: 3.0, APIs: 2, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 0040ED05
_CxxThrowException.MSVCRT(?,00415010), ref: 0040ED28

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: AllocExceptionStringThrow
String ID:
API String ID: 3773818493-0
Opcode ID: 34848b6f66320e7823decd545e24a334e79eeaa2350f65fc9219e56b57dd4bad
Instruction ID: 896a1b371a95ab63a3f889c911e7bff8eb1facf706b7c8fcc1dab20228dace7a
Opcode Fuzzy Hash: 34848b6f66320e7823decd545e24a334e79eeaa2350f65fc9219e56b57dd4bad
Instruction Fuzzy Hash: CDE06D71600309ABDB10AF66D8419D67BE8EF00380B00C83FF948CA250E779E590C7D9

Function 0040E73A Relevance: 2.5, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0040E745
LeaveCriticalSection.KERNEL32(?,?,?,?,?), ref: 0040E764

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 91dbafe27853da7d419d240d9f0ee1b362973845cd939a0bd3a75ec29d074311
Instruction ID: 086d926b78662e0ab04275255430a857868cdabe8091615e808f779c17768b54
Opcode Fuzzy Hash: 91dbafe27853da7d419d240d9f0ee1b362973845cd939a0bd3a75ec29d074311
Instruction Fuzzy Hash: 76F05436200214FBCB119F95DC08E9BBBB9FF49761F14842AF945E7260C771E821DBA4

Function 0040A7DE Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040A7E3

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e5321c9a15e7e390b560e3b31c2ad4413e862a9b2ae91dd544a8c0e33ade4a6e
Instruction ID: 39d544f4fee3d18347c8ea8d59cce7c7d4ef222c74644271f89bd24cd9d44c54
Opcode Fuzzy Hash: e5321c9a15e7e390b560e3b31c2ad4413e862a9b2ae91dd544a8c0e33ade4a6e
Instruction Fuzzy Hash: 4B2180316003099BCB14EFA5C945AAE73B5EF40344F14843EF806BB291DB38DD16CB1A

Function 0040120B Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 0040124F

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5adc5d60a7dd4af011d60b8927d5fbfdd00464e259639d1fcd3b0c23b8927a9d
Instruction ID: 5817d5120c2da98d16edaa91ace5ca285f5b3ff1e58b2ffd557e42fef7bfdc6e
Opcode Fuzzy Hash: 5adc5d60a7dd4af011d60b8927d5fbfdd00464e259639d1fcd3b0c23b8927a9d
Instruction Fuzzy Hash: 66F05E72100201DBC720AF98C840BA777F5BB84314F04483EE583F2AA0D778B885CB59

Function 0040DA56 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040D985: CloseHandle.KERNELBASE(00000001,000000FF,0040DA61,00413330,?,0040DB39,L@,40000000,00000000,00000000,00000000,0040DB50,00000000,00000001,00000001,00000080), ref: 0040D990

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,00413330,?,0040DB39,L@,40000000,00000000,00000000,00000000,0040DB50), ref: 0040DA78

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 08bceb1980caaee1328d4f84b7def86f7a2986f91a3075995b51455990be9560
Instruction ID: 040011ad7fb3de3f437c6c7e3ebc1dcda5640d8293b7e84d035d3e38099293ab
Opcode Fuzzy Hash: 08bceb1980caaee1328d4f84b7def86f7a2986f91a3075995b51455990be9560
Instruction Fuzzy Hash: A1E04F32140219ABCF215FA49C01BCA7B96AF09760F144526BE11A61E0C672D465AF94

Function 0040DB97 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,00000001,00000000,00000000,?,?,0040DD78,00000001,00000000,00000000,00413330,?,00404D94,?,?), ref: 0040DBBA

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3077b537328fed6cd21bdd98b87c61334e39a2b5a14a0e6e22fef2783c677b0b
Instruction ID: ec3d056ad33d5175d1bee219b94afd5900c8108b90431a53c6143dcb1d381838
Opcode Fuzzy Hash: 3077b537328fed6cd21bdd98b87c61334e39a2b5a14a0e6e22fef2783c677b0b
Instruction Fuzzy Hash: D7E0C275600208FBCB00CF95C801B9E7BBABB49755F10C069F918AA2A0D739AA10DF54

Function 0040653F Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_beginthreadex.MSVCRT ref: 00406552

Part of subcall function 00406501: GetLastError.KERNEL32(00406563,00000000), ref: 004064F5

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ErrorLast_beginthreadex
String ID:
API String ID: 4034172046-0
Opcode ID: e5ca857e6cae9760b500a95e192be9ea992c298de85bf840c792a1269a380ec9
Instruction ID: fe95790bd269afcad05a26a3721163fc0b830ac61c9b3c5b6bbddf8a66cf2d64
Opcode Fuzzy Hash: e5ca857e6cae9760b500a95e192be9ea992c298de85bf840c792a1269a380ec9
Instruction Fuzzy Hash: 12D05EF6400208BFDF01DFE0DC05CAB3BADEB08204B004464FD05C2150E632DA108B60

Function 0040CC59 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 0040CC5E

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e8864bf39b3a1c941500cd6d38dedcba990c3b7db4eb5411aa9ab2a8414fad35
Instruction ID: 312fbe8762c42e8d4a239ae194adb86e93363bc1e5443e54fb58aca6058f63a2
Opcode Fuzzy Hash: e8864bf39b3a1c941500cd6d38dedcba990c3b7db4eb5411aa9ab2a8414fad35
Instruction Fuzzy Hash: 70D05EB2A04108FBE7109F85D946BEEFB78EB80399F10823FB506B1150D7BC5A0196AD

Function 0040DADC Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 0040DAF2

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 05e1a1911e5ec75f7d6758f34865a5827037a9c860dec67033daab0b9cfe5943
Instruction ID: c05821c64f4412cbb188b0f884d423eaa3d686fb1c941f6ac6705c8b1bb703da
Opcode Fuzzy Hash: 05e1a1911e5ec75f7d6758f34865a5827037a9c860dec67033daab0b9cfe5943
Instruction Fuzzy Hash: 58E0EC75211208FFDB01CF90CD01FDE7BBDFB49755F208058E90596160C7759A10EB54

Function 0040DB6A Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?,0040DB94,00000000,00000000,?,0040123C,?), ref: 0040DB78

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: d3a1cd3220883f1d47adb6259c26a1719b9664e7d8bae69288c7dd66fbb4bdaa
Instruction ID: c6000770aa4fb4c72b4925fc402daec6625791e8065b7518697746b49206ca3e
Opcode Fuzzy Hash: d3a1cd3220883f1d47adb6259c26a1719b9664e7d8bae69288c7dd66fbb4bdaa
Instruction Fuzzy Hash: 40C04C3A199105FF8F020F70CD04C1ABBA2AB95722F10C918B199C4070CB328424EB02

Function 0040D89F Relevance: 1.3, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000060,?,?,00000000,?,0040D96E,00000000,?,00000000,00000000,000000FF,?,00000001,?,?,?), ref: 0040D91A

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 8955cc1b29c93d01701bbb2481471dd0eaf8a49c35f18cc8a7d41221c9f85a6f
Instruction ID: 1ceb60bf2594cd826c4dcd58ac8a3e75a9726935558582f6c117c88f0dd7e0c4
Opcode Fuzzy Hash: 8955cc1b29c93d01701bbb2481471dd0eaf8a49c35f18cc8a7d41221c9f85a6f
Instruction Fuzzy Hash: 4A219372A042858FCF30FF91D98096B77A5AF50358320853FE093732C1DA38AD49D75A

Function 0040F42D Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0040F446

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ad693850b0beb581ae9f70f91648a78de6b85f526a16152dd36665cc48ec9015
Instruction ID: 8ccd5c106adaedd21fdabd868c2a091acccb285e2c6396e7c66228af9079aab7
Opcode Fuzzy Hash: ad693850b0beb581ae9f70f91648a78de6b85f526a16152dd36665cc48ec9015
Instruction Fuzzy Hash: 68E0ED311087008BEB74DA38A941F97B3DAAB14314F15893FE89AE7690EB74FC448A59

Function 00402F6C Relevance: 1.3, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000018,00000000,004044E9,?,?,?,?,?,?,?,?,?,?,00000000,00000020,?), ref: 00402F71

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: a7abc97568459436273e1f083447e626332fd1c69ee6784c82a7404474e7416c
Instruction ID: 194059228ff5733793a196764ebf5a0b63d959e09992ce12dff2d54d27d13516
Opcode Fuzzy Hash: a7abc97568459436273e1f083447e626332fd1c69ee6784c82a7404474e7416c
Instruction Fuzzy Hash: 67D0A9313083121ADA5432320A09AAF84848B503A0F10083FB800A32D1DCBE8C81A299

Function 0040D985 Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000001,000000FF,0040DA61,00413330,?,0040DB39,L@,40000000,00000000,00000000,00000000,0040DB50,00000000,00000001,00000001,00000080), ref: 0040D990

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5a1e794e604a6db35733be3680912b24c50de2529967425d082228c541f5af6f
Instruction ID: 71cfb53d0268b44c797f7400575dcc0518408263689e7c465582b3111ebcfb94
Opcode Fuzzy Hash: 5a1e794e604a6db35733be3680912b24c50de2529967425d082228c541f5af6f
Instruction Fuzzy Hash: 95D0127251422156CF646E7CB8849C277D85A06334335176AF0B4E32E4D3749DCB5698

Function 004024C4 Relevance: 1.3, APIs: 1, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,0040E4D6,00020000,00000000,?,00000000,?,0040D92B,?,?,00000000,?,0040D96E), ref: 004024E0

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 076169c5b403ddfe74b0b9752022086d8412a0b80d08fe31e2627fee67d73aef
Instruction ID: 23ad038ad5ccaf642d49e1102795c1c714580f299e31bec6e074b0e2bc220d86
Opcode Fuzzy Hash: 076169c5b403ddfe74b0b9752022086d8412a0b80d08fe31e2627fee67d73aef
Instruction Fuzzy Hash: D3C080301443007DED115F505E06B463A916B44717F508065F344540D0C7F484009509

Function 00401B1F Relevance: 1.3, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,0040E561,?,00000004,0040E5B0,?,?,004117E5,?), ref: 00401B2A

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 727c456c664ec040fae2a494910ef8e866b16c48e489126d85a402f0e100615f
Instruction ID: 5381ed20748db0b7fd93371e38984c83fa4171db9cf80dc6a42123bab5888d64
Opcode Fuzzy Hash: 727c456c664ec040fae2a494910ef8e866b16c48e489126d85a402f0e100615f
Instruction Fuzzy Hash: 45A002305446007ADE515B10DD05F457F516744B11F20C5547155540E586755654DA09

Function 0040F3FC Relevance: 1.3, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0040F400

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d9246d09a93a321ccd45a7f77b4b3a05b9734a8e70a1dc2b954ba7e43b8076d7
Instruction ID: 7baee4be7330d58fba6a4d3e6254b3dabd4481adb37f3967e502ba2394f26960
Opcode Fuzzy Hash: d9246d09a93a321ccd45a7f77b4b3a05b9734a8e70a1dc2b954ba7e43b8076d7
Instruction Fuzzy Hash:

Non-executed Functions

Function 004034C1 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 290comCOMMON

Download Yara Rule

APIs

_wtol.MSVCRT ref: 004034E5
SHGetSpecialFolderPathW.SHELL32(00000000,?,CC5BE863,00000000,004177A0,00000000,00417794), ref: 00403588
??3@YAXPAX@Z.MSVCRT(?,?), ref: 004035F9
??3@YAXPAX@Z.MSVCRT(?,?,?), ref: 00403601
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 00403609
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?), ref: 00403611
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?), ref: 00403619
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00403621
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 00403629
_wtol.MSVCRT ref: 0040367F
CoCreateInstance.OLE32(00414BF4,00000000,00000001,00414BE4,00404F9B,.lnk,?,0000005C), ref: 00403720
??3@YAXPAX@Z.MSVCRT(?,0000005C), ref: 004037B8
??3@YAXPAX@Z.MSVCRT(?,?,0000005C), ref: 004037C0
??3@YAXPAX@Z.MSVCRT(?,?,?,0000005C), ref: 004037C8
??3@YAXPAX@Z.MSVCRT(?,?,?,?,0000005C), ref: 004037D0
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,0000005C), ref: 004037D8
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,0000005C), ref: 004037E0
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,0000005C), ref: 004037E8
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,0000005C), ref: 004037EE
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,0000005C), ref: 004037F6

Strings

.lnk, xrefs: 004036FF

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@$_wtol$CreateFolderInstancePathSpecial
String ID: .lnk
API String ID: 408529070-24824748
Opcode ID: cb1a116a375c0276f3cc47ebae34f017b071fc5c88c5a353f484599fe5934efa
Instruction ID: c4a1d47ac56633071a1bd2db01059e5edb54ffe0bccc65637149caefe5d2277b
Opcode Fuzzy Hash: cb1a116a375c0276f3cc47ebae34f017b071fc5c88c5a353f484599fe5934efa
Instruction Fuzzy Hash: 8EA18A71910219ABDF04EFA1CC46DEEBB79EF44705F50442AF502B71A1EB79AA81CB18

Function 00401F9D Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 150stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000020,?), ref: 00401FEC
wsprintfW.USER32 ref: 00401FFD
GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00402012
GetLastError.KERNEL32 ref: 00402017
??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402032
GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402045
GetLastError.KERNEL32 ref: 0040204C
lstrcmpiW.KERNEL32(00000000,00000020), ref: 00402061
??3@YAXPAX@Z.MSVCRT(00000000), ref: 00402071
??3@YAXPAX@Z.MSVCRT(00000020), ref: 0040208F
SetLastError.KERNEL32(00000000), ref: 00402098
lstrlenA.KERNEL32(00413FD0), ref: 004020CC
??2@YAPAXI@Z.MSVCRT(00000000), ref: 004020E7
GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 00402119
_wtol.MSVCRT ref: 0040212A
MultiByteToWideChar.KERNEL32(00000000,00413FD0,00000001,00000000,00000002), ref: 0040214A

Strings

XpA, xrefs: 00401FB4
\3A, xrefs: 00401FDB
7zSfxString%d, xrefs: 00401FF7

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ErrorLast$??2@??3@EnvironmentVariable$ByteCharInfoLocaleMultiWide_wtollstrcmpilstrlenwsprintf
String ID: 7zSfxString%d$XpA$\3A
API String ID: 2117570002-3108448011
Opcode ID: 548ade176c921e3c89d1731ce67e310a71d7e7a73203bdbbb6ff14cd1b9bb65a
Instruction ID: 5c0681f152172bce6659d4e02be164ba9bb36eab7c70e8d4f1a0ed4420d73572
Opcode Fuzzy Hash: 548ade176c921e3c89d1731ce67e310a71d7e7a73203bdbbb6ff14cd1b9bb65a
Instruction Fuzzy Hash: 11518471604305AFDB209F74DD899DBBBB9EB08345B11407AF646E62E0E774AA44CB18

Function 00401BDF Relevance: 26.3, APIs: 11, Strings: 4, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00401BEA
FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 00401C07
FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 00401C1B
SizeofResource.KERNEL32(00000000,00000000), ref: 00401C2C
LoadResource.KERNEL32(00000000,00000000), ref: 00401C36
LockResource.KERNEL32(00000000), ref: 00401C41
LoadLibraryA.KERNEL32(kernel32,SetProcessPreferredUILanguages), ref: 00401C6D
GetProcAddress.KERNEL32(00000000), ref: 00401C76
wsprintfW.USER32 ref: 00401C95
LoadLibraryA.KERNEL32(kernel32,SetThreadPreferredUILanguages), ref: 00401CAA
GetProcAddress.KERNEL32(00000000), ref: 00401CAD

Strings

SetProcessPreferredUILanguages, xrefs: 00401C58
%04X%c%04X%c, xrefs: 00401C8F
SetThreadPreferredUILanguages, xrefs: 00401CA4
kernel32, xrefs: 00401C5D, 00401C62, 00401CA9

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: Resource$Load$AddressFindLibraryProc$HandleLockModuleSizeofwsprintf
String ID: %04X%c%04X%c$SetProcessPreferredUILanguages$SetThreadPreferredUILanguages$kernel32
API String ID: 2639302590-365843014
Opcode ID: a5d0d847a20e007311d4afefc35bdd0d1043cb70ace8406c3a5a944bd10805b9
Instruction ID: 1b367ad183524107b1556f539f271e2bfa11f4d2ebd4ebc35158efee647c5c94
Opcode Fuzzy Hash: a5d0d847a20e007311d4afefc35bdd0d1043cb70ace8406c3a5a944bd10805b9
Instruction Fuzzy Hash: 002153B1944318BBDB109FA59D48F9B7FBCEB48751F118036FA05B72D1D678DA008BA8

Function 00407776 Relevance: 16.6, APIs: 11, Instructions: 96stringwindowCOMMON

Download Yara Rule

APIs

wvsprintfW.USER32(?,00000000,?), ref: 0040779A
GetLastError.KERNEL32(?,00000000,0000FDE9), ref: 004077AB
FormatMessageW.KERNEL32(00001100,00000000,00000000,00402A50,00402A50,00000000,00000000,?,00000000,0000FDE9), ref: 004077D3
FormatMessageW.KERNEL32(00001100,00000000,00402A50,00000000,00402A50,00000000,00000000,?,00000000,0000FDE9), ref: 004077E8
lstrlenW.KERNEL32(?,?,00000000,0000FDE9), ref: 004077FB
lstrlenW.KERNEL32(00402A50,?,00000000,0000FDE9), ref: 00407802
??2@YAPAXI@Z.MSVCRT(00000000,?,00000000,0000FDE9), ref: 00407817
lstrcpyW.KERNEL32(00000000,?,?,00000000,0000FDE9), ref: 0040782D
lstrcpyW.KERNEL32(-00000002,00402A50,?,00000000,0000FDE9), ref: 0040783E
??3@YAXPAX@Z.MSVCRT(00000000,00000000,?,00000000,0000FDE9), ref: 00407847
LocalFree.KERNEL32(00402A50,?,00000000,0000FDE9), ref: 00407851

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@ErrorFreeLastLocalwvsprintf
String ID:
API String ID: 829399097-0
Opcode ID: a8862aa27d5a6cc2b1ba12d709e13e5df444902fd3bed4afc67f02113c073308
Instruction ID: 98041b7e574f1f1c61a73cce3db0a13ad597614178cae5aaf21d0c5f67190c53
Opcode Fuzzy Hash: a8862aa27d5a6cc2b1ba12d709e13e5df444902fd3bed4afc67f02113c073308
Instruction Fuzzy Hash: 85218172804209BEDF14AFA0DC85CEB7BACEB04355B10847BF506A7150EB34EE848BA4

Function 00402B79 Relevance: 16.6, APIs: 11, Instructions: 90filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00413454,?,?,?,00000000), ref: 00402BA8
lstrcmpW.KERNEL32(?,00413450,?,0000005C,?,?,?,00000000), ref: 00402BFB
lstrcmpW.KERNEL32(?,00413448,?,?,00000000), ref: 00402C11
SetFileAttributesW.KERNEL32(?,00000000,?,0000005C,?,?,?,00000000), ref: 00402C27
DeleteFileW.KERNEL32(?,?,?,00000000), ref: 00402C2E
FindNextFileW.KERNEL32(00000000,00000010,?,?,00000000), ref: 00402C40
FindClose.KERNEL32(00000000,?,?,00000000), ref: 00402C4F
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000000), ref: 00402C5A
RemoveDirectoryW.KERNEL32(?,?,?,00000000), ref: 00402C63
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 00402C6E
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000), ref: 00402C79

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: File$Find$??3@Attributeslstrcmp$CloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 1862581289-0
Opcode ID: 3adc14f40e23b1cdad4e4199877390cf68653eec517b691feb080405b1435fa2
Instruction ID: 7ffcf375551190f92b7aba4ef5ef3cd4ed0286f9dec59b0789af02bc25bdcc12
Opcode Fuzzy Hash: 3adc14f40e23b1cdad4e4199877390cf68653eec517b691feb080405b1435fa2
Instruction Fuzzy Hash: A321A230500209BAEB10AF61DE4CFBF7B7C9B0470AF14417AB505B11E0EB78DB459A6C

Function 00406D5D Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(uxtheme,?,00407F57,000004B1,00000000,?,?,?,?,?,0040803E), ref: 00406D65
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 00406D76
GetWindow.USER32(?,00000005), ref: 00406D8F
GetWindow.USER32(00000000,00000002), ref: 00406DA5

Strings

SetWindowTheme, xrefs: 00406D70
uxtheme, xrefs: 00406D5E
\EA, xrefs: 00406D98

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: Window$AddressLibraryLoadProc
String ID: SetWindowTheme$\EA$uxtheme
API String ID: 324724604-1613512829
Opcode ID: 249f97bdfab0f17876e9996a58034084f131abf1d363e9cca7f48feb82d9f298
Instruction ID: f2e0bdee1e376373ef12be0a37c87caa708c4cf78f5ebad58458586032015049
Opcode Fuzzy Hash: 249f97bdfab0f17876e9996a58034084f131abf1d363e9cca7f48feb82d9f298
Instruction Fuzzy Hash: 47F0A73274172537C6312A6A6C4CF9B6B9C9FC6B51B070176B905F7280DA6CCD0045BC

Function 0041022D Relevance: .5, Instructions: 501COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff1f75169f88eb9072603f867e1b9c380318d13f71256e892471df4b1a5f26b0
Instruction ID: 2cf66fefa79674a345482580870fbecf2b771b639b37e27eb1fc897e4fc9b441
Opcode Fuzzy Hash: ff1f75169f88eb9072603f867e1b9c380318d13f71256e892471df4b1a5f26b0
Instruction Fuzzy Hash: 44126E31E00129DFDF08CF68C6945ECBBB2EF85345F2585AAD856AB280D6749EC1DF84

Function 0041206B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e2407533f79ef22d8e6d794d98aef535f9904e2ced6ea7e6753812806be966d
Instruction ID: 8743f1180a29be23716da9caa70fae7f7856ace610ba4dfa2102d12747f13ae8
Opcode Fuzzy Hash: 6e2407533f79ef22d8e6d794d98aef535f9904e2ced6ea7e6753812806be966d
Instruction Fuzzy Hash: D12129725104255BC711DF1DE8887B7B3E1FFC4319F678A36DA81CB281C629D894C6A0

Function 00411F91 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
Instruction ID: 7cc7f0f00d3fdf34bc0739e2af2c3edfb6ca911da6c9eaecf720caf4c907201e
Opcode Fuzzy Hash: a91e830b051fd3563903b3b4c558af91fd9d6843125d3e1887e1db665648e344
Instruction Fuzzy Hash: 0621F53290062587CB12CE6EE4845A7F392FBC436AF134727EE84A3291C62CA855C6A0

Function 0040D72E Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde32e57196543c58229ec3a92fed9e80e5316f67d8377c6540d091cf30b3fc0
Instruction ID: 0032c0c3dd355d3b1328166acc4be040b7821e5e83bc1fe28c274bced218c28f
Opcode Fuzzy Hash: dde32e57196543c58229ec3a92fed9e80e5316f67d8377c6540d091cf30b3fc0
Instruction Fuzzy Hash: 4EF074B5A05209EFCB09CFA9C49199EFBF5FF48304B1084A9E819E7350E731AA11CF50

Function 00404AFF Relevance: 36.9, APIs: 14, Strings: 7, Instructions: 144fileCOMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,?,?), ref: 00404B46
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00404B77
WriteFile.KERNEL32(004177C4,?,?,00406437,00000000,del ",:Repeat,00000000), ref: 00404C2C
??3@YAXPAX@Z.MSVCRT(?), ref: 00404C37
CloseHandle.KERNEL32(004177C4), ref: 00404C40
SetFileAttributesW.KERNEL32(00406437,00000000), ref: 00404C57
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00404C69
??3@YAXPAX@Z.MSVCRT(?), ref: 00404C72
??3@YAXPAX@Z.MSVCRT(?), ref: 00404C7E
??3@YAXPAX@Z.MSVCRT(00406437,?), ref: 00404C84
??3@YAXPAX@Z.MSVCRT(00406437,?,?,?,?,?,?,?,?,?,?,?,?,?,00406437,004177C4), ref: 00404CB2

Strings

open, xrefs: 00404C63
if exist ", xrefs: 00404BC7
:Repeat, xrefs: 00404B92
7ZSfx%03x.cmd, xrefs: 00404B58
", xrefs: 00404BB9, 00404BBE, 00404C02
del ", xrefs: 00404B9F, 00404BA4, 00404BED
" goto Repeat, xrefs: 00404BE0

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@$File$AttributesCloseCreateDriveExecuteHandleShellTypeWrite
String ID: "$" goto Repeat$7ZSfx%03x.cmd$:Repeat$del "$if exist "$open
API String ID: 3007203151-3467708659
Opcode ID: 867eebb51e1b750364ee620a5f1ec15cba4384e9a655442323ea2c3f34152715
Instruction ID: 7a4c4b622d76ac6c1822c64a370ea4e05d699ec4102568342bfcf68b8c9639ad
Opcode Fuzzy Hash: 867eebb51e1b750364ee620a5f1ec15cba4384e9a655442323ea2c3f34152715
Instruction Fuzzy Hash: DE416171D01119BADB00EBA5ED85DEEBB78EF44358F50803AF511720E1EB78AE85CB58

Function 00404603 Relevance: 35.2, APIs: 3, Strings: 17, Instructions: 207stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,0041442C,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004046DF

Part of subcall function 00401F9D: GetLastError.KERNEL32(00000000,00000020,?), ref: 00401FEC
Part of subcall function 00401F9D: wsprintfW.USER32 ref: 00401FFD
Part of subcall function 00401F9D: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00402012
Part of subcall function 00401F9D: GetLastError.KERNEL32 ref: 00402017
Part of subcall function 00401F9D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00402032
Part of subcall function 00401F9D: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00402045
Part of subcall function 00401F9D: GetLastError.KERNEL32 ref: 0040204C
Part of subcall function 00401F9D: lstrcmpiW.KERNEL32(00000000,00000020), ref: 00402061
Part of subcall function 00401F9D: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00402071
Part of subcall function 00401F9D: SetLastError.KERNEL32(00000000), ref: 00402098
Part of subcall function 00401F9D: lstrlenA.KERNEL32(00413FD0), ref: 004020CC
Part of subcall function 00401F9D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004020E7
Part of subcall function 00401F9D: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 00402119

_wtol.MSVCRT ref: 004047DC
_wtol.MSVCRT ref: 004047F8

Strings

GUIMode, xrefs: 004046F4
Title, xrefs: 00404611
OverwriteMode, xrefs: 00404721
MiscFlags, xrefs: 00404771, 00404776, 00404792
|wA, xrefs: 0040464B
ExtractDialogWidth, xrefs: 004047BE
ExtractPathTitle, xrefs: 00404801
ExtractDialogText, xrefs: 004047AD
ExtractPathText, xrefs: 00404819
Progress, xrefs: 004046C7
GUIFlags, xrefs: 0040473E, 00404743, 0040475F
ExtractPathWidth, xrefs: 004047E5
ExtractCancelText, xrefs: 004047A1
ExtractTitle, xrefs: 004046AF
WarningTitle, xrefs: 00404697
CancelPrompt, xrefs: 00404831
ErrorTitle, xrefs: 0040467F

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ErrorLast$??2@EnvironmentVariable_wtollstrcmpi$??3@InfoLocalelstrlenwsprintf
String ID: CancelPrompt$ErrorTitle$ExtractCancelText$ExtractDialogText$ExtractDialogWidth$ExtractPathText$ExtractPathTitle$ExtractPathWidth$ExtractTitle$GUIFlags$GUIMode$MiscFlags$OverwriteMode$Progress$Title$WarningTitle$|wA
API String ID: 2725485552-3187639848
Opcode ID: 7a70c90a09e6339ceb99db9b5511794fba0efbdd365b8bdd8dc3dc4b6a1705ac
Instruction ID: a5d789275b7dd46d140941e9fd319bf554fc7ea6ad5da08365fcb0f0a182a74d
Opcode Fuzzy Hash: 7a70c90a09e6339ceb99db9b5511794fba0efbdd365b8bdd8dc3dc4b6a1705ac
Instruction Fuzzy Hash: 4251B5F1A402047EDB10BB619D86EFF36ACDA85308B64443BF904F32C1E6BC5E854A6D

Function 00402DC0 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 123windowlibrarystringCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 00402DD3
lstrcmpiA.KERNEL32(?,STATIC), ref: 00402DE6
GetWindowLongW.USER32(?,000000F0), ref: 00402DF3

Part of subcall function 00402D7D: GetWindowTextLengthW.USER32(?), ref: 00402D8E
Part of subcall function 00402D7D: GetWindowTextW.USER32(00402E07,00000000,00000001), ref: 00402DAB

Part of subcall function 00401A85: CharUpperW.USER32(?,7556E0B0,00000000,00000000,?,?,?,00403DBD,00000002), ref: 00401AC3
Part of subcall function 00401A85: CharUpperW.USER32(?,?,?,?,00403DBD,00000002), ref: 00401ACF

??3@YAXPAX@Z.MSVCRT(?), ref: 00402E20
GetParent.USER32(?), ref: 00402E2E
LoadLibraryA.KERNEL32(riched20), ref: 00402E42
GetMenu.USER32(?), ref: 00402E55
SetThreadLocale.KERNEL32(00000419), ref: 00402E62
CreateWindowExW.USER32(00000000,RichEdit20W,0041335C,50000804,?,?,?,?,?,00000000,00000000,00000000), ref: 00402E92
DestroyWindow.USER32(?), ref: 00402EA3
SendMessageW.USER32(00000000,00000459,00000022,00000000), ref: 00402EB8
GetSysColor.USER32(0000000F), ref: 00402EBC
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00402ECA
SendMessageW.USER32(00000000,00000461,?,?), ref: 00402EF5
??3@YAXPAX@Z.MSVCRT(?), ref: 00402EFA
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00402F02

Strings

{\rtf, xrefs: 00402E09
STATIC, xrefs: 00402DDD
riched20, xrefs: 00402E3D
RichEdit20W, xrefs: 00402E8C

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: Window$??3@MessageSend$CharTextUpper$ClassColorCreateDestroyLengthLibraryLoadLocaleLongMenuNameParentThreadlstrcmpi
String ID: RichEdit20W$STATIC$riched20${\rtf
API String ID: 1731037045-2281146334
Opcode ID: 2b38b22499d69b5ca28c01525db5cb238b78fd2564d1ef548c56061806c72a13
Instruction ID: c7c9ca1f65d7473fe19c29f8272bdbb18bb8b251efb89c9ee4785ec66c96c850
Opcode Fuzzy Hash: 2b38b22499d69b5ca28c01525db5cb238b78fd2564d1ef548c56061806c72a13
Instruction Fuzzy Hash: FE316072A40119BFDB01AFA5DD49DEF7BBCEF08745F104036F601B21D1DA789A008B68

Function 00401CC8 Relevance: 31.6, APIs: 21, Instructions: 121windowCOMMON

Download Yara Rule

APIs

GetWindowDC.USER32(00000000), ref: 00401CD4
GetDeviceCaps.GDI32(00000000,00000058), ref: 00401CE0
MulDiv.KERNEL32(00000000,00000064,00000060), ref: 00401CF9
GetObjectW.GDI32(?,00000018,?), ref: 00401D28
MulDiv.KERNEL32(?,00000003,00000002), ref: 00401D33
MulDiv.KERNEL32(?,00000003,00000002), ref: 00401D3D
CreateCompatibleDC.GDI32(?), ref: 00401D4B
CreateCompatibleDC.GDI32(?), ref: 00401D52
SelectObject.GDI32(00000000,?), ref: 00401D60
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00401D6E
SelectObject.GDI32(00000000,00000000), ref: 00401D76
SetStretchBltMode.GDI32(00000000,00000004), ref: 00401D7E
StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00401D9D
GetCurrentObject.GDI32(00000000,00000007), ref: 00401DA6
SelectObject.GDI32(00000000,?), ref: 00401DB3
SelectObject.GDI32(00000000,?), ref: 00401DB9
DeleteDC.GDI32(00000000), ref: 00401DC2
DeleteDC.GDI32(00000000), ref: 00401DC5
ReleaseDC.USER32(00000000,?), ref: 00401DCC
ReleaseDC.USER32(00000000,?), ref: 00401DDB
CopyImage.USER32(?,00000000,00000000,00000000,00000000), ref: 00401DE8

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$DeleteReleaseStretch$BitmapCapsCopyCurrentDeviceImageModeWindow
String ID:
API String ID: 3462224810-0
Opcode ID: edcdae41b00ef410d3e7ba3ed19d3c131e86ad83f2f2f2d47359cb6bb3a71bdf
Instruction ID: 24730f8ff9b6a3f8d7f0600a39c6f646a54ca28d21b12e05547a6914d757f366
Opcode Fuzzy Hash: edcdae41b00ef410d3e7ba3ed19d3c131e86ad83f2f2f2d47359cb6bb3a71bdf
Instruction Fuzzy Hash: 00313976D00208BBDF215FA19C48EEFBFBDEB48752F108066F604B21A0C6758A50EB64

Function 00401DF3 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 120windowcommemoryCOMMON

Download Yara Rule

APIs

GetClassNameA.USER32(?,?,00000040), ref: 00401E05
lstrcmpiA.KERNEL32(?,STATIC), ref: 00401E1C
GetWindowLongW.USER32(?,000000F0), ref: 00401E2F
GetMenu.USER32(?), ref: 00401E44

Part of subcall function 00401BDF: GetModuleHandleW.KERNEL32(00000000), ref: 00401BEA
Part of subcall function 00401BDF: FindResourceExA.KERNEL32(00000000,?,?,00000000), ref: 00401C07
Part of subcall function 00401BDF: FindResourceExA.KERNEL32(00000000,?,?,00000409), ref: 00401C1B
Part of subcall function 00401BDF: SizeofResource.KERNEL32(00000000,00000000), ref: 00401C2C
Part of subcall function 00401BDF: LoadResource.KERNEL32(00000000,00000000), ref: 00401C36
Part of subcall function 00401BDF: LockResource.KERNEL32(00000000), ref: 00401C41

GlobalAlloc.KERNEL32(00000040,00000010), ref: 00401E76
memcpy.MSVCRT(00000000,00000000,00000010), ref: 00401E83
CoInitialize.OLE32(00000000), ref: 00401E8C
CreateStreamOnHGlobal.OLE32(00000000,00000000,?), ref: 00401E98
OleLoadPicture.OLEAUT32(?,00000000,00000000,00414C14,?), ref: 00401EBD
GlobalFree.KERNEL32(00000000), ref: 00401ECD

Part of subcall function 00401CC8: GetWindowDC.USER32(00000000), ref: 00401CD4
Part of subcall function 00401CC8: GetDeviceCaps.GDI32(00000000,00000058), ref: 00401CE0
Part of subcall function 00401CC8: MulDiv.KERNEL32(00000000,00000064,00000060), ref: 00401CF9
Part of subcall function 00401CC8: GetObjectW.GDI32(?,00000018,?), ref: 00401D28
Part of subcall function 00401CC8: MulDiv.KERNEL32(?,00000003,00000002), ref: 00401D33
Part of subcall function 00401CC8: MulDiv.KERNEL32(?,00000003,00000002), ref: 00401D3D
Part of subcall function 00401CC8: CreateCompatibleDC.GDI32(?), ref: 00401D4B
Part of subcall function 00401CC8: CreateCompatibleDC.GDI32(?), ref: 00401D52
Part of subcall function 00401CC8: SelectObject.GDI32(00000000,?), ref: 00401D60
Part of subcall function 00401CC8: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00401D6E
Part of subcall function 00401CC8: SelectObject.GDI32(00000000,00000000), ref: 00401D76
Part of subcall function 00401CC8: SetStretchBltMode.GDI32(00000000,00000004), ref: 00401D7E
Part of subcall function 00401CC8: StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00401D9D
Part of subcall function 00401CC8: GetCurrentObject.GDI32(00000000,00000007), ref: 00401DA6
Part of subcall function 00401CC8: SelectObject.GDI32(00000000,?), ref: 00401DB3
Part of subcall function 00401CC8: SelectObject.GDI32(00000000,?), ref: 00401DB9
Part of subcall function 00401CC8: DeleteDC.GDI32(00000000), ref: 00401DC2
Part of subcall function 00401CC8: DeleteDC.GDI32(00000000), ref: 00401DC5
Part of subcall function 00401CC8: ReleaseDC.USER32(00000000,?), ref: 00401DCC

GetObjectW.GDI32(00000000,00000018,?), ref: 00401EFF
SetWindowPos.USER32(00000010,00000000,00000000,00000000,?,?,00000006), ref: 00401F13
SendMessageW.USER32(00000010,00000172,00000000,?), ref: 00401F25
GlobalFree.KERNEL32(00000000), ref: 00401F3A

Strings

IMAGES, xrefs: 00401E4E
STATIC, xrefs: 00401E13

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: Object$Resource$CreateGlobalSelect$CompatibleWindow$DeleteFindFreeLoadStretch$AllocBitmapCapsClassCurrentDeviceHandleInitializeLockLongMenuMessageModeModuleNamePictureReleaseSendSizeofStreamlstrcmpimemcpy
String ID: IMAGES$STATIC
API String ID: 4202116410-1168396491
Opcode ID: 352b3c5e08a174ec4a3ffb4ca519ce1611b0b6cc4168eadb64d38ca8f457be46
Instruction ID: 08c73d75f8249df6a552952f3d33af28cabbedea74541c6d0cfd8ce2793c0c4e
Opcode Fuzzy Hash: 352b3c5e08a174ec4a3ffb4ca519ce1611b0b6cc4168eadb64d38ca8f457be46
Instruction Fuzzy Hash: C7417C71A00218BFCB11DFA1DC49DEEBF7DEF08742B008076FA05A61A0DB758A41DB68

Function 0040813D Relevance: 27.1, APIs: 18, Instructions: 147windowcomtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0040692C: GetDlgItem.USER32(?,?), ref: 00406939
Part of subcall function 0040692C: ShowWindow.USER32(00000000,?), ref: 00406950

GetDlgItem.USER32(?,000004B8), ref: 0040816A
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00408179
GetDlgItem.USER32(?,000004B5), ref: 004081C0
GetWindowLongW.USER32(00000000,000000F0), ref: 004081C5
GetDlgItem.USER32(?,000004B5), ref: 004081D5
SetWindowLongW.USER32(00000000), ref: 004081D8
GetSystemMenu.USER32(?,00000000,000004B4,00000000), ref: 004081FE
EnableMenuItem.USER32(00000000,0000F060,00000001), ref: 00408210
GetDlgItem.USER32(?,000004B4), ref: 0040821A
SetFocus.USER32(00000000), ref: 0040821D
SetTimer.USER32(?,00000001,00000000,00000000), ref: 0040824C
CoCreateInstance.OLE32(00414C34,00000000,00000001,00414808,00000000), ref: 00408277
GetDlgItem.USER32(?,00000002), ref: 00408294
IsWindow.USER32(00000000), ref: 00408297
GetDlgItem.USER32(?,00000002), ref: 004082A7
EnableWindow.USER32(00000000), ref: 004082AA
GetDlgItem.USER32(?,000004B5), ref: 004082BE
ShowWindow.USER32(00000000), ref: 004082C1

Part of subcall function 00407134: GetDlgItem.USER32(?,000004B6), ref: 00407142

Part of subcall function 00407B33: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00407B6D
Part of subcall function 00407B33: GetDlgItem.USER32(?,000004B8), ref: 00407B8B
Part of subcall function 00407B33: SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 00407B9D
Part of subcall function 00407B33: wsprintfW.USER32 ref: 00407BBB
Part of subcall function 00407B33: ??3@YAXPAX@Z.MSVCRT(?), ref: 00407C53

Part of subcall function 00407D06: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,0040803E), ref: 00407D30
Part of subcall function 00407D06: LoadIconW.USER32(00000000), ref: 00407D33
Part of subcall function 00407D06: GetSystemMetrics.USER32(00000032), ref: 00407D43
Part of subcall function 00407D06: GetSystemMetrics.USER32(00000031), ref: 00407D48
Part of subcall function 00407D06: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,0040803E), ref: 00407D51
Part of subcall function 00407D06: LoadImageW.USER32(00000000), ref: 00407D54
Part of subcall function 00407D06: SendMessageW.USER32(?,00000080,00000001,?), ref: 00407D79
Part of subcall function 00407D06: SendMessageW.USER32(?,00000080,00000000,?), ref: 00407D89
Part of subcall function 00407D06: GetWindow.USER32(?,00000005), ref: 00407E76
Part of subcall function 00407D06: GetWindow.USER32(?,00000005), ref: 00407E92

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: Item$Window$MessageSend$System$EnableHandleLoadLongMenuMetricsModuleShow$??3@CreateFocusIconImageInstanceTimerUnothrow_t@std@@@__ehfuncinfo$??2@wsprintf
String ID:
API String ID: 855516470-0
Opcode ID: f96aa9b93e1fd9714dbcbc8c2c582c1e46f74a713c41b2300bd45d2dcf84ac32
Instruction ID: 3ce0214ef3d03b0ee840dd4ab9c121ae631e901bc0d6870238ad5b6e85178a64
Opcode Fuzzy Hash: f96aa9b93e1fd9714dbcbc8c2c582c1e46f74a713c41b2300bd45d2dcf84ac32
Instruction Fuzzy Hash: 014174B0644748ABDA206F65DD49F5B7BADEB40B05F00847DF552A62E1CB79B800CA1C

Function 00403093 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 244stringCOMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,hAA,00000000), ref: 004030F6
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,hAA,00000000), ref: 004030FE
strncmp.MSVCRT ref: 004031F1
??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 00403255
lstrcmpW.KERNEL32(?,SetEnvironment,00000000), ref: 00403273
??3@YAXPAX@Z.MSVCRT(0040414C,?), ref: 00403347

Strings

hAA, xrefs: 0040309E
SetEnvironment, xrefs: 0040326B
MiscFlags, xrefs: 004032C0
{\rtf, xrefs: 004031D6, 004031EB
GUIFlags, xrefs: 004032B2

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@$lstrcmpstrncmp
String ID: GUIFlags$MiscFlags$SetEnvironment$hAA${\rtf
API String ID: 2881732429-172299233
Opcode ID: 436b0b5fdcd0fc7850317bda0c1040a654aafe726af0558e82b6743448b11ef5
Instruction ID: da55d09168dcf28f6e950782b6654b171f18f9ca5632fa18d2c46afc5d57570a
Opcode Fuzzy Hash: 436b0b5fdcd0fc7850317bda0c1040a654aafe726af0558e82b6743448b11ef5
Instruction Fuzzy Hash: 23819D31900218ABDF11DFA1CD55BEE7B78AF14305F1040ABE8017B2E6DB78AB05DB59

Function 00406A47 Relevance: 24.3, APIs: 16, Instructions: 270COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 00406A69
GetWindowLongW.USER32(00000000,000000F0), ref: 00406A6E
GetDlgItem.USER32(?,000004B4), ref: 00406AA5
GetWindowLongW.USER32(00000000,000000F0), ref: 00406AAA
GetSystemMetrics.USER32(00000010), ref: 00406B0B
GetSystemMetrics.USER32(00000011), ref: 00406B11
GetSystemMetrics.USER32(00000008), ref: 00406B18
GetSystemMetrics.USER32(00000007), ref: 00406B1F
GetParent.USER32(?), ref: 00406B43
GetClientRect.USER32(00000000,?), ref: 00406B55
ClientToScreen.USER32(?,?), ref: 00406B68
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00406BCE
GetClientRect.USER32(?,?), ref: 00406C55
ClientToScreen.USER32(?,?), ref: 00406B71

Part of subcall function 0040690F: GetDlgItem.USER32(?,?), ref: 0040691B

GetSystemMetrics.USER32(00000008), ref: 00406CD6
GetSystemMetrics.USER32(00000007), ref: 00406CDD

Part of subcall function 00406A18: GetDlgItem.USER32(?,?), ref: 00406A36
Part of subcall function 00406A18: SetWindowPos.USER32(00000000), ref: 00406A3D

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: MetricsSystem$ClientItemWindow$LongRectScreen$Parent
String ID:
API String ID: 747815384-0
Opcode ID: bdc5cc6ef77edd437f37f749138dc65a224d6988716d71e8386f1ae5cf91717f
Instruction ID: 701d8c843d4ec3579feae24e97f284edc15b0bac0439a5efdbaa5111af673c9b
Opcode Fuzzy Hash: bdc5cc6ef77edd437f37f749138dc65a224d6988716d71e8386f1ae5cf91717f
Instruction Fuzzy Hash: 7B912D71A00209AFDB14DFB9CD85AEEB7F9EF48704F148529E642F6290D778E9008B64

Function 00407D06 Relevance: 22.7, APIs: 15, Instructions: 231windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,0040803E), ref: 00407D30
LoadIconW.USER32(00000000), ref: 00407D33
GetSystemMetrics.USER32(00000032), ref: 00407D43
GetSystemMetrics.USER32(00000031), ref: 00407D48
GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,0040803E), ref: 00407D51
LoadImageW.USER32(00000000), ref: 00407D54
SendMessageW.USER32(?,00000080,00000001,?), ref: 00407D79
SendMessageW.USER32(?,00000080,00000000,?), ref: 00407D89
GetWindow.USER32(?,00000005), ref: 00407E76
GetWindow.USER32(?,00000005), ref: 00407E92
GetWindow.USER32(?,00000005), ref: 00407EAA
GetModuleHandleW.KERNEL32(00000000,00000065,000004B4,00000000,000004B3,00000000,000004B2,?,000004B7,?,?,?,?,?,0040803E), ref: 00407F0A
LoadIconW.USER32(00000000), ref: 00407F0D
GetDlgItem.USER32(?,000004B1), ref: 00407F28
SendMessageW.USER32(00000000), ref: 00407F2F

Part of subcall function 0040725A: GetDlgItem.USER32(?,?), ref: 00407264
Part of subcall function 0040725A: GetWindowTextLengthW.USER32(00000000), ref: 0040726B

Part of subcall function 0040692C: GetDlgItem.USER32(?,?), ref: 00406939
Part of subcall function 0040692C: ShowWindow.USER32(00000000,?), ref: 00406950

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: Window$HandleItemLoadMessageModuleSend$IconMetricsSystem$ImageLengthShowText
String ID:
API String ID: 1889686859-0
Opcode ID: 54e99e0b53345dbf389ae49fdb6e6d7c6227533794aadf34278c182137d853b4
Instruction ID: b6a50195b8a608de49edc5b96f3e83ee8a9b90890169e94b1220211b89b9884f
Opcode Fuzzy Hash: 54e99e0b53345dbf389ae49fdb6e6d7c6227533794aadf34278c182137d853b4
Instruction Fuzzy Hash: E861D47064C7096AE9257B61DC4AF3B3699AB40B05F10447FF642B92D2DBBCBC0056AF

Function 00406F37 Relevance: 16.6, APIs: 11, Instructions: 87windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00406F45
GetWindowLongW.USER32(00000000), ref: 00406F4C
DefWindowProcW.USER32(?,?,?,?), ref: 00406F62
CallWindowProcW.USER32(?,?,?,?,?), ref: 00406F7F
GetSystemMetrics.USER32(00000031), ref: 00406F91
GetSystemMetrics.USER32(00000032), ref: 00406F98
GetWindowDC.USER32(?), ref: 00406FAA
GetWindowRect.USER32(?,?), ref: 00406FB7
DrawIconEx.USER32(00000000,?,?,?,?,?,00000000,00000000,00000003), ref: 00406FEB
ReleaseDC.USER32(?,00000000), ref: 00406FF3

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: Window$MetricsProcSystem$CallDrawIconLongParentRectRelease
String ID:
API String ID: 2586545124-0
Opcode ID: 25d202db14ae47cc7765131eef640a3ba3c2163a3dcc7105130798770ded3a1b
Instruction ID: b1ff7c23223d170b9333fa97acec74f2c9230ee3eabfe87d0be763292bfdf634
Opcode Fuzzy Hash: 25d202db14ae47cc7765131eef640a3ba3c2163a3dcc7105130798770ded3a1b
Instruction Fuzzy Hash: 8E210C7650021ABFCF01AFA8DD48DDF7F69FB08351F008565FA15E21A0C775EA209B64

Function 0040677A Relevance: 13.5, APIs: 9, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000004B3), ref: 0040678E
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004067A1
GetDlgItem.USER32(?,000004B4), ref: 004067AB
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004067B3
SendMessageW.USER32(?,00000401,?,00000000), ref: 004067C3
GetDlgItem.USER32(?,?), ref: 004067CC
SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 004067D4
GetDlgItem.USER32(?,?), ref: 004067DD
SetFocus.USER32(00000000,?,000004B4,75570E50,00407E06,000004B4,000004B3,00000000,000004B4,00000000,000004B2,?,000004B7), ref: 004067E0

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ItemMessageSend$Focus
String ID:
API String ID: 3946207451-0
Opcode ID: ad16f172208785dca513fa64c118104ef693669a3ac6e088fd96c23032a45483
Instruction ID: e7a8c5b21de344c7c4c5496bf688f1d5cc3ba414acf11b32f4788b893cc62525
Opcode Fuzzy Hash: ad16f172208785dca513fa64c118104ef693669a3ac6e088fd96c23032a45483
Instruction Fuzzy Hash: 6FF04F712403087BEA212B61DD86F5BBA6EEF81B45F018425F340650F0CBF7EC109A28

Function 0040C3D8 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 480COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,?,?,00000000), ref: 0040C603

Strings

IA, xrefs: 0040C66E
IA, xrefs: 0040C4D9
IA, xrefs: 0040C74D
IA, xrefs: 0040C4AF
IA, xrefs: 0040C65E
IA, xrefs: 0040C4C6

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@
String ID: IA$IA$IA$IA$IA$IA
API String ID: 613200358-3743982587
Opcode ID: 6e54149e8c3d77333b16b378dc95c38791a09178c73359331ff936fd258cd747
Instruction ID: 4cebfcab61734def35128a955d6a3e34031d8899c11ca8f9bd2aeb72941b6852
Opcode Fuzzy Hash: 6e54149e8c3d77333b16b378dc95c38791a09178c73359331ff936fd258cd747
Instruction Fuzzy Hash: D2221671900248DFCB24EF65C8D09EEBBB5FF48304F50852EE91AA7291DB38A945CF58

Function 004083B6 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 196COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,00000011,00000000,00000000,00417788,00000000,SetEnvironment), ref: 00408479

Strings

SetEnvironment, xrefs: 004083BC
FinishMessage, xrefs: 00408417, 00408433
WarningTitle, xrefs: 0040853A
BeginPrompt, xrefs: 004084A4, 004084A9
HelpText, xrefs: 00408598
ErrorTitle, xrefs: 00408511

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@
String ID: BeginPrompt$ErrorTitle$FinishMessage$HelpText$SetEnvironment$WarningTitle
API String ID: 613200358-994561823
Opcode ID: 971dcdd12a827a4034ed94f9ba1d623efd1f14b2bcca4d73e06b44b648e667ed
Instruction ID: 5566f9f9667118f06bc812855c9affabb63102f3a10b3971892d5eca1131561f
Opcode Fuzzy Hash: 971dcdd12a827a4034ed94f9ba1d623efd1f14b2bcca4d73e06b44b648e667ed
Instruction Fuzzy Hash: CA51D47080420AAACF24AB559E85AFB7774EB20348F54443FF881722E1EF7D5D82D64E

Function 00406DB2 Relevance: 12.1, APIs: 8, Instructions: 69COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,00417410,00000160), ref: 00406DD1
SystemParametersInfoW.USER32(00000029,00000000,?,00000000), ref: 00406DF0
GetDC.USER32(00000000), ref: 00406DFB
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00406E07
MulDiv.KERNEL32(?,00000048,00000000), ref: 00406E16
ReleaseDC.USER32(00000000,?), ref: 00406E24
GetModuleHandleW.KERNEL32(00000000), ref: 00406E4C
DialogBoxIndirectParamW.USER32(00000000,?,?,Function_0000667A), ref: 00406E81

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: CapsDeviceDialogHandleIndirectInfoModuleParamParametersReleaseSystemmemcpy
String ID:
API String ID: 2693764856-0
Opcode ID: e70a94c77e8458ae7b0f85d98e5dff18e09bef3a98047e8bed90a0db42bf0d7e
Instruction ID: b2c1943609947f3a034a1f42a4fd453b3666a2b5c4d4ccfd9a1c2059c5c1cb6f
Opcode Fuzzy Hash: e70a94c77e8458ae7b0f85d98e5dff18e09bef3a98047e8bed90a0db42bf0d7e
Instruction Fuzzy Hash: C32184B5500218BFDB215F61DC45EEB7B7CFB08746F0040B6F609A1190D7748E948B65

Function 0040695E Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 0040696E
GetSystemMetrics.USER32(0000000B), ref: 0040698A
GetSystemMetrics.USER32(0000003D), ref: 00406993
GetSystemMetrics.USER32(0000003E), ref: 0040699B
SelectObject.GDI32(?,?), ref: 004069B8
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 004069D3
SelectObject.GDI32(?,?), ref: 004069F9
ReleaseDC.USER32(?,?), ref: 00406A08

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: MetricsSystem$ObjectSelect$DrawReleaseText
String ID:
API String ID: 2466489532-0
Opcode ID: 3371c90df87af61a96ab0a4f5adfc31794890a389d4733c3cd0e84d47817aa4d
Instruction ID: 7c755332e1b278278a0584394201b19561512224090c74d51841a9ad660c27ee
Opcode Fuzzy Hash: 3371c90df87af61a96ab0a4f5adfc31794890a389d4733c3cd0e84d47817aa4d
Instruction Fuzzy Hash: 6B216871900209EFCB119F65DD84A8EBFF4EF08321F10C46AE559A72A0C7359A50DF40

Function 00407B33 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 102windowCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00407B6D
GetDlgItem.USER32(?,000004B8), ref: 00407B8B
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 00407B9D
wsprintfW.USER32 ref: 00407BBB
??3@YAXPAX@Z.MSVCRT(?), ref: 00407C53

Strings

%d%%, xrefs: 00407BB5

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@ItemMessageSendUnothrow_t@std@@@__ehfuncinfo$??2@wsprintf
String ID: %d%%
API String ID: 3753976982-1518462796
Opcode ID: 0b792d7adb6174ba2d50e5ca9cf87896ffea0db59519718aa7dbff65f529ef39
Instruction ID: b955b8041d8a67620c3180d4911c799512bd6939d195f5b55c3092177650065a
Opcode Fuzzy Hash: 0b792d7adb6174ba2d50e5ca9cf87896ffea0db59519718aa7dbff65f529ef39
Instruction Fuzzy Hash: 1D31D371904208BBDB11AFA0CC45EDA7BB9EF48708F10847AFA42B61E1D779B904CB59

Function 0040408B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(hAA,00000020,?,?,00405838,?,?,?,00000000,?), ref: 004040A4

Part of subcall function 00401A85: CharUpperW.USER32(?,7556E0B0,00000000,00000000,?,?,?,00403DBD,00000002), ref: 00401AC3
Part of subcall function 00401A85: CharUpperW.USER32(?,?,?,?,00403DBD,00000002), ref: 00401ACF

??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 00404156
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 0040415E
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?), ref: 0040416D
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?), ref: 00404175

Strings

hAA, xrefs: 00404091, 0040409B, 004040A2, 004040B0

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@$CharUpper$lstrlen
String ID: hAA
API String ID: 2587799592-1362906312
Opcode ID: f1afb06a12cfea52e195ddd9e8ddb158cdff932f9735d488ba252034b153affa
Instruction ID: 7f7e13310b21401de90169bcc26cd057e2afddf23eedd5de54135d69024cf91c
Opcode Fuzzy Hash: f1afb06a12cfea52e195ddd9e8ddb158cdff932f9735d488ba252034b153affa
Instruction Fuzzy Hash: D7212772D40215AACF20ABA4CC46AEB77B9DF90354F10407BEB41BB2E1E7789D848658

Function 00404CBC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,00000000,00000001,00000000,00000000,00000001,?,00000000), ref: 00404D3E
??3@YAXPAX@Z.MSVCRT(?,?,?,004054CC,?,;!@InstallEnd@!,004054CC,;!@Install@!UTF-8!,00417400,00000000,00000001,?,00000000), ref: 00404DA0
??3@YAXPAX@Z.MSVCRT(?,?,?,004054CC,?,;!@InstallEnd@!,004054CC,;!@Install@!UTF-8!,00417400,00000000,00000001,?,00000000), ref: 00404DB8

Part of subcall function 00403354: lstrlenW.KERNEL32(00404AC6,?,?,00000000,?,?,?,?,00404AC6,?), ref: 00403361
Part of subcall function 00403354: GetSystemTimeAsFileTime.KERNEL32(?,00404AC6,?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?), ref: 004033D7
Part of subcall function 00403354: GetFileAttributesW.KERNELBASE(?,?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?,00000000), ref: 004033DE
Part of subcall function 00403354: ??3@YAXPAX@Z.MSVCRT(?,00404AC6,?,?,?,?,00404AC6,?,?,?,?,?,?,?,?,?), ref: 0040349D

Strings

;!@InstallEnd@!, xrefs: 00404D73
03A, xrefs: 00404CCF
;!@Install@!UTF-8!, xrefs: 00404D59

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@$FileTime$AttributesSystemlstrlen
String ID: 03A$;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 4038993085-2279431206
Opcode ID: 1e5f1ef11ab3d9e84330ff60a8d60345b5fdf25d940142a54a900a3d947b53ea
Instruction ID: 637b7b13a9bcd1d52ea1019587bfa2fb4435f6835f564ae220b3123002230846
Opcode Fuzzy Hash: 1e5f1ef11ab3d9e84330ff60a8d60345b5fdf25d940142a54a900a3d947b53ea
Instruction Fuzzy Hash: CE312D71D0021EEACF05EF92CD429EEBBB4BF44318F10042BE911762E1DB785649DB98

Function 0040755F Relevance: 10.6, APIs: 7, Instructions: 63timethreadinjectionCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 00407579
KillTimer.USER32(?,00000001), ref: 0040758A
SetTimer.USER32(?,00000001,00000000,00000000), ref: 004075B4
SuspendThread.KERNEL32(00000278), ref: 004075CD
ResumeThread.KERNEL32(00000278), ref: 004075EA
EndDialog.USER32(?,00000000), ref: 0040760C

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: DialogThreadTimer$KillResumeSuspend
String ID:
API String ID: 4151135813-0
Opcode ID: fa37b7d0569be928e5d0aecc9653dabfd5de706af621d680b5378aa8e85f3b57
Instruction ID: ebb94c5c4675b2e6542c2b2cb7d5652cccd5624f9a00d71f737e39ca63bd9789
Opcode Fuzzy Hash: fa37b7d0569be928e5d0aecc9653dabfd5de706af621d680b5378aa8e85f3b57
Instruction Fuzzy Hash: 9811BF70A08618BBD7212F15EE849E77BBDFB00756B00843AF523A05A0CB39BD00DA1D

Function 00404E3F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(004177C4,004177C4,004177C4,00000000,0000002C,;!@InstallEnd@!,;!@Install@!UTF-8!,00000000,00000000), ref: 00404E85

Part of subcall function 00404343: ??3@YAXPAX@Z.MSVCRT(?,?,?,004177C4,004177C4,?,;!@InstallEnd@!,;!@Install@!UTF-8!,00000000,00000000), ref: 004043B6

??3@YAXPAX@Z.MSVCRT(004177C4,004177C4,004177C4,00000000,0000002C,004177C4,004177C4,00000000,0000002C,;!@InstallEnd@!,;!@Install@!UTF-8!,00000000,00000000), ref: 00404EAB
wsprintfA.USER32 ref: 00404EBC

Strings

:Language:%u!, xrefs: 00404EB6
;!@InstallEnd@!, xrefs: 00404E59
;!@Install@!UTF-8!, xrefs: 00404E4A

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@$wsprintf
String ID: :Language:%u!$;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 2704270482-1550708412
Opcode ID: b3a647dc230e6375ba5304378dede3f86871d19815b7720c308d82744c7d9f3d
Instruction ID: afe26c372a183c0ca4a1b7edc16cb7be903c3e4040aad79e05e22cec791dc9d0
Opcode Fuzzy Hash: b3a647dc230e6375ba5304378dede3f86871d19815b7720c308d82744c7d9f3d
Instruction Fuzzy Hash: D8115E71B00018BBCF00FB95CC42EFE77ADAB84705B10402EBA15E3182DB78AB028799

Function 00403880 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(00417788,00417788,00000000,%%T\,0041350C,00000000,00417788,00407405,?,00000000,00000000,00000000), ref: 004038C6
??3@YAXPAX@Z.MSVCRT(00417788,00417788,00000000,%%T/,004134FC,00000000,00417788,00000000,%%T\,0041350C,00000000,00417788,00407405,?,00000000,00000000), ref: 00403904
??3@YAXPAX@Z.MSVCRT(00417788,00417788,00000000,00417788,00417788,00000000,%%T/,004134FC,00000000,00417788,00000000,%%T\,0041350C,00000000,00417788,00407405), ref: 0040392A
??3@YAXPAX@Z.MSVCRT(00000000,00417788,00417788,00000000,00417788,00417788,00000000,%%T/,004134FC,00000000,00417788,00000000,%%T\,0041350C,00000000,00417788), ref: 00403932

Strings

%%T\, xrefs: 004038A6
%%T/, xrefs: 004038E4

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@
String ID: %%T/$%%T\
API String ID: 613200358-2679640699
Opcode ID: 9eec194740abc4bee078c15c8dc217b66edb47652cee4dab90ed516c3b80c8f9
Instruction ID: 53c9ca64f2466311d4136dbbff57d229d1af9e29f5fa76e56e45344ae10c91f3
Opcode Fuzzy Hash: 9eec194740abc4bee078c15c8dc217b66edb47652cee4dab90ed516c3b80c8f9
Instruction Fuzzy Hash: 5011DD3190410EBACF05FFA1D857CEDBB79AE00708F50806AB511760E1EF79A785DB98

Function 0040393B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(00414784,00414784,00000000,%%S\,0041350C,00000000,00414784,00407405,?,00000000,00000000,00000000), ref: 00403981
??3@YAXPAX@Z.MSVCRT(00414784,00414784,00000000,%%S/,004134FC,00000000,00414784,00000000,%%S\,0041350C,00000000,00414784,00407405,?,00000000,00000000), ref: 004039BF
??3@YAXPAX@Z.MSVCRT(00414784,00414784,00000000,00414784,00414784,00000000,%%S/,004134FC,00000000,00414784,00000000,%%S\,0041350C,00000000,00414784,00407405), ref: 004039E5
??3@YAXPAX@Z.MSVCRT(00000000,00414784,00414784,00000000,00414784,00414784,00000000,%%S/,004134FC,00000000,00414784,00000000,%%S\,0041350C,00000000,00414784), ref: 004039ED

Strings

%%S/, xrefs: 0040399F
%%S\, xrefs: 00403961

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@
String ID: %%S/$%%S\
API String ID: 613200358-358529586
Opcode ID: c94d4b60668bfb9eedf3143ce332dc4c41685f87d495a97f985edcc2faf71bca
Instruction ID: c240205f9e12946546b7747d8fd44f392230bc1153c6614d6b8016afa5fd7689
Opcode Fuzzy Hash: c94d4b60668bfb9eedf3143ce332dc4c41685f87d495a97f985edcc2faf71bca
Instruction Fuzzy Hash: 1D11AD3190410EBACF05FFA1D856CEDBB79AE00708F51806AB511760E1EF78A789DB98

Function 004039F6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(00414784,00414784,00000000,%%M\,0041350C,00000000,00414784,00407405,?,00000000,00000000,00000000), ref: 00403A3C
??3@YAXPAX@Z.MSVCRT(00414784,00414784,00000000,%%M/,004134FC,00000000,00414784,00000000,%%M\,0041350C,00000000,00414784,00407405,?,00000000,00000000), ref: 00403A7A
??3@YAXPAX@Z.MSVCRT(00414784,00414784,00000000,00414784,00414784,00000000,%%M/,004134FC,00000000,00414784,00000000,%%M\,0041350C,00000000,00414784,00407405), ref: 00403AA0
??3@YAXPAX@Z.MSVCRT(00000000,00414784,00414784,00000000,00414784,00414784,00000000,%%M/,004134FC,00000000,00414784,00000000,%%M\,0041350C,00000000,00414784), ref: 00403AA8

Strings

%%M/, xrefs: 00403A5A
%%M\, xrefs: 00403A1C

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@
String ID: %%M/$%%M\
API String ID: 613200358-4143866494
Opcode ID: 3eb134fca1680c0093703720a533bafa1d2fd801437f3d80c27f205d784cf8f2
Instruction ID: 5f6947e2f47a7d655e02fb84317d9747a35bc7200d49f7273ebe403b31479b31
Opcode Fuzzy Hash: 3eb134fca1680c0093703720a533bafa1d2fd801437f3d80c27f205d784cf8f2
Instruction Fuzzy Hash: C911AD3190410EBACF05FFA1D956CEDBB79AE00708F51806AB511760E1EF78A789DB58

Function 0040E456 Relevance: 10.5, APIs: 1, Strings: 6, Instructions: 42COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT(00000000,00414CFC), ref: 0040E4EE

Strings

DJA, xrefs: 0040E4A8
TJA, xrefs: 0040E4A1
xJA, xrefs: 0040E493
hJA, xrefs: 0040E49A
4JA, xrefs: 0040E4AF
$JA, xrefs: 0040E4B6

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ExceptionThrow
String ID: $JA$4JA$DJA$TJA$hJA$xJA
API String ID: 432778473-803145960
Opcode ID: 8cab838d89dd1577677f775eaf8cb930bb6d64206a7fe5cceb0cff601651d84b
Instruction ID: 5492ea6659e041f1bcf420c4685f7038b08242b420f8f2c51a6428b2159ddc92
Opcode Fuzzy Hash: 8cab838d89dd1577677f775eaf8cb930bb6d64206a7fe5cceb0cff601651d84b
Instruction Fuzzy Hash: 7211A5F0541B419BC7308F16E544587FBF8AF907587218A1FD0AA9BA51D3F8A1888B9C

Function 0040C0DC Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 243COMMON

Download Yara Rule

APIs

Part of subcall function 0040BA46: ??2@YAPAXI@Z.MSVCRT(0000000C,?,0040C20C,004149B0,00000001,?,?,00000000), ref: 0040BA4B

??3@YAXPAX@Z.MSVCRT(00000000,004149B0,00000001,?,?,00000000), ref: 0040C20D

Part of subcall function 0040ADC3: ??2@YAPAXI@Z.MSVCRT(?,?,?,?,0040B1B6,00010000), ref: 0040ADD6
Part of subcall function 0040ADC3: memmove.MSVCRT(00000000,?,?,?,?,?,0040B1B6,00010000), ref: 0040ADF0
Part of subcall function 0040ADC3: ??3@YAXPAX@Z.MSVCRT(?,?,?,?,0040B1B6,00010000), ref: 0040AE00

??2@YAPAXI@Z.MSVCRT(00000014,00000000,004149B0,00000001,?,?,00000000), ref: 0040C245

Strings

IA, xrefs: 0040C12D
IA, xrefs: 0040C0EC
IA, xrefs: 0040C11B

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??2@$??3@$memmove
String ID: IA$IA$IA
API String ID: 4294387087-924693538
Opcode ID: 85fc5e494f6b2b84d8098d484c2c91b8b6bfa0a3dc3e29a15476b27879269a5e
Instruction ID: 38d37476858cbe2739f158cf8086d9562841ccd83740beefedbf55b6536d6dac
Opcode Fuzzy Hash: 85fc5e494f6b2b84d8098d484c2c91b8b6bfa0a3dc3e29a15476b27879269a5e
Instruction Fuzzy Hash: 20B1C1B1900209DFCB54EFAAC8819DEBBB5BF48304F50852EF919A7291DB38A945CF54

Function 0040E811 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT(00100EC3,00414CFC), ref: 0040E83C
??2@YAPAXI@Z.MSVCRT(?,IA,IA,00000000,?,0040E909,00000000,00408769,IA,00402F92,00000000,00000000,004044E9,?,?,?), ref: 0040E864
memcpy.MSVCRT(00000000,?,?,IA,IA,00000000,?,0040E909,00000000,00408769,IA,00402F92,00000000,00000000,004044E9,?), ref: 0040E88D
??3@YAXPAX@Z.MSVCRT(?,IA,IA,00000000,?,0040E909,00000000,00408769,IA,00402F92,00000000,00000000,004044E9,?,?,?), ref: 0040E898

Strings

IA, xrefs: 0040E818, 0040E841

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??2@??3@ExceptionThrowmemcpy
String ID: IA
API String ID: 3462485524-3293647318
Opcode ID: 87c970ed3d1d6bacfe04aab15aff8add49b6e5554cbd4f9de67434676486f6a2
Instruction ID: e9362666a157510f6fc1816af10740f0f0ab3f4ff6eb75305f8b2a096945a613
Opcode Fuzzy Hash: 87c970ed3d1d6bacfe04aab15aff8add49b6e5554cbd4f9de67434676486f6a2
Instruction Fuzzy Hash: 6811E5736003009BCB28AF57D880D6BFBE9AB84354714C83FEA59A7290D779E8954794

Function 00401000 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00401029
wsprintfW.USER32 ref: 00401049
lstrcatW.KERNEL32(?,?), ref: 0040105C
ExitProcess.KERNEL32 ref: 00401084

Strings

0x%p, xrefs: 00401043

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: wsprintf$ExitProcesslstrcat
String ID: 0x%p
API String ID: 2530384128-1745605757
Opcode ID: beb3389330693802dd4b40a551927b7f0c9c9e0999a7fc1e7fc7f64098bb755c
Instruction ID: 6c9eba3c29ae2a0cc7ccd16f79f39b6d6218d418ab2b897ff95ca6c62132cda7
Opcode Fuzzy Hash: beb3389330693802dd4b40a551927b7f0c9c9e0999a7fc1e7fc7f64098bb755c
Instruction Fuzzy Hash: CF019E7580020CAFDB20AFA0DC45FDA777CBF44305F04486AF945A2081D738F6948FAA

Function 00407A3A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 004071B8: GetSystemMetrics.USER32(0000000B), ref: 004071E0
Part of subcall function 004071B8: GetSystemMetrics.USER32(0000000C), ref: 004071E9

GetSystemMetrics.USER32(00000007), ref: 00407A51
GetSystemMetrics.USER32(00000007), ref: 00407A62
??3@YAXPAX@Z.MSVCRT(?,000004B8,?,?), ref: 00407B29

Strings

100%% , xrefs: 00407A81, 00407A88, 00407AE1

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: MetricsSystem$??3@
String ID: 100%%
API String ID: 2562992111-568723177
Opcode ID: 8625fd62ee8a1587f51b59dec5492359d41c9a7e7955315cbfbb4a3169dab2fe
Instruction ID: d2e8aa6d75c6757367bbc63d1236441fd7733528c0e5853e38aed7656a5d7d9b
Opcode Fuzzy Hash: 8625fd62ee8a1587f51b59dec5492359d41c9a7e7955315cbfbb4a3169dab2fe
Instruction Fuzzy Hash: 0D31D771A047059FCB24DFA9C9419AEB7F4EF40308B00012EE542A26E1DB78FE44CF99

Function 00407998 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00407A12

Part of subcall function 0040725A: GetDlgItem.USER32(?,?), ref: 00407264
Part of subcall function 0040725A: GetWindowTextLengthW.USER32(00000000), ref: 0040726B

GetDlgItem.USER32(?,000004B3), ref: 004079C6

Part of subcall function 00402D7D: GetWindowTextLengthW.USER32(?), ref: 00402D8E
Part of subcall function 00402D7D: GetWindowTextW.USER32(00402E07,00000000,00000001), ref: 00402DAB

??3@YAXPAX@Z.MSVCRT(?,00000000), ref: 004079E4

Strings

(%u%s), xrefs: 00407A0C

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: TextWindow$ItemLength$??3@wsprintf
String ID: (%u%s)
API String ID: 3595513934-2496177969
Opcode ID: 81108d5736a162b6d9564d3eb7a2e93f5e39dd0108d0485d36b03b99dec63073
Instruction ID: 1b031bef2a273fddd3247fbc9e57f9590cc69a100d620b238320e5a3a24b3f72
Opcode Fuzzy Hash: 81108d5736a162b6d9564d3eb7a2e93f5e39dd0108d0485d36b03b99dec63073
Instruction Fuzzy Hash: 1401C8B15042147FDB107B65DC46EAF777CAF44708F10807FF516A21E2DB7CA9448A68

Function 004021ED Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,GetNativeSystemInfo,0000003C,?,?,?,?,?,?,00406130,?,00000000,?,?,?), ref: 0040220A
GetProcAddress.KERNEL32(00000000), ref: 00402211

Strings

GetNativeSystemInfo, xrefs: 00402200
kernel32, xrefs: 00402205

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32
API String ID: 2574300362-3846845290
Opcode ID: dcc7844bde5d914e3d472255d944d602bbefc6ee0fc65a521985863f2fff9548
Instruction ID: b757a3d5c4c17e34abb063926c294d8abaed4bc4edbc3347b9308a3de004b423
Opcode Fuzzy Hash: dcc7844bde5d914e3d472255d944d602bbefc6ee0fc65a521985863f2fff9548
Instruction Fuzzy Hash: 88F0B432E1521495CF20BBF48B0D6EF66E89A19349B1004BBD852F31D0E5FCCE8141EE

Function 00402185 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,Wow64RevertWow64FsRedirection,004061B1,?,?,?), ref: 00402198
GetProcAddress.KERNEL32(00000000), ref: 0040219F

Strings

kernel32, xrefs: 00402193
Wow64RevertWow64FsRedirection, xrefs: 0040218E

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32
API String ID: 2574300362-3900151262
Opcode ID: e5c6d40c89fc1f3fb34c79c32c3445fbc861d0d884c7149ba98d4f5b826d618a
Instruction ID: b94e249185ae4a70534d65e1a66e6cdcdba3a47a1e4784fabdbc91f5644b18b3
Opcode Fuzzy Hash: e5c6d40c89fc1f3fb34c79c32c3445fbc861d0d884c7149ba98d4f5b826d618a
Instruction Fuzzy Hash: AFD0C934294201DBDB125FA0EE0E7EA3AB9FB04B0BF458035A920A00F0CBBC9644CA5C

Function 004021B9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32,Wow64DisableWow64FsRedirection,0040223A), ref: 004021CA
GetProcAddress.KERNEL32(00000000), ref: 004021D1

Strings

Wow64DisableWow64FsRedirection, xrefs: 004021C0
kernel32, xrefs: 004021C5

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32
API String ID: 2574300362-736604160
Opcode ID: 5a0f418ac3e49e57b967c4010738a21a45af66be6bd625357fa5c872d0fae828
Instruction ID: 817513c890d082da38b6284c2862a66e2f32a8da2897575df7e5c1eb8648f331
Opcode Fuzzy Hash: 5a0f418ac3e49e57b967c4010738a21a45af66be6bd625357fa5c872d0fae828
Instruction Fuzzy Hash: 0DD012342443009BDB515FA09E0D7DA3EB4B705B07F508076A520E11D1CBFCA244C7AC

Function 00402A69 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000020,?,?,?,?,?,?,?,?,0040507C,?,00000000), ref: 00402B6F

Part of subcall function 0040272E: MultiByteToWideChar.KERNEL32(00000020,00000000,00000024,?,00000000,?,?,00000020,00000024,00000000,00402ACD,?,?,00000000,00000000,00000000), ref: 00402760

??3@YAXPAX@Z.MSVCRT(?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,0040507C,?,00000000), ref: 00402ADC
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,0040507C,?), ref: 00402AF7
??3@YAXPAX@Z.MSVCRT(?,?,?,00000000,00000000,00000000,00000020,?,?,?,?,?,?,?,?,0040507C), ref: 00402AFF

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@$ByteCharMultiWide
String ID:
API String ID: 1731127917-0
Opcode ID: ae4930b9035af11edc18eb83865398ea889af843cb2bb96c85f7d9ecca2ecb95
Instruction ID: 3903ebf3ba6088976d83fc344d3b185d6a20d7f45533e28e7dbc13297377a7b4
Opcode Fuzzy Hash: ae4930b9035af11edc18eb83865398ea889af843cb2bb96c85f7d9ecca2ecb95
Instruction Fuzzy Hash: 2831B3729041156ACB14FFA6DD81DEFB3BCEF00714B51403FF952B31E1EA38AA458658

Function 00403F85 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000001,00000000,00000002,00000000,00406437,00000000,?,?,00404B63,?,7ZSfx%03x.cmd), ref: 00403FA8
GetTempPathW.KERNEL32(00000001,00000000,00000001,?,?,00404B63,?,7ZSfx%03x.cmd), ref: 00403FC5
wsprintfW.USER32 ref: 00403FFB
GetFileAttributesW.KERNEL32(?), ref: 00404016

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: PathTemp$AttributesFilewsprintf
String ID:
API String ID: 1746483863-0
Opcode ID: 013dbc26b67ec8e4cb6dbc59edbfaa415160c5e99e9f4e95bea1135156e91aed
Instruction ID: 4b01c17e8612d334da970e7aef70975a1f373095b445c13461924cc76c43a46f
Opcode Fuzzy Hash: 013dbc26b67ec8e4cb6dbc59edbfaa415160c5e99e9f4e95bea1135156e91aed
Instruction Fuzzy Hash: 1B113672100204BFCB01AF59CC85AADB7F8FF88755F50802EF905972E1DB78AA008B88

Function 00401A85 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

CharUpperW.USER32(?,7556E0B0,00000000,00000000,?,?,?,00403DBD,00000002), ref: 00401AC3
CharUpperW.USER32(?,?,?,?,00403DBD,00000002), ref: 00401ACF
CharUpperW.USER32(?,?,?,?,00403DBD,00000002), ref: 00401B03
CharUpperW.USER32(?,?,?,?,00403DBD,00000002), ref: 00401B13

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: CharUpper
String ID:
API String ID: 9403516-0
Opcode ID: 18230d7c19ca01b706053a4839b324d461c93759ef2237e6a4782e95e1545131
Instruction ID: 0ba0c8867aa888139ba8faa8f8ff432121b60ad667f2455bf366b55ac651d143
Opcode Fuzzy Hash: 18230d7c19ca01b706053a4839b324d461c93759ef2237e6a4782e95e1545131
Instruction Fuzzy Hash: 02112E34A11269ABCF108F99C8446BAB7E8FF44356B504467F881E3290D77CDE51EB64

Function 00407FA5 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 0040690F: GetDlgItem.USER32(?,?), ref: 0040691B

Part of subcall function 0040692C: GetDlgItem.USER32(?,?), ref: 00406939
Part of subcall function 0040692C: ShowWindow.USER32(00000000,?), ref: 00406950

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00407FED
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000103), ref: 0040800D
GetDlgItem.USER32(?,000004B7), ref: 00408020
SetWindowLongW.USER32(00000000,000000FC,Function_00006F37), ref: 0040802E

Part of subcall function 00407D06: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,0040803E), ref: 00407D30
Part of subcall function 00407D06: LoadIconW.USER32(00000000), ref: 00407D33
Part of subcall function 00407D06: GetSystemMetrics.USER32(00000032), ref: 00407D43
Part of subcall function 00407D06: GetSystemMetrics.USER32(00000031), ref: 00407D48
Part of subcall function 00407D06: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,0040803E), ref: 00407D51
Part of subcall function 00407D06: LoadImageW.USER32(00000000), ref: 00407D54
Part of subcall function 00407D06: SendMessageW.USER32(?,00000080,00000001,?), ref: 00407D79
Part of subcall function 00407D06: SendMessageW.USER32(?,00000080,00000000,?), ref: 00407D89
Part of subcall function 00407D06: GetWindow.USER32(?,00000005), ref: 00407E76
Part of subcall function 00407D06: GetWindow.USER32(?,00000005), ref: 00407E92

Part of subcall function 004072DD: GetDlgItem.USER32(?,000004B6), ref: 004072EA
Part of subcall function 004072DD: SetFocus.USER32(00000000,?,?,004073B2,000004B6,?), ref: 004072F1

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ItemWindow$System$HandleLoadMessageMetricsModuleSend$DirectoryFileFocusIconImageInfoLongShow
String ID:
API String ID: 2538916108-0
Opcode ID: a74d79fd4605bc1a7757bdbc28ebf3a23631424810f8539fda01f9cd24d05c25
Instruction ID: 9218ed989044434557cb474aaa53437228351995edfdd36a91d94446a14b3a18
Opcode Fuzzy Hash: a74d79fd4605bc1a7757bdbc28ebf3a23631424810f8539fda01f9cd24d05c25
Instruction Fuzzy Hash: 7D1186B1A402146BCB10BBB99D09F9EB7FDEB84B04F00446EB652E31C0D6B8DA008B54

Function 004067ED Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 00406814
GetSystemMetrics.USER32(00000031), ref: 0040683A
CreateFontIndirectW.GDI32(?), ref: 00406849
DeleteObject.GDI32(00000000), ref: 00406878

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: System$CreateDeleteFontIndirectInfoMetricsObjectParameters
String ID:
API String ID: 1900162674-0
Opcode ID: 5f8418ac61918c0235adc1083e46979a63813a21cc36a9cb80778b220a455722
Instruction ID: e152b01862f646c7a4819b14062263d5307cf72e2961abd6127bac75ebed32e6
Opcode Fuzzy Hash: 5f8418ac61918c0235adc1083e46979a63813a21cc36a9cb80778b220a455722
Instruction Fuzzy Hash: A9116376A00205AFDB10DF94DC88FEAB7B8EB08300F0180AAED06A7291DB74DE54CF54

Function 0040748A Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040749F
SHBrowseForFolderW.SHELL32(?), ref: 004074B8
SHGetPathFromIDListW.SHELL32(00000000,00000000), ref: 004074D4
SHGetMalloc.SHELL32(00000000), ref: 004074FE

Part of subcall function 004072DD: GetDlgItem.USER32(?,000004B6), ref: 004072EA
Part of subcall function 004072DD: SetFocus.USER32(00000000,?,?,004073B2,000004B6,?), ref: 004072F1

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: BrowseFocusFolderFromItemListMallocPathmemset
String ID:
API String ID: 1557639607-0
Opcode ID: a8285b8de4733da597857d8c27af206edc1c0a360700d70dd9a7d2ed45ada19f
Instruction ID: 30b51fec80d89fd3ac1614d0428bedaa433d1aa4d1a510c8e8bcd0531de43efe
Opcode Fuzzy Hash: a8285b8de4733da597857d8c27af206edc1c0a360700d70dd9a7d2ed45ada19f
Instruction Fuzzy Hash: 43112171A00114ABDB10EBA5DD48BDE77FCAB84715F1040A9E505E7280DB78EF05CB75

Function 004027C7 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,00000000), ref: 004027F8
??3@YAXPAX@Z.MSVCRT(00000000,?,00000000,00000000,00000000), ref: 00402801

Part of subcall function 0040112B: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,?,00000000,00401425,00000003,?,0040502D,?,?,00000000), ref: 0040114B
Part of subcall function 0040112B: ??3@YAXPAX@Z.MSVCRT(?,00000000,?,00000000,00401425,00000003,?,0040502D,?,?,00000000), ref: 00401171

ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000001,00000001,00000000,?,00000000,00000000,00000000), ref: 00402819
??3@YAXPAX@Z.MSVCRT(00000000,00000000,?,00000000,00000000,00000000), ref: 00402839

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@$EnvironmentExpandStrings$??2@
String ID:
API String ID: 612612615-0
Opcode ID: 1bf054f2ccdc3be335b048ff77a64ac4bdb67295ffe3aca3d2c9ccbf2cc91127
Instruction ID: 71972da321696c7643696fa2d61077c4bfdb6251f9c85b9dd911fab2e4c9aeed
Opcode Fuzzy Hash: 1bf054f2ccdc3be335b048ff77a64ac4bdb67295ffe3aca3d2c9ccbf2cc91127
Instruction Fuzzy Hash: EF017976D00118BADB04AB55DD41DDEB7BCEF48714B10417BF901B31D1EB746A4086A8

Function 00403AB1 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00402D7D: GetWindowTextLengthW.USER32(?), ref: 00402D8E
Part of subcall function 00402D7D: GetWindowTextW.USER32(00402E07,00000000,00000001), ref: 00402DAB

??3@YAXPAX@Z.MSVCRT(?,?,?,00413550,00413558), ref: 00403AFD
??3@YAXPAX@Z.MSVCRT(?,?,?,?,00413550,00413558), ref: 00403B05
SetWindowTextW.USER32(?,?), ref: 00403B12
??3@YAXPAX@Z.MSVCRT(?), ref: 00403B1D

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ??3@TextWindow$Length
String ID:
API String ID: 2308334395-0
Opcode ID: 8119ca7b33955cbac21e87e4fe12ba773d40effc5d925a3b7e480b00d6a2293b
Instruction ID: 2cc122b1f520d7f8021a056a959bf32eecafdcf33a956e59961b1277582e5a57
Opcode Fuzzy Hash: 8119ca7b33955cbac21e87e4fe12ba773d40effc5d925a3b7e480b00d6a2293b
Instruction Fuzzy Hash: 2EF0FF32D0410DBACF01FBA5DD46CDE7B79EF04705B10406BF501720A1EA79AB559B98

Function 0040702A Relevance: 6.0, APIs: 4, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetObjectW.GDI32(?,0000005C,?), ref: 00407045
CreateFontIndirectW.GDI32(?), ref: 0040705B
GetDlgItem.USER32(?,000004B5), ref: 0040706F
SendMessageW.USER32(00000000,00000030,00000000,00000000), ref: 0040707B

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: CreateFontIndirectItemMessageObjectSend
String ID:
API String ID: 2001801573-0
Opcode ID: 78def116b4819d627590729c5baad135a5410a8d7e74f17ad4cec64f2c4de15c
Instruction ID: 5c236ef126686a3da9008926c30106754acf3bfa0ff8e01310dffb34f405da6a
Opcode Fuzzy Hash: 78def116b4819d627590729c5baad135a5410a8d7e74f17ad4cec64f2c4de15c
Instruction Fuzzy Hash: 35F05475900704ABDB209BA4DC09F8B7BFCAB48B01F048139BD51E11D4D7B4E5018B19

Function 00401BA3 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00401BA8
GetWindowRect.USER32(?,?), ref: 00401BC1
ScreenToClient.USER32(00000000,?), ref: 00401BCF
ScreenToClient.USER32(00000000,?), ref: 00401BD6

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: ClientScreen$ParentRectWindow
String ID:
API String ID: 2099118873-0
Opcode ID: ede60c7992125a9d10b8f8c06fbaeb3be6251aeef84f0c1b655461571a46cee2
Instruction ID: 3a6f634f9500a9f0e676680e31990ed58166cb62974d534a535afb1fb6b8d00a
Opcode Fuzzy Hash: ede60c7992125a9d10b8f8c06fbaeb3be6251aeef84f0c1b655461571a46cee2
Instruction Fuzzy Hash: 09E04F722052116BCB10AFA5AC88C8BBF6DDFC5723700447AF941A2220D7709D109A61

Function 00403C63 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

_wtol.MSVCRT ref: 00403C89

Strings

[G@, xrefs: 00403C64, 00403C88
GUIFlags, xrefs: 00403C68

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: _wtol
String ID: GUIFlags$[G@
API String ID: 2131799477-2126219683
Opcode ID: f402b0c85aba1d66b07b6addbe7eda3b1a8910d5e18cf18c534464033b9959d4
Instruction ID: b6302b9691b8fcfec91ee3c39af82f4337802e9cb3a6f407b943601295de961a
Opcode Fuzzy Hash: f402b0c85aba1d66b07b6addbe7eda3b1a8910d5e18cf18c534464033b9959d4
Instruction Fuzzy Hash: 6DF03C3611C1635AFB342E0994187B6AA9CEB05793FE4443BE9C3F12D0C37C8E82825D

Function 00402F10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?O@,?,00000001,004177A0,00000000,00417794,?,?,00404F3F,?,?,?,?,?), ref: 00402F26
GetEnvironmentVariableW.KERNEL32(?,00000000,?,00000001,00000002,?,?,00404F3F,?,?,?,?,?), ref: 00402F52

Strings

?O@, xrefs: 00402F23

Memory Dump Source

Source File: 00000000.00000002.1423313928.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1423297142.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423332235.0000000000413000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423349052.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.000000000041A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1423363570.0000000000432000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_orderconfirmation.jbxd

Similarity

API ID: EnvironmentVariable
String ID: ?O@
API String ID: 1431749950-3511380453
Opcode ID: 0f0cab1a5fe64df75075e876fd7e6a607817ca224d69030a73e0dc08c334b9f4
Instruction ID: 315e17eccb05daff3adc91fa9074d23558c2207180d60d9b2b56ce26dbf77fcb
Opcode Fuzzy Hash: 0f0cab1a5fe64df75075e876fd7e6a607817ca224d69030a73e0dc08c334b9f4
Instruction Fuzzy Hash: 24F06272200118BFDB00AFA9DC458AEB7EDEF88764B51402BF904D72A1D7B4AD008B98

Analysis Process: Virtual.exePID: 7508, Parent PID: 7392COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	158
Total number of Limit Nodes:	4

Executed Functions

Function 6169119C Relevance: 9.1, APIs: 6, Instructions: 98
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 616D8E68: HeapCreate.KERNEL32 ref: 616D8E7E
Part of subcall function 616D8E68: GetVersion.KERNEL32 ref: 616D8E90
Part of subcall function 616D8E68: HeapSetInformation.KERNEL32 ref: 616D8EAE

Part of subcall function 616D9A28: GetStartupInfoW.KERNEL32 ref: 616D9A49

GetCommandLineA.KERNEL32 ref: 616911EE
GetCommandLineW.KERNEL32 ref: 616911FB

Part of subcall function 61691F7C: FlsFree.KERNEL32(?,?,?,?,6169128B), ref: 61691F8B

Part of subcall function 616D9D00: free.LIBCMT ref: 616D9D51

FlsGetValue.KERNEL32 ref: 6169129D

Part of subcall function 616D8B14: Sleep.KERNEL32(?,?,?,61692097,?,?,?,61695695,?,?,?,?,616D8D9D), ref: 616D8B59

FlsSetValue.KERNEL32 ref: 616912CA
GetCurrentThreadId.KERNEL32 ref: 616912DE
free.LIBCMT ref: 616912ED

Part of subcall function 616D8D78: HeapFree.KERNEL32(?,?,?,616CF018,?,?,?,616CF07E,?,?,?,616CF215,?,?,?,6167115E), ref: 616D8D8E
Part of subcall function 616D8D78: _errno.LIBCMT ref: 616D8D98
Part of subcall function 616D8D78: GetLastError.KERNEL32(?,?,?,616CF018,?,?,?,616CF07E,?,?,?,616CF215,?,?,?,6167115E), ref: 616D8DA0

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Heap$CommandFreeLineValuefree$CreateCurrentErrorInfoInformationLastSleepStartupThreadVersion_errno
String ID:
API String ID: 2868508392-0
Opcode ID: 286131c703e2a81bb84be6b34ff79efe3a6d0054460a2326ce385d347615927f
Instruction ID: da4ad58355e082557e4d1a52a40056b9b3aaa3bc9e4c786f55000aabbe723523
Opcode Fuzzy Hash: 286131c703e2a81bb84be6b34ff79efe3a6d0054460a2326ce385d347615927f
Instruction Fuzzy Hash: C831E87C70974387EB05ABF5A90439D22BF6F9573EF38CE29C85181650EF39C1928219

Function 616D8E68 Relevance: 4.5, APIs: 3, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNEL32 ref: 616D8E7E
GetVersion.KERNEL32 ref: 616D8E90
HeapSetInformation.KERNEL32 ref: 616D8EAE

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Heap$CreateInformationVersion
String ID:
API String ID: 3563531100-0
Opcode ID: affa5e307324a24ab18884bb6118ed00515dec0b06829699a5c2c099920076a1
Instruction ID: 4f9fd3c64c5435ae5f95a5808a4eee77acadf97bc76f1b7e149d509b0e75707a
Opcode Fuzzy Hash: affa5e307324a24ab18884bb6118ed00515dec0b06829699a5c2c099920076a1
Instruction Fuzzy Hash: 2AE0D87461979082F7845710E8197A923B2FB8C745FC85514F90A03774DF3EC1568B00

Function 616D9988 Relevance: 3.0, APIs: 2, Instructions: 46
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 616D99AB
HeapAlloc.KERNEL32(?,?,00000000,616D8B47,?,?,?,61692097,?,?,?,61695695), ref: 616D99DF

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: AllocHeap_errno
String ID:
API String ID: 1925743348-0
Opcode ID: e0bb99957d503fba66b5e86b2982b7bbc5be58b9ff5d380f07ffa9720e9843bc
Instruction ID: 68dbe444dc35eb5219d6072e8de90053896b871a2fe44d93e7c77697a781f733
Opcode Fuzzy Hash: e0bb99957d503fba66b5e86b2982b7bbc5be58b9ff5d380f07ffa9720e9843bc
Instruction Fuzzy Hash: 3501887A70624186FF064B65D6A436877F29B957ECF0CC6208E295B798EB7CC4418315

Function 61691A54 Relevance: 2.6, APIs: 2, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.LIBCMT ref: 61691B15

Part of subcall function 616E0450: GetCurrentProcess.KERNEL32(?,?,?,?,616E04F6), ref: 616E0468

free.LIBCMT ref: 61691B5A

Part of subcall function 616D8D78: HeapFree.KERNEL32(?,?,?,616CF018,?,?,?,616CF07E,?,?,?,616CF215,?,?,?,6167115E), ref: 616D8D8E
Part of subcall function 616D8D78: _errno.LIBCMT ref: 616D8D98
Part of subcall function 616D8D78: GetLastError.KERNEL32(?,?,?,616CF018,?,?,?,616CF07E,?,?,?,616CF215,?,?,?,6167115E), ref: 616D8DA0

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: free$CurrentErrorFreeHeapLastProcess_errno
String ID:
API String ID: 3424231777-0
Opcode ID: 9dc717e8ed77f7b975c46d830584198fcbee5e6b31bcb93b89623506827a8d69
Instruction ID: 68adde970463f473f1db390d7d0a5cf7a43320beb12b851e14d9eff66f437346
Opcode Fuzzy Hash: 9dc717e8ed77f7b975c46d830584198fcbee5e6b31bcb93b89623506827a8d69
Instruction Fuzzy Hash: C321E13AA0978246FB018B65E94039927F6AB95BD8F6CC525CE4947759EF3CC2528300

Function 616D8B14 Relevance: 1.3, APIs: 1, Instructions: 36
sleepCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 616D9988: _errno.LIBCMT ref: 616D99AB

Sleep.KERNEL32(?,?,?,61692097,?,?,?,61695695,?,?,?,?,616D8D9D), ref: 616D8B59

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Sleep_errno
String ID:
API String ID: 1068366078-0
Opcode ID: 75ffa96e50ffecf2e1d13281b102f41e0e313c05a22d1f05df01868687b5b582
Instruction ID: 10e8b9a7995bded5b9962d5acdc448ed6df0d460e3a2c5be1a9b20227ac1cfe0
Opcode Fuzzy Hash: 75ffa96e50ffecf2e1d13281b102f41e0e313c05a22d1f05df01868687b5b582
Instruction Fuzzy Hash: B201D136A20B8086E7088F17A85025DB7B6F3C8FE0F4C5225EE5903B64CB39D8A2C704

Non-executed Functions

Function 6168D73C Relevance: 121.1, APIs: 51, Strings: 18, Instructions: 383
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 6168D75B
GetProcAddress.KERNEL32 ref: 6168D76B
GetModuleHandleW.KERNEL32 ref: 6168D9A9
GetProcAddress.KERNEL32 ref: 6168D9B9
GetLastError.KERNEL32 ref: 6168D9C7
GetModuleHandleW.KERNEL32 ref: 6168DA09
GetProcAddress.KERNEL32 ref: 6168DA19
GetLastError.KERNEL32 ref: 6168DA27
GetModuleHandleW.KERNEL32 ref: 6168DA6F
GetProcAddress.KERNEL32 ref: 6168DA7F
GetLastError.KERNEL32 ref: 6168DA8D
GetModuleHandleW.KERNEL32 ref: 6168DAD1
GetProcAddress.KERNEL32 ref: 6168DAE1
GetLastError.KERNEL32 ref: 6168DAEF
GetModuleHandleW.KERNEL32 ref: 6168DB33
GetProcAddress.KERNEL32 ref: 6168DB43
GetLastError.KERNEL32 ref: 6168DB51
GetModuleHandleW.KERNEL32 ref: 6168DB93
GetProcAddress.KERNEL32 ref: 6168DBA3
GetLastError.KERNEL32 ref: 6168DBB1
GetModuleHandleW.KERNEL32 ref: 6168DBF3
GetProcAddress.KERNEL32 ref: 6168DC03
GetLastError.KERNEL32 ref: 6168DC11
GetModuleHandleW.KERNEL32 ref: 6168DC53
GetProcAddress.KERNEL32 ref: 6168DC63
GetLastError.KERNEL32 ref: 6168DC71
GetModuleHandleW.KERNEL32 ref: 6168DCB3
GetProcAddress.KERNEL32 ref: 6168DCC3
GetLastError.KERNEL32 ref: 6168DCD1
GetModuleHandleW.KERNEL32 ref: 6168DD19
GetProcAddress.KERNEL32 ref: 6168DD29
GetLastError.KERNEL32 ref: 6168DD37
GetModuleHandleW.KERNEL32 ref: 6168DD7F
GetProcAddress.KERNEL32 ref: 6168DD8F
GetLastError.KERNEL32 ref: 6168DD9A
GetLastError.KERNEL32 ref: 6168D779

Part of subcall function 616740A8: std::exception::exception.LIBCMT ref: 616740C8

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

GetModuleHandleW.KERNEL32 ref: 6168D7BD
GetProcAddress.KERNEL32 ref: 6168D7CD
GetLastError.KERNEL32 ref: 6168D7DB
GetModuleHandleW.KERNEL32 ref: 6168D81D
GetProcAddress.KERNEL32 ref: 6168D82D
GetLastError.KERNEL32 ref: 6168D83B
GetModuleHandleW.KERNEL32 ref: 6168D87D
GetProcAddress.KERNEL32 ref: 6168D88D
GetLastError.KERNEL32 ref: 6168D89B
GetModuleHandleW.KERNEL32 ref: 6168D8E3
GetProcAddress.KERNEL32 ref: 6168D8F3
GetLastError.KERNEL32 ref: 6168D901
GetModuleHandleW.KERNEL32 ref: 6168D943
GetProcAddress.KERNEL32 ref: 6168D953
GetLastError.KERNEL32 ref: 6168D961

Strings

DeleteUmsThreadContext, xrefs: 6168DB39
GetNextUmsListItem, xrefs: 6168DA0F
QueryUmsThreadInformation, xrefs: 6168DA75
DeleteProcThreadAttributeList, xrefs: 6168DD85
UpdateProcThreadAttribute, xrefs: 6168DD1F
UmsThreadYield, xrefs: 6168D8E9
EnterUmsSchedulingMode, xrefs: 6168DBF9
DeleteUmsCompletionList, xrefs: 6168D949
SetUmsThreadInformation, xrefs: 6168DAD7
CreateRemoteThreadEx, xrefs: 6168DC59
CreateUmsThreadContext, xrefs: 6168DB99
DequeueUmsCompletionListItems, xrefs: 6168D7C3
InitializeProcThreadAttributeList, xrefs: 6168DCB9
ExecuteUmsThread, xrefs: 6168D883
CreateUmsCompletionList, xrefs: 6168D761
GetUmsCompletionListEvent, xrefs: 6168D823
GetCurrentUmsThread, xrefs: 6168D9AF
kernel32.dll, xrefs: 6168D751

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc$ExceptionRaisestd::exception::exception
String ID: CreateRemoteThreadEx$CreateUmsCompletionList$CreateUmsThreadContext$DeleteProcThreadAttributeList$DeleteUmsCompletionList$DeleteUmsThreadContext$DequeueUmsCompletionListItems$EnterUmsSchedulingMode$ExecuteUmsThread$GetCurrentUmsThread$GetNextUmsListItem$GetUmsCompletionListEvent$InitializeProcThreadAttributeList$QueryUmsThreadInformation$SetUmsThreadInformation$UmsThreadYield$UpdateProcThreadAttribute$kernel32.dll
API String ID: 2860015169-2643937717
Opcode ID: 46cf6aadf270b6651ceccda4f181abe9d153c02ea712ae288e36a15f131f00e6
Instruction ID: 10a9ec2724e6b029cb28fb64df34bb889876806ddd4c757f1a5e6b40d4c97acd
Opcode Fuzzy Hash: 46cf6aadf270b6651ceccda4f181abe9d153c02ea712ae288e36a15f131f00e6
Instruction Fuzzy Hash: 8102FA7871AB4691EF04DB65E8583D423B3FB88789F488426D98D43728EF7EC52AC350

Function 616983E8 Relevance: 51.0, APIs: 28, Strings: 1, Instructions: 282
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 61698429
_errno.LIBCMT ref: 61698431
_invalid_parameter_noinfo.LIBCMT ref: 6169843C
_errno.LIBCMT ref: 6169845F
__doserrno.LIBCMT ref: 6169846B
_getdrive.LIBCMT ref: 61698499
FindFirstFileExW.KERNEL32 ref: 616984B8
_errno.LIBCMT ref: 616984E9
_errno.LIBCMT ref: 616984F1
_errno.LIBCMT ref: 61698516
_errno.LIBCMT ref: 61698520
_errno.LIBCMT ref: 6169852E
IsRootUNCName.LIBCMT ref: 61698566
GetDriveTypeW.KERNEL32 ref: 61698572
free.LIBCMT ref: 6169858B
free.LIBCMT ref: 616985DF
_errno.LIBCMT ref: 616985E4
__doserrno.LIBCMT ref: 616985F0
_wsopen_s.LIBCMT ref: 61698629
FileTimeToLocalFileTime.KERNEL32 ref: 61698670
FileTimeToSystemTime.KERNEL32 ref: 61698688
FileTimeToLocalFileTime.KERNEL32 ref: 616986EB
FileTimeToSystemTime.KERNEL32 ref: 61698703
FileTimeToLocalFileTime.KERNEL32 ref: 61698766
FileTimeToSystemTime.KERNEL32 ref: 6169877E
FindClose.KERNEL32 ref: 616987C6
GetLastError.KERNEL32 ref: 61698813
FindClose.KERNEL32 ref: 61698823

Strings

./\, xrefs: 616984CE

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Time$File$_errno$FindLocalSystem__doserrno$Closefree$DriveErrorFirstLastNameRootType_getdrive_invalid_parameter_noinfo_wsopen_s
String ID: ./\
API String ID: 987274459-3176372042
Opcode ID: c2a67ce0f316f84ba7ebf1be624c9bafb489022e4d71618d55550962718f52a5
Instruction ID: 69efed7a094f01e5a9d88b5944c40525c6249f08d64cc20d9a9a55e94d37988e
Opcode Fuzzy Hash: c2a67ce0f316f84ba7ebf1be624c9bafb489022e4d71618d55550962718f52a5
Instruction Fuzzy Hash: 9EB1F57A208756C7EB108F61E40036EB7B6F785B89F008919EB995BA68DB3DC464DB04

Function 61697B1C Relevance: 51.0, APIs: 28, Strings: 1, Instructions: 282
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 61697B5D
_errno.LIBCMT ref: 61697B65
_invalid_parameter_noinfo.LIBCMT ref: 61697B70
_errno.LIBCMT ref: 61697B93
__doserrno.LIBCMT ref: 61697B9F
_getdrive.LIBCMT ref: 61697BCD
FindFirstFileExW.KERNEL32 ref: 61697BEC
_errno.LIBCMT ref: 61697C1D
_errno.LIBCMT ref: 61697C25
_errno.LIBCMT ref: 61697C4A
_errno.LIBCMT ref: 61697C54
_errno.LIBCMT ref: 61697C62
IsRootUNCName.LIBCMT ref: 61697C96
GetDriveTypeW.KERNEL32 ref: 61697CA2
free.LIBCMT ref: 61697CBB
free.LIBCMT ref: 61697D0C
_errno.LIBCMT ref: 61697D11
__doserrno.LIBCMT ref: 61697D1D
_wsopen_s.LIBCMT ref: 61697D56
FileTimeToLocalFileTime.KERNEL32 ref: 61697D9D
FileTimeToSystemTime.KERNEL32 ref: 61697DB5
FileTimeToLocalFileTime.KERNEL32 ref: 61697E16
FileTimeToSystemTime.KERNEL32 ref: 61697E2E
FileTimeToLocalFileTime.KERNEL32 ref: 61697E8F
FileTimeToSystemTime.KERNEL32 ref: 61697EA7
FindClose.KERNEL32 ref: 61697EEE
GetLastError.KERNEL32 ref: 61697F3B
FindClose.KERNEL32 ref: 61697F4B

Strings

./\, xrefs: 61697C02

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Time$File$_errno$FindLocalSystem__doserrno$Closefree$DriveErrorFirstLastNameRootType_getdrive_invalid_parameter_noinfo_wsopen_s
String ID: ./\
API String ID: 987274459-3176372042
Opcode ID: 4ed6bc5d018895b4d2599e8e90c9b7c41f85b22c5a9bfca2dd51120197fbc2e2
Instruction ID: 0ea5e41d92eed70130055745189bdfbd1d10114b16f72a55c24cb6067faf613a
Opcode Fuzzy Hash: 4ed6bc5d018895b4d2599e8e90c9b7c41f85b22c5a9bfca2dd51120197fbc2e2
Instruction Fuzzy Hash: C0B1F4BB208292CBEB149F65E44036EB7B2F789B89F50C815EB8557A58DB3DC464CF04

Function 616968D8 Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 328
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 61696919
_errno.LIBCMT ref: 61696921
_invalid_parameter_noinfo.LIBCMT ref: 6169692C
_errno.LIBCMT ref: 6169694F
__doserrno.LIBCMT ref: 6169695B
_getdrive.LIBCMT ref: 61696989
FindFirstFileExA.KERNEL32 ref: 616969A8
_errno.LIBCMT ref: 616969D6
_errno.LIBCMT ref: 616969DE
_errno.LIBCMT ref: 61696A03
_errno.LIBCMT ref: 61696A0D
_errno.LIBCMT ref: 61696A1B
GetDriveTypeA.KERNEL32 ref: 61696AF7
free.LIBCMT ref: 61696B0E
free.LIBCMT ref: 61696B60
_errno.LIBCMT ref: 61696B65
__doserrno.LIBCMT ref: 61696B71
_wsopen_s.LIBCMT ref: 61696BAA
FileTimeToLocalFileTime.KERNEL32 ref: 61696BF1
FileTimeToSystemTime.KERNEL32 ref: 61696C09
FileTimeToLocalFileTime.KERNEL32 ref: 61696C6C
FileTimeToSystemTime.KERNEL32 ref: 61696C84
FileTimeToLocalFileTime.KERNEL32 ref: 61696CE7
FileTimeToSystemTime.KERNEL32 ref: 61696CFF
FindClose.KERNEL32 ref: 61696D47
GetLastError.KERNEL32 ref: 61696D94
FindClose.KERNEL32 ref: 61696DA4

Strings

./\, xrefs: 616969BE

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Time$File$_errno$FindLocalSystem__doserrno$Closefree$DriveErrorFirstLastType_getdrive_invalid_parameter_noinfo_wsopen_s
String ID: ./\
API String ID: 385398445-3176372042
Opcode ID: 238e48e78ce1a78233326563401afe204e933919ce5a1da0fb6a76b474956846
Instruction ID: 2ffa668004997ce9d1f3d8e7761561ba38f746c07cc53e787d76ee825054a4ba
Opcode Fuzzy Hash: 238e48e78ce1a78233326563401afe204e933919ce5a1da0fb6a76b474956846
Instruction Fuzzy Hash: D3D1F47A2083D387EB118F65E05036E7BB2F785B99F50C815EB9907A58EB3DC464CB84

Function 61695EE8 Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 328
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 61695F29
_errno.LIBCMT ref: 61695F31
_invalid_parameter_noinfo.LIBCMT ref: 61695F3C
_errno.LIBCMT ref: 61695F5F
__doserrno.LIBCMT ref: 61695F6B
_getdrive.LIBCMT ref: 61695F99
FindFirstFileExA.KERNEL32 ref: 61695FB8
_errno.LIBCMT ref: 61695FE6
_errno.LIBCMT ref: 61695FEE
_errno.LIBCMT ref: 61696013
_errno.LIBCMT ref: 6169601D
_errno.LIBCMT ref: 6169602B
GetDriveTypeA.KERNEL32 ref: 61696107
free.LIBCMT ref: 6169611E
free.LIBCMT ref: 6169616D
_errno.LIBCMT ref: 61696172
__doserrno.LIBCMT ref: 6169617E
_wsopen_s.LIBCMT ref: 616961B7
FileTimeToLocalFileTime.KERNEL32 ref: 616961FE
FileTimeToSystemTime.KERNEL32 ref: 61696216
FileTimeToLocalFileTime.KERNEL32 ref: 61696277
FileTimeToSystemTime.KERNEL32 ref: 6169628F
FileTimeToLocalFileTime.KERNEL32 ref: 616962F0
FileTimeToSystemTime.KERNEL32 ref: 61696308
FindClose.KERNEL32 ref: 6169634F
GetLastError.KERNEL32 ref: 6169639C
FindClose.KERNEL32 ref: 616963AC

Strings

./\, xrefs: 61695FCE

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Time$File$_errno$FindLocalSystem__doserrno$Closefree$DriveErrorFirstLastType_getdrive_invalid_parameter_noinfo_wsopen_s
String ID: ./\
API String ID: 385398445-3176372042
Opcode ID: 8a770091fe9a0274a64966ec29cb2611e19c800a92412743cd4ffa8298027521
Instruction ID: d213fbbb0a00e6e472ec1bc62a2761cf17cf0e0f3d02acc91426c27fb48ab7c1
Opcode Fuzzy Hash: 8a770091fe9a0274a64966ec29cb2611e19c800a92412743cd4ffa8298027521
Instruction Fuzzy Hash: 4CD106BA2083C28BEB118F65E44036EBB72F785B9AF40C816EB9547A54DB3DC464CF44

Function 616A0288 Relevance: 47.7, APIs: 22, Strings: 5, Instructions: 423
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.LIBCMT ref: 616A02C6
_invalid_parameter_noinfo.LIBCMT ref: 616A02D1
_lock.LIBCMT ref: 616A03B0

Part of subcall function 61691740: _amsg_exit.LIBCMT ref: 6169176A

GetCurrentProcess.KERNEL32 ref: 616A03BE
idtab.LIBCMT ref: 616A044E
fclose.LIBCMT ref: 616A0892

Part of subcall function 616E2208: _lock.LIBCMT ref: 616E222F
Part of subcall function 616E2208: _errno.LIBCMT ref: 616E2243
Part of subcall function 616E2208: _invalid_parameter_noinfo.LIBCMT ref: 616E224F

_errno.LIBCMT ref: 616A0597
CreateProcessA.KERNEL32 ref: 616A05EE
free.LIBCMT ref: 616A0618
free.LIBCMT ref: 616A0620
free.LIBCMT ref: 616A062A
free.LIBCMT ref: 616A0675
CreateProcessA.KERNEL32 ref: 616A07AD
free.LIBCMT ref: 616A07E1
free.LIBCMT ref: 616A07E9
_errno.LIBCMT ref: 616A062F

Part of subcall function 616E0450: GetCurrentProcess.KERNEL32(?,?,?,?,616E04F6), ref: 616E0468

Part of subcall function 616E2208: calloc.LIBCMT ref: 616E2291
Part of subcall function 616E2208: _errno.LIBCMT ref: 616E229E
Part of subcall function 616E2208: _errno.LIBCMT ref: 616E22A9

free.LIBCMT ref: 616A07F8
free.LIBCMT ref: 616A0802
CloseHandle.KERNEL32 ref: 616A080F
CloseHandle.KERNEL32 ref: 616A081D
_errno.LIBCMT ref: 616A0823
DuplicateHandle.KERNEL32 ref: 616A0408

Part of subcall function 616D9E40: __doserrno.LIBCMT ref: 616D9E59
Part of subcall function 616D9E40: _errno.LIBCMT ref: 616D9E61

Part of subcall function 6169E17C: _errno.LIBCMT ref: 6169E19A
Part of subcall function 6169E17C: _invalid_parameter_noinfo.LIBCMT ref: 6169E2FB

Strings

cmd.exe, xrefs: 616A049E
/c , xrefs: 616A0524, 616A0562
COMSPEC, xrefs: 616A045F
PATH, xrefs: 616A063B
w, xrefs: 616A035D

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$free$Process$Handle_invalid_parameter_noinfo$CloseCreateCurrent_lock$Duplicate__doserrno_amsg_exitcallocfcloseidtab
String ID: /c $COMSPEC$PATH$cmd.exe$w
API String ID: 595185807-3679458415
Opcode ID: 145b4451e873cfc61d542236271193c73697ae59714cd6e22cced236a780ba66
Instruction ID: 0b941ae5bd72de1d682dbbb06d55f28b1c7e3f6716ce6ce7aee0f6ee7267401b
Opcode Fuzzy Hash: 145b4451e873cfc61d542236271193c73697ae59714cd6e22cced236a780ba66
Instruction Fuzzy Hash: AAF1F57A70978186EB21CB66E4507AFB7A2FBC9788F44C125CA8987B54DF3DC804CB44

Function 6169885C Relevance: 47.5, APIs: 26, Strings: 1, Instructions: 272
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 6169889A
_errno.LIBCMT ref: 616988A2
_invalid_parameter_noinfo.LIBCMT ref: 616988AD
_errno.LIBCMT ref: 616988CD
__doserrno.LIBCMT ref: 616988D9

Strings

./\, xrefs: 61698942

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfo
String ID: ./\
API String ID: 2315031519-3176372042
Opcode ID: f223685c304bcabc77b8170635077f15e53bae76e8107d04297cd58fe73b6dd4
Instruction ID: 7c031bdb9ffea74053e541cdb01fdebd41bf68ce32db3b13bc1cb05a879b727e
Opcode Fuzzy Hash: f223685c304bcabc77b8170635077f15e53bae76e8107d04297cd58fe73b6dd4
Instruction Fuzzy Hash: 63B1F3B6208392C7EB109F65E44036EB7B6F789B99F10CA15EB9547AA8DB3CC450DB04

Function 61697F84 Relevance: 47.5, APIs: 26, Strings: 1, Instructions: 272
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__doserrno.LIBCMT ref: 61697FC2
_errno.LIBCMT ref: 61697FCA
_invalid_parameter_noinfo.LIBCMT ref: 61697FD5
_errno.LIBCMT ref: 61697FF5
__doserrno.LIBCMT ref: 61698001

Strings

./\, xrefs: 6169806A

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfo
String ID: ./\
API String ID: 2315031519-3176372042
Opcode ID: 743906bb9bcf132b9ea84f08e2b78afe0004f0fd61d41d256096b4d707897fcb
Instruction ID: 0a35201ffb2301d248711b8405a8424452a8676f8bef57daafc30b861329a17f
Opcode Fuzzy Hash: 743906bb9bcf132b9ea84f08e2b78afe0004f0fd61d41d256096b4d707897fcb
Instruction Fuzzy Hash: 36B1E4B6208752C7EB108F65E40036EB7B6F789B99F10CA15EB9947AA8DF3DC450DB04

Function 616A4D40 Relevance: 46.0, APIs: 21, Strings: 5, Instructions: 456processCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A4D95
_invalid_parameter_noinfo.LIBCMT ref: 616A4DA0
_lock.LIBCMT ref: 616A4E98

Part of subcall function 61691740: _amsg_exit.LIBCMT ref: 6169176A

GetCurrentProcess.KERNEL32 ref: 616A4EA8
_errno.LIBCMT ref: 616A5119
CreateProcessW.KERNEL32 ref: 616A5170
free.LIBCMT ref: 616A519A
free.LIBCMT ref: 616A51A2
free.LIBCMT ref: 616A51AC
_errno.LIBCMT ref: 616A51B1
free.LIBCMT ref: 616A51F6
CreateProcessW.KERNEL32 ref: 616A52F1
free.LIBCMT ref: 616A5327
free.LIBCMT ref: 616A532F
free.LIBCMT ref: 616A533E
free.LIBCMT ref: 616A5348
CloseHandle.KERNEL32 ref: 616A5355
CloseHandle.KERNEL32 ref: 616A5363
_errno.LIBCMT ref: 616A5369

Part of subcall function 616D8B14: Sleep.KERNEL32(?,?,?,61692097,?,?,?,61695695,?,?,?,?,616D8D9D), ref: 616D8B59

fclose.LIBCMT ref: 616A53D0

Part of subcall function 616E2704: _errno.LIBCMT ref: 616E273C

DuplicateHandle.KERNEL32 ref: 616A4EEF

Part of subcall function 616D9E40: __doserrno.LIBCMT ref: 616D9E59
Part of subcall function 616D9E40: _errno.LIBCMT ref: 616D9E61

Part of subcall function 616A4608: _errno.LIBCMT ref: 616A4630
Part of subcall function 616A4608: _invalid_parameter_noinfo.LIBCMT ref: 616A479F

Strings

COMSPEC, xrefs: 616A4FDB
w, xrefs: 616A4E47
/c , xrefs: 616A50A3, 616A50E3
PATH, xrefs: 616A51BD
cmd.exe, xrefs: 616A5019

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: free$_errno$HandleProcess$CloseCreate_invalid_parameter_noinfo$CurrentDuplicateSleep__doserrno_amsg_exit_lockfclose
String ID: /c $COMSPEC$PATH$cmd.exe$w
API String ID: 3203412883-3679458415
Opcode ID: 73380c5e63fb7bf9372410176e776cd0a2a03eaf5e8387aa726ee087168a04da
Instruction ID: ff01af6114e561d6ce7e8a8502917e08fd401e2a71cf62fcfbd7c6101c9016db
Opcode Fuzzy Hash: 73380c5e63fb7bf9372410176e776cd0a2a03eaf5e8387aa726ee087168a04da
Instruction Fuzzy Hash: 1202B27A70978286EB24CB66E85035EB2A6F7C8788F54C125DE8987B54EF78C811CB04

Function 616963E4 Relevance: 45.8, APIs: 25, Strings: 1, Instructions: 319COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 61696422
_errno.LIBCMT ref: 6169642A
_invalid_parameter_noinfo.LIBCMT ref: 61696435
_errno.LIBCMT ref: 61696455
__doserrno.LIBCMT ref: 61696461

Strings

./\, xrefs: 616964C4

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfo
String ID: ./\
API String ID: 2315031519-3176372042
Opcode ID: db0dbbf0f6f5f4a7ba4dae3b858f54ddce39b4a23b9ae05217e4022cff81bcf7
Instruction ID: 4ef8762fb9191ace44b97c3f5592d3f6e7f6b7f32072e521ff2c6648c9e4ed1e
Opcode Fuzzy Hash: db0dbbf0f6f5f4a7ba4dae3b858f54ddce39b4a23b9ae05217e4022cff81bcf7
Instruction Fuzzy Hash: 47C14BBA2083D287EB14CF64E45036E7BB2F785B99F10C915DB9947A68DB3DC054CB81

Function 61696DDC Relevance: 45.8, APIs: 25, Strings: 1, Instructions: 319COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 61696E1A
_errno.LIBCMT ref: 61696E22
_invalid_parameter_noinfo.LIBCMT ref: 61696E2D
_errno.LIBCMT ref: 61696E4D
__doserrno.LIBCMT ref: 61696E59

Strings

./\, xrefs: 61696EBC

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfo
String ID: ./\
API String ID: 2315031519-3176372042
Opcode ID: aa48421c76b9713bf82f833ea231f8bc8733d180aee774b4df3cd5df66da88aa
Instruction ID: aacbc4a3f508578a689ebb03bf6a8c3ae474be44be210d123824ade2f2981ab6
Opcode Fuzzy Hash: aa48421c76b9713bf82f833ea231f8bc8733d180aee774b4df3cd5df66da88aa
Instruction Fuzzy Hash: 9AC126BA20C38287EB10CF64E45036EBBB2F785B99F54C916EBA547A58DB39C454CF00

Function 616DCBA0 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 465COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 616DCBF6
_errno.LIBCMT ref: 616DCBFD
_invalid_parameter_noinfo.LIBCMT ref: 616DCC08

Strings

U, xrefs: 616DD184

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID: U
API String ID: 3902385426-4171548499
Opcode ID: 7b440f42bdd183043f9995350f9096241e2969befe1d3af45bff954453e2dd4b
Instruction ID: 02ad8c024b7ebeae656f459c3b9ea442381439e84c72e2545e457e31794fa50d
Opcode Fuzzy Hash: 7b440f42bdd183043f9995350f9096241e2969befe1d3af45bff954453e2dd4b
Instruction Fuzzy Hash: CB02487BB18A8586EB109F69E44039EBB72F7C9798F54811AEF8A47B54DB3DC045CB00

Function 616944A8 Relevance: 42.3, APIs: 28, Instructions: 349fileCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616944D6
_invalid_parameter_noinfo.LIBCMT ref: 616944E1
FindFirstFileExA.KERNEL32 ref: 61694527
GetLastError.KERNEL32 ref: 61694536
_errno.LIBCMT ref: 61694550
_errno.LIBCMT ref: 6169455D
_errno.LIBCMT ref: 6169456D

Part of subcall function 61694414: FileTimeToLocalFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,61694271), ref: 61694437
Part of subcall function 61694414: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,61694271), ref: 6169444B

Part of subcall function 616A6420: _errno.LIBCMT ref: 616A6438
Part of subcall function 616A6420: _invalid_parameter_noinfo.LIBCMT ref: 616A6444

_errno.LIBCMT ref: 61694620
_invalid_parameter_noinfo.LIBCMT ref: 6169462B
FindNextFileA.KERNEL32 ref: 61694660
GetLastError.KERNEL32 ref: 6169466A
_errno.LIBCMT ref: 61694684
_errno.LIBCMT ref: 61694691
_errno.LIBCMT ref: 6169469E
_errno.LIBCMT ref: 6169474E
_invalid_parameter_noinfo.LIBCMT ref: 61694759
FindFirstFileExA.KERNEL32 ref: 6169479F
GetLastError.KERNEL32 ref: 616947AE
_errno.LIBCMT ref: 616947C8
_errno.LIBCMT ref: 616947D5
_errno.LIBCMT ref: 616947E5
_errno.LIBCMT ref: 616948A0
_invalid_parameter_noinfo.LIBCMT ref: 616948AB
FindNextFileA.KERNEL32 ref: 616948E0
GetLastError.KERNEL32 ref: 616948EA
_errno.LIBCMT ref: 61694904
_errno.LIBCMT ref: 61694911
_errno.LIBCMT ref: 6169491E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$File$_invalid_parameter_noinfo$ErrorFindLastTime$FirstNext$LocalSystem
String ID:
API String ID: 2928870310-0
Opcode ID: 37a969794efc7c1a42ce5c1b145084a3179a640609717341694d48bb8804a540
Instruction ID: 9d7ed946989bddba2a6922488a76f51c2b1ee6b4221a986167a1c6adf8295b81
Opcode Fuzzy Hash: 37a969794efc7c1a42ce5c1b145084a3179a640609717341694d48bb8804a540
Instruction Fuzzy Hash: 5BC1C37A21965287EB10CFB4E54039E77B2FBC9B68F50CA12D67987A84DF78C410CB85

Function 61693F10 Relevance: 42.3, APIs: 28, Instructions: 348fileCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 61693F3E
_invalid_parameter_noinfo.LIBCMT ref: 61693F49
FindFirstFileExA.KERNEL32 ref: 61693F8F
GetLastError.KERNEL32 ref: 61693F9E
_errno.LIBCMT ref: 61693FB8
_errno.LIBCMT ref: 61693FC5
_errno.LIBCMT ref: 61693FD5

Part of subcall function 61693E7C: FileTimeToLocalFileTime.KERNEL32 ref: 61693E9F
Part of subcall function 61693E7C: FileTimeToSystemTime.KERNEL32 ref: 61693EB3

Part of subcall function 616A6420: _errno.LIBCMT ref: 616A6438
Part of subcall function 616A6420: _invalid_parameter_noinfo.LIBCMT ref: 616A6444

_errno.LIBCMT ref: 61694084
_invalid_parameter_noinfo.LIBCMT ref: 6169408F
FindNextFileA.KERNEL32 ref: 616940C4
GetLastError.KERNEL32 ref: 616940CE
_errno.LIBCMT ref: 616940E8
_errno.LIBCMT ref: 616940F5
_errno.LIBCMT ref: 61694102
_errno.LIBCMT ref: 616941B2
_invalid_parameter_noinfo.LIBCMT ref: 616941BD
FindFirstFileExA.KERNEL32 ref: 61694203
GetLastError.KERNEL32 ref: 61694212
_errno.LIBCMT ref: 6169422C
_errno.LIBCMT ref: 61694239
_errno.LIBCMT ref: 61694249
_errno.LIBCMT ref: 61694308
_invalid_parameter_noinfo.LIBCMT ref: 61694313
FindNextFileA.KERNEL32 ref: 61694348
GetLastError.KERNEL32 ref: 61694352
_errno.LIBCMT ref: 6169436C
_errno.LIBCMT ref: 61694379
_errno.LIBCMT ref: 61694386

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$File$_invalid_parameter_noinfo$ErrorFindLastTime$FirstNext$LocalSystem
String ID:
API String ID: 2928870310-0
Opcode ID: d665c275110693589b43fcc2cd8103e02ed0879459ba5b721aaa5676dc816206
Instruction ID: fef5da7b09ce4844ce7405b82b8aaeb66e1116c033003ee5a98f39c8add150a9
Opcode Fuzzy Hash: d665c275110693589b43fcc2cd8103e02ed0879459ba5b721aaa5676dc816206
Instruction Fuzzy Hash: 20C1917A60964287EB10CFB4E54039E77B2FBC9768F50CA12D7B987684DB78C411CB45

Function 6169A1F0 Relevance: 40.6, APIs: 20, Strings: 3, Instructions: 398COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169A224
_errno.LIBCMT ref: 6169A3BC
_errno.LIBCMT ref: 6169A408
wcomexecmd.LIBCMT ref: 6169A425
free.LIBCMT ref: 6169A430
_invalid_parameter_noinfo.LIBCMT ref: 6169A22F

Part of subcall function 616E0450: GetCurrentProcess.KERNEL32(?,?,?,?,616E04F6), ref: 616E0468

wcomexecmd.LIBCMT ref: 6169A367
free.LIBCMT ref: 6169A441
_errno.LIBCMT ref: 6169A4BC
_invalid_parameter_noinfo.LIBCMT ref: 6169A4C7

Strings

d$pa, xrefs: 6169A3CA, 6169A498
PATH, xrefs: 6169A53C
t$pa, xrefs: 6169A3F6

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfofreewcomexecmd$CurrentProcess
String ID: PATH$d$pa$t$pa
API String ID: 2725273913-709495004
Opcode ID: f92ef5f502ffe32a8f2700a101121536dda78c153b0ec05619c617af1c90080e
Instruction ID: 69d31df8a77fb708e4eeaa2b2885ab748ca74f08cd6b51418e9ff9463ded3787
Opcode Fuzzy Hash: f92ef5f502ffe32a8f2700a101121536dda78c153b0ec05619c617af1c90080e
Instruction Fuzzy Hash: 47C1297DB0A25347FF059AB6991477E26E39BC5BD8F44CA258E694BBA4EF3CC0018704

Function 6169BE1C Relevance: 37.1, APIs: 20, Strings: 1, Instructions: 385COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169BE50
_errno.LIBCMT ref: 6169BFEA
_errno.LIBCMT ref: 6169C03B
wcomexecmd.LIBCMT ref: 6169C058
free.LIBCMT ref: 6169C063
_invalid_parameter_noinfo.LIBCMT ref: 6169BE5B

Part of subcall function 616E0450: GetCurrentProcess.KERNEL32(?,?,?,?,616E04F6), ref: 616E0468

wcomexecmd.LIBCMT ref: 6169BF95
free.LIBCMT ref: 6169C074
_errno.LIBCMT ref: 6169C0F3
_invalid_parameter_noinfo.LIBCMT ref: 6169C0FE

Strings

PATH, xrefs: 6169C176

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfofreewcomexecmd$CurrentProcess
String ID: PATH
API String ID: 2725273913-1036084923
Opcode ID: 730f1b126710e398cdc27b5e314b2c7409d09740729dd09a69b5c93811260024
Instruction ID: 32423f982893a35432d626b677e0f1d8129240d5e01af0dc1bd0b96c919c5157
Opcode Fuzzy Hash: 730f1b126710e398cdc27b5e314b2c7409d09740729dd09a69b5c93811260024
Instruction Fuzzy Hash: 6EC1466D70524787FF05DBBAA510B5E36A2BBC6BD8F44CA258F2A47B94DF38C4418708

Function 616799E0 Relevance: 33.6, APIs: 16, Strings: 3, Instructions: 316libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 61679A1B
GetVersionExW.KERNEL32 ref: 61679A52
GetModuleHandleW.KERNEL32 ref: 61679AC2
GetProcAddress.KERNEL32 ref: 61679AD2
GetLastError.KERNEL32 ref: 61679AE4
GetLogicalProcessorInformation.KERNEL32 ref: 61679C26
GetLastError.KERNEL32 ref: 61679C2C
GetLastError.KERNEL32 ref: 61679C37
malloc.LIBCMT ref: 61679C6D
GetLogicalProcessorInformation.KERNEL32 ref: 61679CC4
GetLastError.KERNEL32 ref: 61679D7E
GetLastError.KERNEL32 ref: 61679D89
malloc.LIBCMT ref: 61679DBF
GetLastError.KERNEL32 ref: 61679E21
free.LIBCMT ref: 61679EEC
GetLastError.KERNEL32 ref: 61679CCE

Part of subcall function 6167412C: std::exception::exception.LIBCMT ref: 61674146

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

Strings

GetLogicalProcessorInformationEx, xrefs: 61679AC8
bad allocation, xrefs: 61679C7E, 61679DD0
kernel32.dll, xrefs: 61679ABB

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ErrorLast$InformationLogicalProcessormalloc$AddressExceptionHandleInfoModuleProcRaiseSystemVersionfreestd::exception::exception
String ID: GetLogicalProcessorInformationEx$bad allocation$kernel32.dll
API String ID: 3584649644-1014828841
Opcode ID: 5cab55cd51010c93ea344c35203ab6a99a222f95d4f4bc947934bf2882deadb5
Instruction ID: 7f1e55920b6d0c7edf369d30468bb6fe61e67f89e1c31ce17eeec1ccdcc30cad
Opcode Fuzzy Hash: 5cab55cd51010c93ea344c35203ab6a99a222f95d4f4bc947934bf2882deadb5
Instruction Fuzzy Hash: 47D1B27960978186FB20CF65E88439937F2F78539CF889526C54943A28EF3EC766CB40

Function 61699AAC Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 225COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 61699ADD
_invalid_parameter_noinfo.LIBCMT ref: 61699AE8
_errno.LIBCMT ref: 61699B09
_errno.LIBCMT ref: 61699B1F

Strings

d$pa, xrefs: 616999E8, 61699ABE
PATH, xrefs: 61699B66
t$pa, xrefs: 61699A15

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: PATH$d$pa$t$pa
API String ID: 2819658684-709495004
Opcode ID: 8d6dc1c33d5741fbf9c3a47c479538aa3cc67cb4f8d0ea464a2ed6b0f881e712
Instruction ID: 5f1263d88144143987c7e499d5681a83cc2d804115d886a48e3f044cd7bb4cd0
Opcode Fuzzy Hash: 8d6dc1c33d5741fbf9c3a47c479538aa3cc67cb4f8d0ea464a2ed6b0f881e712
Instruction Fuzzy Hash: E961292E3096838FFF159BA2995036E2A62A7C57CCF48D925DE6607B45DF3CC046C305

Function 616A24D0 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209COMMON

Download Yara Rule

APIs

Part of subcall function 61691654: _FF_MSGBANNER.LIBCMT ref: 6169167B

calloc.LIBCMT ref: 616A25B5

Strings

TMP, xrefs: 616A250A

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: calloc
String ID: TMP
API String ID: 2635317215-3125297090
Opcode ID: 830953703ca9594d6c40bb7a73d999bed1939d3f8e76bb2463b8172febd14678
Instruction ID: ad91798996662454812188a1aea00a0ad4498a67ca57f184dbc0b0485a0da87d
Opcode Fuzzy Hash: 830953703ca9594d6c40bb7a73d999bed1939d3f8e76bb2463b8172febd14678
Instruction Fuzzy Hash: F561247E70565243FB08CBB3A96476E76A3BBC57C8F48C429DE4687A54DF38C8128708

Function 616A56B8 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

Part of subcall function 61691654: _FF_MSGBANNER.LIBCMT ref: 6169167B

calloc.LIBCMT ref: 616A579F
_lock.LIBCMT ref: 616A584A
_errno.LIBCMT ref: 616A5872

Strings

TMP, xrefs: 616A56F6

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_lockcalloc
String ID: TMP
API String ID: 1428780384-3125297090
Opcode ID: c34061df10f83c13d30b8c55f9c37c73f71c9835ba56e88bcaae5433ded47ba9
Instruction ID: ab08c56570759b86ddb558805c3149e292f77f9afc3fc2ee4640629827ec0fdf
Opcode Fuzzy Hash: c34061df10f83c13d30b8c55f9c37c73f71c9835ba56e88bcaae5433ded47ba9
Instruction Fuzzy Hash: A351283D7057A282FB15CBB6A91076E76A7BBC57C8F54C425CE4687B54DF38C8028708

Function 616DECC8 Relevance: 18.1, APIs: 12, Instructions: 115memoryfileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 616DCA18: _errno.LIBCMT ref: 616DCA3A

_errno.LIBCMT ref: 616DED50

Part of subcall function 616DCA18: SetFilePointer.KERNEL32(00000000,00000001,00000001,616DD395,00000400,00000000,?,6169D8F1,?,?,00000000,616A420F), ref: 616DCA5A
Part of subcall function 616DCA18: GetLastError.KERNEL32(?,?,00000000,616A420F), ref: 616DCA69

GetProcessHeap.KERNEL32(00000000,00000000,00000000,616DA6DC), ref: 616DED22
HeapAlloc.KERNEL32 ref: 616DED37
_errno.LIBCMT ref: 616DED45
__doserrno.LIBCMT ref: 616DEDAA
_errno.LIBCMT ref: 616DEDB4
GetProcessHeap.KERNEL32 ref: 616DEDCD
HeapFree.KERNEL32 ref: 616DEDDB
SetEndOfFile.KERNEL32(00000000,00000000,00000000,616DA6DC), ref: 616DEE06
_errno.LIBCMT ref: 616DEE1D
__doserrno.LIBCMT ref: 616DEE28
GetLastError.KERNEL32 ref: 616DEE30

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$Heap$ErrorFileLastProcess__doserrno$AllocFreePointer
String ID:
API String ID: 3112900366-0
Opcode ID: f4b896f3743d222384a719992f29c9c8b9976d8447e3cd9eea8b0a736b1b094d
Instruction ID: af1563c96483882dcd1773bf522950d9bb15f392b971a9f8ad943c7ee5632ee4
Opcode Fuzzy Hash: f4b896f3743d222384a719992f29c9c8b9976d8447e3cd9eea8b0a736b1b094d
Instruction Fuzzy Hash: 0741F53AB01A5146EB059B7AA80035DB262A789BF9F08C725DE3A0B7E4DF38C0428745

Function 616EDF5C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 201COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 616AC9B8: _getptd.LIBCMT ref: 616AC9CA

_errno.LIBCMT ref: 616EDF9B
_invalid_parameter_noinfo.LIBCMT ref: 616EDFA5
_errno.LIBCMT ref: 616EDFE3
_invalid_parameter_noinfo.LIBCMT ref: 616EDFEF
_errno.LIBCMT ref: 616EE01A

Part of subcall function 616E0450: GetCurrentProcess.KERNEL32(?,?,?,?,616E04F6), ref: 616E0468

_fltout2.LIBCMT ref: 616EE1CD
_errno.LIBCMT ref: 616EE1D7
_invalid_parameter_noinfo.LIBCMT ref: 616EE1DE

Strings

e+000, xrefs: 616EE09F
gfff, xrefs: 616EE121

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$CurrentProcess_fltout2_getptd
String ID: e+000$gfff
API String ID: 720932481-3030954782
Opcode ID: 2b638c1efc3fa4bc2f775c159b1ff5013959ac1db56498c30d6e8177ae428a27
Instruction ID: 181241f56c387ba4acfd77a07a37a9174ca2614d6d52460bc1524cfef7c5fe91
Opcode Fuzzy Hash: 2b638c1efc3fa4bc2f775c159b1ff5013959ac1db56498c30d6e8177ae428a27
Instruction Fuzzy Hash: 2461386A30A7C486D7128F79E8483897B62E785B98F08C226DF5847B95DF39C455C701

Function 616A2BF4 Relevance: 16.7, APIs: 11, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A2C22
_invalid_parameter_noinfo.LIBCMT ref: 616A2C2C
_errno.LIBCMT ref: 616A2C4B

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 6a7ad4fff72fdbc128b1a22129f6cfe3820d55c8758731ef5903d2166b464442
Instruction ID: e771ea8a021d7f0520e723e9bf6f884217914c45b54f0b5c0f40c8c5b9946f19
Opcode Fuzzy Hash: 6a7ad4fff72fdbc128b1a22129f6cfe3820d55c8758731ef5903d2166b464442
Instruction Fuzzy Hash: 4A51E47A20878286E721CF76E84039E77B2B784748F04CA19DF458B651DF3DC99ACB84

Function 6169A92C Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 373COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169A9E0
__doserrno.LIBCMT ref: 6169A9EB

Part of subcall function 616E25FC: _lock.LIBCMT ref: 616E2623

free.LIBCMT ref: 6169AABE
free.LIBCMT ref: 6169ABAB
_errno.LIBCMT ref: 6169ABB6
__doserrno.LIBCMT ref: 6169ABC1

Part of subcall function 616E0450: GetCurrentProcess.KERNEL32(?,?,?,?,616E04F6), ref: 616E0468

Part of subcall function 616A69A8: _errno.LIBCMT ref: 616A69C7
Part of subcall function 616A69A8: _invalid_parameter_noinfo.LIBCMT ref: 616A69D3

free.LIBCMT ref: 6169ADEC
free.LIBCMT ref: 6169AE01

Strings

SystemRoot, xrefs: 6169A953

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: free$_errno$__doserrno$CurrentProcess_invalid_parameter_noinfo_lock
String ID: SystemRoot
API String ID: 2288820184-2034820756
Opcode ID: 8cc2785c3e4b5b5cba78410635876b543d7e49e23df1aa415d52236b6e56bdc0
Instruction ID: 16b7c61f41ca9d8509d1b4e344f7714f6629c953d30d799fbd00ef92c1c94680
Opcode Fuzzy Hash: 8cc2785c3e4b5b5cba78410635876b543d7e49e23df1aa415d52236b6e56bdc0
Instruction Fuzzy Hash: 4CD1E27AB05B5286EB00CFA9E5243AD33F6FB88B88B44C925DE4A87764DF38C515C304

Function 61698CF8 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 369COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 61698DA6
__doserrno.LIBCMT ref: 61698DB1

Part of subcall function 616E2208: _lock.LIBCMT ref: 616E222F
Part of subcall function 616E2208: _errno.LIBCMT ref: 616E2243
Part of subcall function 616E2208: _invalid_parameter_noinfo.LIBCMT ref: 616E224F

free.LIBCMT ref: 61698E87
free.LIBCMT ref: 61698F62
_errno.LIBCMT ref: 61698F6D
__doserrno.LIBCMT ref: 61698F78

Part of subcall function 616E0450: GetCurrentProcess.KERNEL32(?,?,?,?,616E04F6), ref: 616E0468

free.LIBCMT ref: 61699195
free.LIBCMT ref: 616991AA

Strings

SystemRoot, xrefs: 61698D1F

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: free$_errno$__doserrno$CurrentProcess_invalid_parameter_noinfo_lock
String ID: SystemRoot
API String ID: 2288820184-2034820756
Opcode ID: cc0b0103e9f58fc6a865a08de47e632b0733dc300a5e5049e7818545a9769bb4
Instruction ID: 757022ec3df6a99bef65ae8ae6aad1fa5794efabcdeb2113ef606671f971575f
Opcode Fuzzy Hash: cc0b0103e9f58fc6a865a08de47e632b0733dc300a5e5049e7818545a9769bb4
Instruction Fuzzy Hash: 0CD1C07AB0AA468AEB01CFB5E51439D37B6BB85BCCB04C9199E4A97B14EF38C5118304

Function 6169B7C4 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169B7F5
_invalid_parameter_noinfo.LIBCMT ref: 6169B800
_errno.LIBCMT ref: 6169B823
_errno.LIBCMT ref: 6169B839
_errno.LIBCMT ref: 6169B985

Strings

PATH, xrefs: 6169B884

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID: PATH
API String ID: 2819658684-1036084923
Opcode ID: 42edd9f285fffdb4010327c39da16a54c49424ddc7419c3a1ad059e1b79425da
Instruction ID: 10d70104278454bb58380820c949b5e0f40c1faa83d803ea2534821c5fec85be
Opcode Fuzzy Hash: 42edd9f285fffdb4010327c39da16a54c49424ddc7419c3a1ad059e1b79425da
Instruction Fuzzy Hash: B651376E71538387FF149BA6A550B6E3276EB85B88F44CD25DF590BB80EB38C441C309

Function 61690DCC Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 159fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_set_error_mode.LIBCMT ref: 61690E11
_set_error_mode.LIBCMT ref: 61690E22
GetModuleFileNameW.KERNEL32 ref: 61690E84

Part of subcall function 616E0450: GetCurrentProcess.KERNEL32(?,?,?,?,616E04F6), ref: 616E0468

GetStdHandle.KERNEL32 ref: 61690F99
WriteFile.KERNEL32 ref: 61690FF6

Strings

..., xrefs: 61690ED6
Microsoft Visual C++ Runtime Library, xrefs: 61690F3D
Runtime Error!Program: , xrefs: 61690E51
<program name unknown>, xrefs: 61690E93

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: File_set_error_mode$CurrentHandleModuleNameProcessWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 2183313154-4022980321
Opcode ID: eb284b609ec96d914c38b3a182ca582a34e1de4fed6938655b5fce1af661dfd9
Instruction ID: 33363f9623f0b74b61c26d779b65d04aac59ade7142604ed25a30031ee6ce6aa
Opcode Fuzzy Hash: eb284b609ec96d914c38b3a182ca582a34e1de4fed6938655b5fce1af661dfd9
Instruction Fuzzy Hash: 4C51153E30879282EB24CB79A52079B736AF7C9B88F84C516DE5983B54CF39C216C604

Function 6169C350 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 616E25FC: _lock.LIBCMT ref: 616E2623

_errno.LIBCMT ref: 6169C3D7
_errno.LIBCMT ref: 6169C3DE
_errno.LIBCMT ref: 6169C3FE

Part of subcall function 616E0450: GetCurrentProcess.KERNEL32(?,?,?,?,616E04F6), ref: 616E0468

_errno.LIBCMT ref: 6169C407
_errno.LIBCMT ref: 6169C411
_errno.LIBCMT ref: 6169C41B
free.LIBCMT ref: 6169C441

Strings

COMSPEC, xrefs: 6169C365
cmd.exe, xrefs: 6169C422

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$CurrentProcess_lockfree
String ID: COMSPEC$cmd.exe
API String ID: 3359361903-2256226045
Opcode ID: 9084a173ee8b136a58f8ad09a28986647506d9740e92ad2a3c41e99cf99fe81b
Instruction ID: da27b8cbed8118e0e0a1b1d7de767b86da6270e0ee073e9f3c32de90b1687689
Opcode Fuzzy Hash: 9084a173ee8b136a58f8ad09a28986647506d9740e92ad2a3c41e99cf99fe81b
Instruction Fuzzy Hash: 6921E97A7057038AFB01DFB5B85129D37B6BBC8788B94C926DB4A87A54CF34C011C798

Function 6169A760 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 616E2208: _lock.LIBCMT ref: 616E222F
Part of subcall function 616E2208: _errno.LIBCMT ref: 616E2243
Part of subcall function 616E2208: _invalid_parameter_noinfo.LIBCMT ref: 616E224F

_errno.LIBCMT ref: 6169A7E7
_errno.LIBCMT ref: 6169A7EE
_errno.LIBCMT ref: 6169A80E

Part of subcall function 616E0450: GetCurrentProcess.KERNEL32(?,?,?,?,616E04F6), ref: 616E0468

_errno.LIBCMT ref: 6169A817
_errno.LIBCMT ref: 6169A821
_errno.LIBCMT ref: 6169A82B
free.LIBCMT ref: 6169A851

Strings

cmd.exe, xrefs: 6169A832
COMSPEC, xrefs: 6169A775

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$CurrentProcess_invalid_parameter_noinfo_lockfree
String ID: COMSPEC$cmd.exe
API String ID: 3119157571-2256226045
Opcode ID: 96eb6583e152b48fef28f41f385da56bbe7141f7998aef1c208bd6580f49d4c0
Instruction ID: 2af69b95448a89737ce01928674766be621ad35ce0b0d58f48dddc630d41ef4f
Opcode Fuzzy Hash: 96eb6583e152b48fef28f41f385da56bbe7141f7998aef1c208bd6580f49d4c0
Instruction Fuzzy Hash: 9B21D57AB007038AFB018FB5A55169D37F6FBC8388B55C926CB098BA24DF34C051C788

Function 616A8E10 Relevance: 15.3, APIs: 10, Instructions: 292timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 616A8E3B

Part of subcall function 61691740: _amsg_exit.LIBCMT ref: 6169176A

_get_daylight.LIBCMT ref: 616A8E51

Part of subcall function 616A8CDC: _errno.LIBCMT ref: 616A8CE5
Part of subcall function 616A8CDC: _invalid_parameter_noinfo.LIBCMT ref: 616A8CF0

_get_daylight.LIBCMT ref: 616A8E66

Part of subcall function 616A8C6C: _errno.LIBCMT ref: 616A8C75
Part of subcall function 616A8C6C: _invalid_parameter_noinfo.LIBCMT ref: 616A8C80

_get_daylight.LIBCMT ref: 616A8E7B

Part of subcall function 616A8CA4: _errno.LIBCMT ref: 616A8CAD
Part of subcall function 616A8CA4: _invalid_parameter_noinfo.LIBCMT ref: 616A8CB8

___lc_codepage_func.LIBCMT ref: 616A8E88

Part of subcall function 616E2CEC: _getptd.LIBCMT ref: 616E2CF0

Part of subcall function 616E1FF0: __wtomb_environ.LIBCMT ref: 616E2017

free.LIBCMT ref: 616A8EF9

Part of subcall function 616D8D78: HeapFree.KERNEL32(?,?,?,616CF018,?,?,?,616CF07E,?,?,?,616CF215,?,?,?,6167115E), ref: 616D8D8E
Part of subcall function 616D8D78: _errno.LIBCMT ref: 616D8D98
Part of subcall function 616D8D78: GetLastError.KERNEL32(?,?,?,616CF018,?,?,?,616CF07E,?,?,?,616CF215,?,?,?,6167115E), ref: 616D8DA0

free.LIBCMT ref: 616A8F62
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,00000000,?,51EB851F,616A9846,?,?,?,?,616A7C5C), ref: 616A8F75
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000000,?,51EB851F,616A9846,?,?,?,?,616A7C5C), ref: 616A902B
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,00000000,?,51EB851F,616A9846,?,?,?,?,616A7C5C), ref: 616A907E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_get_daylight_invalid_parameter_noinfo$ByteCharMultiWidefree$ErrorFreeHeapInformationLastTimeZone___lc_codepage_func__wtomb_environ_amsg_exit_getptd_lock
String ID:
API String ID: 2532449802-0
Opcode ID: 62006d557f9bb8b5254968244ff903a7dcfaca99c70ff3275ae77be5d52cfbf9
Instruction ID: f0013978eeb183112ae628ea34d2e75145745cf1c54b4b0b018232951fa1d323
Opcode Fuzzy Hash: 62006d557f9bb8b5254968244ff903a7dcfaca99c70ff3275ae77be5d52cfbf9
Instruction Fuzzy Hash: F0B1E27A2082C18AE721CF75E85075A7BABF7C5788F54C1299E8953B64DF3ACD12CB04

Function 616AA410 Relevance: 15.3, APIs: 10, Instructions: 259COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616AA432
_invalid_parameter_noinfo.LIBCMT ref: 616AA43E
_errno.LIBCMT ref: 616AA468
__tzset.LIBCMT ref: 616AA485
_get_daylight.LIBCMT ref: 616AA48E
_get_daylight.LIBCMT ref: 616AA49F
_get_daylight.LIBCMT ref: 616AA4B0
_isindst.LIBCMT ref: 616AA4F4
_isindst.LIBCMT ref: 616AA544
__getgmtimebuf.LIBCMT ref: 616AA742

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _get_daylight$_errno_isindst$__getgmtimebuf__tzset_invalid_parameter_noinfo
String ID:
API String ID: 1457502553-0
Opcode ID: 80aa8874562a6d452bf2540e564537ca61a73caa064972329fadf5a8c68407f3
Instruction ID: 873fb4b2c80f5b7504c6b382ffcadbbca375f1bbbc0951d70efdb50382010019
Opcode Fuzzy Hash: 80aa8874562a6d452bf2540e564537ca61a73caa064972329fadf5a8c68407f3
Instruction Fuzzy Hash: 1081F6BB7017468BDB18CF79D95575977A6E794B8CF04D03ADE098BB68EB38C8018B40

Function 616A8194 Relevance: 15.3, APIs: 10, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A81B6
_invalid_parameter_noinfo.LIBCMT ref: 616A81C2
_errno.LIBCMT ref: 616A81EB
__tzset.LIBCMT ref: 616A81F9

Part of subcall function 616A9820: _lock.LIBCMT ref: 616A9832

_get_daylight.LIBCMT ref: 616A8202

Part of subcall function 616A8C6C: _errno.LIBCMT ref: 616A8C75
Part of subcall function 616A8C6C: _invalid_parameter_noinfo.LIBCMT ref: 616A8C80

_get_daylight.LIBCMT ref: 616A8213

Part of subcall function 616A8CA4: _errno.LIBCMT ref: 616A8CAD
Part of subcall function 616A8CA4: _invalid_parameter_noinfo.LIBCMT ref: 616A8CB8

_get_daylight.LIBCMT ref: 616A8224

Part of subcall function 616A8CDC: _errno.LIBCMT ref: 616A8CE5
Part of subcall function 616A8CDC: _invalid_parameter_noinfo.LIBCMT ref: 616A8CF0

_isindst.LIBCMT ref: 616A8267
_isindst.LIBCMT ref: 616A82B5
__getgmtimebuf.LIBCMT ref: 616A8482

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$_get_daylight$_isindst$__getgmtimebuf__tzset_lock
String ID:
API String ID: 2175338424-0
Opcode ID: 3b01e644d60006382a710b4bd011029ad2f1d67d81beaffa3c83fa25a57dabab
Instruction ID: 33dd8a353ee0cbd6db1e654ffab28134aa3db2803f726b761d6b481655fd87f0
Opcode Fuzzy Hash: 3b01e644d60006382a710b4bd011029ad2f1d67d81beaffa3c83fa25a57dabab
Instruction Fuzzy Hash: 8081137BB102968BE758CF79D94075D76AAE79474DF44C129EA028BF69EB38DC00CB40

Function 617864B8 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCR100 ref: 61786506

Part of subcall function 617893EC: ___lc_handle_func.MSVCR100 ref: 617893F5
Part of subcall function 617893EC: ___lc_codepage_func.MSVCR100 ref: 61789400
Part of subcall function 617893EC: _calloc_crt.MSVCR100(?,?,?,617587C7), ref: 61789413
Part of subcall function 617893EC: __pctype_func.MSVCR100 ref: 61789422

??2@YAPEAX_K@Z.MSVCR100 ref: 61786604
??2@YAPEAX_K@Z.MSVCR100 ref: 617866E7
??2@YAPEAX_K@Z.MSVCR100 ref: 617867D1
??2@YAPEAX_K@Z.MSVCR100 ref: 617868C3

Strings

(5va, xrefs: 61786615
(5va, xrefs: 617866F8

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??2@$___lc_codepage_func___lc_handle_func__pctype_func_calloc_crt
String ID: (5va$(5va
API String ID: 740275333-1856697906
Opcode ID: a885edc9ccd41c3f003abdce96e4bc5e03b7c04f670b42a72e0097505817a30a
Instruction ID: 5abba81fc3aaca2befd8153ce85b6f11a17c469ab57fdaa1569ff61c939848e2
Opcode Fuzzy Hash: a885edc9ccd41c3f003abdce96e4bc5e03b7c04f670b42a72e0097505817a30a
Instruction Fuzzy Hash: 36D18071619A4095EB46CFA1EA543D8B7B2FF86BC8F58C135DA0987758EF39C262C340

Function 616EE2B8 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 288COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 616AC9B8: _getptd.LIBCMT ref: 616AC9CA

_errno.LIBCMT ref: 616EE308
_invalid_parameter_noinfo.LIBCMT ref: 616EE312
_errno.LIBCMT ref: 616EE334
_invalid_parameter_noinfo.LIBCMT ref: 616EE340
_errno.LIBCMT ref: 616EE368
_cftoe_l.LIBCMT ref: 616EE3AC

Strings

gfffffff, xrefs: 616EE637

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$_cftoe_l_getptd
String ID: gfffffff
API String ID: 1282097019-1523873471
Opcode ID: 96ad450056c59cccad7274b5b385ef099c025077f2c28498494f514af5d8e531
Instruction ID: 2e3026b747a97da4f1125739f67158fd6cd66f09aca7c5c397b28135ed000793
Opcode Fuzzy Hash: 96ad450056c59cccad7274b5b385ef099c025077f2c28498494f514af5d8e531
Instruction Fuzzy Hash: 13A134A770A7C98BEB02CB6A964838D7BA5E7167A4F04C722CF5907795FB39D025C301

Function 6168C894 Relevance: 12.2, APIs: 8, Instructions: 196COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 6168C91D
GetCurrentProcess.KERNEL32 ref: 6168CB13
GetLastError.KERNEL32 ref: 6168CB7F
GetLastError.KERNEL32 ref: 6168C92C

Part of subcall function 616740A8: std::exception::exception.LIBCMT ref: 616740C8

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

GetLastError.KERNEL32 ref: 6168C987
GetLastError.KERNEL32 ref: 6168C9DF
GetLastError.KERNEL32 ref: 6168CA79
GetLastError.KERNEL32 ref: 6168CAE5

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ErrorLast$CreateCurrentEventExceptionProcessRaisestd::exception::exception
String ID:
API String ID: 2681293297-0
Opcode ID: 4a8e7a682ebcb2a9abc6b53460ac1df965039cd19f1a20112758bc547aae59a6
Instruction ID: c261d9ebf5cdeab77924d6cecd9669bbc9dc70be46082b34515d7665f022d4d3
Opcode Fuzzy Hash: 4a8e7a682ebcb2a9abc6b53460ac1df965039cd19f1a20112758bc547aae59a6
Instruction Fuzzy Hash: 8B819036608B4585EB00DF69F8503DA33B6FB8878CF548116DE8D83628EF7AC56AD744

Function 616E06B0 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 616E49A7
RtlLookupFunctionEntry.KERNEL32 ref: 616E49C6
RtlVirtualUnwind.KERNEL32 ref: 616E4A12
IsDebuggerPresent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,616E03D7), ref: 616E4A84
SetUnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,616E03D7), ref: 616E4A9C
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,616E03D7), ref: 616E4AA9
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,616E03D7), ref: 616E4AC2
TerminateProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,616E03D7), ref: 616E4AD0

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentDebuggerEntryFunctionLookupPresentTerminateUnwindVirtual
String ID:
API String ID: 3778485334-0
Opcode ID: cbe8fdf6df426e514117a0e39cccabfcbc4720925b520ffc9da17805533aee65
Instruction ID: 0a91eb36ded927e215e66148b6a88538921fe222e6dd2f9fda388cd19490f347
Opcode Fuzzy Hash: cbe8fdf6df426e514117a0e39cccabfcbc4720925b520ffc9da17805533aee65
Instruction Fuzzy Hash: 8E311B7910DB4086EB10CB65F85439973B6F788394F684116DA8D87768EF7EC265C704

Function 61779580 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 456COMMON

Download Yara Rule

APIs

memchr.MSVCR100 ref: 61779928
??3@YAXPEAX@Z.MSVCR100 ref: 61779B04
??3@YAXPEAX@Z.MSVCR100 ref: 61779B28

Strings

string too long, xrefs: 61779898
0123456789abcdefABCDEF, xrefs: 61779921
X, xrefs: 6177982D

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??3@$memchr
String ID: 0123456789abcdefABCDEF$X$string too long
API String ID: 963951447-171264291
Opcode ID: b62f8e23588cf882e0f1f910e006a86902b849acb2254958a69f48b6f7c50834
Instruction ID: 2b5b6badf2aa8b84ee275bbd3a3db20f77294527f467f7f9174ee6461c855caa
Opcode Fuzzy Hash: b62f8e23588cf882e0f1f910e006a86902b849acb2254958a69f48b6f7c50834
Instruction Fuzzy Hash: 3E02E3227077C089FF21CEBAC25035CBB72A7A2BA8F18C566CE595B759DB39C446C340

Function 616AB1E0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 61692064: GetLastError.KERNEL32(?,?,?,61695695,?,?,?,?,616D8D9D,?,?,?,616CF018), ref: 6169206E
Part of subcall function 61692064: FlsGetValue.KERNEL32(?,?,?,61695695,?,?,?,?,616D8D9D,?,?,?,616CF018), ref: 6169207C
Part of subcall function 61692064: FlsSetValue.KERNEL32(?,?,?,61695695,?,?,?,?,616D8D9D,?,?,?,616CF018), ref: 616920A8
Part of subcall function 61692064: GetCurrentThreadId.KERNEL32 ref: 616920BC
Part of subcall function 61692064: SetLastError.KERNEL32(?,?,?,61695695,?,?,?,?,616D8D9D,?,?,?,616CF018), ref: 616920D4

Part of subcall function 616D8B14: Sleep.KERNEL32(?,?,?,61692097,?,?,?,61695695,?,?,?,?,616D8D9D), ref: 616D8B59

_errno.LIBCMT ref: 616AB51A
_invalid_parameter_noinfo.LIBCMT ref: 616AB525

Strings

JanFebMarAprMayJunJulAugSepOctNovDec, xrefs: 616AB342
;, xrefs: 616AB293
gfff, xrefs: 616AB38E
;, xrefs: 616AB281

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ErrorLastValue$CurrentSleepThread_errno_invalid_parameter_noinfo
String ID: ;$;$JanFebMarAprMayJunJulAugSepOctNovDec$gfff
API String ID: 1962487656-880385205
Opcode ID: 9dd4241c0e9e31a42ba2e15d7633f3f0060de52184145c4dc8ab1b1b63371a3b
Instruction ID: 9cadfc7c7acf926fd9a98249d9263c02be7ce897f8f6aa365456881d75498cf2
Opcode Fuzzy Hash: 9dd4241c0e9e31a42ba2e15d7633f3f0060de52184145c4dc8ab1b1b63371a3b
Instruction Fuzzy Hash: DF81347B72029A87C709EF38D4516AD37B2FBA4705B48C126D781CB754EB38E911C752

Function 616A84BC Relevance: 9.2, APIs: 6, Instructions: 222COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A84EA
_invalid_parameter_noinfo.LIBCMT ref: 616A84F5
_errno.LIBCMT ref: 616A85AA
__tzset.LIBCMT ref: 616A86C0
_get_daylight.LIBCMT ref: 616A86C9
_get_daylight.LIBCMT ref: 616A86D6

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_get_daylight$__tzset_invalid_parameter_noinfo
String ID:
API String ID: 2616478628-0
Opcode ID: 655ef1f4ea83cfb6a320505c19e1d66a8da784a7a9e1a6e0897fe5c66cd822df
Instruction ID: 54368d6a7d0a01917de06630aed0d2dbe1272b130a8b397d18b60c954302cd3d
Opcode Fuzzy Hash: 655ef1f4ea83cfb6a320505c19e1d66a8da784a7a9e1a6e0897fe5c66cd822df
Instruction Fuzzy Hash: 2C71C27E7112A2CBFB5DCA69C954B9D37B9EB4074EF50D02DDE01C6A28DB25CD019B00

Function 616A9C74 Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

__tzset.LIBCMT ref: 616A9DD7
_get_daylight.LIBCMT ref: 616A9DE0
_get_daylight.LIBCMT ref: 616A9DF1
_get_daylight.LIBCMT ref: 616A9E02
_isindst.LIBCMT ref: 616A9EBE

Part of subcall function 616E0450: GetCurrentProcess.KERNEL32(?,?,?,?,616E04F6), ref: 616E0468

_errno.LIBCMT ref: 616A9F12

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _get_daylight$CurrentProcess__tzset_errno_isindst
String ID:
API String ID: 1870958493-0
Opcode ID: 78597dc28c4bfcc6b616d853051d3b187f8dc8c2dfde18e1f4a000f91dbb8494
Instruction ID: ead34b48856c6f5b3286400694b730853fbd8dfcff2d13a7a5e43f76fc52e260
Opcode Fuzzy Hash: 78597dc28c4bfcc6b616d853051d3b187f8dc8c2dfde18e1f4a000f91dbb8494
Instruction Fuzzy Hash: BD6167B7B055014AE718CBB8D9916AC7BAAB78434CB74C129EF098BE98EB35D941C640

Function 616A7AF4 Relevance: 9.2, APIs: 6, Instructions: 211COMMON

Download Yara Rule

APIs

__tzset.LIBCMT ref: 616A7C57
_get_daylight.LIBCMT ref: 616A7C60
_get_daylight.LIBCMT ref: 616A7C71
_get_daylight.LIBCMT ref: 616A7C82
_isindst.LIBCMT ref: 616A7D2D
_errno.LIBCMT ref: 616A7D7C

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _get_daylight$__tzset_errno_isindst
String ID:
API String ID: 3124964479-0
Opcode ID: 7a773bace9ddb8c24bb18e5ffb11b6da3d5e8d3a1d315ed95f16ac26d9baed3e
Instruction ID: ce1dd4d7ced8fe1c251160fc23bbbd28b5844dda0372e029f4210c6df832adb2
Opcode Fuzzy Hash: 7a773bace9ddb8c24bb18e5ffb11b6da3d5e8d3a1d315ed95f16ac26d9baed3e
Instruction Fuzzy Hash: 8B61387BB145014FE30CDF78DD91AAC7A7AB39434CF64C129DE0687AA8EB3699428640

Function 616AA77C Relevance: 9.2, APIs: 6, Instructions: 194COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616AA7B3
_invalid_parameter_noinfo.LIBCMT ref: 616AA7BE

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: 130320b11ef42d93b8ac045de66516de0c5adf1c9e1da14806623ab4e1cf88f4
Instruction ID: 6f7c8d87a18a34faa8e573b26093fc0b43ab9e17436ec55b3cde021ea3cd93ae
Opcode Fuzzy Hash: 130320b11ef42d93b8ac045de66516de0c5adf1c9e1da14806623ab4e1cf88f4
Instruction Fuzzy Hash: 4261C3BAB11B1586EF18CBA4D4557AC73B6F784789F52C12BDA0D4B768EB38C902C700

Function 616E02A4 Relevance: 9.1, APIs: 6, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 616E0311
RtlLookupFunctionEntry.KERNEL32 ref: 616E0329
RtlVirtualUnwind.KERNEL32 ref: 616E0363
IsDebuggerPresent.KERNEL32 ref: 616E0399
SetUnhandledExceptionFilter.KERNEL32 ref: 616E03A3
UnhandledExceptionFilter.KERNEL32 ref: 616E03AE

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 7f827f5f2175393c44725c978d461e6ae7b58077890ace0ea4cdd88024c54cbe
Instruction ID: 50be69c70624ecaad74de9926594a62169d3d6f0cbcaca193bd9c42690c03a68
Opcode Fuzzy Hash: 7f827f5f2175393c44725c978d461e6ae7b58077890ace0ea4cdd88024c54cbe
Instruction Fuzzy Hash: B331B036209F828ADB20CF65E84439E73B5F789758F644226EA9D87B58DF38C555CB00

Function 616806B0 Relevance: 7.7, APIs: 5, Instructions: 181COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,616754CC), ref: 616806E7
CreateEventW.KERNEL32(?,?,?,?,?,?,?,616754CC), ref: 616807C2
SetEvent.KERNEL32(?,?,?,?,?,?,?,616754CC), ref: 6168090F
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,616754CC), ref: 61680919
CloseHandle.KERNEL32(?,?,?,?,?,?,?,616754CC), ref: 61680944

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CriticalEventSection$CloseCreateEnterHandleLeave
String ID:
API String ID: 4114679765-0
Opcode ID: d2da6be3d9f087af6532904accb09e89f3afc5e77ed5519e90b3592840ae0e87
Instruction ID: cd97ab8447f361842a8c749d690e04314aab8fc68958e67a4dcfbcd4df67128b
Opcode Fuzzy Hash: d2da6be3d9f087af6532904accb09e89f3afc5e77ed5519e90b3592840ae0e87
Instruction Fuzzy Hash: 198128BA202B8492DB59CF26E550399B3B5F388B94F05C526CFAE43760DF38D4A1C350

Function 6168B878 Relevance: 7.7, APIs: 5, Instructions: 175synchronizationCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6168B906
SetEvent.KERNEL32 ref: 6168B93F
GetLastError.KERNEL32 ref: 6168B97A
WaitForSingleObject.KERNEL32 ref: 6168B9FF
SleepEx.KERNEL32 ref: 6168BB18

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ErrorLast$EventObjectSingleSleepWait
String ID:
API String ID: 2604728305-0
Opcode ID: d94ed23b51a83f83d35df8797e179fceb7cdf327c0f5fcf2da3868a5d654ccee
Instruction ID: 480918cd0098c96d9b323a8bb90b9980da232058279b8274d375f85597b014eb
Opcode Fuzzy Hash: d94ed23b51a83f83d35df8797e179fceb7cdf327c0f5fcf2da3868a5d654ccee
Instruction Fuzzy Hash: 0A714736318B8182EB64CB25E85039AB3B2F785B94F44C212DEAD43BA8DF39C552C750

Function 616AAE9C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616AB1BC
_invalid_parameter_noinfo.LIBCMT ref: 616AB1C8

Strings

JanFebMarAprMayJunJulAugSepOctNovDec, xrefs: 616AAFE1
gfff, xrefs: 616AB029

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: JanFebMarAprMayJunJulAugSepOctNovDec$gfff
API String ID: 2959964966-1854364414
Opcode ID: 0132dee6f95171efb05213b32c397d296929693bf348205aaef80d0d60df5990
Instruction ID: 1e7be355d470b8c950d8e49d201c06115bbf7cc06638c5f707bd71c348bc90ad
Opcode Fuzzy Hash: 0132dee6f95171efb05213b32c397d296929693bf348205aaef80d0d60df5990
Instruction Fuzzy Hash: 6D7115BB72025A87C708DF28C451A9937A6F7A9712B41C13ADA40CB795F73AED02C741

Function 616A5B88 Relevance: 6.1, APIs: 4, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A5BB2

Part of subcall function 61691654: _FF_MSGBANNER.LIBCMT ref: 6169167B

_errno.LIBCMT ref: 616A5BD4
_lock.LIBCMT ref: 616A5BE5
_errno.LIBCMT ref: 616A5D1E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_lock
String ID:
API String ID: 8016435-0
Opcode ID: 4e288c3b32784aeb7903c735041174c601bd4e0ad07342c35ca7b16b70900d3a
Instruction ID: c71d8c16046528de634c369936789607eb6bc574b00e09854297ff27bce82cdb
Opcode Fuzzy Hash: 4e288c3b32784aeb7903c735041174c601bd4e0ad07342c35ca7b16b70900d3a
Instruction Fuzzy Hash: 6641CC7E30835283E705DBA6A41471E76A2BBC1B84F14C51ADE464BB18EF38CC13C748

Function 616EA7C4 Relevance: 107.7, APIs: 86, Instructions: 180
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.LIBCMT ref: 616EA7D9

Part of subcall function 616D8D78: HeapFree.KERNEL32(?,?,?,616CF018,?,?,?,616CF07E,?,?,?,616CF215,?,?,?,6167115E), ref: 616D8D8E
Part of subcall function 616D8D78: _errno.LIBCMT ref: 616D8D98
Part of subcall function 616D8D78: GetLastError.KERNEL32(?,?,?,616CF018,?,?,?,616CF07E,?,?,?,616CF215,?,?,?,6167115E), ref: 616D8DA0

free.LIBCMT ref: 616EA7E2
free.LIBCMT ref: 616EA7EB
free.LIBCMT ref: 616EA7F4
free.LIBCMT ref: 616EA7FD
free.LIBCMT ref: 616EA806
free.LIBCMT ref: 616EA80E
free.LIBCMT ref: 616EA817
free.LIBCMT ref: 616EA820
free.LIBCMT ref: 616EA829
free.LIBCMT ref: 616EA832
free.LIBCMT ref: 616EA83B
free.LIBCMT ref: 616EA844
free.LIBCMT ref: 616EA84D
free.LIBCMT ref: 616EA856
free.LIBCMT ref: 616EA85F
free.LIBCMT ref: 616EA86B
free.LIBCMT ref: 616EA877
free.LIBCMT ref: 616EA883
free.LIBCMT ref: 616EA88F
free.LIBCMT ref: 616EA89B
free.LIBCMT ref: 616EA8A7
free.LIBCMT ref: 616EA8B3
free.LIBCMT ref: 616EA8BF
free.LIBCMT ref: 616EA8CB
free.LIBCMT ref: 616EA8D7
free.LIBCMT ref: 616EA8E3
free.LIBCMT ref: 616EA8EF
free.LIBCMT ref: 616EA8FB
free.LIBCMT ref: 616EA907
free.LIBCMT ref: 616EA913
free.LIBCMT ref: 616EA91F
free.LIBCMT ref: 616EA92B
free.LIBCMT ref: 616EA937
free.LIBCMT ref: 616EA943
free.LIBCMT ref: 616EA94F
free.LIBCMT ref: 616EA95B
free.LIBCMT ref: 616EA967
free.LIBCMT ref: 616EA973
free.LIBCMT ref: 616EA97F
free.LIBCMT ref: 616EA98B
free.LIBCMT ref: 616EA997
free.LIBCMT ref: 616EA9A3
free.LIBCMT ref: 616EA9AF
free.LIBCMT ref: 616EA9BB
free.LIBCMT ref: 616EA9C7
free.LIBCMT ref: 616EA9D3
free.LIBCMT ref: 616EA9DF
free.LIBCMT ref: 616EA9EB
free.LIBCMT ref: 616EA9F7
free.LIBCMT ref: 616EAA03
free.LIBCMT ref: 616EAA0F
free.LIBCMT ref: 616EAA1B
free.LIBCMT ref: 616EAA27
free.LIBCMT ref: 616EAA33
free.LIBCMT ref: 616EAA3F
free.LIBCMT ref: 616EAA4B
free.LIBCMT ref: 616EAA57
free.LIBCMT ref: 616EAA63
free.LIBCMT ref: 616EAA6F
free.LIBCMT ref: 616EAA7B
free.LIBCMT ref: 616EAA87
free.LIBCMT ref: 616EAA93
free.LIBCMT ref: 616EAA9F
free.LIBCMT ref: 616EAAAB
free.LIBCMT ref: 616EAAB7
free.LIBCMT ref: 616EAAC3
free.LIBCMT ref: 616EAACF
free.LIBCMT ref: 616EAADB
free.LIBCMT ref: 616EAAE7
free.LIBCMT ref: 616EAAF3
free.LIBCMT ref: 616EAAFF
free.LIBCMT ref: 616EAB0B
free.LIBCMT ref: 616EAB17
free.LIBCMT ref: 616EAB23
free.LIBCMT ref: 616EAB2F
free.LIBCMT ref: 616EAB3B
free.LIBCMT ref: 616EAB47
free.LIBCMT ref: 616EAB53
free.LIBCMT ref: 616EAB5F
free.LIBCMT ref: 616EAB6B
free.LIBCMT ref: 616EAB77
free.LIBCMT ref: 616EAB83
free.LIBCMT ref: 616EAB8F
free.LIBCMT ref: 616EAB9B
free.LIBCMT ref: 616EABA7

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: free$ErrorFreeHeapLast_errno
String ID:
API String ID: 1012874770-0
Opcode ID: ef96ce964b64d82700c3506b6899d380002feb126bf0aafe0e8424e6a65e2e61
Instruction ID: 2089e754f621beec0ddd3fcdf2851b4cfb2a63812f53788db14936dedc367f35
Opcode Fuzzy Hash: ef96ce964b64d82700c3506b6899d380002feb126bf0aafe0e8424e6a65e2e61
Instruction Fuzzy Hash: 03815527E11D4685DB419B33CC982AC132AAFE6F89F94A132CA4F6B574CF30C845935C

Function 616E1450 Relevance: 38.6, APIs: 16, Strings: 6, Instructions: 136libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,616CF215,?,?,?,6167115E), ref: 616E1495
GetProcAddress.KERNEL32(?,616CF215,?,?,?,6167115E), ref: 616E14B1
EncodePointer.KERNEL32(?,616CF215,?,?,?,6167115E), ref: 616E14C3
GetProcAddress.KERNEL32(?,616CF215,?,?,?,6167115E), ref: 616E14DA
EncodePointer.KERNEL32(?,616CF215,?,?,?,6167115E), ref: 616E14E3
GetProcAddress.KERNEL32(?,616CF215,?,?,?,6167115E), ref: 616E14FA
EncodePointer.KERNEL32(?,616CF215,?,?,?,6167115E), ref: 616E1503
GetProcAddress.KERNEL32(?,616CF215,?,?,?,6167115E), ref: 616E151A
EncodePointer.KERNEL32(?,616CF215,?,?,?,6167115E), ref: 616E1523
GetProcAddress.KERNEL32(?,616CF215,?,?,?,6167115E), ref: 616E1542
EncodePointer.KERNEL32(?,616CF215,?,?,?,6167115E), ref: 616E154B
DecodePointer.KERNEL32(?,616CF215,?,?,?,6167115E), ref: 616E157E
DecodePointer.KERNEL32(?,616CF215,?,?,?,6167115E), ref: 616E158E
DecodePointer.KERNEL32(?,616CF215,?,?,?,6167115E), ref: 616E15E4
DecodePointer.KERNEL32(?,616CF215,?,?,?,6167115E), ref: 616E1605
DecodePointer.KERNEL32(?,616CF215,?,?,?,6167115E), ref: 616E161F

Strings

GetActiveWindow, xrefs: 616E14C9
USER32.DLL, xrefs: 616E148E
MessageBoxW, xrefs: 616E14A7
GetLastActivePopup, xrefs: 616E14E9
GetProcessWindowStation, xrefs: 616E1538
GetUserObjectInformationW, xrefs: 616E1509

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$GetProcessWindowStation$GetUserObjectInformationW$MessageBoxW$USER32.DLL
API String ID: 2643518689-564504941
Opcode ID: 81cd7c73098148d8932ef771a249fe1c63b7a4110763cea09cd36e985f08efe0
Instruction ID: c6887339ebf4e19f489f26c94e73bf467fc8b34ff903152f3106d34506b5edb7
Opcode Fuzzy Hash: 81cd7c73098148d8932ef771a249fe1c63b7a4110763cea09cd36e985f08efe0
Instruction Fuzzy Hash: 98514EB470BB5184FF05DB56B81879927B6BB89BC6F4C8125DC5E43720EF3AC19A9700

Function 616DC1C8 Relevance: 32.0, APIs: 21, Instructions: 481COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 616DC1F9
_errno.LIBCMT ref: 616DC202
__doserrno.LIBCMT ref: 616DC25C
_errno.LIBCMT ref: 616DC263
_invalid_parameter_noinfo.LIBCMT ref: 616DC8D2

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfo
String ID:
API String ID: 2315031519-0
Opcode ID: 8beaf6d05ab0162b6b88ed41747cfa18bd0c7fa81a6da14457e9cf568e977924
Instruction ID: 7a0a187e7399265d1757ab0804fc4e56103a6b53e96a2c64e1801012a609ce3f
Opcode Fuzzy Hash: 8beaf6d05ab0162b6b88ed41747cfa18bd0c7fa81a6da14457e9cf568e977924
Instruction Fuzzy Hash: 9512386AE197C986E7028FA9D48039D3F72F786B68F99C209CE5B47791D778C041C346

Function 6169DB48 Relevance: 28.2, APIs: 3, Strings: 13, Instructions: 205COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169DB99
_invalid_parameter_noinfo.LIBCMT ref: 6169DBA4
_wsopen_s.LIBCMT ref: 6169DDB5

Strings

a, xrefs: 6169DB8A
UTF-16LE, xrefs: 6169DD44
, xrefs: 6169DD91
UNICODE, xrefs: 6169DD67
r, xrefs: 6169DB8F
, xrefs: 6169DB85
, xrefs: 6169DD1C
, xrefs: 6169DD0B
w, xrefs: 6169DB94
UTF-8, xrefs: 6169DD21
ccs, xrefs: 6169DCE5
, xrefs: 6169DCE0
=, xrefs: 6169DD10

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo_wsopen_s
String ID: $ $ $ $ $=$UNICODE$UTF-16LE$UTF-8$a$ccs$r$w
API String ID: 2053332431-1561892669
Opcode ID: 6754c196a1625cf74d22b905ebe631ce762c451f07fce90f8e757717c62ee22d
Instruction ID: 8fddbed70cd0ee2ff56f46822a818e7487e37d60e132dacf3bd43911c7440d88
Opcode Fuzzy Hash: 6754c196a1625cf74d22b905ebe631ce762c451f07fce90f8e757717c62ee22d
Instruction Fuzzy Hash: C66132AFA1C38387FB224FB6ED007956EAA6792798F48CC35CF5606699D7BDC1408301

Function 616DACA0 Relevance: 27.2, APIs: 18, Instructions: 239COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 616DACE4
_errno.LIBCMT ref: 616DACEB
__doserrno.LIBCMT ref: 616DAD0E
_errno.LIBCMT ref: 616DAD15
_invalid_parameter_noinfo.LIBCMT ref: 616DB02F

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfo
String ID:
API String ID: 2315031519-0
Opcode ID: e493a688a0ecc31f51e28543543d507ce02bf4c1fd501db93bf1c89f9ff9b3ca
Instruction ID: 8b586b7d06b08912fc7ace0eddb9ff064dd0c5b3dfd79f5ba38d0caa0313f28a
Opcode Fuzzy Hash: e493a688a0ecc31f51e28543543d507ce02bf4c1fd501db93bf1c89f9ff9b3ca
Instruction Fuzzy Hash: 9EA10276A0C751C7D714CF66E48035EB7B2F785B55F04C11AEBA987AA8DB38C460CB00

Function 616DB424 Relevance: 27.2, APIs: 18, Instructions: 238COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 616DB468
_errno.LIBCMT ref: 616DB46F
__doserrno.LIBCMT ref: 616DB492
_errno.LIBCMT ref: 616DB499
_invalid_parameter_noinfo.LIBCMT ref: 616DB7A8

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfo
String ID:
API String ID: 2315031519-0
Opcode ID: 864085794b2f38e08053cfd672e25b289c15526655db702a990b325b7040f09c
Instruction ID: 744d54f9021334ad0eb1748d3177c40a23007487de3b89b36bd8470530fae10d
Opcode Fuzzy Hash: 864085794b2f38e08053cfd672e25b289c15526655db702a990b325b7040f09c
Instruction Fuzzy Hash: C3A1117AA08791C7D710CF66E48036EB7B1F786B55F45C11AEBA987A98DB38C460CF00

Function 616DB06C Relevance: 27.2, APIs: 18, Instructions: 236COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 616DB0B0
_errno.LIBCMT ref: 616DB0B7
__doserrno.LIBCMT ref: 616DB0DA
_errno.LIBCMT ref: 616DB0E1
_invalid_parameter_noinfo.LIBCMT ref: 616DB3E9

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfo
String ID:
API String ID: 2315031519-0
Opcode ID: 2983ff00726601a7282e187ead0cdbb625c2633e0729287ed5ee9da56edf29a9
Instruction ID: b75f3a24455c7335a9d0047db5612e86995543bb4a593f23267f58d1073303af
Opcode Fuzzy Hash: 2983ff00726601a7282e187ead0cdbb625c2633e0729287ed5ee9da56edf29a9
Instruction Fuzzy Hash: 00A1F076A08751C7D714CFA5E48036EB7B2F786B55F01C21AEB9987A98DF38C460CB10

Function 616D9F0C Relevance: 27.2, APIs: 18, Instructions: 235COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 616D9F50
_errno.LIBCMT ref: 616D9F57
__doserrno.LIBCMT ref: 616D9F7A
_errno.LIBCMT ref: 616D9F81
_invalid_parameter_noinfo.LIBCMT ref: 616DA27E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfo
String ID:
API String ID: 2315031519-0
Opcode ID: b6eadaa03243fc035e42b904b4c18735be55e895de56f0b7379cd1603c870121
Instruction ID: 5f33e91907cb98fcc5509ae87668ea7c4c46d938ab17660fbc3131cc7a183ac0
Opcode Fuzzy Hash: b6eadaa03243fc035e42b904b4c18735be55e895de56f0b7379cd1603c870121
Instruction Fuzzy Hash: 1DA1F276A0C761C7D710CFA6E48036EB7B1F784B59F04C11AEB9987A68DB79C460CB50

Function 616976B8 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 616976EA
_errno.LIBCMT ref: 616976F5
_invalid_parameter_noinfo.LIBCMT ref: 61697700
_getdrive.LIBCMT ref: 6169770A
_errno.LIBCMT ref: 6169771A
GetFullPathNameW.KERNEL32 ref: 6169776A
_errno.LIBCMT ref: 61697782

Strings

., xrefs: 61697753
., xrefs: 6169773F

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$FullNamePath__doserrno_getdrive_invalid_parameter_noinfo
String ID: .$.
API String ID: 2522281643-3769392785
Opcode ID: b85bf5b496b82f197dbb225acfdd4899b448cc7da5b25e94e1cfbef6c59376bb
Instruction ID: c231327887749c69117fdc82c3d9f1acd6ec6bc351a08dee9614baf4b8a9ec3d
Opcode Fuzzy Hash: b85bf5b496b82f197dbb225acfdd4899b448cc7da5b25e94e1cfbef6c59376bb
Instruction Fuzzy Hash: FA31D46E30964387FB115FA1E8103BE66A2AFC4789F59C822DA484F710EB3CC4418F55

Function 61695B6C Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 61695B8D
_errno.LIBCMT ref: 61695B98
_invalid_parameter_noinfo.LIBCMT ref: 61695BA3
_getdrive.LIBCMT ref: 61695BAD
_errno.LIBCMT ref: 61695BBD
GetFullPathNameA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,61695CC7), ref: 61695C04
_errno.LIBCMT ref: 61695C1C

Strings

., xrefs: 61695BEE
:., xrefs: 61695BDB

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$FullNamePath__doserrno_getdrive_invalid_parameter_noinfo
String ID: .$:.
API String ID: 2522281643-2811378331
Opcode ID: ae874ff989e2e718eb45454ba6256e5f9fbe1ede6cfbe8505bb8dbb6944a5352
Instruction ID: d997fbc229cda33d1e25049168c7cc73744ae154d0e19b1eab89f63c2305a701
Opcode Fuzzy Hash: ae874ff989e2e718eb45454ba6256e5f9fbe1ede6cfbe8505bb8dbb6944a5352
Instruction Fuzzy Hash: AB31056A2097D7CBFB115FA4981034D3AB1AB85B8BF59CD27DB044B704EB7CC8418B96

Function 616896BC Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 616896D0
GetProcAddress.KERNEL32 ref: 616896EC
GetProcAddress.KERNEL32 ref: 61689709
GetProcAddress.KERNEL32 ref: 61689727
GetProcAddress.KERNEL32 ref: 61689745
GetProcAddress.KERNEL32 ref: 61689763
GetProcAddress.KERNEL32 ref: 61689781

Strings

GetTraceEnableLevel, xrefs: 61689752
UnregisterTraceGuids, xrefs: 61689702
RegisterTraceGuidsW, xrefs: 616896E2
TraceEvent, xrefs: 61689716
GetTraceLoggerHandle, xrefs: 61689734
GetTraceEnableFlags, xrefs: 61689770
advapi32.dll, xrefs: 616896C9

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetTraceEnableFlags$GetTraceEnableLevel$GetTraceLoggerHandle$RegisterTraceGuidsW$TraceEvent$UnregisterTraceGuids$advapi32.dll
API String ID: 2238633743-19120757
Opcode ID: c9f42445f85ffc9c27826621f6730bf1ec1149dd7b6345642ba07660ea6dc94a
Instruction ID: b1ba32000dd12cd0992cef04b01221513dc0bf1fe1cd844c6ab6a463842065f1
Opcode Fuzzy Hash: c9f42445f85ffc9c27826621f6730bf1ec1149dd7b6345642ba07660ea6dc94a
Instruction Fuzzy Hash: 8621C5B5309B4081EB04CB25F9A43A923B6F74CBC9F49912A995E47724DE3AC56AC300

Function 6168DF50 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 108threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6168DF96
TlsGetValue.KERNEL32 ref: 6168DFAA
DebugBreak.KERNEL32 ref: 6168DFB5
GetCurrentThreadId.KERNEL32 ref: 6168E00B
swprintf.LIBCMT ref: 6168E068
GetCurrentThreadId.KERNEL32 ref: 6168E071
swprintf.LIBCMT ref: 6168E09A
fwprintf.LIBCMT ref: 6168E0B3
fflush.LIBCMT ref: 6168E0BF
OutputDebugStringW.KERNEL32 ref: 6168E0C9
DebugBreak.KERNEL32 ref: 6168E0CF

Strings

[%d] %S: !!!!!!!Assert Failed(%S: %d), xrefs: 6168E07C
[%d:%d:%d:%d(%d)] %S: !!!!!!!Assert Failed(%S: %d), xrefs: 6168E04C

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Debug$BreakCurrentThreadValueswprintf$OutputStringfflushfwprintf
String ID: [%d:%d:%d:%d(%d)] %S: !!!!!!!Assert Failed(%S: %d)$[%d] %S: !!!!!!!Assert Failed(%S: %d)
API String ID: 2283501107-813932914
Opcode ID: 5d371ec26b70e0a2d514147bb65014d8fe0dd72756ede78e45ded96c05ba8c4a
Instruction ID: 179243076c9771029a6e47d66797fa0c54a358ff1a55ae812d8dc4626d87f5f5
Opcode Fuzzy Hash: 5d371ec26b70e0a2d514147bb65014d8fe0dd72756ede78e45ded96c05ba8c4a
Instruction Fuzzy Hash: 8341E77A209B80C7EB50DF62E84039A7772F788B99F088525EE9947B64CF3DC565CB40

Function 616DD6BC Relevance: 19.7, APIs: 13, Instructions: 183COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 616DD6ED
_errno.LIBCMT ref: 616DD6F4
_invalid_parameter_noinfo.LIBCMT ref: 616DD6FF
__doserrno.LIBCMT ref: 616DD724
_errno.LIBCMT ref: 616DD72B
_invalid_parameter_noinfo.LIBCMT ref: 616DD736

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: __doserrno_errno_invalid_parameter_noinfo
String ID:
API String ID: 3902385426-0
Opcode ID: a1d4d399a98053759bac8ca5dd7bc528b66e30614e0d423699d1b14415df85f2
Instruction ID: 163781c57f25ebef44b40ab38b4faa6f27b6bd1411670e6cc6ff593ee4c2a21c
Opcode Fuzzy Hash: a1d4d399a98053759bac8ca5dd7bc528b66e30614e0d423699d1b14415df85f2
Instruction Fuzzy Hash: BC710277A18BC582DB019F29E84075E7B76F7C0B98F488216EE890B7A4CF79C445CB01

Function 616E19F4 Relevance: 19.6, APIs: 13, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

__free_lconv_mon.LIBCMT ref: 616E1A4C

Part of subcall function 616EAF3C: free.LIBCMT ref: 616EAF5A
Part of subcall function 616EAF3C: free.LIBCMT ref: 616EAF6C
Part of subcall function 616EAF3C: free.LIBCMT ref: 616EAF7E
Part of subcall function 616EAF3C: free.LIBCMT ref: 616EAF90
Part of subcall function 616EAF3C: free.LIBCMT ref: 616EAFA2
Part of subcall function 616EAF3C: free.LIBCMT ref: 616EAFB4
Part of subcall function 616EAF3C: free.LIBCMT ref: 616EAFC6
Part of subcall function 616EAF3C: free.LIBCMT ref: 616EAFD8
Part of subcall function 616EAF3C: free.LIBCMT ref: 616EAFEA
Part of subcall function 616EAF3C: free.LIBCMT ref: 616EAFFC
Part of subcall function 616EAF3C: free.LIBCMT ref: 616EB011
Part of subcall function 616EAF3C: free.LIBCMT ref: 616EB026
Part of subcall function 616EAF3C: free.LIBCMT ref: 616EB03B

free.LIBCMT ref: 616E1A40

Part of subcall function 616D8D78: HeapFree.KERNEL32(?,?,?,616CF018,?,?,?,616CF07E,?,?,?,616CF215,?,?,?,6167115E), ref: 616D8D8E
Part of subcall function 616D8D78: _errno.LIBCMT ref: 616D8D98
Part of subcall function 616D8D78: GetLastError.KERNEL32(?,?,?,616CF018,?,?,?,616CF07E,?,?,?,616CF215,?,?,?,6167115E), ref: 616D8DA0

free.LIBCMT ref: 616E1A62
__free_lconv_num.LIBCMT ref: 616E1A6E
free.LIBCMT ref: 616E1A7A
free.LIBCMT ref: 616E1A86
free.LIBCMT ref: 616E1AAA
free.LIBCMT ref: 616E1ABE
free.LIBCMT ref: 616E1ACD
free.LIBCMT ref: 616E1AD9
free.LIBCMT ref: 616E1B06
free.LIBCMT ref: 616E1B2E
free.LIBCMT ref: 616E1B48

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: free$ErrorFreeHeapLast__free_lconv_mon__free_lconv_num_errno
String ID:
API String ID: 518839503-0
Opcode ID: 6b274e39cf9f29a01767cfa375c4f6863c6f0671e53504cfd1eb2c932612e73e
Instruction ID: 05ed74923289d8f1bd2dd0932c38ace3c13164913fc8355a8ca5dd176afc13f5
Opcode Fuzzy Hash: 6b274e39cf9f29a01767cfa375c4f6863c6f0671e53504cfd1eb2c932612e73e
Instruction Fuzzy Hash: 1A313F3AA0BA8585EF05CFA6C4583AC2371EB94F99F54D231CE1E4B2A4DF78C492D314

Function 617555FC Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 61756C80: ??0_NonReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 61756CB6
Part of subcall function 61756C80: ??0_NonReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 61756CD1

??0_ReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 61755677
??0_ReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 617556A6
??0_NonReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 61755740
??0_ReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6175574E
??2@YAPEAX_K@Z.MSVCR100(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 61755765
??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 617557C1
_CxxThrowException.MSVCR100 ref: 617557DD

Strings

l4ua, xrefs: 617556C9
_PSource, xrefs: 617557AE
P ua, xrefs: 61755657
tOua, xrefs: 617557C7

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0_Concurrency@@Lock@details@Reentrant$??0exception@std@@??2@ExceptionThrow
String ID: P ua$_PSource$l4ua$tOua
API String ID: 268262149-2283109827
Opcode ID: 0178999f7a5a06d35d3100dc2d114517bf8cac98ef55b5fcd4a543c652308cb4
Instruction ID: 494150fff1ba830a54cfd51904cc1fe2ed7ab1fb68b7f7855d6a15007dba84b7
Opcode Fuzzy Hash: 0178999f7a5a06d35d3100dc2d114517bf8cac98ef55b5fcd4a543c652308cb4
Instruction Fuzzy Hash: C8711332209B80EAEB498F65EA903DDB3B5F708768F54462A9B6D43764DF34D1B9C340

Function 61679638 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 113memorylibraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000010,6167922C), ref: 61679682
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000010,6167922C), ref: 616796E0
TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000010,6167922C), ref: 616796E7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000010,6167922C), ref: 616796F5

Part of subcall function 616740A8: std::exception::exception.LIBCMT ref: 616740C8

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000010,6167922C), ref: 6167972C
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000010,6167922C), ref: 6167973C
VirtualAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000010,6167922C), ref: 61679779
CreateEventW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000010,6167922C), ref: 616797E6

Strings

bad allocation, xrefs: 6167978B
kernel32.dll, xrefs: 61679725
FlushProcessWriteBuffers, xrefs: 61679735

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: AllocCountCriticalInitializeSectionSpin$AddressCreateErrorEventExceptionHandleLastModuleProcRaiseVirtualstd::exception::exception
String ID: FlushProcessWriteBuffers$bad allocation$kernel32.dll
API String ID: 427061777-103648123
Opcode ID: 8de592576e202f15f1ae4f0244687eea5953383bffe01723ecf52d645c2ede7b
Instruction ID: d082480d3d0d917bf0df06fd955c8c15cfd3217b5a54824d7ce83f4224e860e2
Opcode Fuzzy Hash: 8de592576e202f15f1ae4f0244687eea5953383bffe01723ecf52d645c2ede7b
Instruction Fuzzy Hash: E951C132314B4092E714CF24E94038973BAF389BA8F54821AEBAD43BA4DF39D576C740

Function 61695508 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 6169553E
_errno.LIBCMT ref: 61695545
_invalid_parameter_noinfo.LIBCMT ref: 61695550
SetCurrentDirectoryA.KERNEL32 ref: 6169555A
GetCurrentDirectoryA.KERNEL32 ref: 61695572
GetCurrentDirectoryA.KERNEL32 ref: 616955A9
SetEnvironmentVariableA.KERNEL32 ref: 616955E4
free.LIBCMT ref: 61695606

Strings

=, xrefs: 616955C4
:, xrefs: 616955DD

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CurrentDirectory$EnvironmentVariable__doserrno_errno_invalid_parameter_noinfofree
String ID: :$=
API String ID: 1545685631-2134709475
Opcode ID: ef231725696f2a73f9dea36a2ad79aee88074f013ebd36f0bfbf285b97c5d4e6
Instruction ID: 986fe25c71be69a3f3c43e549c23452363d6e49a0678871cee64c67d2172186e
Opcode Fuzzy Hash: ef231725696f2a73f9dea36a2ad79aee88074f013ebd36f0bfbf285b97c5d4e6
Instruction Fuzzy Hash: FC31497A209B9247EB219BA5E80439E3773FBC8786F488426DE9A87355DF3CC401C750

Function 6175D304 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 6175D333
_CxxThrowException.MSVCR100 ref: 6175D34F
??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 6175D368
_CxxThrowException.MSVCR100 ref: 6175D384
??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 6175D39D
_CxxThrowException.MSVCR100 ref: 6175D3B9

Strings

tOua, xrefs: 6175D339
Index is inside segment which failed to be allocated, xrefs: 6175D320
Index out of range, xrefs: 6175D38A
tOua, xrefs: 6175D36E, 6175D3A3
Index out of segments table range, xrefs: 6175D355

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0exception@std@@ExceptionThrow
String ID: Index is inside segment which failed to be allocated$Index out of range$Index out of segments table range$tOua$tOua
API String ID: 2684170311-4041706153
Opcode ID: d681b1d3a76db99dc97160d7132f24f1cc41b788918cd3adde1d633a0faff526
Instruction ID: ca8eed8d006131fa2e4069ef6f9950f026fa9a60c36f71f5fbea49c3b114e5c8
Opcode Fuzzy Hash: d681b1d3a76db99dc97160d7132f24f1cc41b788918cd3adde1d633a0faff526
Instruction Fuzzy Hash: CA11E471614A0BD8EF00DFA8E9853D82B76F75434CF948811EA1D57628EF39C26EC380

Function 6169AEC8 Relevance: 18.2, APIs: 12, Instructions: 193processsynchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 6169AF18
_errno.LIBCMT ref: 6169AF1F
_invalid_parameter_noinfo.LIBCMT ref: 6169AF2A
__doserrno.LIBCMT ref: 6169B07F
CreateProcessW.KERNEL32 ref: 6169B0C6
GetLastError.KERNEL32 ref: 6169B0CE
free.LIBCMT ref: 6169B0DB
WaitForSingleObject.KERNEL32 ref: 6169B108
GetExitCodeProcess.KERNEL32 ref: 6169B116
CloseHandle.KERNEL32 ref: 6169B130
CloseHandle.KERNEL32 ref: 6169B140
_errno.LIBCMT ref: 6169B14B

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CloseHandleProcess__doserrno_errno$CodeCreateErrorExitLastObjectSingleWait_invalid_parameter_noinfofree
String ID:
API String ID: 2975444996-0
Opcode ID: eba17b64527e1530965ca59e8d07be83234985b03dd61579e564013a7a025279
Instruction ID: afca29c2f38f5593253d93bf1c77cc498cff786ff102c074ca4dc585d9fbe666
Opcode Fuzzy Hash: eba17b64527e1530965ca59e8d07be83234985b03dd61579e564013a7a025279
Instruction Fuzzy Hash: 3F71F3BAB04B4287EB118FA9D48079D3772F7847A9F45CA16CE6E477A4DB39C446C340

Function 616991D4 Relevance: 18.2, APIs: 12, Instructions: 192processsynchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 61699224
_errno.LIBCMT ref: 6169922B
_invalid_parameter_noinfo.LIBCMT ref: 61699236
__doserrno.LIBCMT ref: 61699381
CreateProcessA.KERNEL32 ref: 616993C3
GetLastError.KERNEL32 ref: 616993CB
free.LIBCMT ref: 616993D8
WaitForSingleObject.KERNEL32 ref: 61699405
GetExitCodeProcess.KERNEL32 ref: 61699413
CloseHandle.KERNEL32 ref: 6169942D
CloseHandle.KERNEL32 ref: 6169943D
_errno.LIBCMT ref: 61699448

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CloseHandleProcess__doserrno_errno$CodeCreateErrorExitLastObjectSingleWait_invalid_parameter_noinfofree
String ID:
API String ID: 2975444996-0
Opcode ID: bd7d71c22e4cb79508f599155796a4a3a40279fd4502dbffaf768286d81f37a7
Instruction ID: 23b95e6306dc3a3831aec14b290fb6912efb6351574506c32e7279e2d52aa178
Opcode Fuzzy Hash: bd7d71c22e4cb79508f599155796a4a3a40279fd4502dbffaf768286d81f37a7
Instruction Fuzzy Hash: F461D07A709B828AEB128FA9E48039D3B71F795B9CF45DA16CE2D47794DB39C016C301

Function 6169CF4C Relevance: 18.1, APIs: 12, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 6169CF80

Part of subcall function 6169CCA8: _errno.LIBCMT ref: 6169CCB1
Part of subcall function 6169CCA8: _invalid_parameter_noinfo.LIBCMT ref: 6169CCBC

_fileno.LIBCMT ref: 6169CF9B
_fileno.LIBCMT ref: 6169CFA8
_fileno.LIBCMT ref: 6169CFB7

Part of subcall function 6169D788: _fileno.LIBCMT ref: 6169D7A5
Part of subcall function 6169D788: _errno.LIBCMT ref: 6169D7B5

_fileno.LIBCMT ref: 6169CFE1
_fileno.LIBCMT ref: 6169CFEE
_fileno.LIBCMT ref: 6169CFFB
_fileno.LIBCMT ref: 6169D00A
_fileno.LIBCMT ref: 6169D034
_fileno.LIBCMT ref: 6169D041
_fileno.LIBCMT ref: 6169D04E
_fileno.LIBCMT ref: 6169D05D

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _fileno$_errno$_invalid_parameter_noinfo
String ID:
API String ID: 482796045-0
Opcode ID: fd9cc67645d82977742459256bee5d8e2172cb68e1142e58a2db6490841c1e7b
Instruction ID: 2d88552606fa727aec179416a3f15d5e13ebd5d1adb68f0bad938ec67f0bd1e4
Opcode Fuzzy Hash: fd9cc67645d82977742459256bee5d8e2172cb68e1142e58a2db6490841c1e7b
Instruction Fuzzy Hash: 4851E86A214A8387DB149F35969027D7B61FBC2BE8B948B25DB7A476D0CF28C553C304

Function 61691DBC Relevance: 18.1, APIs: 12, Instructions: 103threadCOMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 61691DD1
FlsSetValue.KERNEL32 ref: 61691DE8
GetLastError.KERNEL32 ref: 61691DF1
ExitThread.KERNEL32 ref: 61691DF9
GetCurrentThreadId.KERNEL32 ref: 61691E00
_freefls.LIBCMT ref: 61691E31
_errno.LIBCMT ref: 61691E6F
_invalid_parameter_noinfo.LIBCMT ref: 61691E7A
_getptd.LIBCMT ref: 61691EA0
CreateThread.KERNEL32 ref: 61691EF5
GetLastError.KERNEL32 ref: 61691F00
free.LIBCMT ref: 61691F0B

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Thread$ErrorLastValue$CreateCurrentExit_errno_freefls_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 2004984279-0
Opcode ID: fd180c92c318adab2cf48b931671bec3e0283a790434355c247febf222898513
Instruction ID: cbe94349ba45b5c5d64aa224ca9d5824d7471e01ed9f2c6324e4de11dcf442ae
Opcode Fuzzy Hash: fd180c92c318adab2cf48b931671bec3e0283a790434355c247febf222898513
Instruction Fuzzy Hash: C0319E79704B8687EB049BB6E84439D72BABB88BE9F648935DE6D47754DF38C0108704

Function 6177E554 Relevance: 17.9, APIs: 8, Strings: 2, Instructions: 408stringCOMMON

Download Yara Rule

APIs

localeconv.MSVCR100 ref: 6177E674
memchr.MSVCR100 ref: 6177E695
memchr.MSVCR100 ref: 6177E6A9
strcspn.MSVCR100 ref: 6177E7A8
memchr.MSVCR100 ref: 6177E8ED
memchr.MSVCR100 ref: 6177E9E1
??3@YAXPEAX@Z.MSVCR100 ref: 6177EB4B
??3@YAXPEAX@Z.MSVCR100 ref: 6177EB6B

Strings

0, xrefs: 6177E62C
e, xrefs: 6177E683

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: memchr$??3@$localeconvstrcspn
String ID: 0$e
API String ID: 1796278405-387598579
Opcode ID: 7bac4a27951be3549de9fee23c06f75c31eefb6aff52a8da5b63fe32bdc8bd96
Instruction ID: ce5e44cf1189af47dd34972aa69b6e2922927bc3322f65bed4d2cdea531769a3
Opcode Fuzzy Hash: 7bac4a27951be3549de9fee23c06f75c31eefb6aff52a8da5b63fe32bdc8bd96
Instruction Fuzzy Hash: 7302BD23A18B9485EB118F66E9442EEF771FB98798F449225EFC917B18EF38C185C740

Function 616973AC Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 616973EC
_errno.LIBCMT ref: 616973F4
_invalid_parameter_noinfo.LIBCMT ref: 616973FF
SetCurrentDirectoryW.KERNEL32 ref: 61697409
GetCurrentDirectoryW.KERNEL32 ref: 61697421
GetCurrentDirectoryW.KERNEL32 ref: 61697457
SetEnvironmentVariableW.KERNEL32 ref: 6169749F
free.LIBCMT ref: 616974C3

Strings

:, xrefs: 61697497

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CurrentDirectory$EnvironmentVariable__doserrno_errno_invalid_parameter_noinfofree
String ID: :
API String ID: 1545685631-336475711
Opcode ID: f9421d43f0021f005d97c70d66ca373e171393c3bf5b40d9a7b70b31816158f2
Instruction ID: 93c3acae2f55e44ba248048de2b4af861c3e7a7858df3aba97027bdae7da8e33
Opcode Fuzzy Hash: f9421d43f0021f005d97c70d66ca373e171393c3bf5b40d9a7b70b31816158f2
Instruction Fuzzy Hash: D731043A216B4283EB248BA1A40435A3676F7C8F98F988535DE9947748EF3CC445CB04

Function 616E9888 Relevance: 16.8, APIs: 11, Instructions: 265COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616E98AE
_invalid_parameter_noinfo.LIBCMT ref: 616E98B9
__mbtow_environ.LIBCMT ref: 616E99A9
_errno.LIBCMT ref: 616E99B2
free.LIBCMT ref: 616E9AB5
SetEnvironmentVariableW.KERNEL32 ref: 616E9BE7
_errno.LIBCMT ref: 616E9BF4
free.LIBCMT ref: 616E9C02
free.LIBCMT ref: 616E9C0F
free.LIBCMT ref: 616E9C36

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: free$_errno$EnvironmentVariable__mbtow_environ_invalid_parameter_noinfo
String ID:
API String ID: 808566419-0
Opcode ID: 44dec85cbf36c3ed5f25b695bc4e54977ccb39839b8db2e2d7d91b9b7ba47299
Instruction ID: e2155b71e4266751d01010e6efd7fba13f51e0c96ce689ad9143b312a3374e5e
Opcode Fuzzy Hash: 44dec85cbf36c3ed5f25b695bc4e54977ccb39839b8db2e2d7d91b9b7ba47299
Instruction Fuzzy Hash: 2591E43A70BB5281EE159B55E94839A37A6EF80F9CF48C729CE694B754EF38C052C304

Function 616EC274 Relevance: 16.8, APIs: 11, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616EC29C
_invalid_parameter_noinfo.LIBCMT ref: 616EC2A7
__wtomb_environ.LIBCMT ref: 616EC389
_errno.LIBCMT ref: 616EC392
free.LIBCMT ref: 616EC483
SetEnvironmentVariableA.KERNEL32 ref: 616EC5B4
_errno.LIBCMT ref: 616EC5C1
free.LIBCMT ref: 616EC5CF
free.LIBCMT ref: 616EC5DC
free.LIBCMT ref: 616EC603

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: free$_errno$EnvironmentVariable__wtomb_environ_invalid_parameter_noinfo
String ID:
API String ID: 101574016-0
Opcode ID: 142cc38f11f9df6bdf8963543e9be6de5627d73a049b9a753f6dd3e57d63aa58
Instruction ID: bc6f10305064b62c33d304a3125405b40244c77aa98c8fa82316f791c0953236
Opcode Fuzzy Hash: 142cc38f11f9df6bdf8963543e9be6de5627d73a049b9a753f6dd3e57d63aa58
Instruction Fuzzy Hash: B691073D70BB8185EA06DB55A9083AA3FA6FB81BD8F14C725CE6B4B754EF38C1518304

Function 6169757C Relevance: 16.6, APIs: 11, Instructions: 87COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 616975BD
GetLastError.KERNEL32 ref: 616975C7
_errno.LIBCMT ref: 616975F6
calloc.LIBCMT ref: 6169760B
_errno.LIBCMT ref: 61697618
_errno.LIBCMT ref: 6169762A
_invalid_parameter_noinfo.LIBCMT ref: 61697635
GetFullPathNameW.KERNEL32 ref: 6169764C
free.LIBCMT ref: 61697661
_errno.LIBCMT ref: 61697666
free.LIBCMT ref: 61697686

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$FullNamePathfree$ErrorLast_invalid_parameter_noinfocalloc
String ID:
API String ID: 3219262609-0
Opcode ID: 77c3f45acb8e4ab45a09114969e47f6ac23192c8394b0a969bb5fcc20e49f261
Instruction ID: c73ec78a9ebcd082fb403f3f29e041ea32d95f315da070c92b9c5fd5e5a62293
Opcode Fuzzy Hash: 77c3f45acb8e4ab45a09114969e47f6ac23192c8394b0a969bb5fcc20e49f261
Instruction Fuzzy Hash: 8321F8793097A347EB055BAA991434935725BD5BE4F18CD31CE154BB94EF38C4408F45

Function 616959CC Relevance: 16.6, APIs: 11, Instructions: 83COMMON

Download Yara Rule

APIs

GetFullPathNameA.KERNEL32 ref: 61695A0B
GetLastError.KERNEL32 ref: 61695A15
_errno.LIBCMT ref: 61695A3B
calloc.LIBCMT ref: 61695A50
_errno.LIBCMT ref: 61695A5D
_errno.LIBCMT ref: 61695A6F
_invalid_parameter_noinfo.LIBCMT ref: 61695A7A
GetFullPathNameA.KERNEL32 ref: 61695A91
free.LIBCMT ref: 61695AA6
_errno.LIBCMT ref: 61695AAB
free.LIBCMT ref: 61695ACB

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$FullNamePathfree$ErrorLast_invalid_parameter_noinfocalloc
String ID:
API String ID: 3219262609-0
Opcode ID: 48ebf33db22a0063aca16eeb3cbbb586b4346b6ba897934f6d092f1beb0fdf1c
Instruction ID: 4c20bbdcd7d30b67b8cd5d389451bc8b3dc0ddde41264054605a9e9fb08ecb74
Opcode Fuzzy Hash: 48ebf33db22a0063aca16eeb3cbbb586b4346b6ba897934f6d092f1beb0fdf1c
Instruction Fuzzy Hash: 442149387057538BEB059BA6A8443492272AFCABE6F18C923DE5607B54EF3CC001430D

Function 6175872C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 6175874B
_CxxThrowException.MSVCR100 ref: 61758769
??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 617863F4
_CxxThrowException.MSVCR100 ref: 61786412
setlocale.MSVCR100 ref: 61786458

Strings

bad locale name, xrefs: 61758735, 617863E1
tOua, xrefs: 61758751, 617863FA

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0exception@std@@ExceptionThrow$setlocale
String ID: bad locale name$tOua
API String ID: 868602453-2242159295
Opcode ID: 61bb232330257a162773b70be00043fcf8d16b62329222f13ec6449e51080a49
Instruction ID: c71dc5915a6947476ee1af091a535e4d0b89056d1a78522ee7f204417e0acacf
Opcode Fuzzy Hash: 61bb232330257a162773b70be00043fcf8d16b62329222f13ec6449e51080a49
Instruction Fuzzy Hash: CE31CD71218B82A2EF50CB19E64438DB777FB85788F888531EA5D47228EF39C75AC340

Function 616798E0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 58libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 61679909
GetProcAddress.KERNEL32 ref: 61679919
GetLastError.KERNEL32 ref: 61679927
GetModuleHandleW.KERNEL32 ref: 61679976
GetProcAddress.KERNEL32 ref: 61679986
GetLastError.KERNEL32 ref: 61679994

Strings

GetCurrentProcessorNumberEx, xrefs: 6167997C
GetCurrentProcessorNumber, xrefs: 6167990F
kernel32.dll, xrefs: 61679902, 6167996F

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: GetCurrentProcessorNumber$GetCurrentProcessorNumberEx$kernel32.dll
API String ID: 4275029093-690119961
Opcode ID: 72714d911e568c634a97040c6cd57162d719992555829c7774f84e2ec6000e43
Instruction ID: 89c2448ac2e5597834a218548790275773c458a2dea323e53cf7c8c52c5d6148
Opcode Fuzzy Hash: 72714d911e568c634a97040c6cd57162d719992555829c7774f84e2ec6000e43
Instruction Fuzzy Hash: 50210E78609B4691FB21DB64EC5439523F2FB8939DF988512D44E43228EF7EC626D310

Function 616E40C0 Relevance: 15.2, APIs: 10, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 616E415A
malloc.LIBCMT ref: 616E41C3
MultiByteToWideChar.KERNEL32 ref: 616E41F7
LCMapStringW.KERNEL32 ref: 616E421E
LCMapStringW.KERNEL32 ref: 616E4266
malloc.LIBCMT ref: 616E42C3

Part of subcall function 616D8CBC: _FF_MSGBANNER.LIBCMT ref: 616D8CEC
Part of subcall function 616D8CBC: HeapAlloc.KERNEL32(?,?,?,616D8AC0,?,?,?,616916B5,?,?,?,61691763), ref: 616D8D11
Part of subcall function 616D8CBC: _errno.LIBCMT ref: 616D8D35
Part of subcall function 616D8CBC: _errno.LIBCMT ref: 616D8D40

LCMapStringW.KERNEL32 ref: 616E42F8
WideCharToMultiByte.KERNEL32 ref: 616E4338
free.LIBCMT ref: 616E434C
free.LIBCMT ref: 616E435D

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ByteCharMultiStringWide$_errnofreemalloc$AllocHeap
String ID:
API String ID: 3251299703-0
Opcode ID: d3e74f72bdfe8e82d1dd4a58ad0a4ebc8b12c70409819e47da6c4a2db683094c
Instruction ID: de0a14a39625c953b63881fc6550619f6c91f71ca978cbfa0a1a6d16a2f6476a
Opcode Fuzzy Hash: d3e74f72bdfe8e82d1dd4a58ad0a4ebc8b12c70409819e47da6c4a2db683094c
Instruction Fuzzy Hash: 6C71E87670A7808AEF14CF76D84829977A6FB88BE9F548315DE6D87B94DB78C101C700

Function 6169C948 Relevance: 15.1, APIs: 10, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 6169C97D
_fileno.LIBCMT ref: 6169C98A
_fileno.LIBCMT ref: 6169C999

Part of subcall function 6169D408: _errno.LIBCMT ref: 6169D41F
Part of subcall function 6169D408: _invalid_parameter_noinfo.LIBCMT ref: 6169D42A

_fileno.LIBCMT ref: 6169C970

Part of subcall function 6169CCA8: _errno.LIBCMT ref: 6169CCB1
Part of subcall function 6169CCA8: _invalid_parameter_noinfo.LIBCMT ref: 6169CCBC

_fileno.LIBCMT ref: 6169CA26
_fileno.LIBCMT ref: 6169CA33
_fileno.LIBCMT ref: 6169CA40
_fileno.LIBCMT ref: 6169CA4F
ungetc.LIBCMT ref: 6169CAD0
_errno.LIBCMT ref: 6169CAFE

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _fileno$_errno$_invalid_parameter_noinfo$ungetc
String ID:
API String ID: 3937924059-0
Opcode ID: 19384649f5336f7c44ef6a0949c9e24576f45193929c8f685a72b8309854f632
Instruction ID: 1bffc4dc8e6d6b611add4f4440179699c3de52007df28b1d859951aecd6d84c3
Opcode Fuzzy Hash: 19384649f5336f7c44ef6a0949c9e24576f45193929c8f685a72b8309854f632
Instruction Fuzzy Hash: 5051D52624968783DB058B7A929427C3A61EBC37B8B54CE16DFBB477D1CB2CC4628354

Function 616B0EB0 Relevance: 15.1, APIs: 10, Instructions: 123COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616B0EF7
_invalid_parameter_noinfo.LIBCMT ref: 616B0F03
_errno.LIBCMT ref: 616B0F4D
_errno.LIBCMT ref: 616B0F58
_errno.LIBCMT ref: 616B0F8A
_invalid_parameter_noinfo.LIBCMT ref: 616B0F94
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,616B108B), ref: 616B1006
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,616B108B), ref: 616B1023
_errno.LIBCMT ref: 616B1049
_invalid_parameter_noinfo.LIBCMT ref: 616B1055

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 2295021086-0
Opcode ID: 0fb21a851a81f650c83b35a3cd013bee7db2884d8166f77a7198e8c14a211696
Instruction ID: db53811a2adfeb48e7984b3bedb837b100d70497f8cc6bf724ef822437770601
Opcode Fuzzy Hash: 0fb21a851a81f650c83b35a3cd013bee7db2884d8166f77a7198e8c14a211696
Instruction Fuzzy Hash: B441297A7057419AFB128FA8C64039C3F75FB81BACF14C221DF698BA98DB38C4528745

Function 61691BE0 Relevance: 15.1, APIs: 10, Instructions: 98threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 61691C15
ExitThread.KERNEL32 ref: 61691C1D
_freefls.LIBCMT ref: 61691C4B
_errno.LIBCMT ref: 61691C85
_invalid_parameter_noinfo.LIBCMT ref: 61691C90
_getptd.LIBCMT ref: 61691CB6
CreateThread.KERNEL32 ref: 61691CF4
GetLastError.KERNEL32 ref: 61691D06
free.LIBCMT ref: 61691D11
ResumeThread.KERNEL32 ref: 61691D43

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Thread$ErrorLast$CreateExitResume_errno_freefls_getptd_invalid_parameter_noinfofree
String ID:
API String ID: 15052567-0
Opcode ID: f4f635f9c7f6e1bc0a3f6de0ac00f242ceda2a1d6796d1881827bca8ca70102b
Instruction ID: 7dffae21688e8244f50de476072089535f6434a97454afa96ef7bd96cad9c410
Opcode Fuzzy Hash: f4f635f9c7f6e1bc0a3f6de0ac00f242ceda2a1d6796d1881827bca8ca70102b
Instruction Fuzzy Hash: 9831A53D705B8686DB04DBB6A45435D72BABB88BE9F28CA35DE6D47794EF38C0148304

Function 6167370C Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 244timeCOMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 616737B9
std::exception::exception.LIBCMT ref: 61673812

Part of subcall function 616731F4: CreateTimerQueue.KERNEL32(616711BA), ref: 61673217

CreateTimerQueueTimer.KERNEL32 ref: 616739F4
std::exception::exception.LIBCMT ref: 61673759

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

Strings

bad allocation, xrefs: 616739FE
eiha, xrefs: 61673A76
pEvents, xrefs: 61673746, 616737A6, 616737FF
, xrefs: 616739D9

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Timerstd::exception::exception$CreateQueue$ExceptionRaise
String ID: $bad allocation$eiha$pEvents
API String ID: 653127754-3341620078
Opcode ID: d020c1ebd56b5c442353a4f359e9293d49648d437950e617e230ee7d25fbc01f
Instruction ID: b8668dd38ac0719443625d8ba09b9f9a7d41d36241ab22f4bf23d6db31f5b18b
Opcode Fuzzy Hash: d020c1ebd56b5c442353a4f359e9293d49648d437950e617e230ee7d25fbc01f
Instruction Fuzzy Hash: 6FA1CB7AB09B8186EB21CF68E8403CD6771F784BA8F548216DE5D47BA8EF38C585C340

Function 6175E03C Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

?Log2@details@Concurrency@@YAK_K@Z.MSVCR100 ref: 6175E0B5
memset.MSVCR100 ref: 6175E141
??0exception@std@@QEAA@AEBQEBDH@Z.MSVCR100 ref: 6175E190
_CxxThrowException.MSVCR100 ref: 6175E1AE
memmove.MSVCR100 ref: 6175E287
memmove.MSVCR100 ref: 6175E34E
memset.MSVCR100 ref: 6175E35C

Strings

bad allocation, xrefs: 6175E177

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: memmovememset$??0exception@std@@Concurrency@@ExceptionLog2@details@Throw
String ID: bad allocation
API String ID: 3478826611-2104205924
Opcode ID: 0d17ccccb50229f272d06a1f30a2cbc0b046b05e37ae73226ec4bf57260dd424
Instruction ID: b731aa8cac91b7e281c8a5e37d0aba962b31ccff188f79a5012227764f7a123c
Opcode Fuzzy Hash: 0d17ccccb50229f272d06a1f30a2cbc0b046b05e37ae73226ec4bf57260dd424
Instruction Fuzzy Hash: F981C072319F8886DA54CF47EA0479AF726F788BE0F498525DE6E07B58DE39C0A5C700

Function 616A4A64 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 209COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A4ACA
_invalid_parameter_noinfo.LIBCMT ref: 616A4AD5
_wsopen_s.LIBCMT ref: 616A4CF4

Part of subcall function 616CC470: _errno.LIBCMT ref: 616CC48E
Part of subcall function 616CC470: _invalid_parameter_noinfo.LIBCMT ref: 616CC499

Strings

=, xrefs: 616A4C49
UTF-8, xrefs: 616A4C5D
UNICODE, xrefs: 616A4CA3
UTF-16LE, xrefs: 616A4C80
ccs, xrefs: 616A4C1C

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_wsopen_s
String ID: =$UNICODE$UTF-16LE$UTF-8$ccs
API String ID: 2449612375-31882262
Opcode ID: daa3f06300a3518f52380af68d870d9cb4ba9de76553bd41ab5d0b76cf1729b1
Instruction ID: 8b79a8ef9b15cb463ea49455b29a7c77300a81fb31d4eaa2b9c6c5b44440be24
Opcode Fuzzy Hash: daa3f06300a3518f52380af68d870d9cb4ba9de76553bd41ab5d0b76cf1729b1
Instruction Fuzzy Hash: 7F51367EB4922081E7254FAAAD5076536A1EB87B94F0DC115CF1A13A98EFFACD418341

Function 616D9A28 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

GetStartupInfoW.KERNEL32 ref: 616D9A49

Part of subcall function 616D8B14: Sleep.KERNEL32(?,?,?,61692097,?,?,?,61695695,?,?,?,?,616D8D9D), ref: 616D8B59

GetFileType.KERNEL32 ref: 616D9BB4
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 616D9BF2

Strings

@, xrefs: 616D9CAD

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CountCriticalFileInfoInitializeSectionSleepSpinStartupType
String ID: @
API String ID: 3473179607-2766056989
Opcode ID: ee8297f20fa4d0de0d96e6b9001fbf0e8f4cb4ca7d7a6e0daafca581cdf113bd
Instruction ID: cf722ee027a337c678053acf186ace125df9e7c07bc16725ef34e42ed83abcfa
Opcode Fuzzy Hash: ee8297f20fa4d0de0d96e6b9001fbf0e8f4cb4ca7d7a6e0daafca581cdf113bd
Instruction Fuzzy Hash: A8819B76705B8186EB14CF25D5A43597BB2F785B78F488329DA7A433E4EB39C066C304

Function 6178A748 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 171stringCOMMON

Download Yara Rule

APIs

Part of subcall function 61788DAC: ___lc_handle_func.MSVCR100 ref: 61788DB0
Part of subcall function 61788DAC: ___lc_codepage_func.MSVCR100 ref: 61788DBD

localeconv.MSVCR100 ref: 6178A77C
strlen.MSVCR100 ref: 6178A79F
memcpy_s.MSVCR100 ref: 6178A939
memcpy_s.MSVCR100 ref: 6178A985
memmove.MSVCR100(?,?,?,?,?,?,?,?,?,?,6178BA05), ref: 6178A99E
memmove.MSVCR100(?,?,?,?,?,?,?,?,?,?,6178BA05), ref: 6178A9B1

Strings

+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v, xrefs: 6178A915, 6178A928
$+xv, xrefs: 6178A921, 6178A974, 6178A993, 6178A9A6

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: memcpy_smemmove$___lc_codepage_func___lc_handle_funclocaleconvstrlen
String ID: $+xv$+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v
API String ID: 2979225317-1561270975
Opcode ID: 88ce5137dbb02ada1930082f345e3384cdfe2a0037f8fa7826d50188fac3c4ea
Instruction ID: 8db8702e8fb808bb999ada2859f072b478603b926420dab2430f45aaca8b4a68
Opcode Fuzzy Hash: 88ce5137dbb02ada1930082f345e3384cdfe2a0037f8fa7826d50188fac3c4ea
Instruction Fuzzy Hash: E0711066218BD092D752CF72E69029DBBB4F784F88F548126CF8913BA8DF38C566C700

Function 61766528 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 76stringCOMMON

Download Yara Rule

APIs

Part of subcall function 61788DAC: ___lc_handle_func.MSVCR100 ref: 61788DB0
Part of subcall function 61788DAC: ___lc_codepage_func.MSVCR100 ref: 61788DBD

_Getdays.MSVCR100(?,?,?,?,?,6176CF22), ref: 61766563
free.MSVCR100 ref: 61766581
strlen.MSVCR100 ref: 6176659D
_Getmonths.MSVCR100(?,?,?,?,?,6176CF22), ref: 617665C9
free.MSVCR100 ref: 617665E7
strlen.MSVCR100 ref: 61766603

Part of subcall function 6175B5B4: free.MSVCR100 ref: 6175B5D6
Part of subcall function 6175B5B4: malloc.MSVCR100 ref: 6175B5FC
Part of subcall function 6175B5B4: memmove.MSVCR100(?,?,?,617898F4), ref: 6175B614

Strings

:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 61766587
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December, xrefs: 617665ED

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: free$strlen$GetdaysGetmonths___lc_codepage_func___lc_handle_funcmallocmemmove
String ID: :Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December$:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 1121988169-3059390450
Opcode ID: 6491f8405941f56065761ac887c88199974e388535f8a4b53b2dd448087f4ac8
Instruction ID: 859f32618355daa600e4d2cfb2a2c09b8250278044510a7d23b0bc8d4d7a8efc
Opcode Fuzzy Hash: 6491f8405941f56065761ac887c88199974e388535f8a4b53b2dd448087f4ac8
Instruction Fuzzy Hash: B431B472205B8181DB05CF15E20C31DBBB5E789BE8F548625DE5D07758DF38C55AC380

Function 61679394 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 73libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,00000001,6167996F), ref: 616793A1
GetProcAddress.KERNEL32(?,?,?,?,?,?,00000001,6167996F), ref: 616793B1
GetModuleHandleW.KERNEL32(?,?,?,?,?,?,00000001,6167996F), ref: 616793C1
GetProcAddress.KERNEL32(?,?,?,?,?,?,00000001,6167996F), ref: 616793D1
GetLastError.KERNEL32(?,?,?,?,?,?,00000001,6167996F), ref: 61679405

Strings

SetThreadGroupAffinity, xrefs: 616793A7
GetThreadGroupAffinity, xrefs: 616793C7
kernel32.dll, xrefs: 6167939A, 616793B7

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: AddressHandleModuleProc$ErrorLast
String ID: GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 798792539-3636059452
Opcode ID: 219a88ddd12c460c98a3bd43fd138103a81c988a586b077b2f00d2b6b569dafd
Instruction ID: f39953c3113c8812949ea0de733f02e71ba762a09d0f6adedc0f401103bf2b08
Opcode Fuzzy Hash: 219a88ddd12c460c98a3bd43fd138103a81c988a586b077b2f00d2b6b569dafd
Instruction Fuzzy Hash: DB318275319B4286FB11CB25EC4439533F6FB543A9F488116D85A47764EF7EC626CB00

Function 617564D8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@AEAV123@@Z.MSVCR100 ref: 61756504
??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 61756526
_CxxThrowException.MSVCR100 ref: 61756544
??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 61756581
??0bad_target@Concurrency@@QEAA@XZ.MSVCR100 ref: 61756591
_CxxThrowException.MSVCR100 ref: 617565A3

Strings

tOua, xrefs: 6175652C
_PTarget, xrefs: 61756510

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: Concurrency@@$ExceptionLock@details@ReentrantScoped_lock@_Throw$??0_??0bad_target@??0exception@std@@??1_V123@@
String ID: _PTarget$tOua
API String ID: 1344678239-1708587465
Opcode ID: 6e03dc662b86942853226e459451b11db5ae88c95bb6450931f987ac4f8739bb
Instruction ID: 957ea901f913a97dc512310a6eb35cd4aee51fe89f513392504f4b75be64cc0c
Opcode Fuzzy Hash: 6e03dc662b86942853226e459451b11db5ae88c95bb6450931f987ac4f8739bb
Instruction Fuzzy Hash: 4C216032208F8591DB11CF15E544389B771F788BA8F688221EA5D477B8DF39CA5EC780

Function 617565C4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@AEAV123@@Z.MSVCR100 ref: 617565F0
??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 61756612
_CxxThrowException.MSVCR100 ref: 61756630
??0bad_target@Concurrency@@QEAA@XZ.MSVCR100 ref: 61756641
_CxxThrowException.MSVCR100 ref: 61756653
??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 6175667B

Strings

tOua, xrefs: 61756618
_PTarget, xrefs: 617565FC

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: Concurrency@@$ExceptionLock@details@ReentrantScoped_lock@_Throw$??0_??0bad_target@??0exception@std@@??1_V123@@
String ID: _PTarget$tOua
API String ID: 1344678239-1708587465
Opcode ID: a87f05fb9662cf5f82fa58ca5eb761ef8f9b40def9ba6aa6f27f8a76da04d2a2
Instruction ID: 473a6f177c047952e8a46b388fb1a06ffcc433e5187628877dbb642d07c20161
Opcode Fuzzy Hash: a87f05fb9662cf5f82fa58ca5eb761ef8f9b40def9ba6aa6f27f8a76da04d2a2
Instruction Fuzzy Hash: 6B213B32208A4992DB10DF15E5543897731F788BA8F588222EAAD47778DF39CA5EC780

Function 6167EF58 Relevance: 13.7, APIs: 9, Instructions: 171memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 616D8DBC: malloc.LIBCMT ref: 616D8DD6

InitializeSListHead.KERNEL32(?,?,?,?,?,?,00000001,00000000,?,6167F78B,?,?,?,?,?,?), ref: 6167F084
InitializeSListHead.KERNEL32(?,?,?,?,?,?,00000001,00000000,?,6167F78B,?,?,?,?,?,?), ref: 6167F08E
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,?,?,?,00000001,00000000,?,6167F78B,?,?,?,?,?,?), ref: 6167F0C0
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,?,?,?,00000001,00000000,?,6167F78B,?,?,?,?,?,?), ref: 6167F170
InitializeSListHead.KERNEL32(?,?,?,?,?,?,00000001,00000000,?,6167F78B,?,?,?,?,?,?), ref: 6167F193
InitializeSListHead.KERNEL32(?,?,?,?,?,?,00000001,00000000,?,6167F78B,?,?,?,?,?,?), ref: 6167F1A0
InitializeSListHead.KERNEL32(?,?,?,?,?,?,00000001,00000000,?,6167F78B,?,?,?,?,?,?), ref: 6167F1AD
TlsAlloc.KERNEL32(?,?,?,?,?,?,00000001,00000000,?,6167F78B,?,?,?,?,?,?), ref: 6167F21D
GetLastError.KERNEL32(?,?,?,?,?,?,00000001,00000000,?,6167F78B,?,?,?,?,?,?), ref: 6167F22A

Part of subcall function 616740A8: std::exception::exception.LIBCMT ref: 616740C8

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Initialize$HeadList$CountCriticalSectionSpin$AllocErrorExceptionLastRaisemallocstd::exception::exception
String ID:
API String ID: 2957020575-0
Opcode ID: 323747e53cb0badc4ee06aa455cf67eb99eeb6a393f9b3718b8996c471ec25ee
Instruction ID: 5d6dbf3f3afe6d996f10165fef484ac3c6f2216d757dd655d4922dcce19e55c4
Opcode Fuzzy Hash: 323747e53cb0badc4ee06aa455cf67eb99eeb6a393f9b3718b8996c471ec25ee
Instruction Fuzzy Hash: DE812576201B80ABD75CDF60EA48BC9B7BAF789784F448229CBA943360DF34A574C704

Function 616A98C8 Relevance: 13.6, APIs: 9, Instructions: 128COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A98F9
_errno.LIBCMT ref: 616A9971

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: edfa0a2c1e23e8df5eb847eadfcfcd6ca21b9d0112daa8360452babadc566b39
Instruction ID: c0af5143a19651b0f902ad3c900264b6a237377dfe5f654a12d1883e99326694
Opcode Fuzzy Hash: edfa0a2c1e23e8df5eb847eadfcfcd6ca21b9d0112daa8360452babadc566b39
Instruction Fuzzy Hash: 42518F6AB1466298FB10CFF1D8803EC3771BB4875DF589016EE0AA7A58EB39C845C354

Function 616AAC08 Relevance: 13.6, APIs: 9, Instructions: 128COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616AAC3B
_errno.LIBCMT ref: 616AACB3

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno
String ID:
API String ID: 2918714741-0
Opcode ID: a5236ee5930283fdc1c131cfcac391b42137cc9696632774d908f62946ea8370
Instruction ID: 92b8f29feb1d2bd04ec95dd6f7dbc0f6b65254da480dfffbe144ac62538dc731
Opcode Fuzzy Hash: a5236ee5930283fdc1c131cfcac391b42137cc9696632774d908f62946ea8370
Instruction Fuzzy Hash: 4E517B6A714A41A9FB108FB1C5503FC3372FB48B8DF449117EE0997AA8EB39CA46C354

Function 616A4374 Relevance: 13.6, APIs: 9, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A43D5
_errno.LIBCMT ref: 616A440B
_errno.LIBCMT ref: 616A4419
_errno.LIBCMT ref: 616A4425
_errno.LIBCMT ref: 616A4467
_errno.LIBCMT ref: 616A4471
_errno.LIBCMT ref: 616A4495
_invalid_parameter_noinfo.LIBCMT ref: 616A44A0

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: a789630c19ee3fb5b3f2ea17bdf994872909d4c42dc779d1ef14e53421ffad09
Instruction ID: 9cd6536a2d0c345b1437eb5f28ea73166112d07cc2839f7021ba1d622691786e
Opcode Fuzzy Hash: a789630c19ee3fb5b3f2ea17bdf994872909d4c42dc779d1ef14e53421ffad09
Instruction Fuzzy Hash: 0431E3BE60A74189EB018FA5AA0014D7372FB857F8F68C622DF64077A4CFB8C8008745

Function 616A3C30 Relevance: 13.6, APIs: 9, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A3C8F
_errno.LIBCMT ref: 616A3CC5
_errno.LIBCMT ref: 616A3CD3
_errno.LIBCMT ref: 616A3CDC
_errno.LIBCMT ref: 616A3D1D
_errno.LIBCMT ref: 616A3D27
_errno.LIBCMT ref: 616A3D4A
_invalid_parameter_noinfo.LIBCMT ref: 616A3D55

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: bea420004228cc6377e12bdb90b4f32301daa5ee8304c18565c53671c1c411ce
Instruction ID: ba75ebf2e3057f7c5484a291a24618e6f415bdbafbb01c5e8d4816ba2ef17057
Opcode Fuzzy Hash: bea420004228cc6377e12bdb90b4f32301daa5ee8304c18565c53671c1c411ce
Instruction Fuzzy Hash: AC31D27A508B42C9DF11EF91E50024DB772E79ABE8F44C612DF680B7A4CB38C8408795

Function 616DC8F4 Relevance: 13.6, APIs: 9, Instructions: 81COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 616DC91D
_errno.LIBCMT ref: 616DC926
__doserrno.LIBCMT ref: 616DC984
_errno.LIBCMT ref: 616DC98B
_invalid_parameter_noinfo.LIBCMT ref: 616DC9EF

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: __doserrno_errno$_invalid_parameter_noinfo
String ID:
API String ID: 2315031519-0
Opcode ID: 8061baf6eae75e846ba0a64bfc51b101a1797f50ae586ba8fd5ca267744c3b89
Instruction ID: bc46bba3d313a11a2b398b87278daa43548e6d69512bbae362ab9ead747545e7
Opcode Fuzzy Hash: 8061baf6eae75e846ba0a64bfc51b101a1797f50ae586ba8fd5ca267744c3b89
Instruction Fuzzy Hash: AA216A7B70535A8AD7026F65A88031D3A63B7C1768F4AC61EEA220F3A0CB78C441C798

Function 6178A2EC Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

isspace.MSVCR100 ref: 6178A329
tolower.MSVCR100 ref: 6178A3CF
memchr.MSVCR100 ref: 6178A3E1
tolower.MSVCR100 ref: 6178A41D
memchr.MSVCR100 ref: 6178A42B
_errno.MSVCR100 ref: 6178A48C

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 6178A3D5, 6178A3EC

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: memchrtolower$_errnoisspace
String ID: 0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3508154992-4256519037
Opcode ID: 4a9782488fe4ef37ca56b28911c3abb38883da6c5f2a146f9f92e58c06d0706b
Instruction ID: 28c1ce88f1f0c0bfabd77d08f95b82b76160376007ee1e46d2b11d2380489168
Opcode Fuzzy Hash: 4a9782488fe4ef37ca56b28911c3abb38883da6c5f2a146f9f92e58c06d0706b
Instruction Fuzzy Hash: D2514E22609AD442EB618F69EA043ADFF61B746BA4F0CC131DDAD07BF4D77C84468701

Function 61752118 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 133COMMON

Download Yara Rule

APIs

??0_NonReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 617521A2
??0_NonReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 617521BB
??0_ReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 617521E7
??0_ReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 61752217

Strings

l4ua, xrefs: 61752239
TJua, xrefs: 61752279
TKua, xrefs: 61752150

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0_Concurrency@@Lock@details@Reentrant
String ID: TJua$TKua$l4ua
API String ID: 2508204085-726952838
Opcode ID: b8e17d4a6ac2af757b63430fcbff109936ea0a6844fe7869a878b22ef0f1bf0d
Instruction ID: f895af35f2f9d18d3a55bbe4a9d6d8aef32d6cdf252c83ffbca8234871e785a1
Opcode Fuzzy Hash: b8e17d4a6ac2af757b63430fcbff109936ea0a6844fe7869a878b22ef0f1bf0d
Instruction Fuzzy Hash: EC61B432205B80EADB588F60E9803DDB7B9FB08B64F544225DBA963760DF35D1B6D340

Function 61680188 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 616801B9
GetCurrentProcess.KERNEL32 ref: 616801C2
DuplicateHandle.KERNEL32 ref: 616801EB
GetLastError.KERNEL32 ref: 616801F5

Part of subcall function 616740A8: std::exception::exception.LIBCMT ref: 616740C8

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

std::exception::exception.LIBCMT ref: 616802B9
TlsGetValue.KERNEL32 ref: 616802F3

Strings

eventObject, xrefs: 6168029D

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CurrentProcessstd::exception::exception$DuplicateErrorExceptionHandleLastRaiseValue
String ID: eventObject
API String ID: 296986234-1680012138
Opcode ID: 350beee8a953665c5057aaa2949b0634cf02684f7d912e5d8c37aebf2728edcc
Instruction ID: 328b940240931128fff0eb6a9ed48405083b4f682bf584917344e1ddcf8071c1
Opcode Fuzzy Hash: 350beee8a953665c5057aaa2949b0634cf02684f7d912e5d8c37aebf2728edcc
Instruction Fuzzy Hash: 8041BDBA20AB4582DB10CB15F444399B3B2F798B98F48C622CB9D83B68DF79C559C700

Function 616A87A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 91timeCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A87D3
GetLocalTime.KERNEL32 ref: 616A87E7
_errno.LIBCMT ref: 616A88AA
_invalid_parameter_noinfo.LIBCMT ref: 616A88B6

Strings

/, xrefs: 616A880A
gfff, xrefs: 616A87FF
/, xrefs: 616A880E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$LocalTime_invalid_parameter_noinfo
String ID: /$/$gfff
API String ID: 250023431-3252747359
Opcode ID: 084c0f95ededa3dc13139fcd324434408b019fa2ca5e87200920bcc7182b7b43
Instruction ID: 23adacb4d69022ec888ef10a8b09dca2ae879fcbdf553c5a1df15f58e7afa3de
Opcode Fuzzy Hash: 084c0f95ededa3dc13139fcd324434408b019fa2ca5e87200920bcc7182b7b43
Instruction Fuzzy Hash: EC316C967252C18BE7058B3CA8953896FA6E3E5709F09D024D644CFB9BDA3CC419D311

Function 6168FE1C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 6168FE3A

Part of subcall function 616920F0: _amsg_exit.LIBCMT ref: 61692106

_getptd.LIBCMT ref: 6168FE4C
_getptd.LIBCMT ref: 6168FE5D
_getptd.LIBCMT ref: 6168FE75

Part of subcall function 616D8DBC: malloc.LIBCMT ref: 616D8DD6

_getptd.LIBCMT ref: 6168FEA7

Part of subcall function 6168F4BC: EncodePointer.KERNEL32 ref: 6168F5B9
Part of subcall function 6168F4BC: malloc.LIBCMT ref: 6168F5DC

Strings

MOC, xrefs: 6168FE69
RCC, xrefs: 6168FE81

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _getptd$malloc$EncodePointer_amsg_exit
String ID: MOC$RCC
API String ID: 329319875-2084237596
Opcode ID: 322f80ab2669c936185ff7441b64d8fe1047131fb066574ed8d8b56affc7d1c2
Instruction ID: 14c7c1009f89fdb8646d90b374053b066cdefc8e286dea3175f07a1a59bf1f86
Opcode Fuzzy Hash: 322f80ab2669c936185ff7441b64d8fe1047131fb066574ed8d8b56affc7d1c2
Instruction Fuzzy Hash: A331B03A216B4182E7618B69E44026D77A5F7C4FA8F18C265EB9947B94CF3CC451CB90

Function 616A89F0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 83timeCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A8A23
GetLocalTime.KERNEL32 ref: 616A8A37
_errno.LIBCMT ref: 616A8AE2
_invalid_parameter_noinfo.LIBCMT ref: 616A8AEE

Strings

:, xrefs: 616A8A55
:, xrefs: 616A8A5C
gfff, xrefs: 616A8A4F

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$LocalTime_invalid_parameter_noinfo
String ID: :$:$gfff
API String ID: 250023431-2795524152
Opcode ID: 7c94922a0f50137fc0837eb3028b48af57ebea12477e663573dfa9815d2dc9b3
Instruction ID: 49af400fcedc3fe9adf4edaa3a56181e860a01ab6469060480dea3103db5caef
Opcode Fuzzy Hash: 7c94922a0f50137fc0837eb3028b48af57ebea12477e663573dfa9815d2dc9b3
Instruction Fuzzy Hash: 8A215C9A3293C18BE7068F38D4913897FA5E3A6749F48C005DA848FB56E63CC51AD711

Function 617575EC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

??0event@Concurrency@@QEAA@XZ.MSVCR100(?,?,?,?,?,00000000,?,61757117), ref: 61757635
??2@YAPEAX_K@Z.MSVCR100(?,?,?,?,?,00000000,?,61757117), ref: 6175764D
??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100(?,?,?,?,?,00000000,?,61757117), ref: 617576AA
_CxxThrowException.MSVCR100 ref: 617576C8

Strings

_PSource, xrefs: 61757694
tOua, xrefs: 617576B0
}ua, xrefs: 6175760F

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0event@??0exception@std@@??2@Concurrency@@ExceptionThrow
String ID: _PSource$tOua$}ua
API String ID: 3301464277-3536274865
Opcode ID: e722dd382a8adb2cfbef47d0f24a85f69a6ef1b024324f94a995b9d2d918c963
Instruction ID: cc802f7685d01a1ad0136f815e815b305f7a102e77e66f8f55977b4d3e1741fe
Opcode Fuzzy Hash: e722dd382a8adb2cfbef47d0f24a85f69a6ef1b024324f94a995b9d2d918c963
Instruction Fuzzy Hash: C8318D72205B04C6EB508F18E584399B7B1F758BA8F688625DA5D077A4DF38C5AAC380

Function 61754548 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 61754579
_CxxThrowException.MSVCR100 ref: 61754597

Part of subcall function 6175F0D0: ??0exception@std@@QEAA@XZ.MSVCR100(?,?,?,?,?,?,?,?,61752AFD), ref: 6175F0D9
Part of subcall function 6175F0D0: _CxxThrowException.MSVCR100 ref: 6175F0F7
Part of subcall function 6175F0D0: ??0exception@std@@QEAA@AEBV01@@Z.MSVCR100(?,?,?,?,?,?,?,?,?,?,?,?,61752AFD), ref: 6175F10D

??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 617545B8
_CxxThrowException.MSVCR100 ref: 617545D6

Strings

_PSource, xrefs: 617545A2
tOua, xrefs: 6175457F, 617545BE
_PMessage, xrefs: 61754566

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0exception@std@@$ExceptionThrow$V01@@
String ID: _PMessage$_PSource$tOua
API String ID: 2939144689-4040379854
Opcode ID: cc4a6335517cb2dc87151618dac3bd461eae8a66049b7d27ad9778536f563ed0
Instruction ID: c424649559ff948ab3ff006d52d8af66bf151fa4ed41693b7312847466f52c85
Opcode Fuzzy Hash: cc4a6335517cb2dc87151618dac3bd461eae8a66049b7d27ad9778536f563ed0
Instruction Fuzzy Hash: B6219071208B8A91DF40CF55E548388B375FB44B8CF688526DA5D43B68EF39C66AC740

Function 6175F578 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

??0exception@std@@QEAA@AEBQEBDH@Z.MSVCR100 ref: 6175F598
_CxxThrowException.MSVCR100 ref: 6175F5B6
??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 6175F5E2
_CxxThrowException.MSVCR100 ref: 6175F604
??0exception@std@@QEAA@AEBV01@@Z.MSVCR100 ref: 6175F620

Strings

bad allocation, xrefs: 6175F57C
regular expression error, xrefs: 6175F5CC

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0exception@std@@$ExceptionThrow$V01@@
String ID: bad allocation$regular expression error
API String ID: 2939144689-1547847425
Opcode ID: 5fa9f58f3d857d9f92b5b808727cd2121850fb16fef5b714fcd3f9735d2e6585
Instruction ID: 01eab6bd8fa3fc87e9af4b809989d6b71fa0a5e991a5431c129775bec7f6944b
Opcode Fuzzy Hash: 5fa9f58f3d857d9f92b5b808727cd2121850fb16fef5b714fcd3f9735d2e6585
Instruction Fuzzy Hash: 31112B72208B8AE2DB10CF14F584789B771F798398F444516EA8D43B28DB7DC6ADCB40

Function 61756410 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@AEAV123@@Z.MSVCR100 ref: 6175643C
??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 6175645E
_CxxThrowException.MSVCR100 ref: 6175647C
??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 6175648E
??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 617564B5

Strings

tOua, xrefs: 61756464
_PTarget, xrefs: 61756448

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: Concurrency@@Lock@details@ReentrantScoped_lock@_$??1_$??0_??0exception@std@@ExceptionThrowV123@@
String ID: _PTarget$tOua
API String ID: 124525874-1708587465
Opcode ID: 7e7b5897c4648ae3e431efb8451f73c5abe97544afe1c43d02f1358e784a883e
Instruction ID: c99d20a14f5403863e12cc1bc14b5d4ba6eafbb6ebf447399cfb0bf1f5b6b352
Opcode Fuzzy Hash: 7e7b5897c4648ae3e431efb8451f73c5abe97544afe1c43d02f1358e784a883e
Instruction Fuzzy Hash: 9A116032208B4492DB10CF14F44438D7771F785BA4F688662EAAD477B8DF39CA6AC780

Function 61757160 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 617572EC: ??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@AEAV123@@Z.MSVCR100 ref: 61757316
Part of subcall function 617572EC: ?set@event@Concurrency@@QEAAXXZ.MSVCR100 ref: 617573A1
Part of subcall function 617572EC: ??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 617573AC

?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QEAA_NXZ.MSVCR100 ref: 617571A5
??0invalid_operation@Concurrency@@QEAA@PEBD@Z.MSVCR100 ref: 617571F0
_CxxThrowException.MSVCR100 ref: 61757202
??1critical_section@Concurrency@@QEAA@XZ.MSVCR100 ref: 6175720C
??1event@Concurrency@@QEAA@XZ.MSVCR100 ref: 61757217

Strings

Deleting link registry before removing all the links, xrefs: 617571E4
P ua, xrefs: 617571CC

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: Concurrency@@$Lock@details@ReentrantScoped_lock@_Spin$??0_??0invalid_operation@??1_??1critical_section@??1event@?set@event@ExceptionOnce@?$_ThrowV123@@Wait@$00@details@
String ID: Deleting link registry before removing all the links$P ua
API String ID: 2644273089-1598919298
Opcode ID: e3d34f34ca7835a627fe4c96e9c8a381666f2a6b89bf1b36771840f618b37700
Instruction ID: a941add362124431ac4a51c21a9d0b520b4addc0e132663d56d491f7ca600e02
Opcode Fuzzy Hash: e3d34f34ca7835a627fe4c96e9c8a381666f2a6b89bf1b36771840f618b37700
Instruction Fuzzy Hash: BB214C32218B45A6EB40CF64E88439D7771F785B65F888221EA5D477B8DF39C9A8C700

Function 61757234 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 61757267
_CxxThrowException.MSVCR100 ref: 61757285
??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@AEAV123@@Z.MSVCR100 ref: 61757294
?set@event@Concurrency@@QEAAXXZ.MSVCR100 ref: 617572C6
??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 617572D2

Strings

tOua, xrefs: 6175726D
_PTarget, xrefs: 61757254

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: Concurrency@@$Lock@details@ReentrantScoped_lock@_$??0_??0exception@std@@??1_?set@event@ExceptionThrowV123@@
String ID: _PTarget$tOua
API String ID: 3905866857-1708587465
Opcode ID: a7b9406cd68bc751b75540f35d75a937b66b6ecc6b5fa38f923d512b74131686
Instruction ID: 563a8e7dd6d7363cabb05aa3a660fb40fb4e4bc84e5a99ef837ebda596125368
Opcode Fuzzy Hash: a7b9406cd68bc751b75540f35d75a937b66b6ecc6b5fa38f923d512b74131686
Instruction Fuzzy Hash: 08116D32208A45A2DB10CF14E94438C7731F785BA4F948621D76D476B4EF3AC969C300

Function 61695928 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 6169594E

Part of subcall function 61691740: _amsg_exit.LIBCMT ref: 6169176A

SetCurrentDirectoryW.KERNEL32 ref: 6169596B
GetLastError.KERNEL32 ref: 61695975
__doserrno.LIBCMT ref: 61695993
_errno.LIBCMT ref: 6169599E
_invalid_parameter_noinfo.LIBCMT ref: 616959A9

Strings

:, xrefs: 6169595E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CurrentDirectoryErrorLast__doserrno_amsg_exit_errno_invalid_parameter_noinfo_lock
String ID: :
API String ID: 4028197287-336475711
Opcode ID: f18d682a88b1fe565965954c1f07202d7e9f73b8e74231e37a243ff00a6a1e36
Instruction ID: 4fed293fb1d42c4dcfb0a24066ed7b0ee1b4c574643b7aab4e7030314fc29c46
Opcode Fuzzy Hash: f18d682a88b1fe565965954c1f07202d7e9f73b8e74231e37a243ff00a6a1e36
Instruction Fuzzy Hash: E001D47A60828387F710AFB0D45031D3372EBCA72DF544A26D658473A0DB2CC0058B15

Function 616A303C Relevance: 12.1, APIs: 8, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 616A30B7
_fileno.LIBCMT ref: 616A30D2
_fileno.LIBCMT ref: 616A30DF
_fileno.LIBCMT ref: 616A30EE
_fileno.LIBCMT ref: 616A3115
_fileno.LIBCMT ref: 616A3122
_fileno.LIBCMT ref: 616A312F
_fileno.LIBCMT ref: 616A313E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _fileno
String ID:
API String ID: 467780811-0
Opcode ID: 0282544ad22641c65687f14427829d34fb466da75a6df85f6bead54e9d9b7b46
Instruction ID: 902c5abc484521d61b6cbd99cf33a42fa5641ef2d4f0df33e88cfda0309d1d73
Opcode Fuzzy Hash: 0282544ad22641c65687f14427829d34fb466da75a6df85f6bead54e9d9b7b46
Instruction Fuzzy Hash: 8751343A20978283D711CB21968436D7BB1FB867A9F14C615DFA943BD0DB3CD8A2C750

Function 61690B0C Relevance: 12.1, APIs: 8, Instructions: 123COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,00000000,61690D95,?,?,00000000,6169176F), ref: 61690B37
_lock.LIBCMT ref: 61690BA7
DecodePointer.KERNEL32(?,?,?,?,?,?,00000000,61690D95,?,?,00000000,6169176F), ref: 61690BDA
DecodePointer.KERNEL32(?,?,?,?,?,?,00000000,61690D95,?,?,00000000,6169176F), ref: 61690BF8
DecodePointer.KERNEL32(?,?,?,?,?,?,00000000,61690D95,?,?,00000000,6169176F), ref: 61690C38
DecodePointer.KERNEL32(?,?,?,?,?,?,00000000,61690D95,?,?,00000000,6169176F), ref: 61690C52
DecodePointer.KERNEL32(?,?,?,?,?,?,00000000,61690D95,?,?,00000000,6169176F), ref: 61690C62
ExitProcess.KERNEL32 ref: 61690CC7

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: DecodePointer$ExitHandleModuleProcess_lock
String ID:
API String ID: 499131415-0
Opcode ID: 1fac90e4e148d4432301285cd5cd77b94e726262e77ce1c531bf42e548951eac
Instruction ID: 82d76236413ee719bf5493850ea0cacc4a811d678c00282bc8464570433b7f5e
Opcode Fuzzy Hash: 1fac90e4e148d4432301285cd5cd77b94e726262e77ce1c531bf42e548951eac
Instruction Fuzzy Hash: 1341E27A61A782C3E7418F15E94039D33B9F788BA9F188C25DA99C3714EF39C096C701

Function 616DD5D4 Relevance: 12.1, APIs: 8, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 616DD5F7
_errno.LIBCMT ref: 616DD5FF
_lseek_nolock.LIBCMT ref: 616DD65C

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: __doserrno_errno_lseek_nolock
String ID:
API String ID: 3948042459-0
Opcode ID: 3b60aa6ff9b77e2df270921a83d2b99f7cbea908284103e46c61e793520a0cbd
Instruction ID: 389cf263a424e055c6708a8f8754b6cf2ca2c3b51f8a69cafc390cceaca1ca88
Opcode Fuzzy Hash: 3b60aa6ff9b77e2df270921a83d2b99f7cbea908284103e46c61e793520a0cbd
Instruction Fuzzy Hash: 75115C37B152A146D7066F65E94031D7923A7C176AF4AC105DB180B3E1DB788441CFD5

Function 61691654 Relevance: 12.1, APIs: 8, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

_FF_MSGBANNER.LIBCMT ref: 6169167B

Part of subcall function 61691030: _set_error_mode.LIBCMT ref: 61691039
Part of subcall function 61691030: _set_error_mode.LIBCMT ref: 61691048

Part of subcall function 61690DCC: _set_error_mode.LIBCMT ref: 61690E11
Part of subcall function 61690DCC: _set_error_mode.LIBCMT ref: 61690E22
Part of subcall function 61690DCC: GetModuleFileNameW.KERNEL32 ref: 61690E84

Part of subcall function 61690944: ExitProcess.KERNEL32 ref: 61690953

Part of subcall function 616D8A90: malloc.LIBCMT ref: 616D8ABB
Part of subcall function 616D8A90: Sleep.KERNEL32(?,?,?,616916B5,?,?,?,61691763,?,?,?,?,?,?,00000000,616920BC), ref: 616D8ACE

_errno.LIBCMT ref: 616916BD
_lock.LIBCMT ref: 616916D1
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,61691763,?,?,?,?,?,?,00000000,616920BC,?,?,?,61695695), ref: 616916E7
free.LIBCMT ref: 616916F4
_errno.LIBCMT ref: 616916F9
LeaveCriticalSection.KERNEL32(?,?,?,61691763,?,?,?,?,?,?,00000000,616920BC,?,?,?,61695695), ref: 6169171C

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _set_error_mode$CriticalSection_errno$CountExitFileInitializeLeaveModuleNameProcessSleepSpin_lockfreemalloc
String ID:
API String ID: 113790786-0
Opcode ID: dadbb772010af8e1603bda05c82fcb06af786adf20652ebb32309c2a928575f5
Instruction ID: 8320661d77cc653b6f95455ac8e9e0d78b30114ffe49cdcb4ae6c86ca49dfc99
Opcode Fuzzy Hash: dadbb772010af8e1603bda05c82fcb06af786adf20652ebb32309c2a928575f5
Instruction Fuzzy Hash: 2D21063DA5969383E7159B60E41476E23BEFBC17A8F2CDC24D6464B694CF3DC4418345

Function 6169A870 Relevance: 12.0, APIs: 8, Instructions: 50synchronizationCOMMONLIBRARYCODE

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 6169A89A
GetExitCodeProcess.KERNEL32 ref: 6169A8AC
GetLastError.KERNEL32 ref: 6169A8BB
_errno.LIBCMT ref: 6169A8C6
__doserrno.LIBCMT ref: 6169A8D1
GetLastError.KERNEL32 ref: 6169A8DE
CloseHandle.KERNEL32 ref: 6169A8F2
_errno.LIBCMT ref: 6169A905

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ErrorLast_errno$CloseCodeExitHandleObjectProcessSingleWait__doserrno
String ID:
API String ID: 280878599-0
Opcode ID: 2868334d3139bb4fad9e840435609b0fcfb8628aaf72abb884866a2dd74c65b2
Instruction ID: c805eb560dc011026ab4102541cecd6f1d4edb4d32bff3a8374f3bbfc8d66ebe
Opcode Fuzzy Hash: 2868334d3139bb4fad9e840435609b0fcfb8628aaf72abb884866a2dd74c65b2
Instruction Fuzzy Hash: FE11E7B9B0868287FB009F61A94432D3672B789BF1F55C721E6764B7F4DB38C0428711

Function 6169730C Relevance: 12.0, APIs: 8, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 61697319
_errno.LIBCMT ref: 61697321
_invalid_parameter_noinfo.LIBCMT ref: 6169732D
GetFileAttributesW.KERNEL32 ref: 6169733E
GetLastError.KERNEL32 ref: 61697349
_errno.LIBCMT ref: 61697356

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$AttributesErrorFileLast__doserrno_invalid_parameter_noinfo
String ID:
API String ID: 2953107838-0
Opcode ID: 44e8a5bfc5585dea19d37132c0d8019dedfd288e6f7e132648223526bd0d6f45
Instruction ID: 5f956e721cb560d9dc576e97f27340adc44fd435cc590a2a571da515738df9d7
Opcode Fuzzy Hash: 44e8a5bfc5585dea19d37132c0d8019dedfd288e6f7e132648223526bd0d6f45
Instruction Fuzzy Hash: 96F062BD609203CBFB052FF4A84639D32735B9576AF49CD11DF208B2D2CB3844408EA5

Function 616953EC Relevance: 12.0, APIs: 8, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 616953F9
_errno.LIBCMT ref: 61695401
_invalid_parameter_noinfo.LIBCMT ref: 6169540D
GetFileAttributesA.KERNEL32 ref: 6169541E
GetLastError.KERNEL32 ref: 61695429
_errno.LIBCMT ref: 61695436

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$AttributesErrorFileLast__doserrno_invalid_parameter_noinfo
String ID:
API String ID: 2953107838-0
Opcode ID: 14f6a73c5e0977c9fbc2cb90e3415c11c502771ccc8c8ceec2e017113f2669d9
Instruction ID: 3763fe5e1ea2366eea975d66ccc7bb5262623e4644cc955598c9871cfc00d7cf
Opcode Fuzzy Hash: 14f6a73c5e0977c9fbc2cb90e3415c11c502771ccc8c8ceec2e017113f2669d9
Instruction Fuzzy Hash: 49F062B970B3038BFB452BF4A94135D32735B95B2BF49CD12DE204F2E2DB38844086A5

Function 616A75D0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 240COMMON

Download Yara Rule

APIs

Part of subcall function 61692064: GetLastError.KERNEL32(?,?,?,61695695,?,?,?,?,616D8D9D,?,?,?,616CF018), ref: 6169206E
Part of subcall function 61692064: FlsGetValue.KERNEL32(?,?,?,61695695,?,?,?,?,616D8D9D,?,?,?,616CF018), ref: 6169207C
Part of subcall function 61692064: FlsSetValue.KERNEL32(?,?,?,61695695,?,?,?,?,616D8D9D,?,?,?,616CF018), ref: 616920A8
Part of subcall function 61692064: GetCurrentThreadId.KERNEL32 ref: 616920BC
Part of subcall function 61692064: SetLastError.KERNEL32(?,?,?,61695695,?,?,?,?,616D8D9D,?,?,?,616CF018), ref: 616920D4

Part of subcall function 616D8B14: Sleep.KERNEL32(?,?,?,61692097,?,?,?,61695695,?,?,?,?,616D8D9D), ref: 616D8B59

_errno.LIBCMT ref: 616A78D8
_invalid_parameter_noinfo.LIBCMT ref: 616A78E3

Strings

JanFebMarAprMayJunJulAugSepOctNovDec, xrefs: 616A7730
gfff, xrefs: 616A7788
;, xrefs: 616A7682
;, xrefs: 616A766F

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ErrorLastValue$CurrentSleepThread_errno_invalid_parameter_noinfo
String ID: ;$;$JanFebMarAprMayJunJulAugSepOctNovDec$gfff
API String ID: 1962487656-880385205
Opcode ID: a0e62373bb17aa3bbf02b78116d7aed55dc8e6f8f4ea2cf6cd5f0e20622559d9
Instruction ID: ed9ee57714c353ed0cc162f266d5dd6e19d29fb3442e29e4089298012c28cefd
Opcode Fuzzy Hash: a0e62373bb17aa3bbf02b78116d7aed55dc8e6f8f4ea2cf6cd5f0e20622559d9
Instruction Fuzzy Hash: E28118777052C58BD70ACE2CC4957D93FE2D3A2748F09C12ADA408B75AE63AD90AC752

Function 6168AEA0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 220threadmemoryCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6168AEB8
std::exception::exception.LIBCMT ref: 6168B056
GetCurrentThreadId.KERNEL32 ref: 6168B09A
VirtualProtect.KERNEL32 ref: 6168B1AD
std::exception::exception.LIBCMT ref: 6168B1CB

Part of subcall function 6168B1F4: WaitForMultipleObjects.KERNEL32 ref: 6168B27C

Strings

pContext, xrefs: 6168B03A, 6168B1B5

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CurrentThreadstd::exception::exception$MultipleObjectsProtectVirtualWait
String ID: pContext
API String ID: 867383853-2046700901
Opcode ID: f26a7383001d32b3c2f742e033be9d30d687146ec277ad5111334bc384e3dcf2
Instruction ID: 36743d24ed201ea1e0dd02d5227d11e7319ddf9418c8eff3298e0ceca7772c9e
Opcode Fuzzy Hash: f26a7383001d32b3c2f742e033be9d30d687146ec277ad5111334bc384e3dcf2
Instruction Fuzzy Hash: 1D91B03A209B8696EB60CF65E45039D7771F789B88F88C012DB9E07B64DF79C54AC350

Function 6167F324 Relevance: 10.7, APIs: 7, Instructions: 184COMMONLIBRARYCODE

Download Yara Rule

APIs

QueryDepthSList.KERNEL32(?,?,?,?,?,?,?,?,6167F2DD), ref: 6167F47A
InterlockedPushEntrySList.KERNEL32(?,?,?,?,?,?,?,?,6167F2DD), ref: 6167F495
QueryDepthSList.KERNEL32(?,?,?,?,?,?,?,?,6167F2DD), ref: 6167F49F
InterlockedFlushSList.KERNEL32(?,?,?,?,?,?,?,?,6167F2DD), ref: 6167F4D4
InterlockedPushEntrySList.KERNEL32(?,?,?,?,?,?,?,?,6167F2DD), ref: 6167F4FA
TlsFree.KERNEL32(?,?,?,?,?,?,?,?,6167F2DD), ref: 6167F548
InterlockedPopEntrySList.KERNEL32(?,?,?,?,?,?,?,?,6167F2DD), ref: 6167F5DD

Part of subcall function 616843CC: InterlockedFlushSList.KERNEL32 ref: 616843E3
Part of subcall function 616843CC: InterlockedFlushSList.KERNEL32 ref: 61684414

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: List$Interlocked$EntryFlush$DepthPushQuery$Free
String ID:
API String ID: 3985742171-0
Opcode ID: a513889d92382b1447f7de881cf64cb007bdca829629ab5f24aa2c0bc79126a3
Instruction ID: b0d99169e1bd5095860a1fca6db25ac3cfa6a5947b340e17ba09dcc1b565b7b2
Opcode Fuzzy Hash: a513889d92382b1447f7de881cf64cb007bdca829629ab5f24aa2c0bc79126a3
Instruction Fuzzy Hash: 54710F76215B809BEB21CF25E940B9D33B6F384B99F448226CF2A47B64CF38C461C740

Function 6169FCB0 Relevance: 10.7, APIs: 7, Instructions: 174COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169FCE3
_invalid_parameter_noinfo.LIBCMT ref: 6169FCEE
_fileno.LIBCMT ref: 6169FD28
_errno.LIBCMT ref: 6169FD98
_invalid_parameter_noinfo.LIBCMT ref: 6169FDA3

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno
String ID:
API String ID: 3947385824-0
Opcode ID: cf6c5e846a74429edd85737948a24788b0b3d0ea6f8c3af24df4c2ce0e22ff9a
Instruction ID: e269f1a3823a29189479cc43647c41abb68912e3c281fa29f7f907a595457a2c
Opcode Fuzzy Hash: cf6c5e846a74429edd85737948a24788b0b3d0ea6f8c3af24df4c2ce0e22ff9a
Instruction Fuzzy Hash: 4351143A20574387DB06CBA5A45026D7EB2BB85FA8F16CE56FA6A87795DF38C401C304

Function 616882A8 Relevance: 10.6, APIs: 7, Instructions: 146synchronizationCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 616882D4
WaitForSingleObject.KERNEL32 ref: 616882E6
TlsGetValue.KERNEL32 ref: 616883CB
ReleaseSemaphore.KERNEL32 ref: 61688441
GetTickCount.KERNEL32 ref: 61688475
WaitForSingleObject.KERNEL32 ref: 6168849D
CloseHandle.KERNEL32 ref: 616884B7

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CountObjectSingleTickWait$CloseHandleReleaseSemaphoreValue
String ID:
API String ID: 2463594477-0
Opcode ID: b208b46dfab0b08fa96a0cf9e073c7fe55cde0a8637b648a28502c9269e673ae
Instruction ID: f928cbfa639f74202b9ede282e34e90e99d632c842673696c80f84bab0c4ddc3
Opcode Fuzzy Hash: b208b46dfab0b08fa96a0cf9e073c7fe55cde0a8637b648a28502c9269e673ae
Instruction Fuzzy Hash: 4551F136709B808BEB49DBB9D5543AD7362F785BA4F048229CB6A877B0DF38C455C390

Function 6168BCB8 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 616821B4: InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,?,?,6167BB4C), ref: 61682204
Part of subcall function 616821B4: GetCurrentThread.KERNEL32 ref: 616822C7
Part of subcall function 616821B4: GetThreadPriority.KERNEL32(?,?,?,?,?,6167BB4C), ref: 616822D0

EnterCriticalSection.KERNEL32 ref: 6168BD51
LeaveCriticalSection.KERNEL32 ref: 6168BDAD

Part of subcall function 616D8DBC: malloc.LIBCMT ref: 616D8DD6

Part of subcall function 6168A5D0: CreateEventW.KERNEL32 ref: 6168A611
Part of subcall function 6168A5D0: GetLastError.KERNEL32 ref: 6168A620

CreateEventW.KERNEL32 ref: 6168BDBD
GetLastError.KERNEL32 ref: 6168BDCF
GetLastError.KERNEL32 ref: 6168BE1A
GetLastError.KERNEL32 ref: 6168BE6C
InitializeSListHead.KERNEL32 ref: 6168BEA3

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ErrorLast$CriticalSection$CreateEventInitializeThread$CountCurrentEnterHeadLeaveListPrioritySpinmalloc
String ID:
API String ID: 3053325962-0
Opcode ID: 5bd18fc7c93f525d8d766988577e51343a8f4e985883e9349b8f7079bb519116
Instruction ID: 35e7a5ae87376280bd991a3253dc00477ada53fb6a0a352093fe5952b0b9eeba
Opcode Fuzzy Hash: 5bd18fc7c93f525d8d766988577e51343a8f4e985883e9349b8f7079bb519116
Instruction Fuzzy Hash: 1451B036305B8192EB59DB71E8543DA73B2FB88799F448126CB9E433A4EF39C465C310

Function 6167E3A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6167E3D5

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

InterlockedPopEntrySList.KERNEL32 ref: 6167E406
TlsGetValue.KERNEL32 ref: 6167E489

Strings

proc, xrefs: 6167E3C2

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: EntryExceptionInterlockedListRaiseValuestd::exception::exception
String ID: proc
API String ID: 2218005756-735085620
Opcode ID: c0d07d9867c0c85077fc0f04318041a81b08fd9fde93509a6f4975dbfd6f3799
Instruction ID: 017d52f9aeb6453bb4c92a02b57484056dc2bcb59c00c9bbc5aa4e1e34a33f94
Opcode Fuzzy Hash: c0d07d9867c0c85077fc0f04318041a81b08fd9fde93509a6f4975dbfd6f3799
Instruction Fuzzy Hash: EB5167B6205B4887EB24CF26E44439977B1F789F99F48812ACB9E07760EF39D858C744

Function 6168A02C Relevance: 10.6, APIs: 7, Instructions: 119sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6168A088

Part of subcall function 616740A8: std::exception::exception.LIBCMT ref: 616740C8

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

GetLastError.KERNEL32 ref: 6168A0CE
SetEvent.KERNEL32 ref: 6168A12D
Sleep.KERNEL32 ref: 6168A16A
Sleep.KERNEL32 ref: 6168A1A1
WaitForSingleObject.KERNEL32 ref: 6168A1B4
Sleep.KERNEL32 ref: 6168A1EA

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Sleep$ErrorLast$EventExceptionObjectRaiseSingleWaitstd::exception::exception
String ID:
API String ID: 4069521859-0
Opcode ID: cc0ce11f144d7f33da0d32a194008e5b95eb4d1ded5fda0dbe19138c0165e87c
Instruction ID: cebf4f128fd79f511e01269ca6df3ae67c5ba4bca9b85bf6cb264c6ddfaf70fa
Opcode Fuzzy Hash: cc0ce11f144d7f33da0d32a194008e5b95eb4d1ded5fda0dbe19138c0165e87c
Instruction Fuzzy Hash: 28518C76204B4085EB40CF65E8A439933B2FB88BDDF18912ACE5D87768DF3AC956C350

Function 6169C7D8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169C7FB
_invalid_parameter_noinfo.LIBCMT ref: 6169C806
_fileno.LIBCMT ref: 6169C848
_errno.LIBCMT ref: 6169C8B8
_invalid_parameter_noinfo.LIBCMT ref: 6169C8C3

Strings

@, xrefs: 6169C83B

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno
String ID: @
API String ID: 3947385824-2766056989
Opcode ID: 7732cbde19be314e44aac538ceb60d8027b5076fcd1711ee41e36c3ce92d9749
Instruction ID: 16f5c4d9eeb0cdfd896adadb6da93189616ab52897febff0ee0ff6d7f100ce88
Opcode Fuzzy Hash: 7732cbde19be314e44aac538ceb60d8027b5076fcd1711ee41e36c3ce92d9749
Instruction Fuzzy Hash: 0B312B7A30574343FB058B69A95036D7E62BB85BB4F59CE26DE6B8A2D4DB38C041C300

Function 6168F6EC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6168F73B

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

Part of subcall function 616CFA94: _getptd.LIBCMT ref: 616CFA98

DecodePointer.KERNEL32 ref: 6168F7B7
RaiseException.KERNEL32 ref: 6168F85A
std::exception::exception.LIBCMT ref: 6168F8A5

Part of subcall function 616CF1F4: std::exception::operator=.LIBCMT ref: 616CF210

Strings

csm, xrefs: 6168F77A
bad exception, xrefs: 6168F728

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ExceptionRaisestd::exception::exception$DecodePointer_getptdstd::exception::operator=
String ID: bad exception$csm
API String ID: 2308181687-1249633139
Opcode ID: 25f5683e5a7b7d17836758188af33820d4208e648678836955e667bb4cdb4321
Instruction ID: 74c38c9434ca9b2f7b3b2adfa9e700e3a1badb57cce1f6ca63a508a090fe48bd
Opcode Fuzzy Hash: 25f5683e5a7b7d17836758188af33820d4208e648678836955e667bb4cdb4321
Instruction Fuzzy Hash: 5441AF7A210B8589DB60CF61D8403E83379F748BACF598212DA6D47F98CF35C595C740

Function 61674AF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 61674B20

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

TlsGetValue.KERNEL32 ref: 61674B51
EnterCriticalSection.KERNEL32 ref: 6167A501
LeaveCriticalSection.KERNEL32 ref: 6167A553
SetEvent.KERNEL32 ref: 6167A563

Strings

pScheduler, xrefs: 61674B0D

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CriticalSection$EnterEventExceptionLeaveRaiseValuestd::exception::exception
String ID: pScheduler
API String ID: 161914421-923244539
Opcode ID: 4a0dd5ab3653cd8598daa17ba78d3211c36834b2c229728f6320d605f3a8c4d7
Instruction ID: 5ffefb714ec4f0311f7fb8c476bb2b0411b6cc19ecb41d4d69eade495ebc47a6
Opcode Fuzzy Hash: 4a0dd5ab3653cd8598daa17ba78d3211c36834b2c229728f6320d605f3a8c4d7
Instruction Fuzzy Hash: 8F41E376708B8192DB24DF15E45439D7372F788BE8F588122DA9E43764EF78C966C700

Function 6169D408 Relevance: 10.6, APIs: 7, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169D41F
_invalid_parameter_noinfo.LIBCMT ref: 6169D42A

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: 1cd00314af6734f49247f5a8054da3340dbb3c2b3d48c3afaed5b4e0387fb79c
Instruction ID: 3a0d9d95bbd10456b5b72a033fcf1e1296f028d0e5341a7388fcf11190a5d197
Opcode Fuzzy Hash: 1cd00314af6734f49247f5a8054da3340dbb3c2b3d48c3afaed5b4e0387fb79c
Instruction Fuzzy Hash: A131E73A61564387DB118B6DC28036C3761F7867ACF50CA25DB6AC7690DB38D4A2C740

Function 6169D2B0 Relevance: 10.6, APIs: 7, Instructions: 95COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169D2C7
_invalid_parameter_noinfo.LIBCMT ref: 6169D2D2

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: 0da03f6180c710f92dd11a9822ee99fe25bcca878c23ccf36bbb05e83a58d1af
Instruction ID: 70309b660bf8835e9f9a88f92de2c81395b3af684a9c58e87890769fd7270a70
Opcode Fuzzy Hash: 0da03f6180c710f92dd11a9822ee99fe25bcca878c23ccf36bbb05e83a58d1af
Instruction Fuzzy Hash: 6831F43A61864387DB018FB9D28036C3BA1F7877A9F54CE25DB6993690DB78C4A2C740

Function 61763108 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90stringCOMMON

Download Yara Rule

APIs

localeconv.MSVCR100 ref: 6176312F
strlen.MSVCR100 ref: 6176315F
strlen.MSVCR100 ref: 6176319A
strlen.MSVCR100 ref: 617631D5

Strings

false, xrefs: 61763190
true, xrefs: 617631CB

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: strlen$localeconv
String ID: false$true
API String ID: 618594221-2658103896
Opcode ID: f150b292f2c1248f225175a6e9d8b6fa72a8da774720d357734352cf1c27007b
Instruction ID: 0c0c48231235e1f856754d51d67f6f9791477363f3e945c8f43a5e5596fe122c
Opcode Fuzzy Hash: f150b292f2c1248f225175a6e9d8b6fa72a8da774720d357734352cf1c27007b
Instruction Fuzzy Hash: AD31B226109BC181D706CF26A60835DFBB1E799BECF18C265CEA90B759CF68C15BC384

Function 6169ED58 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169ED8A
_invalid_parameter_noinfo.LIBCMT ref: 6169ED95
_fileno.LIBCMT ref: 6169EDC4
_errno.LIBCMT ref: 6169EE34
_invalid_parameter_noinfo.LIBCMT ref: 6169EE3F

Strings

@, xrefs: 6169EDB7

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno
String ID: @
API String ID: 3947385824-2766056989
Opcode ID: 0e43267210b1b3b832943b124bb6625d3352ed88aec7bd6f832cfed21ebd6084
Instruction ID: ef2481fd3a09bcae42ce4dde5dccc199eeef5fd8c07222b892aa734ca88f27fa
Opcode Fuzzy Hash: 0e43267210b1b3b832943b124bb6625d3352ed88aec7bd6f832cfed21ebd6084
Instruction Fuzzy Hash: 2221F76A20474343EB058B6A6C503697662BB95BF8F689A22DE39873E4DF38C111C244

Function 61755200 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

??0invalid_link_target@Concurrency@@QEAA@PEBD@Z.MSVCR100(?,?,?,?,?,?,?,61753BDE), ref: 61755247
_CxxThrowException.MSVCR100 ref: 61755259
??0invalid_link_target@Concurrency@@QEAA@PEBD@Z.MSVCR100(?,?,?,?,?,?,?,61753BDE), ref: 617552A2
_CxxThrowException.MSVCR100 ref: 617552B4
??_V@YAXPEAX@Z.MSVCR100(?,?,?,?,?,?,?,61753BDE), ref: 61755301

Strings

_Link, xrefs: 6175523C, 61755296

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0invalid_link_target@Concurrency@@ExceptionThrow
String ID: _Link
API String ID: 3916662256-3418048212
Opcode ID: 25558a8eadfd14843a1fd50a5024366b9734e29012ca6fa7afb69e37d5d84ece
Instruction ID: 5ca1b3da146ab7ff548b74145f035934b404463b954e5c080820d9af830d40ca
Opcode Fuzzy Hash: 25558a8eadfd14843a1fd50a5024366b9734e29012ca6fa7afb69e37d5d84ece
Instruction Fuzzy Hash: 35316DB2209F4082DB00CF51EA5465CB776F388FD8F958622EA6E47768DF75C566C380

Function 616A88D8 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83timeCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A88F5
_invalid_parameter_noinfo.LIBCMT ref: 616A8900
GetLocalTime.KERNEL32 ref: 616A8914

Strings

gfff, xrefs: 616A892C
/, xrefs: 616A893B
/, xrefs: 616A8937

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: LocalTime_errno_invalid_parameter_noinfo
String ID: /$/$gfff
API String ID: 2620414595-3252747359
Opcode ID: 5f42100513a871392e8f6fc020c9f0397f42100cec876e209b331600e6d270a3
Instruction ID: 939080e2dde93687b58d3ea3fab8f7afec61d4615d8baa2175aa3774d5e002d8
Opcode Fuzzy Hash: 5f42100513a871392e8f6fc020c9f0397f42100cec876e209b331600e6d270a3
Instruction Fuzzy Hash: A0217C976292C18BE3068F3CE85638A6FA6E3E5708F4CD014D6848FB8AD63CC519C721

Function 61682EC8 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 61682F2F

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

EnterCriticalSection.KERNEL32 ref: 61682F5E
LeaveCriticalSection.KERNEL32 ref: 61682FE8

Strings

'pa, xrefs: 61682EF6
pExecutionResource, xrefs: 61682F19
'pa, xrefs: 61682EEF

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CriticalSection$EnterExceptionLeaveRaisestd::exception::exception
String ID: pExecutionResource$'pa$'pa
API String ID: 3055179850-3402273741
Opcode ID: 575b046a22a18941575a71274cb85b2ebe6194a40475ce52e48a1d115c72170a
Instruction ID: 8c7faaba34a47bc20dc55322eb509581302d3b0b7c64867b752bb70ccf0ab4d3
Opcode Fuzzy Hash: 575b046a22a18941575a71274cb85b2ebe6194a40475ce52e48a1d115c72170a
Instruction Fuzzy Hash: C7314876205F8486CA44CF2AE84028C77B5F789FD4F989226EB9D07B64DF38C566C740

Function 6169CCD4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169CCFB
_invalid_parameter_noinfo.LIBCMT ref: 6169CD06
_fileno.LIBCMT ref: 6169CD29
_errno.LIBCMT ref: 6169CD99
_invalid_parameter_noinfo.LIBCMT ref: 6169CDA4

Strings

@, xrefs: 6169CD1C

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno
String ID: @
API String ID: 3947385824-2766056989
Opcode ID: 85bb89b60c4e1e0b6ddd87000d7ee90a80f7ade18aaa43c1c3bb08d2f1a85e0e
Instruction ID: 0a165d37a5a16df3ac408b2737042f92a91d203b5aec6c33ce297be1b64ff80f
Opcode Fuzzy Hash: 85bb89b60c4e1e0b6ddd87000d7ee90a80f7ade18aaa43c1c3bb08d2f1a85e0e
Instruction Fuzzy Hash: 23213C7B208A4343DF058B74985036D3A72ABD5BB4F95DB26DA2A873E4DF38C406C354

Function 6169C684 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169C6A4
_invalid_parameter_noinfo.LIBCMT ref: 6169C6AF
_fileno.LIBCMT ref: 6169C6CF
_errno.LIBCMT ref: 6169C73F
_invalid_parameter_noinfo.LIBCMT ref: 6169C74A

Strings

@, xrefs: 6169C6C2

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno
String ID: @
API String ID: 3947385824-2766056989
Opcode ID: 94a4b249fd65a0cf581046c661d07ef4531eee4a86d79ffbaca5dd24d9b8304a
Instruction ID: 9b6b727e8999b43f53c4a7875666b84b76592c5250999488f231a389aad1f168
Opcode Fuzzy Hash: 94a4b249fd65a0cf581046c661d07ef4531eee4a86d79ffbaca5dd24d9b8304a
Instruction Fuzzy Hash: B5214D79209A4743DF058BB5A85037C3662ABC5B78F59DF22CA3B8B2E0DF38C1118354

Function 616A8B10 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 75timeCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A8B2D
_invalid_parameter_noinfo.LIBCMT ref: 616A8B38
GetLocalTime.KERNEL32 ref: 616A8B4C

Strings

:, xrefs: 616A8B6A
gfff, xrefs: 616A8B64
:, xrefs: 616A8B71

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: LocalTime_errno_invalid_parameter_noinfo
String ID: :$:$gfff
API String ID: 2620414595-2795524152
Opcode ID: 7186e8d73f4c848f8be93f7149886236addcee2746bae524db0a03d3e6a5e7b3
Instruction ID: 584268d272846e1f0da61420ccd970a835ade5a16e26746e786adf489435f349
Opcode Fuzzy Hash: 7186e8d73f4c848f8be93f7149886236addcee2746bae524db0a03d3e6a5e7b3
Instruction Fuzzy Hash: 74214D966292C18BE7028F3CD45238A6FA5E3A5748F48C045DA848B756D73CC51AC721

Function 617532B4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

??0invalid_operation@Concurrency@@QEAA@PEBD@Z.MSVCR100 ref: 617532DF
_CxxThrowException.MSVCR100 ref: 617532F1
??0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QEAA@AEAV123@@Z.MSVCR100 ref: 61753340
??1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 61753362
?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPEAX@Z0@Z.MSVCR100 ref: 617533C2

Strings

async_send called without registering a callback, xrefs: 617532D3

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: Concurrency@@$Lock@details@ReentrantScoped_lock@_$??0_??0invalid_operation@??1_CurrentExceptionScheduleScheduler@Task@ThrowV123@@
String ID: async_send called without registering a callback
API String ID: 2025733603-1686835759
Opcode ID: b6ee90c73c71d73f5dfc66736a485d230d81a31767dc79e264436f1c31a0f801
Instruction ID: f4166c1eec6788acf8f995a6cb6ce96fd3ed8febad74a04a2408e4fa5bdaf0d1
Opcode Fuzzy Hash: b6ee90c73c71d73f5dfc66736a485d230d81a31767dc79e264436f1c31a0f801
Instruction Fuzzy Hash: 8C316932209A45D2EB44CB29EA4439DB771F784B84F948422DB5987B35DF3AC5BAC340

Function 616DD308 Relevance: 10.6, APIs: 7, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 616DD32B
_errno.LIBCMT ref: 616DD333

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: cb3d93b428fb162e22540ccd785e7fa987475e45698172ca680a63b20d55bfa7
Instruction ID: 69c410f43b5ed8dc1738358b09649ac107434e4d97d31ec200fba004a27f9003
Opcode Fuzzy Hash: cb3d93b428fb162e22540ccd785e7fa987475e45698172ca680a63b20d55bfa7
Instruction Fuzzy Hash: C0115C7B71465286D7066F65E85031D7A23A7C276AF4BC105DF240B3D0CFB88441CBA5

Function 616DCAB4 Relevance: 10.6, APIs: 7, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 616DCAD7
_errno.LIBCMT ref: 616DCADF

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: ba1aef64d5423de7613766572440792cc7071c955a4b430d51cdda9508a0adeb
Instruction ID: 7e246108aa4fff0097e1ab9648e94f86d9f7a933a1d3a537ffebaa62712ba44b
Opcode Fuzzy Hash: ba1aef64d5423de7613766572440792cc7071c955a4b430d51cdda9508a0adeb
Instruction Fuzzy Hash: 3411573AB1965946D7025F65E80036D7523A7C1BBAF4DC709DE350F3D0CB38C4418799

Function 616DD458 Relevance: 10.6, APIs: 7, Instructions: 63COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616DD471
FlushFileBuffers.KERNEL32(?,?,?,6169E3D6,?,?,?,6169E50C,?,?,?,6168E0C4), ref: 616DD4D4
GetLastError.KERNEL32(?,?,?,6169E3D6,?,?,?,6169E50C,?,?,?,6168E0C4), ref: 616DD4DE
__doserrno.LIBCMT ref: 616DD4EE
_errno.LIBCMT ref: 616DD4F5

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$BuffersErrorFileFlushLast__doserrno
String ID:
API String ID: 1845094721-0
Opcode ID: 319b6e2d610539583d160c29f35e8f1bf16372b91154b41762b6d3405281c1a6
Instruction ID: 9cdab6e290ec754fc51a9ae49d267ef3b938a65e5e3e6611b72da2d7a1185cdd
Opcode Fuzzy Hash: 319b6e2d610539583d160c29f35e8f1bf16372b91154b41762b6d3405281c1a6
Instruction Fuzzy Hash: BF112979B0574246EB11BFA5A8903AD3A3297C17DDF4DC119DA150B3E0CB78C441CB58

Function 616D9E40 Relevance: 10.6, APIs: 7, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 616D9E59
_errno.LIBCMT ref: 616D9E61
_close_nolock.LIBCMT ref: 616D9EB8

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: __doserrno_close_nolock_errno
String ID:
API String ID: 186997739-0
Opcode ID: c5d1f6e1595d210cc2b95716d4ea9eb253871eb80bc236e58661ff8cb317301e
Instruction ID: fe9089c9abc4be3000c66d376823af22fdf7a989bda8789b0a95eea68dde3280
Opcode Fuzzy Hash: c5d1f6e1595d210cc2b95716d4ea9eb253871eb80bc236e58661ff8cb317301e
Instruction Fuzzy Hash: 0B119C3BF0968246E7056F65F8A031C3A23ABC17ADF59C625DA290B3D1CB78C441C758

Function 617561C4 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@AEAV123@@Z.MSVCR100 ref: 617561EA
??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 6175620C
_CxxThrowException.MSVCR100 ref: 6175622A
??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 6175625C

Strings

tOua, xrefs: 61756212
_PTarget, xrefs: 617561F6

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: Concurrency@@Lock@details@ReentrantScoped_lock@_$??0_??0exception@std@@??1_ExceptionThrowV123@@
String ID: _PTarget$tOua
API String ID: 449426131-1708587465
Opcode ID: 8edc5562fd63baac52e647e1cf5b65c1132dbb2f11a9e3016306b909d17b9015
Instruction ID: 637846a8589093ca9b1773ad444cf2cbb3a6f50b582615133bdc4b67be939575
Opcode Fuzzy Hash: 8edc5562fd63baac52e647e1cf5b65c1132dbb2f11a9e3016306b909d17b9015
Instruction Fuzzy Hash: 81114C32208A4592DA108F25E944389B331F798BE4F684222DBAD477B8DF39C569C740

Function 61756274 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@AEAV123@@Z.MSVCR100 ref: 6175629A
??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 617562BC
_CxxThrowException.MSVCR100 ref: 617562DA
??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 61756303

Strings

tOua, xrefs: 617562C2
_PTarget, xrefs: 617562A6

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: Concurrency@@Lock@details@ReentrantScoped_lock@_$??0_??0exception@std@@??1_ExceptionThrowV123@@
String ID: _PTarget$tOua
API String ID: 449426131-1708587465
Opcode ID: 5d8975085e171812300bdd56f8dce51114edd05465f47f6002d8e2f04fdccd63
Instruction ID: 98328318855713e2d69e7a5b229f98d861210a32eaea2a87bef19dd3bab15155
Opcode Fuzzy Hash: 5d8975085e171812300bdd56f8dce51114edd05465f47f6002d8e2f04fdccd63
Instruction Fuzzy Hash: 2C015232208A4592DB10CF18F944389B731F795BA8F584221E7AD476B8DF39C569C700

Function 6175753C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

??0event@Concurrency@@QEAA@XZ.MSVCR100(?,?,?,?,?,?,?,61751570), ref: 61757580
??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100(?,?,?,?,?,?,?,61751570), ref: 617575A7
_CxxThrowException.MSVCR100 ref: 617575C5

Strings

_PSource, xrefs: 61757591
tOua, xrefs: 617575AD
}ua, xrefs: 6175755A

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0event@??0exception@std@@Concurrency@@ExceptionThrow
String ID: _PSource$tOua$}ua
API String ID: 944994503-3536274865
Opcode ID: 2e920387dc33f4c524f944ae151333e8a0a941e9c34bec74044eb29bbf6b7035
Instruction ID: 0d942b7bafccd9ec7efdd63f9ca6058403e4c53ddeb1f5ece16b4dacf1ecb569
Opcode Fuzzy Hash: 2e920387dc33f4c524f944ae151333e8a0a941e9c34bec74044eb29bbf6b7035
Instruction Fuzzy Hash: CE117072208B4481DB108F04F544399B771F7487A8F688325D6AD077B8DF39C56AC740

Function 61756140 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 29COMMON

Download Yara Rule

APIs

??1critical_section@Concurrency@@QEAA@XZ.MSVCR100 ref: 61756167

Part of subcall function 617540A4: ?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QEAA_NXZ.MSVCR100(?,?,?,?,?,?,?,?,?,617544F1), ref: 617540F0
Part of subcall function 617540A4: ??1critical_section@Concurrency@@QEAA@XZ.MSVCR100(?,?,?,?,?,?,?,?,?,617544F1), ref: 61754127

??0invalid_operation@Concurrency@@QEAA@PEBD@Z.MSVCR100 ref: 61756196
_CxxThrowException.MSVCR100 ref: 617561A8

Strings

P ua, xrefs: 61756178
$Jua, xrefs: 617561AE
Deleting link registry before removing all the links, xrefs: 6175618A

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: Concurrency@@$??1critical_section@Spin$??0invalid_operation@ExceptionOnce@?$_ThrowWait@$00@details@
String ID: $Jua$Deleting link registry before removing all the links$P ua
API String ID: 1733054733-592582858
Opcode ID: 31ca34a4f2f89d9bbd68a06115402bf4dde9310f460b89a767c341ec5aa3ef6e
Instruction ID: 7d8d761502ad06f49ef9abc4808efffe84b1e8462ca4b5a60c90f36b775d429e
Opcode Fuzzy Hash: 31ca34a4f2f89d9bbd68a06115402bf4dde9310f460b89a767c341ec5aa3ef6e
Instruction Fuzzy Hash: 36016972208B01A1EB109F50E8443983375F788378F48432196AE022F8EF39C6BAC340

Function 616B2BF4 Relevance: 9.2, APIs: 6, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616B2C51
_invalid_parameter_noinfo.LIBCMT ref: 616B2C5D
_errno.LIBCMT ref: 616B2D40
_errno.LIBCMT ref: 616B2DC5
_invalid_parameter_noinfo.LIBCMT ref: 616B2DD1
_errno.LIBCMT ref: 616B2E2B

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: ad194d831e03a3361be2f49a0bbb7f307fc2dca0cd889eb6c3b33f72cb281788
Instruction ID: 46e4c5eb4e98439db101dd68fb44f8bc3e0e5059e120d6760bee9299ddb3cda8
Opcode Fuzzy Hash: ad194d831e03a3361be2f49a0bbb7f307fc2dca0cd889eb6c3b33f72cb281788
Instruction Fuzzy Hash: 5361482A70979189EB128FF9C59419D7FB1B712BA8B18C62DCFB51B7A8D734D0638301

Function 6168E9C4 Relevance: 9.2, APIs: 6, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::ReturnSubAllocator.LIBCMT ref: 6168EB3A
QueryDepthSList.KERNEL32 ref: 6168EBD7
InterlockedPushEntrySList.KERNEL32 ref: 6168EBF2
QueryDepthSList.KERNEL32 ref: 6168EBFC
InterlockedFlushSList.KERNEL32 ref: 6168EC2E
InterlockedPushEntrySList.KERNEL32 ref: 6168EC54

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: List$Interlocked$DepthEntryPushQuery$AllocatorBase::Concurrency::details::FlushReturnScheduler
String ID:
API String ID: 2125383497-0
Opcode ID: baccbe3c47373ea94f41a2fd6f2d59b8b018b8ee0f2c3e119da7c4d151884c5a
Instruction ID: dd0a6be768cc5efe611deabb94f3152e794746afe9c109f1e6d405a1e4328326
Opcode Fuzzy Hash: baccbe3c47373ea94f41a2fd6f2d59b8b018b8ee0f2c3e119da7c4d151884c5a
Instruction Fuzzy Hash: 78812F7A710B448ADB45CF6AC6907AE77B1F788F89F048126DE0A87728DF34D465C760

Function 61787340 Relevance: 9.2, APIs: 6, Instructions: 158COMMON

Download Yara Rule

APIs

fgetwc.MSVCR100 ref: 617873F6
fgetc.MSVCR100 ref: 61787430
memcpy_s.MSVCR100 ref: 6178750F
??3@YAXPEAX@Z.MSVCR100 ref: 6178757E

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??3@fgetcfgetwcmemcpy_s
String ID:
API String ID: 4087598233-0
Opcode ID: 09e80f566dafba8aaeb9b0bc44a85845f72b6da3b08b612088b326344d083961
Instruction ID: 6499665e4b757a3791a02948db4a77854a4e7d38f184c51de642f619ad9584ee
Opcode Fuzzy Hash: 09e80f566dafba8aaeb9b0bc44a85845f72b6da3b08b612088b326344d083961
Instruction Fuzzy Hash: F8713572201A81C9DB50CF6AD59039C77B2F749B8CF958632EA4E87BA8DF34C594C360

Function 6168D228 Relevance: 9.1, APIs: 6, Instructions: 135synchronizationsleepCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,?,?,6168D215), ref: 6168D24C
GetTickCount.KERNEL32 ref: 6168D274
Sleep.KERNEL32(?,?,?,6168D215), ref: 6168D28D
InterlockedPushEntrySList.KERNEL32(?,?,?,6168D215), ref: 6168D2CD
WaitForSingleObject.KERNEL32(?,?,?,6168D215), ref: 6168D3BE
CloseHandle.KERNEL32(?,?,?,6168D215), ref: 6168D3E1

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ObjectSingleWait$CloseCountEntryHandleInterlockedListPushSleepTick
String ID:
API String ID: 1290815868-0
Opcode ID: 0685c44eee99dcb6ad3d569bf5b606e07cad6a711856ac0dc3bb5be1fa51103a
Instruction ID: f1e86a87c876a47c63d8184ade68cdd5690d9b72a206e78bda0140dac2df9502
Opcode Fuzzy Hash: 0685c44eee99dcb6ad3d569bf5b606e07cad6a711856ac0dc3bb5be1fa51103a
Instruction Fuzzy Hash: 9C41577630868463DB49CF76A59439E73B2FB89BA8F008111DF6647750DF38D465C760

Function 616B4320 Relevance: 9.1, APIs: 6, Instructions: 118COMMON

Download Yara Rule

APIs

_getptd.LIBCMT ref: 616B433F

Part of subcall function 616920F0: _amsg_exit.LIBCMT ref: 61692106

Part of subcall function 616B3EF4: _getptd.LIBCMT ref: 616B3EFE
Part of subcall function 616B3EF4: _amsg_exit.LIBCMT ref: 616B3F9B

Part of subcall function 616B3FB4: GetOEMCP.KERNEL32(?,?,?,?,?,?,?,616B435A,?,?,?,?,?,616B4512), ref: 616B3FDE

Part of subcall function 616D8A90: malloc.LIBCMT ref: 616D8ABB
Part of subcall function 616D8A90: Sleep.KERNEL32(?,?,?,616916B5,?,?,?,61691763,?,?,?,?,?,?,00000000,616920BC), ref: 616D8ACE

free.LIBCMT ref: 616B43CA

Part of subcall function 616D8D78: HeapFree.KERNEL32(?,?,?,616CF018,?,?,?,616CF07E,?,?,?,616CF215,?,?,?,6167115E), ref: 616D8D8E
Part of subcall function 616D8D78: _errno.LIBCMT ref: 616D8D98
Part of subcall function 616D8D78: GetLastError.KERNEL32(?,?,?,616CF018,?,?,?,616CF07E,?,?,?,616CF215,?,?,?,6167115E), ref: 616D8DA0

_lock.LIBCMT ref: 616B43FA
free.LIBCMT ref: 616B449D
free.LIBCMT ref: 616B44C9
_errno.LIBCMT ref: 616B44CE

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: free$_amsg_exit_errno_getptd$ErrorFreeHeapLastSleep_lockmalloc
String ID:
API String ID: 3894533514-0
Opcode ID: 09bdd8d315bb947166f2b335ea7e558dd6c56cafa1d5cbbc95f5f0d15fd75df3
Instruction ID: 6dcfc54a080dbb68aece7d411557539d963feaaf5dbd31151f8614a7e182bdda
Opcode Fuzzy Hash: 09bdd8d315bb947166f2b335ea7e558dd6c56cafa1d5cbbc95f5f0d15fd75df3
Instruction Fuzzy Hash: CF41113A60AA8186E715CF25E44039DB7B6F784B98F18C116CA6B47768CFBDC032C754

Function 6167DA90 Relevance: 9.1, APIs: 6, Instructions: 102synchronizationCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6167DAAC
WaitForSingleObject.KERNEL32 ref: 6167DAD3
EnterCriticalSection.KERNEL32 ref: 6167DADF
GetTickCount.KERNEL32 ref: 6167DB0C
GetTickCount.KERNEL32 ref: 6167DB94
LeaveCriticalSection.KERNEL32 ref: 6167DBD3

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CountTick$CriticalSection$EnterLeaveObjectSingleWait
String ID:
API String ID: 2379733562-0
Opcode ID: f638deb5ec2c302f582257d5f50c56f62f124f14238560ff7eda16594809c379
Instruction ID: ff5fa2ca9eb783e1b640844d92525d9f5880a45c83ffae579d22b0a0ab2e6bcc
Opcode Fuzzy Hash: f638deb5ec2c302f582257d5f50c56f62f124f14238560ff7eda16594809c379
Instruction Fuzzy Hash: 3931D3BA608705C7EB20CF69D5403A93372F389BA9F088622DF59436A4CF38D865C740

Function 616A340C Relevance: 9.1, APIs: 6, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A3443
_invalid_parameter_noinfo.LIBCMT ref: 616A344E
_fileno.LIBCMT ref: 616A347D
_errno.LIBCMT ref: 616A34ED
_invalid_parameter_noinfo.LIBCMT ref: 616A34F8
_ftbuf.LIBCMT ref: 616A3526

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno_ftbuf
String ID:
API String ID: 2434734397-0
Opcode ID: 589a9c4baf8c8bf2a26f7b296cf2a41bf592afacbab5dfb913f59ca30bacba12
Instruction ID: e1b5b0721d93ffe5458867d31fdb33168c9ecaa9d68e78792d43fdd5aca18ca0
Opcode Fuzzy Hash: 589a9c4baf8c8bf2a26f7b296cf2a41bf592afacbab5dfb913f59ca30bacba12
Instruction Fuzzy Hash: 29316679309B4242DF06CBB5699036D7662BB96FF8F559622CE29873D0DF38C812C344

Function 6169E6DC Relevance: 9.1, APIs: 6, Instructions: 92COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169E709
_invalid_parameter_noinfo.LIBCMT ref: 6169E714
_fileno.LIBCMT ref: 6169E745
_errno.LIBCMT ref: 6169E7B5
_invalid_parameter_noinfo.LIBCMT ref: 6169E7C0
_ftbuf.LIBCMT ref: 6169E7F0

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_fileno_ftbuf
String ID:
API String ID: 2434734397-0
Opcode ID: 96c943987aa4c2ab8779513e6d75eda46c652a917b813bd8153bf4bec50ca458
Instruction ID: d4e176dcc81243ea18c18bcb4e153128e8703fa74105cea1eb087d484a326647
Opcode Fuzzy Hash: 96c943987aa4c2ab8779513e6d75eda46c652a917b813bd8153bf4bec50ca458
Instruction Fuzzy Hash: AE31007A30960343EB0587BA999037D3662BB91BF4F55DB21CD298B3E0DF38C451C242

Function 61689ACC Relevance: 9.1, APIs: 6, Instructions: 88synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 61689BA3
InterlockedFlushSList.KERNEL32 ref: 61689BB7
WaitForSingleObject.KERNEL32 ref: 61689BCF
SetEvent.KERNEL32 ref: 61689BDD
CloseHandle.KERNEL32 ref: 61689BEF
CloseHandle.KERNEL32 ref: 61689BF8

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CloseHandleObjectSingleWait$EventFlushInterlockedList
String ID:
API String ID: 3450103117-0
Opcode ID: 368c593d90518ed607a7165e5459882560637bfad339eb9ab12fcdcd20621c1f
Instruction ID: 2f020e1378a0fdc760af1da14b619b169831b361e477eb364fb8bf81d6cc25d3
Opcode Fuzzy Hash: 368c593d90518ed607a7165e5459882560637bfad339eb9ab12fcdcd20621c1f
Instruction Fuzzy Hash: 0E318F36708B5082DB51CF2AE8543497375F7C8BA8F488221CBAD43BA4DF78C4A2C714

Function 616E2208 Relevance: 9.1, APIs: 6, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 616E222F

Part of subcall function 61691740: _amsg_exit.LIBCMT ref: 6169176A

_errno.LIBCMT ref: 616E2243
_invalid_parameter_noinfo.LIBCMT ref: 616E224F

Part of subcall function 616E0450: GetCurrentProcess.KERNEL32(?,?,?,?,616E04F6), ref: 616E0468

calloc.LIBCMT ref: 616E2291
_errno.LIBCMT ref: 616E229E
_errno.LIBCMT ref: 616E22A9

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$CurrentProcess_amsg_exit_invalid_parameter_noinfo_lockcalloc
String ID:
API String ID: 1209116363-0
Opcode ID: 70d8bffe61029b432c933ef40dc9a2e4ebdcf7ec5b34ebbf5174e3f5a3bb5f63
Instruction ID: 3b6e7eca82fcb33946ac85b30f571535dfd0f1cf5388ad90c6ee017f797e293c
Opcode Fuzzy Hash: 70d8bffe61029b432c933ef40dc9a2e4ebdcf7ec5b34ebbf5174e3f5a3bb5f63
Instruction Fuzzy Hash: 5A21D43A30BB1386EB059FB5A54421E7667BBD5BC8B49C52C9F484B704EF38C811C708

Function 6167A2FC Relevance: 9.1, APIs: 6, Instructions: 74COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32 ref: 6167A37C
SetEvent.KERNEL32 ref: 6167A396
SetEvent.KERNEL32 ref: 6167A3B8
CloseHandle.KERNEL32 ref: 6167A3CA
CloseHandle.KERNEL32 ref: 6167A3E2
DeleteCriticalSection.KERNEL32 ref: 6167A40E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CloseEventHandle$CriticalDeleteFreeSectionVirtual
String ID:
API String ID: 2064654181-0
Opcode ID: cccd1179d638054a3066fad610aceeffeb224ad76909503856ce64e3ad019acc
Instruction ID: 830b135e3fca93f5040c7ef630740c29acc382129de38d73a5aaccc06c75ae07
Opcode Fuzzy Hash: cccd1179d638054a3066fad610aceeffeb224ad76909503856ce64e3ad019acc
Instruction Fuzzy Hash: 14315A3A704B40A2DA18DF6ADA543A87332FBC8B98F149256CBAE87770CF75D465C344

Function 6168E2CC Relevance: 9.1, APIs: 6, Instructions: 74librarythreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 6168E316
GetModuleFileNameW.KERNEL32 ref: 6168E333
LoadLibraryW.KERNEL32 ref: 6168E342
CreateThread.KERNEL32 ref: 6168E36A
GetLastError.KERNEL32 ref: 6168E375
GetLastError.KERNEL32 ref: 6168E3A5

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ErrorLastModule$CreateFileHandleLibraryLoadNameThread
String ID:
API String ID: 293330511-0
Opcode ID: 81cde878fc1db074e732cdf8a8056de300deb3889be58d8c1eda6d3275188686
Instruction ID: 001d2364b72298df1677ace38674037e705a0e992a60079424a6064c5eb00c16
Opcode Fuzzy Hash: 81cde878fc1db074e732cdf8a8056de300deb3889be58d8c1eda6d3275188686
Instruction Fuzzy Hash: 8C21A27570978196FB50DB61EC443A663B2FB88799F488026E98A83658EF3DC516C710

Function 616E17B8 Relevance: 9.1, APIs: 6, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,616911E7), ref: 616E17D1
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,616911E7), ref: 616E1828
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,616911E7), ref: 616E1863
free.LIBCMT ref: 616E1870
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,616911E7), ref: 616E187B
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,616911E7), ref: 616E1889

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide$free
String ID:
API String ID: 517548149-0
Opcode ID: 41e076ef8d09d8a7838d842e7457ca0fdd6d8fe5ba83e7b7feeb98583371bbbf
Instruction ID: f9a062eeb2b146ba2fad3720708468fc3f44a29512634404fee0a9ddd66cf6f5
Opcode Fuzzy Hash: 41e076ef8d09d8a7838d842e7457ca0fdd6d8fe5ba83e7b7feeb98583371bbbf
Instruction Fuzzy Hash: 0D217F76B0EB8086EB149F62B80425AB7B6F789FC5F5D8128DE8A47B54EF38C050D704

Function 6169DF14 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169DF37
_invalid_parameter_noinfo.LIBCMT ref: 6169DF43
_fileno.LIBCMT ref: 6169DF59
_fileno.LIBCMT ref: 6169DF66
_fileno.LIBCMT ref: 6169DF73
_fileno.LIBCMT ref: 6169DF89

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _fileno$_errno_invalid_parameter_noinfo
String ID:
API String ID: 1839398362-0
Opcode ID: f750f7366740a2871a8e1200a57b0d042e0638c932b7c235d32c3136af0d26b8
Instruction ID: c7c9681f93d550e105e5a5e17eced18cc9cf42638f74f4d6b991892f2b973821
Opcode Fuzzy Hash: f750f7366740a2871a8e1200a57b0d042e0638c932b7c235d32c3136af0d26b8
Instruction Fuzzy Hash: 3C110C25318A8387C7019B79A58537D7722ABC27A4F54CF21DA6687790DF28C5538304

Function 6167541C Relevance: 9.0, APIs: 6, Instructions: 48threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6167543B
GetCurrentProcess.KERNEL32 ref: 6167544C
GetCurrentThread.KERNEL32 ref: 61675455
GetCurrentProcess.KERNEL32 ref: 6167545E
DuplicateHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,61680475), ref: 61675486
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,61680475), ref: 61675490

Part of subcall function 616740A8: std::exception::exception.LIBCMT ref: 616740C8

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Current$ProcessThread$DuplicateErrorExceptionHandleLastRaisestd::exception::exception
String ID:
API String ID: 2860095299-0
Opcode ID: 27bf3471a7a7f82a004e6d28b23ce3ec6d4224d1041a3a586f5f7a20fb114c29
Instruction ID: 3d10b315ce1f5a06b7f9da248caf9a1232642c7f98d3d2012683584b2ca8bd8a
Opcode Fuzzy Hash: 27bf3471a7a7f82a004e6d28b23ce3ec6d4224d1041a3a586f5f7a20fb114c29
Instruction Fuzzy Hash: 76118276709B818AE710DF21E8483C97771F799BCAF588125EE8943718DF39C559C740

Function 61692064 Relevance: 9.0, APIs: 6, Instructions: 37threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,61695695,?,?,?,?,616D8D9D,?,?,?,616CF018), ref: 6169206E
FlsGetValue.KERNEL32(?,?,?,61695695,?,?,?,?,616D8D9D,?,?,?,616CF018), ref: 6169207C
SetLastError.KERNEL32(?,?,?,61695695,?,?,?,?,616D8D9D,?,?,?,616CF018), ref: 616920D4

Part of subcall function 616D8B14: Sleep.KERNEL32(?,?,?,61692097,?,?,?,61695695,?,?,?,?,616D8D9D), ref: 616D8B59

FlsSetValue.KERNEL32(?,?,?,61695695,?,?,?,?,616D8D9D,?,?,?,616CF018), ref: 616920A8
free.LIBCMT ref: 616920CB

Part of subcall function 61691FA8: _lock.LIBCMT ref: 61691FFC
Part of subcall function 61691FA8: _lock.LIBCMT ref: 6169201B

GetCurrentThreadId.KERNEL32 ref: 616920BC

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ErrorLastValue_lock$CurrentSleepThreadfree
String ID:
API String ID: 3106088686-0
Opcode ID: d85c9f79f418503ee552302a8ae7f7bc89cbab5757871e3b39da8aa61d636832
Instruction ID: fb19b46c3d9697e1688ede6ead5daa40ef71f5e096d414ba8695f0099a82a5f1
Opcode Fuzzy Hash: d85c9f79f418503ee552302a8ae7f7bc89cbab5757871e3b39da8aa61d636832
Instruction Fuzzy Hash: 62018F7870578287EB05DF76A4443592273BB8CBA5F18C628D96A023D4EF3CC455C210

Function 61697500 Relevance: 9.0, APIs: 6, Instructions: 36COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 61697514
_errno.LIBCMT ref: 6169751B
_invalid_parameter_noinfo.LIBCMT ref: 61697526
GetFileAttributesW.KERNEL32 ref: 61697530
GetLastError.KERNEL32 ref: 6169753B
SetFileAttributesW.KERNEL32 ref: 6169755C

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: AttributesFile$ErrorLast__doserrno_errno_invalid_parameter_noinfo
String ID:
API String ID: 2168707896-0
Opcode ID: 2dc22861aea15a8f8c1cc9d31e5b5ad1ace8dd2370d8ed4f448f0e6e343a4b70
Instruction ID: d093d1bbd147deda885725bd54b99ee171e00de4deb6ab6010219d6d6f0a0d08
Opcode Fuzzy Hash: 2dc22861aea15a8f8c1cc9d31e5b5ad1ace8dd2370d8ed4f448f0e6e343a4b70
Instruction Fuzzy Hash: B6F0F6B961C68387EB845BB8B80035D31726B89779F18CF20E931C22E0EF38C4404A51

Function 6169548C Relevance: 9.0, APIs: 6, Instructions: 36COMMON

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 616954A0
_errno.LIBCMT ref: 616954A7
_invalid_parameter_noinfo.LIBCMT ref: 616954B2
GetFileAttributesA.KERNEL32 ref: 616954BC
GetLastError.KERNEL32 ref: 616954C7
SetFileAttributesA.KERNEL32 ref: 616954E8

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: AttributesFile$ErrorLast__doserrno_errno_invalid_parameter_noinfo
String ID:
API String ID: 2168707896-0
Opcode ID: 276cb46fe6bd1fd7f454afe148f6452f78b9ceebca755916e450dff6a90a5aff
Instruction ID: 074c9fd4e42112d8dd89a8ac24ce62a355d34e8a13c16cbf7265825ff1731d6c
Opcode Fuzzy Hash: 276cb46fe6bd1fd7f454afe148f6452f78b9ceebca755916e450dff6a90a5aff
Instruction Fuzzy Hash: B6F0F07A71A60387EB859BB8A80436D31726B89F7BF28CF22E931862D0DF38C4504651

Function 61763250 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 124stringCOMMON

Download Yara Rule

APIs

localeconv.MSVCR100 ref: 61763273
strlen.MSVCR100 ref: 617632A3

Strings

,, xrefs: 6176344E
false, xrefs: 617632EC
true, xrefs: 61763313

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: localeconvstrlen
String ID: ,$false$true
API String ID: 186660782-760133229
Opcode ID: 6422e148dd8ea201b2adc8bb88b08342a2e69cf123dfd67969932aa64c634d89
Instruction ID: 98fa4484f9324eba6c7c8cc8c93fd0e1fe6e26e80dd42936347ba20427b71634
Opcode Fuzzy Hash: 6422e148dd8ea201b2adc8bb88b08342a2e69cf123dfd67969932aa64c634d89
Instruction Fuzzy Hash: 71513262129BC185C7A1CF21E5443CEB7A4FB88758F509226EACD17B59EF38C159CB44

Function 617875C8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCR100 ref: 6178765E
fwrite.MSVCR100 ref: 61787704
??3@YAXPEAX@Z.MSVCR100 ref: 61787760
??3@YAXPEAX@Z.MSVCR100 ref: 61787773

Strings

string too long, xrefs: 61787648

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??3@$fwritememset
String ID: string too long
API String ID: 1895199055-2556327735
Opcode ID: 0f5be9c612e6a2f5acfef332ca45ed402caa2632452172f07a068ece83bba235
Instruction ID: 1c5d5e15330aa703e096eb8fc2232e79fb3c6813f61ee11dc00a4bfe2ef73706
Opcode Fuzzy Hash: 0f5be9c612e6a2f5acfef332ca45ed402caa2632452172f07a068ece83bba235
Instruction Fuzzy Hash: 4B419B22B10A9488FB40CBB9D954B9C7771F755B9CF948532EE0A67B98CF34C585C740

Function 6178621C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_realloc_crt.MSVCR100 ref: 61786273
??0exception@std@@QEAA@AEBQEBDH@Z.MSVCR100 ref: 617862B6

Part of subcall function 61796D64: _onexit.MSVCRT ref: 61796D68

??0exception@std@@QEAA@AEBV01@@Z.MSVCR100 ref: 617862DB
_CxxThrowException.MSVCR100 ref: 617862F2

Strings

bad allocation, xrefs: 61786298

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0exception@std@@$ExceptionThrowV01@@_onexit_realloc_crt
String ID: bad allocation
API String ID: 478257277-2104205924
Opcode ID: 2c444ae4ed6d9717facee9c42fb3fb73465ffa2b4bfad2030254816ddeca00d0
Instruction ID: 0051e453e78c627f68662e521602d753cfd593df16096c7b981673900409b75b
Opcode Fuzzy Hash: 2c444ae4ed6d9717facee9c42fb3fb73465ffa2b4bfad2030254816ddeca00d0
Instruction Fuzzy Hash: A2418332218F4592DB51CF25E950399B372F7847A8F588632EA6E43BA8DF38C565C740

Function 616AB768 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 96timeCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616AB7A1
GetLocalTime.KERNEL32 ref: 616AB7B3
_errno.LIBCMT ref: 616AB894
_invalid_parameter_noinfo.LIBCMT ref: 616AB8A0

Strings

gfff, xrefs: 616AB7CB

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$LocalTime_invalid_parameter_noinfo
String ID: gfff
API String ID: 250023431-1553575800
Opcode ID: 47517cb4b6b9fd46706fd8de66f3e9b76a6524a7fd9687decf9a78b4c219b1b5
Instruction ID: 25e23ab02dbc197590d2f6f42256f432d6fcd5cf40a75335c3b84a293a204bea
Opcode Fuzzy Hash: 47517cb4b6b9fd46706fd8de66f3e9b76a6524a7fd9687decf9a78b4c219b1b5
Instruction Fuzzy Hash: F03168AA32528587D704DF39E402299B3B2FBE8744B89C122E784CBB58EB3CC410C700

Function 61683C0C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93threadCOMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 61683C46

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

std::exception::exception.LIBCMT ref: 61683C80
SwitchToThread.KERNEL32 ref: 61683CDA

Strings

ppVirtualProcessorRoots, xrefs: 61683C33
count, xrefs: 61683C6D

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: std::exception::exception$ExceptionRaiseSwitchThread
String ID: count$ppVirtualProcessorRoots
API String ID: 2257776306-3650809737
Opcode ID: a5886f418b08fdf130ab9f736cf4aeb2723f9647466e60da9c5354ae4f703888
Instruction ID: dd1868c3c5c6760bd0030313b5de20a94214463edc7071288a72e050613864b3
Opcode Fuzzy Hash: a5886f418b08fdf130ab9f736cf4aeb2723f9647466e60da9c5354ae4f703888
Instruction Fuzzy Hash: EF31897A701B5294EF80CB66E8447983735F788BC8F948022DE0D17B24EF39C58AC350

Function 616ABA08 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88timeCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616ABA41
GetLocalTime.KERNEL32 ref: 616ABA53
_errno.LIBCMT ref: 616ABB1C
_invalid_parameter_noinfo.LIBCMT ref: 616ABB28

Strings

gfff, xrefs: 616ABA70

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$LocalTime_invalid_parameter_noinfo
String ID: gfff
API String ID: 250023431-1553575800
Opcode ID: df30cd7a6a1b94830a507bbd8bd961be52cfb85ac72fc56f9852c08aea17c8af
Instruction ID: 7204e111d587c34c9af0fbdfd9d0a068781b0fc7c520be22982cad204e223bdb
Opcode Fuzzy Hash: df30cd7a6a1b94830a507bbd8bd961be52cfb85ac72fc56f9852c08aea17c8af
Instruction Fuzzy Hash: FF3127AA32429583D714DF39E44129AB3B2FFA8759B48C222E794CBB58EB3CD411C715

Function 616897AC Relevance: 8.8, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6168981F

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 04e7290cbcc8fa2762993de692bcd91749336297de193e30a3ced84b6df21d1e
Instruction ID: d6b772d7a5b8e63addecab27b253accb77404d676f98ef810e67058328f54056
Opcode Fuzzy Hash: 04e7290cbcc8fa2762993de692bcd91749336297de193e30a3ced84b6df21d1e
Instruction Fuzzy Hash: 313189B831EA82C5FB809765E8543D537F2AB897ACF0D4615C9A9073E0DF3AC156D322

Function 6175D41C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 6175D459
_CxxThrowException.MSVCR100 ref: 6175D477
?Log2@details@Concurrency@@YAK_K@Z.MSVCR100 ref: 6175D485

Strings

argument to concurrent_vector::reserve() exceeds concurrent_vector::max_size(), xrefs: 6175D446
tOua, xrefs: 6175D45F

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0exception@std@@Concurrency@@ExceptionLog2@details@Throw
String ID: argument to concurrent_vector::reserve() exceeds concurrent_vector::max_size()$tOua
API String ID: 3588803953-320144991
Opcode ID: 9c69869eaa2813bd4ac72900dabcb5e3329028cbb243bb8b2698f95d59b857df
Instruction ID: 26a217265905f9c18119b117b3cab26c1c797ded57d3fa5f225ee08c93030c94
Opcode Fuzzy Hash: 9c69869eaa2813bd4ac72900dabcb5e3329028cbb243bb8b2698f95d59b857df
Instruction Fuzzy Hash: 3921EC72304B4492EA508B15E6443887722F784BE4F548335DF7D07BA4DF38D965C340

Function 616A0EE8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A0F06
_invalid_parameter_noinfo.LIBCMT ref: 616A0F11
_fileno.LIBCMT ref: 616A0F1B
_flush.LIBCMT ref: 616A0F2F

Strings

, xrefs: 616A0F8F

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_fileno_flush_invalid_parameter_noinfo
String ID:
API String ID: 329365992-3916222277
Opcode ID: d84cc8d5c66f596a198bb58ebee7af6bd9226d58f6ffd5515e57d51930d2cc73
Instruction ID: 0cbe1771857c99b470651ee7c2ebf7dcdc4f9bc7e03e07ce59fc36614139f686
Opcode Fuzzy Hash: d84cc8d5c66f596a198bb58ebee7af6bd9226d58f6ffd5515e57d51930d2cc73
Instruction Fuzzy Hash: 8911E736305B8286DB09CF7DE89122D7626ABD1B68F58D321DA36C72E4DF38C5918784

Function 617531E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

??0invalid_operation@Concurrency@@QEAA@PEBD@Z.MSVCR100 ref: 61753213
_CxxThrowException.MSVCR100 ref: 61753225
??0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QEAA@AEAV123@@Z.MSVCR100 ref: 6175325F
??1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 61753281

Strings

sync_send called without registering a callback, xrefs: 61753207

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: Concurrency@@$Lock@details@ReentrantScoped_lock@_$??0_??0invalid_operation@??1_ExceptionThrowV123@@
String ID: sync_send called without registering a callback
API String ID: 427308038-4178601950
Opcode ID: 82390e358fdecabb974f614bd464a7261bbca73fe5db109472702da70e8de4aa
Instruction ID: 077a380a8ec32cfb1fb130f2fb5c1a0431814f787f496399cf4075570d296ec8
Opcode Fuzzy Hash: 82390e358fdecabb974f614bd464a7261bbca73fe5db109472702da70e8de4aa
Instruction Fuzzy Hash: 32116D32209B4592EB54CF15EA44399B771F784B88F54C022EB9D87738EF39C5AAC700

Function 6175346C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

??0invalid_link_target@Concurrency@@QEAA@PEBD@Z.MSVCR100 ref: 617534A2
_CxxThrowException.MSVCR100 ref: 617534B4
??0invalid_link_target@Concurrency@@QEAA@PEBD@Z.MSVCR100 ref: 617534FA
_CxxThrowException.MSVCR100 ref: 6175350C

Strings

_Link, xrefs: 61753496, 617534EE

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0invalid_link_target@Concurrency@@ExceptionThrow
String ID: _Link
API String ID: 3916662256-3418048212
Opcode ID: 8757aba89ee33e380456149e4327fe6e56d748ad8e3ad2188401ce9e6ffa279d
Instruction ID: e51cc06da97ff5a3207547629954bf5d23a48b047b442643a544d115b5e20cc6
Opcode Fuzzy Hash: 8757aba89ee33e380456149e4327fe6e56d748ad8e3ad2188401ce9e6ffa279d
Instruction Fuzzy Hash: 9111C472209B4691DE51CF54D650398AB32F7803A8FD4D622D67D475B4EF3AC66AC340

Function 617541FC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

??0invalid_operation@Concurrency@@QEAA@PEBD@Z.MSVCR100(?,?,?,?,?,?,?,61754504), ref: 61754251
_CxxThrowException.MSVCR100 ref: 61754263
??_V@YAXPEAX@Z.MSVCR100(?,?,?,?,?,?,?,61754504), ref: 61754272

Strings

Deleting link registry before removing all the links, xrefs: 61754245
l4ua, xrefs: 61754212

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0invalid_operation@Concurrency@@ExceptionThrow
String ID: Deleting link registry before removing all the links$l4ua
API String ID: 1760184552-4271889975
Opcode ID: 3b6b0c40af0f7e3730f6c18ba75be784c45faf355270cb2d234521dc88b08cea
Instruction ID: f6ce46d1c2c8de8705d18a211b5de378d4ccf03451e4b903e40bc19a6555d93e
Opcode Fuzzy Hash: 3b6b0c40af0f7e3730f6c18ba75be784c45faf355270cb2d234521dc88b08cea
Instruction Fuzzy Hash: 0B01B173609F0591EF14CF64E8403A97771F794BA8F148721966E062E8EF39C5BAC340

Function 617533D4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

??0invalid_operation@Concurrency@@QEAA@PEBD@Z.MSVCR100 ref: 61753429
_CxxThrowException.MSVCR100 ref: 6175343B
??_V@YAXPEAX@Z.MSVCR100 ref: 6175344A

Strings

l4ua, xrefs: 617533EA
Deleting link registry before removing all the links, xrefs: 6175341D

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0invalid_operation@Concurrency@@ExceptionThrow
String ID: Deleting link registry before removing all the links$l4ua
API String ID: 1760184552-4271889975
Opcode ID: 873fae0aefa58f10350cef8168298298a0ad89ebdd908051724f43d718b96fe2
Instruction ID: dc647fca1ad0bedea4c642a8931554863553bcb9768a7862017a6e6c16f89287
Opcode Fuzzy Hash: 873fae0aefa58f10350cef8168298298a0ad89ebdd908051724f43d718b96fe2
Instruction Fuzzy Hash: 75019E72605F0482EF15CF24E4503A86B71F784B6CF148B218A6E0A2F8DF78C5AAC340

Function 6169E8D4 Relevance: 7.7, APIs: 5, Instructions: 170COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169E913
_invalid_parameter_noinfo.LIBCMT ref: 6169E91E
memcpy_s.LIBCMT ref: 6169E9E7
_fileno.LIBCMT ref: 6169EA5A
_errno.LIBCMT ref: 6169EAD9

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_fileno_invalid_parameter_noinfomemcpy_s
String ID:
API String ID: 897514287-0
Opcode ID: 698502edf53e1c989443fd8f2f6ac452a3b4bc5eb284fb5ac8557d1b47dac023
Instruction ID: be8216c1bb88f1acb91613e8951da3fd7eab754fe5ba060d616a0d7e804147f5
Opcode Fuzzy Hash: 698502edf53e1c989443fd8f2f6ac452a3b4bc5eb284fb5ac8557d1b47dac023
Instruction Fuzzy Hash: 9B51293930568287AB04CEA7A50066A7E51B786FF4F08CF21AE7957BE4DB3CD092C740

Function 616F7850 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 616F788A
_set_statfp.LIBCMT ref: 616F78A8
_set_statfp.LIBCMT ref: 616F78D1
_set_statfp.LIBCMT ref: 616F7A90

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 06c9698889a030c0bba520342c20936ded4db84d7ee2d2667104db06cfac5fdc
Instruction ID: a1117fee0d9cf1d7963eebe67bf1d18d8e50b38ecc3161a97681fb3575b4e573
Opcode Fuzzy Hash: 06c9698889a030c0bba520342c20936ded4db84d7ee2d2667104db06cfac5fdc
Instruction Fuzzy Hash: C951072A608E458DE223CFB9F850396A733FF52794F15C3159FA6275A4EB348697C700

Function 61681268 Relevance: 7.6, APIs: 5, Instructions: 142COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,00000000,61681257,?,?,?,61680FC9,?,?,00000001,61681108), ref: 616812A4
InterlockedFlushSList.KERNEL32(?,?,00000000,61681257,?,?,?,61680FC9,?,?,00000001,61681108), ref: 6168134C
InterlockedFlushSList.KERNEL32(?,?,00000000,61681257,?,?,?,61680FC9,?,?,00000001,61681108), ref: 61681392
SetEvent.KERNEL32(?,?,00000000,61681257,?,?,?,61680FC9,?,?,00000001,61681108), ref: 61681424
CloseHandle.KERNEL32(?,?,00000000,61681257,?,?,?,61680FC9,?,?,00000001,61681108), ref: 6168142E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CloseFlushHandleInterlockedList$Event
String ID:
API String ID: 2682403456-0
Opcode ID: ae73e837cd9386afe00a34148a29bcee4a096fa9df7a1486f64070a3b47b74aa
Instruction ID: 8e2170be4a214503676a6c0159aa48897c8061af1026093d87152b6790e9aac1
Opcode Fuzzy Hash: ae73e837cd9386afe00a34148a29bcee4a096fa9df7a1486f64070a3b47b74aa
Instruction Fuzzy Hash: 2A51357A705A948BDA55DF66D5943AD7331FB88F84F088022CB6E47B24CF39D865C350

Function 616DDC64 Relevance: 7.6, APIs: 5, Instructions: 137COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 61691654: _FF_MSGBANNER.LIBCMT ref: 6169167B

_lock.LIBCMT ref: 616DDC9E
_lock.LIBCMT ref: 616DDCF7
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,?,?,00000000,00000000,616DA4BC), ref: 616DDD0C
EnterCriticalSection.KERNEL32(?,?,?,?,?,00000000,00000000,616DA4BC), ref: 616DDD37
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00000000,00000000,616DA4BC), ref: 616DDD47

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CriticalSection$_lock$CountEnterInitializeLeaveSpin
String ID:
API String ID: 3451527041-0
Opcode ID: dce5e5ab3833156e0bcb8aeaf4bf6a8d55a4c4d2568c17ba87367640385386f8
Instruction ID: fa9ef74d87bf3f30fa6b894ea8f7658214c1a5b2685aca206efee021af02cafc
Opcode Fuzzy Hash: dce5e5ab3833156e0bcb8aeaf4bf6a8d55a4c4d2568c17ba87367640385386f8
Instruction Fuzzy Hash: 8F51257BA08B8186DB119F24E450399BBB6F794B68F48D229DE6D473D4DB78C066CB00

Function 61674BF4 Relevance: 7.6, APIs: 5, Instructions: 131threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 61674CA2
GetCurrentProcess.KERNEL32 ref: 61674CCF
GetProcessAffinityMask.KERNEL32 ref: 61674CE2
TlsGetValue.KERNEL32 ref: 61674DD6
TlsSetValue.KERNEL32 ref: 61674DE5

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CurrentProcessValue$AffinityMaskThread
String ID:
API String ID: 3334446058-0
Opcode ID: fc4a7f8545831cba2304de724c22c30c0c3a2f4c4f09b837e48adbe6b2b69ada
Instruction ID: 3f106785ca4ed465ded5c0b8eb1dbcc7546ae55cd706e49f656ae21c19042076
Opcode Fuzzy Hash: fc4a7f8545831cba2304de724c22c30c0c3a2f4c4f09b837e48adbe6b2b69ada
Instruction Fuzzy Hash: F151497A214B8487DB25CF56E48469EB3B6F388B84F548226DF8E43B24DF39D451CB00

Function 616A4608 Relevance: 7.6, APIs: 5, Instructions: 128COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A4630
_errno.LIBCMT ref: 616A4645
_invalid_parameter_noinfo.LIBCMT ref: 616A479F

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: ac97d8d3d01107ba1ac368710fd3671d91f748745e1a5b913ceed7cda1686f2e
Instruction ID: 3ce558da2fa6671864fa8a298baa739bbb33a2e38bece413050e9e6dbae36460
Opcode Fuzzy Hash: ac97d8d3d01107ba1ac368710fd3671d91f748745e1a5b913ceed7cda1686f2e
Instruction Fuzzy Hash: F44154BEA192A1C2EF198F999C107793EA1BB83B84F5DE015CA1407A54DFB9CC90C781

Function 6169E17C Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169E19A
_errno.LIBCMT ref: 6169E1AF
_invalid_parameter_noinfo.LIBCMT ref: 6169E2FB

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: af10c64a609301e79616a3e59d1cae060f6e73c7f7aac21156dfb37a786004fe
Instruction ID: 48475b7b8c58c1d31fd2b8f43b38cd60a7e0af72448cc8bc6ee80cb813003673
Opcode Fuzzy Hash: af10c64a609301e79616a3e59d1cae060f6e73c7f7aac21156dfb37a786004fe
Instruction Fuzzy Hash: F54199FEA2E2538FFB1A4BEBA51075C3E627796B55F09ED96CA1407B81C73C84408B41

Function 616E3ED8 Relevance: 7.6, APIs: 5, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00000004,?,616E4097), ref: 616E3F32
malloc.LIBCMT ref: 616E3F96
MultiByteToWideChar.KERNEL32(?,?,?,00000000,?,00000004,?,616E4097), ref: 616E3FDE
GetStringTypeW.KERNEL32(?,?,?,00000000,?,00000004,?,616E4097), ref: 616E3FF5
free.LIBCMT ref: 616E4009

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ByteCharMultiWide$StringTypefreemalloc
String ID:
API String ID: 307345228-0
Opcode ID: e7901344258c268d85b5f0b8e771a5ce4c3b1442826c12822aeb3ad28b26c599
Instruction ID: 7ef50ae6a4a778925a7b3256e374394b2a352ee18696b635c8bec6259ec84bfb
Opcode Fuzzy Hash: e7901344258c268d85b5f0b8e771a5ce4c3b1442826c12822aeb3ad28b26c599
Instruction Fuzzy Hash: 79319576706B8086DB01CF69980429977B6FB88BB8F588716EE6D477E8DF34C401C300

Function 6168ACA0 Relevance: 7.6, APIs: 5, Instructions: 90synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 6168ACDC
GetLastError.KERNEL32 ref: 6168ACEC

Part of subcall function 616740A8: std::exception::exception.LIBCMT ref: 616740C8

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

SetThreadPriority.KERNEL32 ref: 6168ADCB
WaitForSingleObject.KERNEL32 ref: 6168ADD9
CloseHandle.KERNEL32 ref: 6168ADEA

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CloseCreateErrorEventExceptionHandleLastObjectPriorityRaiseSingleThreadWaitstd::exception::exception
String ID:
API String ID: 3569707365-0
Opcode ID: 691f34abb4b69260e05af947054a788f55c03b4b0d5edbba1bd2e20051893f3e
Instruction ID: 85ad7641fa184422ed43416d946be677496ce098e089e577255ae63dfdce6ecf
Opcode Fuzzy Hash: 691f34abb4b69260e05af947054a788f55c03b4b0d5edbba1bd2e20051893f3e
Instruction Fuzzy Hash: DD415B36305B4082EB54CB65E45079A73B1FB88BA4F948326DAAE43BE4DF39D446C750

Function 617892B0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

___lc_handle_func.MSVCR100 ref: 617892C7
___lc_codepage_func.MSVCR100 ref: 617892D0
isupper.MSVCR100 ref: 61789304
__pctype_func.MSVCR100 ref: 6178931F
__crtLCMapStringA.MSVCR100 ref: 617893AF

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: String___lc_codepage_func___lc_handle_func__crt__pctype_funcisupper
String ID:
API String ID: 3436188357-0
Opcode ID: 0ef693057266405bfb3cf7177c7357639178fdfe2303212cded2d696418cf9e4
Instruction ID: 976cc5dc9d3ef5806e91fb1499299500d91c5cfc70d457bba63b05c7ba811bf0
Opcode Fuzzy Hash: 0ef693057266405bfb3cf7177c7357639178fdfe2303212cded2d696418cf9e4
Instruction Fuzzy Hash: 6131F63220C68087E7514F58D68039DFEA1F3E1B85F188039EA9587BA9DB38C498CB10

Function 61672A28 Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

QueryDepthSList.KERNEL32(?,?,00000000,616725A6), ref: 61672AD4
InterlockedPushEntrySList.KERNEL32(?,00000000,616725A6), ref: 61672AEC
QueryDepthSList.KERNEL32(?,00000000,616725A6), ref: 61672AF6
InterlockedFlushSList.KERNEL32(?,00000000,616725A6), ref: 61672B28

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: List$DepthInterlockedQuery$EntryFlushPush
String ID:
API String ID: 4063097673-0
Opcode ID: f8c1e935672d4c5c4d494b4acf4a477fc431d49d854f89519af7ca426dccba66
Instruction ID: 1b6dbdc2c04b7f933d806758e82f171de88f5050902f2a9ac3fff6e7547bdd64
Opcode Fuzzy Hash: f8c1e935672d4c5c4d494b4acf4a477fc431d49d854f89519af7ca426dccba66
Instruction Fuzzy Hash: B731AB77214A458ADB25DF36D8806AA3771F788F8EF54402AEE0E43758DF35C899CB40

Function 6176719C Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

??2@YAPEAX_K@Z.MSVCR100 ref: 61767231
??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 61767253
_CxxThrowException.MSVCR100 ref: 61767271
memmove.MSVCR100 ref: 617672B7
??3@YAXPEAX@Z.MSVCR100 ref: 617672C6

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0exception@std@@??2@??3@ExceptionThrowmemmove
String ID:
API String ID: 1234185409-0
Opcode ID: d633923ec46029f7b1ec69690d3970922d0c99ab124d8f53e91eccc35ab2dbbc
Instruction ID: 5975d0e83539270a63f3cb6ce0373567289fea95747be552e0590ed49b56b4d3
Opcode Fuzzy Hash: d633923ec46029f7b1ec69690d3970922d0c99ab124d8f53e91eccc35ab2dbbc
Instruction Fuzzy Hash: 8621B37220978195CE208B45FA5059AE3B8F7A5BF8B548725EFB9077A4EF38C585C380

Function 61684AE4 Relevance: 7.6, APIs: 5, Instructions: 83COMMON

Download Yara Rule

APIs

QueryDepthSList.KERNEL32(?,00000000,00000000,6167E6A0), ref: 61684B8D
InterlockedPushEntrySList.KERNEL32 ref: 61684BA8
QueryDepthSList.KERNEL32 ref: 61684BB2
InterlockedFlushSList.KERNEL32 ref: 61684BE4
InterlockedPushEntrySList.KERNEL32 ref: 61684C0A

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: List$Interlocked$DepthEntryPushQuery$Flush
String ID:
API String ID: 358188281-0
Opcode ID: 563641fd92c8259613a19844aec86b5a7ec08c62921e687c83864745e28cec6c
Instruction ID: 9370b2619d772dc665c7c588a469d275e44fc18cfc5abd6e531624c708d4bd32
Opcode Fuzzy Hash: 563641fd92c8259613a19844aec86b5a7ec08c62921e687c83864745e28cec6c
Instruction Fuzzy Hash: A431AF77214A458ADB11DF25E48079E33B9F788F8AF144426DE0A43718EF75C895CB90

Function 61689D9C Relevance: 7.6, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 61689DF7

Part of subcall function 616740A8: std::exception::exception.LIBCMT ref: 616740C8

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

CreateEventW.KERNEL32 ref: 61689E31
GetLastError.KERNEL32 ref: 61689E40
CreateEventW.KERNEL32 ref: 61689E9C
GetLastError.KERNEL32 ref: 61689EAB

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ErrorLast$CreateEvent$ExceptionRaisestd::exception::exception
String ID:
API String ID: 637141394-0
Opcode ID: d92f7a012e7c34870abebd034b30a3fdd9a4002a0fe4fd6a47a5e5d71d3658b6
Instruction ID: d8bfd0e003bd0fa0d48d63d6884af86e9cff8c30b3d59c74673501f8cd98fc6b
Opcode Fuzzy Hash: d92f7a012e7c34870abebd034b30a3fdd9a4002a0fe4fd6a47a5e5d71d3658b6
Instruction Fuzzy Hash: A931C276718B4286EB14CB78E85439933F2FB8870CF588115C64D47268EF7EC526C350

Function 616A4918 Relevance: 7.6, APIs: 5, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A494C
_invalid_parameter_noinfo.LIBCMT ref: 616A4958
_errno.LIBCMT ref: 616A4994
_errno.LIBCMT ref: 616A49A0

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 3ab4859b0f88a77129cde24ab28cd46d301f80764768f162350e0534fdda4542
Instruction ID: 5610df91d46fec687cdde26a754aae37f95401825a3f36f6d9351ffc461d454a
Opcode Fuzzy Hash: 3ab4859b0f88a77129cde24ab28cd46d301f80764768f162350e0534fdda4542
Instruction Fuzzy Hash: DF219D3A20578687AB059F66BD4062E7769BB85BCCB1CC4209E908B304DF78C8B1C388

Function 6169EC0C Relevance: 7.6, APIs: 5, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169EC3D
_invalid_parameter_noinfo.LIBCMT ref: 6169EC49
_errno.LIBCMT ref: 6169EC82
_errno.LIBCMT ref: 6169EC8E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 242a973ba5fe848b4d2318ae71d740af37fc65e6b093da23631929a6d7536ae7
Instruction ID: 3de46e98c74403a59713e84df7d4ef159ec90332b86fbdddd61e4433b6a4a4f9
Opcode Fuzzy Hash: 242a973ba5fe848b4d2318ae71d740af37fc65e6b093da23631929a6d7536ae7
Instruction Fuzzy Hash: 31216F7A215B8787EB068F72984031D7AA5F795B98F09D8348EA58B345DF38C861C784

Function 616E0724 Relevance: 7.6, APIs: 5, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,00000001,00000000,616E083D,?,?,?,?,616D8E37), ref: 616E074D
DecodePointer.KERNEL32(?,00000001,00000000,616E083D,?,?,?,?,616D8E37), ref: 616E075D

Part of subcall function 616D96B4: _errno.LIBCMT ref: 616D96BD
Part of subcall function 616D96B4: _invalid_parameter_noinfo.LIBCMT ref: 616D96C8

EncodePointer.KERNEL32(?,00000001,00000000,616E083D,?,?,?,?,616D8E37), ref: 616E07DB

Part of subcall function 616D8BA0: realloc.LIBCMT ref: 616D8BCB
Part of subcall function 616D8BA0: Sleep.KERNEL32(?,?,00000000,616E07CB,?,00000001,00000000,616E083D,?,?,?,?,616D8E37), ref: 616D8BE7

EncodePointer.KERNEL32(?,00000001,00000000,616E083D,?,?,?,?,616D8E37), ref: 616E07EB
EncodePointer.KERNEL32(?,00000001,00000000,616E083D,?,?,?,?,616D8E37), ref: 616E07F8

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Pointer$Encode$Decode$Sleep_errno_invalid_parameter_noinforealloc
String ID:
API String ID: 1909145217-0
Opcode ID: e1b392c46783819d7045d94c2e20a1e9ef50a483151a8906cc54f51f32754b38
Instruction ID: e6190820e98fad7fdba72c9dba1c18512936c57176960e07c48a9f7484b910e5
Opcode Fuzzy Hash: e1b392c46783819d7045d94c2e20a1e9ef50a483151a8906cc54f51f32754b38
Instruction Fuzzy Hash: 2D21837970BB8181EE01DB51F95839A63B6F789BD5F488825D98D87718EF7CC055C340

Function 6178A524 Relevance: 7.5, APIs: 5, Instructions: 46stringCOMMON

Download Yara Rule

APIs

_errno.MSVCR100 ref: 6178A54D
_errno.MSVCR100 ref: 6178A555
strtod.MSVCR100(?,?,?,?,?,6178A4FD,?,?,?,?,61785360), ref: 6178A564
_errno.MSVCR100 ref: 6178A56E
_errno.MSVCR100 ref: 6178A579

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: _errno$strtod
String ID:
API String ID: 3632641845-0
Opcode ID: 42ec7c2d9c98069ef40716e046c7f06063c24ae8b9b4925ff9786986fe43279d
Instruction ID: 11f8e432ca695a9119bb15f336c7bfde4255d3ce5c4c206b6a6dd259a822034d
Opcode Fuzzy Hash: 42ec7c2d9c98069ef40716e046c7f06063c24ae8b9b4925ff9786986fe43279d
Instruction Fuzzy Hash: F511453A218B848AD3128F21E9003AEF775FB99FD1F598621EE4517770DB79D4A6C700

Function 616E1CA4 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 616E1CDB
GetCurrentProcessId.KERNEL32 ref: 616E1CE6
GetCurrentThreadId.KERNEL32 ref: 616E1CF2
GetTickCount.KERNEL32 ref: 616E1CFE
QueryPerformanceCounter.KERNEL32 ref: 616E1D0F

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 9f382d4c1e650aaff1ccb72839b77a233b070e9b9a0d55221568a5fc62068496
Instruction ID: 8e3034fd19a98ae2a7596ce33fb9a490182779d0d18d165f2379f6bab5b2a988
Opcode Fuzzy Hash: 9f382d4c1e650aaff1ccb72839b77a233b070e9b9a0d55221568a5fc62068496
Instruction Fuzzy Hash: F801AD75229B4082E740CF22E8443952371F70DB95F486220EE6E4B764DB3EC9A58300

Function 61797584 Relevance: 7.5, APIs: 5, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 617975BB
GetCurrentProcessId.KERNEL32 ref: 617975C6
GetCurrentThreadId.KERNEL32 ref: 617975D2
GetTickCount.KERNEL32 ref: 617975DE
QueryPerformanceCounter.KERNEL32 ref: 617975EF

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 0af19371efdba7e7359e6c7e9929e08256ec23324f0b151a282744a24755fb3b
Instruction ID: 241b8ce7cb4b680bee796c6a4e7a8e2ff852b7d7960d6ae9b3e12c6c53094812
Opcode Fuzzy Hash: 0af19371efdba7e7359e6c7e9929e08256ec23324f0b151a282744a24755fb3b
Instruction Fuzzy Hash: 20019231259A0486EB40CF25F9403957776FB49B90F4C6A20EE5E477A4DB3EC9A88704

Function 616DDB0C Relevance: 7.5, APIs: 5, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__doserrno.LIBCMT ref: 616DDB15
_errno.LIBCMT ref: 616DDB1D

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 8470666be67dc4cd19513010924cf2b0632133b6195994021733883ceeca7579
Instruction ID: 8254f4c5545e27ef162d2e7623b162abb5ceca95281422ec31ff28d143e69e88
Opcode Fuzzy Hash: 8470666be67dc4cd19513010924cf2b0632133b6195994021733883ceeca7579
Instruction Fuzzy Hash: 72F0CDFAA0A61586EB052B64C89036C7A639BA1B3EF9AC702C6390B3E1C77840048B55

Function 617893EC Relevance: 7.5, APIs: 5, Instructions: 28COMMON

Download Yara Rule

APIs

___lc_handle_func.MSVCR100 ref: 617893F5
___lc_codepage_func.MSVCR100 ref: 61789400
_calloc_crt.MSVCR100(?,?,?,617587C7), ref: 61789413
__pctype_func.MSVCR100 ref: 61789422
__pctype_func.MSVCR100 ref: 61789443

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: __pctype_func$___lc_codepage_func___lc_handle_func_calloc_crt
String ID:
API String ID: 2304991739-0
Opcode ID: 162eba2d9ccf8fb652c46381aa1b29cc7dafc0bd3fea6ceceacb2b1c674e04fe
Instruction ID: 9d74b143cc5c2ece8eac87b2955fa53cc6c9d68300be4b4b870cf26706ea2855
Opcode Fuzzy Hash: 162eba2d9ccf8fb652c46381aa1b29cc7dafc0bd3fea6ceceacb2b1c674e04fe
Instruction Fuzzy Hash: FCF01779219B4086EB049F61E44835D7BB1F788F49F08C824CE090B348DB7DC4A987A0

Function 6179C284 Relevance: 7.5, APIs: 5, Instructions: 26COMMON

Download Yara Rule

APIs

??_V@YAXPEAX@Z.MSVCR100 ref: 6179C29A
??_V@YAXPEAX@Z.MSVCR100 ref: 6179C2A3
??_V@YAXPEAX@Z.MSVCR100 ref: 6179C2AC
??_V@YAXPEAX@Z.MSVCR100 ref: 6179C2B5
_CxxThrowException.MSVCR100 ref: 6179C2BE

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ExceptionThrow
String ID:
API String ID: 432778473-0
Opcode ID: 53f1921c747649cfcfc6de0541821da60f796e4d0f33df0773326706be64530b
Instruction ID: a5d74889561d13f78e5b146af952c1e98e5d6d5c19d56a8e34473ed50645fabc
Opcode Fuzzy Hash: 53f1921c747649cfcfc6de0541821da60f796e4d0f33df0773326706be64530b
Instruction Fuzzy Hash: BDE012622119C185CF48DF33E95446C6330FBC4F88B44DE31AE4D4762CCF24CA198740

Function 617934A8 Relevance: 7.5, APIs: 5, Instructions: 26COMMON

Download Yara Rule

APIs

??_V@YAXPEAX@Z.MSVCR100 ref: 617934C5
??_V@YAXPEAX@Z.MSVCR100 ref: 617934CE
??_V@YAXPEAX@Z.MSVCR100 ref: 617934D7
??_V@YAXPEAX@Z.MSVCR100 ref: 617934E0
??3@YAXPEAX@Z.MSVCR100 ref: 617934F7

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: cd6ea637999f8fb781f45dc17ec84d32b2544cc6015a7328efadf143cd10605b
Instruction ID: a366cabbd3393886bc5b50617e296b2a61ed97cb58dae19d289029913f91bcec
Opcode Fuzzy Hash: cd6ea637999f8fb781f45dc17ec84d32b2544cc6015a7328efadf143cd10605b
Instruction Fuzzy Hash: 3DF0FE32315A8191DF04DB27F794668B325FBC8B84F58C521AA5D47B34DF29CA7AC740

Function 616A72C4 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 226COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A75B0
_invalid_parameter_noinfo.LIBCMT ref: 616A75BC

Strings

JanFebMarAprMayJunJulAugSepOctNovDec, xrefs: 616A7406
gfff, xrefs: 616A745E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: JanFebMarAprMayJunJulAugSepOctNovDec$gfff
API String ID: 2959964966-1854364414
Opcode ID: ce7b2acab1735850eadd7752ddc20c28a277eab8e19d0d533fb2fecf89d4b347
Instruction ID: b86e2dd1d91786e1275220c075bb6185fe6fd38f78319288341320bcb0719007
Opcode Fuzzy Hash: ce7b2acab1735850eadd7752ddc20c28a277eab8e19d0d533fb2fecf89d4b347
Instruction Fuzzy Hash: 0A7126B73111C48BD70A8A3C84957D83FA6E3A2305F45C029D6848B75BFA3AE909C752

Function 6178157C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCR100 ref: 61781661
??3@YAXPEAX@Z.MSVCR100 ref: 617816A1
??3@YAXPEAX@Z.MSVCR100 ref: 617816D2

Part of subcall function 6175F96C: ??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100(?,?,?,?,?,?,?,?,61777A33,?,?,?,6178C78B), ref: 6175F97F
Part of subcall function 6175F96C: _CxxThrowException.MSVCR100 ref: 6175F99D

Strings

string too long, xrefs: 61781622

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??3@$??0exception@std@@ExceptionThrow
String ID: string too long
API String ID: 1182588843-2556327735
Opcode ID: 3dd117dfcb814fce467e462dc70a0cfd0b3291ec595d50bd52f18ab834d6ae99
Instruction ID: 7b922cf68078281241f6770634570159a8a0ea8c7c7c657001da92b982dc251c
Opcode Fuzzy Hash: 3dd117dfcb814fce467e462dc70a0cfd0b3291ec595d50bd52f18ab834d6ae99
Instruction Fuzzy Hash: 4651F033B15A408AE740CFB6E94468DB371F7857ACF408626AE2E27A98DF34C50AC740

Function 61783494 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 149COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCR100 ref: 61783579
??3@YAXPEAX@Z.MSVCR100 ref: 617835B9
??3@YAXPEAX@Z.MSVCR100 ref: 617835EA

Part of subcall function 6175F96C: ??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100(?,?,?,?,?,?,?,?,61777A33,?,?,?,6178C78B), ref: 6175F97F
Part of subcall function 6175F96C: _CxxThrowException.MSVCR100 ref: 6175F99D

Strings

string too long, xrefs: 6178353A

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??3@$??0exception@std@@ExceptionThrow
String ID: string too long
API String ID: 1182588843-2556327735
Opcode ID: e271cc1e1f65c1c8259a9c3289be1f59d330e01cdec7f81c2ae906e137692703
Instruction ID: ba1335b2072e024f68056c33d86389a9beedf057a3c9a1ff6150ea148c53ab41
Opcode Fuzzy Hash: e271cc1e1f65c1c8259a9c3289be1f59d330e01cdec7f81c2ae906e137692703
Instruction Fuzzy Hash: AE51EF23B15B4189EB50CFBAE85468DB371F78579CF408626AE1E67B98DF34C50AC740

Function 61791060 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

sprintf_s.MSVCR100 ref: 61791122
??3@YAXPEAX@Z.MSVCR100 ref: 6179124A

Strings

%.0Lf, xrefs: 61791112
0, xrefs: 6179118F

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??3@sprintf_s
String ID: %.0Lf$0
API String ID: 766125096-3603403928
Opcode ID: e9822888631e00ec5cb4857ec242636f66c5927bd89cfa976222c36fdf22f90a
Instruction ID: b18cc8747297f96c6e2292ae0cd173d9add912c5795565e6c13f065280f5938c
Opcode Fuzzy Hash: e9822888631e00ec5cb4857ec242636f66c5927bd89cfa976222c36fdf22f90a
Instruction Fuzzy Hash: C651B032618B908AE711CF69F84078EBB75F7897A8F508216EF9857B68DB39C155CB00

Function 6179035C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

sprintf_s.MSVCR100 ref: 6179041E
??3@YAXPEAX@Z.MSVCR100 ref: 61790546

Strings

0, xrefs: 6179048B
%.0Lf, xrefs: 6179040E

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??3@sprintf_s
String ID: %.0Lf$0
API String ID: 766125096-3603403928
Opcode ID: e33f07f96d52dcbe0f6d241d91e6fca30d993e923aecf4104ed0ed7b8cfd9d30
Instruction ID: f4c980a9ff94dd69670607a22bd31aa90c6fbdfbd046d5bf52820f1d2523ed36
Opcode Fuzzy Hash: e33f07f96d52dcbe0f6d241d91e6fca30d993e923aecf4104ed0ed7b8cfd9d30
Instruction Fuzzy Hash: 1351B033628B908AE711CF65F84078EBB74F7897A8F504216EF9857B68DB79C145CB00

Function 6167F8CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 616D8DBC: malloc.LIBCMT ref: 616D8DD6

CreateSemaphoreW.KERNEL32(?,?,?,?,?,?,?,?,00000001,6167FBA1), ref: 6167FA10
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000001,6167FBA1), ref: 6167FA22

Strings

@:ha, xrefs: 6167F913
eiha, xrefs: 6167FAC0

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CreateErrorLastSemaphoremalloc
String ID: @:ha$eiha
API String ID: 2925762670-3209250906
Opcode ID: 588afb01cfb9fbe837a471fb395fec8fe994b923d7fa0abfb8aef91e5434f632
Instruction ID: f765d5fd14c8af2898c3b5c72d188e6bb3527ce5fc73c115b28133b2ad226b1b
Opcode Fuzzy Hash: 588afb01cfb9fbe837a471fb395fec8fe994b923d7fa0abfb8aef91e5434f632
Instruction Fuzzy Hash: DE519A76601B4082EB54CF6AE8543AA73B6F7C8B98F18C13ADA6D87368DF39C055C740

Function 6168F4BC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 6168F5B9
malloc.LIBCMT ref: 6168F5DC

Strings

bad allocation, xrefs: 6168F5F0
csm, xrefs: 6168F544

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: EncodePointermalloc
String ID: bad allocation$csm
API String ID: 4011298729-2003371537
Opcode ID: 2fb32110191cd79c7b07c23d120328ba8ddca3237d2f362e2e80a335f6967aa7
Instruction ID: 55cd126814fb80f50ac12facbd76592a2b12ef4cb16829048d165d55dba767da
Opcode Fuzzy Hash: 2fb32110191cd79c7b07c23d120328ba8ddca3237d2f362e2e80a335f6967aa7
Instruction Fuzzy Hash: C141CC7A604B41CADB50CF66E08075C77B4F798B88F54C616DB4D87B28CB39C5A2C791

Function 61683A8C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 61683ACF

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

std::exception::exception.LIBCMT ref: 61683B09

Strings

ppVirtualProcessorRoots, xrefs: 61683ABC
count, xrefs: 61683AF6

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: std::exception::exception$ExceptionRaise
String ID: count$ppVirtualProcessorRoots
API String ID: 127205192-3650809737
Opcode ID: 0ca4594492cb927c2f43241f1f1054ac3d97c7697b2ac7e405f5157053e77243
Instruction ID: c0dbadddc219e801aa02bcf3a6d758637591213bd7894031d249b2214b5ac255
Opcode Fuzzy Hash: 0ca4594492cb927c2f43241f1f1054ac3d97c7697b2ac7e405f5157053e77243
Instruction Fuzzy Hash: C441CE7A711B1194EB54CF69E8807983775F788BE8F948122DE1D07B64EF34C482C350

Function 6168E430 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,6168E135), ref: 6168E46C
GetCurrentThreadId.KERNEL32 ref: 6168E4A3
swprintf.LIBCMT ref: 6168E4ED

Strings

[%d:%d:%d:%d(%d)] , xrefs: 6168E4D5

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CurrentThreadValueswprintf
String ID: [%d:%d:%d:%d(%d)]
API String ID: 3453547420-3832470304
Opcode ID: 8e412c0397156738b8be3bc34bdb06a4e5d72303a5cadc0c721d1b97e5c955bc
Instruction ID: 83dade2fc6b1a4513caf5b9187b3a13df570239fc0678512cc3df724bfe57102
Opcode Fuzzy Hash: 8e412c0397156738b8be3bc34bdb06a4e5d72303a5cadc0c721d1b97e5c955bc
Instruction Fuzzy Hash: 1331CC76201B408AEB448F2BD8447997BB5FB88FD4F198126DE6A53724EF79C952C300

Function 616EE934 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

_fltout2.LIBCMT ref: 616EE96F
_errno.LIBCMT ref: 616EE979
_invalid_parameter_noinfo.LIBCMT ref: 616EE980

Strings

-, xrefs: 616EE99B

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_fltout2_invalid_parameter_noinfo
String ID: -
API String ID: 485257318-2547889144
Opcode ID: dc8d9ea3d497079f6a8cf695397b1785df3033515a5c4e31e7331c8382a488ec
Instruction ID: 361fc252fa0d1c47e42545d1fc81ca93f00368309bf768a38d25efe769e7da09
Opcode Fuzzy Hash: dc8d9ea3d497079f6a8cf695397b1785df3033515a5c4e31e7331c8382a488ec
Instruction Fuzzy Hash: F431092630E68186EB118F6AA44874AB7A1B785BD8F14C316EF9807B98DF3DC445CB04

Function 617931F8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 617932DC
_CxxThrowException.MSVCR100 ref: 617932EE
std::_Facet_Register.LIBCPMT ref: 6179332A

Strings

bad cast, xrefs: 617932D0

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: 795e38392f5b05c5c5d2ddd98092171fe213b880b154216a852855451ab3b34e
Instruction ID: 0c892209101b26f302786a56f932103d496a2142534cfcad847c75ad0b101e31
Opcode Fuzzy Hash: 795e38392f5b05c5c5d2ddd98092171fe213b880b154216a852855451ab3b34e
Instruction Fuzzy Hash: BE315E32248A4191DB01CB65FA40399B372F7D57A8F588772DA6E47AE8DF28C55AC700

Function 6178B0F8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 6178B1DC
_CxxThrowException.MSVCR100 ref: 6178B1EE
std::_Facet_Register.LIBCPMT ref: 6178B22A

Strings

bad cast, xrefs: 6178B1D0

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: dbc110a7f88cf2d1af06febf91898750a02afe3e62104c60730dea465bc32f7b
Instruction ID: a658d19fcc51f8512e0a098232a1deb94b8736f295a5fa02c870d5b52e768adb
Opcode Fuzzy Hash: dbc110a7f88cf2d1af06febf91898750a02afe3e62104c60730dea465bc32f7b
Instruction Fuzzy Hash: 8A316D32608A4581EB41CB65EA50399B772F7D47A8F58C332D66E4B6E8DF28D856C700

Function 6178C0EC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 6178C1D0
_CxxThrowException.MSVCR100 ref: 6178C1E2
std::_Facet_Register.LIBCPMT ref: 6178C21E

Strings

bad cast, xrefs: 6178C1C4

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: 9d912c72413a9359db377dcae85d9f69e5269e6488e4e1d7fd0843ebb6ada199
Instruction ID: eb80bfe7189488f6724834af4e5fb69f2752da0192307949391932c02b809a6b
Opcode Fuzzy Hash: 9d912c72413a9359db377dcae85d9f69e5269e6488e4e1d7fd0843ebb6ada199
Instruction Fuzzy Hash: D3317072708A4181EB41CB69EA907D9B372F7D07A8F5C8332D66E476E8DF28C456C740

Function 617870E4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 617871C8
_CxxThrowException.MSVCR100 ref: 617871DA
std::_Facet_Register.LIBCPMT ref: 61787216

Strings

bad cast, xrefs: 617871BC

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: f60017785ce23f625f9bd424affdc93dd7b6d86fe69203341ea0a59a1ee61ae2
Instruction ID: befab6dce95e673643766802098dcd768403ae1edba3e5edfdfec23eea399877
Opcode Fuzzy Hash: f60017785ce23f625f9bd424affdc93dd7b6d86fe69203341ea0a59a1ee61ae2
Instruction Fuzzy Hash: D9316132748A4181DB52CB65EA40399B373F7D17A8F588332D66E87AE8DF34C496C710

Function 617930A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 61793184
_CxxThrowException.MSVCR100 ref: 61793196
std::_Facet_Register.LIBCPMT ref: 617931D2

Strings

bad cast, xrefs: 61793178

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: 0d76eb6dc6e92a9edf75e7ecdf23233ca731539488e867a6a2e002d420670350
Instruction ID: a44742c1a60d028a3793d1d3c93d904910193fd8678e14687e92bb6a66391f0e
Opcode Fuzzy Hash: 0d76eb6dc6e92a9edf75e7ecdf23233ca731539488e867a6a2e002d420670350
Instruction Fuzzy Hash: 17315B72248E4181DB01DF69FA40399A372F7D17A8F188732DA6E876F8DF28C55AC740

Function 6178B3A8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 6178B48C
_CxxThrowException.MSVCR100 ref: 6178B49E
std::_Facet_Register.LIBCPMT ref: 6178B4DA

Strings

bad cast, xrefs: 6178B480

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: 10f201885277658056e8f6a47e71b5e89c72bd2cbbc40a96746e34b593e54591
Instruction ID: 85cef553a6827f46e527bd866fab934bd7ca95bc858dbf3163a47da83ab47307
Opcode Fuzzy Hash: 10f201885277658056e8f6a47e71b5e89c72bd2cbbc40a96746e34b593e54591
Instruction Fuzzy Hash: 2A318F32208A4181DB51CB69EA40399B372FBD57B8F58C332DA6E47AE8DF29D456C700

Function 6178C39C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 6178C480
_CxxThrowException.MSVCR100 ref: 6178C492
std::_Facet_Register.LIBCPMT ref: 6178C4CE

Strings

bad cast, xrefs: 6178C474

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: a0f20825a465a0063326285fd7b9dd8db408a2e4253195dfeb8b1e870b3531e8
Instruction ID: aa1b94fe21f74ddedc2712682618b273a5d902ca6540ab3b74b2a8b93246787c
Opcode Fuzzy Hash: a0f20825a465a0063326285fd7b9dd8db408a2e4253195dfeb8b1e870b3531e8
Instruction Fuzzy Hash: 39314032248A4181DB91DB69EA403E9B771E7D17A8F1C8332DB6E476E8DF29C596C700

Function 6178E388 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 6178E46C
_CxxThrowException.MSVCR100 ref: 6178E47E
std::_Facet_Register.LIBCPMT ref: 6178E4BA

Strings

bad cast, xrefs: 6178E460

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: 869d39777ef4161bc2a57bd68d91658e30703299bd7393bf16f25c30cd0d0ffa
Instruction ID: 7f9af9692222db2abded55ff687c7453e10bb0cdcc322b14fa7c46cedd85d6aa
Opcode Fuzzy Hash: 869d39777ef4161bc2a57bd68d91658e30703299bd7393bf16f25c30cd0d0ffa
Instruction Fuzzy Hash: 74318032208A4581DB51DB6AEA40389B372F7D17A8F588331EA6E476E8DF34C556C700

Function 6178B250 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 6178B334
_CxxThrowException.MSVCR100 ref: 6178B346
std::_Facet_Register.LIBCPMT ref: 6178B382

Strings

bad cast, xrefs: 6178B328

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: 131e265a36873c6d42dc96048c66aedff05fe2ad16b972c76a2b08afc84e58e6
Instruction ID: c61f25f346112643c6906af8ee6b6aa09b27c4274a19bc01346fcc7cd8d8f6e1
Opcode Fuzzy Hash: 131e265a36873c6d42dc96048c66aedff05fe2ad16b972c76a2b08afc84e58e6
Instruction Fuzzy Hash: C7318B32208B4181DB41CB65EA40399B372FBD17A8F58C332DA6E47AE8DF28D556C300

Function 6178C244 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 6178C328
_CxxThrowException.MSVCR100 ref: 6178C33A
std::_Facet_Register.LIBCPMT ref: 6178C376

Strings

bad cast, xrefs: 6178C31C

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: b1135b4169e628c68fb6eac0b5d6ec5c342a4ea7a4e3445e055f33ede9aabb7f
Instruction ID: 43a7435b50fb9b29a67db63dd1b240aa10d64e2e9efdae9b1cfb18a668e40358
Opcode Fuzzy Hash: b1135b4169e628c68fb6eac0b5d6ec5c342a4ea7a4e3445e055f33ede9aabb7f
Instruction Fuzzy Hash: 93319232248A4581DB51CBA9EA403C9B371F7D57A8F188332DA6E47AE8DF28C956C700

Function 617672F8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 617673DC
_CxxThrowException.MSVCR100 ref: 617673EE
std::_Facet_Register.LIBCPMT ref: 6176742A

Strings

bad cast, xrefs: 617673D0

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: 3438218e91bb720d9779c01edaf9c2695a33a00cfe7ff7185dc61416a4c74b2b
Instruction ID: 2ddb27b72c14bf7e8e196417b518939425c298ffd2d0934109ac67887e11c46e
Opcode Fuzzy Hash: 3438218e91bb720d9779c01edaf9c2695a33a00cfe7ff7185dc61416a4c74b2b
Instruction Fuzzy Hash: 58317232618A4181DB01CB66EA40399B776FBD17E8F5C8332DA6E47AE8DF34C556C780

Function 6175C2CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 6175C3B0
_CxxThrowException.MSVCR100 ref: 6175C3C2
std::_Facet_Register.LIBCPMT ref: 6175C3FE

Strings

bad cast, xrefs: 6175C3A4

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: f1af9cb3a3bac708ff657fdd0381d03d647e2b21e2dd7134db4aeb729b0ff47b
Instruction ID: 7605accec3d245f2a0452d42d418deaa009aa180894216166811c1befa44d16b
Opcode Fuzzy Hash: f1af9cb3a3bac708ff657fdd0381d03d647e2b21e2dd7134db4aeb729b0ff47b
Instruction Fuzzy Hash: AB31AD32348A4581EB42CF69EA40399B776F7D17A8F188332D66E476E9DF38C562C340

Function 6175C57C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 6175C660
_CxxThrowException.MSVCR100 ref: 6175C672
std::_Facet_Register.LIBCPMT ref: 6175C6AE

Strings

bad cast, xrefs: 6175C654

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: 9588f2de762ea5d541940e7dd80accfa75f5b7bae5a90e85801450b44f2876a0
Instruction ID: 5d2b62c971851bcb0803cedfe0652c7c4dfb5bf62278e8f548b930604494aacb
Opcode Fuzzy Hash: 9588f2de762ea5d541940e7dd80accfa75f5b7bae5a90e85801450b44f2876a0
Instruction Fuzzy Hash: CD318432308A4181DB41CF69EA80799B376F7D07A8F689332D66D476E8DF34D565C710

Function 61753558 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 61756C80: ??0_NonReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 61756CB6
Part of subcall function 61756C80: ??0_NonReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 61756CD1

??0_ReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 617535CC
??0_ReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 617535FC
??0_NonReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 61753681

Strings

l4ua, xrefs: 6175361E

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0_Concurrency@@Lock@details@Reentrant
String ID: l4ua
API String ID: 2508204085-455804566
Opcode ID: c342fd793e2d028afffc9b8c2c70a59467ca1398e85edeabaf3fad51143e7675
Instruction ID: 1cefa7ee95e4fc2d0af2c200f75572ca400b610f20ee7a81327972838c293f16
Opcode Fuzzy Hash: c342fd793e2d028afffc9b8c2c70a59467ca1398e85edeabaf3fad51143e7675
Instruction Fuzzy Hash: 0441E336215B809AD7658F24F8803CBB7B9F748768F644225DBEA033A0DF39D1A9D300

Function 6178B500 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 6178B5E4
_CxxThrowException.MSVCR100 ref: 6178B5F6
std::_Facet_Register.LIBCPMT ref: 6178B632

Strings

bad cast, xrefs: 6178B5D8

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: e6bfc95d73e3644b57c9784e16baeaec6fdf1c5851332c4a8f571be042dab843
Instruction ID: a116b6394c3a1c3a9f27587a0c0314bf2047ffc0364697c276686bdc2d226dc1
Opcode Fuzzy Hash: e6bfc95d73e3644b57c9784e16baeaec6fdf1c5851332c4a8f571be042dab843
Instruction Fuzzy Hash: C1318D32308A4181DB41CF65EA80399B372E7D57A8F68C332D66E476E8DF28D456C710

Function 617675A8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 6176768C
_CxxThrowException.MSVCR100 ref: 6176769E
std::_Facet_Register.LIBCPMT ref: 617676DA

Strings

bad cast, xrefs: 61767680

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: fdecc37760adabf347e3e723097059085c91945ee923fdd638c9e26e7164dc3a
Instruction ID: 4607bfa1ee1f3aa8de15a955bba6baa7d4328a9f14eb786822a56676389c2c72
Opcode Fuzzy Hash: fdecc37760adabf347e3e723097059085c91945ee923fdd638c9e26e7164dc3a
Instruction Fuzzy Hash: 39314F32608A4181DB01CF69EA40399B776FBD17E8F5C8332DA6E47AE8DF25C956C740

Function 61767450 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 61767534
_CxxThrowException.MSVCR100 ref: 61767546
std::_Facet_Register.LIBCPMT ref: 61767582

Strings

bad cast, xrefs: 61767528

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: 1b25beb9ecaeacf808ae2c66eafdf26590381d4ed4379015c9c43b3bf7c65f67
Instruction ID: 7f78ecb3e4aa5b29e9d1ff24030e1923392af6ab1e0514511705919e87f137a2
Opcode Fuzzy Hash: 1b25beb9ecaeacf808ae2c66eafdf26590381d4ed4379015c9c43b3bf7c65f67
Instruction Fuzzy Hash: 90319232608A4591DB02CB65EA40389B776FBD17E8F288371DA6E476E8DF28C596C740

Function 6175C424 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 6175C508
_CxxThrowException.MSVCR100 ref: 6175C51A
std::_Facet_Register.LIBCPMT ref: 6175C556

Strings

bad cast, xrefs: 6175C4FC

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: bc03fc82b565a61f9cacbf02582a897176c0722ef98c9b237d97bfb7fc461689
Instruction ID: 7cafebde81e86ecfcf6d52dcaafef4a2ffcdbab53faccaab46436bc04978d899
Opcode Fuzzy Hash: bc03fc82b565a61f9cacbf02582a897176c0722ef98c9b237d97bfb7fc461689
Instruction Fuzzy Hash: 0F319F32209A4181DB81CB69EA40799B775F7D47A8F288332D66E876E8DF38C565C740

Function 6178E4E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 6178E5C4
_CxxThrowException.MSVCR100 ref: 6178E5D6
std::_Facet_Register.LIBCPMT ref: 6178E612

Strings

bad cast, xrefs: 6178E5B8

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: 2b5728584709415ffd6af18e1545fd11e65ace7d28527efd2e604f5b76d6ad67
Instruction ID: 0b0cc0876487c91ba7c708445bf75d2375c5959f4cee8eedfc84e7ed03b0d0db
Opcode Fuzzy Hash: 2b5728584709415ffd6af18e1545fd11e65ace7d28527efd2e604f5b76d6ad67
Instruction Fuzzy Hash: BF31B332308A4581EB51DF26EA40399B772F7C47A8F2C8332D66E476E8EF24C456C710

Function 61767700 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 617677E4
_CxxThrowException.MSVCR100 ref: 617677F6
std::_Facet_Register.LIBCPMT ref: 61767832

Strings

bad cast, xrefs: 617677D8

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: 56ae88525e438fa9696210c213549e5f8859418a68096e6125ba6290348c7075
Instruction ID: a4b16610d49f12cab1dc5a168dd82382b4fa59b4576a31c502ec6ba833d51d2c
Opcode Fuzzy Hash: 56ae88525e438fa9696210c213549e5f8859418a68096e6125ba6290348c7075
Instruction Fuzzy Hash: E3317232648A4181DB01CF69EA50399B376FBD1BF8F188331DA6D476E8DF28C856C740

Function 6178B7B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 6178B894
_CxxThrowException.MSVCR100 ref: 6178B8A6
std::_Facet_Register.LIBCPMT ref: 6178B8E2

Strings

bad cast, xrefs: 6178B888

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: 4fc07c76f52ea44c5a7d225f328b7cc6a1ca3cede88387c7e64aacd585fd52d5
Instruction ID: c6b208bd316bfa6e9d0e5f0908cd7d808b78fa8322ccea2b6b8e57036d29d6de
Opcode Fuzzy Hash: 4fc07c76f52ea44c5a7d225f328b7cc6a1ca3cede88387c7e64aacd585fd52d5
Instruction Fuzzy Hash: 0531CE32658A4185DB41CF65EA80399B372FBC47B8F58C332DA6E476E8DF28D486C340

Function 6178B658 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 6178B73C
_CxxThrowException.MSVCR100 ref: 6178B74E
std::_Facet_Register.LIBCPMT ref: 6178B78A

Strings

bad cast, xrefs: 6178B730

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: 1cb85475a7d8d1f078b0b9be1d82b10022e39bfcfb725b32617a74a838d60ee2
Instruction ID: 6914215fa8057d6c79cbc6dbe5d41500dd0de77c6041c775ab30d073917c15f7
Opcode Fuzzy Hash: 1cb85475a7d8d1f078b0b9be1d82b10022e39bfcfb725b32617a74a838d60ee2
Instruction Fuzzy Hash: 26315A32708B4181DA41DB65EA40399B372FBD17A8F1CC332D66A476E8DF29D556C700

Function 6167A43C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6167A45B

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

std::exception::exception.LIBCMT ref: 6167A49D

Strings

pScheduler, xrefs: 6167A445
version, xrefs: 6167A487

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: std::exception::exception$ExceptionRaise
String ID: pScheduler$version
API String ID: 127205192-3154422776
Opcode ID: 290056e2afb8ae586098ba778af8d19811d2dca14c5a9fe664f1bb98bda51f61
Instruction ID: 03697496c84fc7d05657e1516939eb0f39c92bc0e57a72b204eaa7a9202e0c2f
Opcode Fuzzy Hash: 290056e2afb8ae586098ba778af8d19811d2dca14c5a9fe664f1bb98bda51f61
Instruction Fuzzy Hash: 2131C335609B8691DE20CB54E44029AB776F7C9BD8F88C125DA9C07B6CEF3CC245C700

Function 61793350 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

??0bad_cast@std@@QEAA@PEBD@Z.MSVCR100 ref: 61793434
_CxxThrowException.MSVCR100 ref: 61793446
std::_Facet_Register.LIBCPMT ref: 61793482

Strings

bad cast, xrefs: 61793428

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0bad_cast@std@@ExceptionFacet_RegisterThrowstd::_
String ID: bad cast
API String ID: 53418987-3145022300
Opcode ID: 95c3b9392574b94fa40b2a612aadb582eb900e7166c588f7e93ed78f69c4f03f
Instruction ID: d10ca0bb693e4705267bed0bb4370e70cffeb9737e5366ed2f966e3e13d22f70
Opcode Fuzzy Hash: 95c3b9392574b94fa40b2a612aadb582eb900e7166c588f7e93ed78f69c4f03f
Instruction Fuzzy Hash: 96318F32348A4181DB02CF65FA40399B372EBD07A8F188732D66E4B6E8DF28C45AC700

Function 616AB8C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88timeCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616AB8EB
_invalid_parameter_noinfo.LIBCMT ref: 616AB8F6
GetLocalTime.KERNEL32 ref: 616AB90A

Strings

gfff, xrefs: 616AB922

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: LocalTime_errno_invalid_parameter_noinfo
String ID: gfff
API String ID: 2620414595-1553575800
Opcode ID: c20c2d6799fafeed378026e353791354346742a88a11d9e2470b0f635cec6ca2
Instruction ID: be455184b42ecc308b009cb900165b8a1b0312e77faab4c4990c66a9ff8169df
Opcode Fuzzy Hash: c20c2d6799fafeed378026e353791354346742a88a11d9e2470b0f635cec6ca2
Instruction Fuzzy Hash: 0021259272429583D704DF39E41229AB3A2FBF8B59B48D222E785CBB58EB3CC411C710

Function 616ABB50 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80timeCOMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616ABB73
_invalid_parameter_noinfo.LIBCMT ref: 616ABB7E
GetLocalTime.KERNEL32 ref: 616ABB92

Strings

gfff, xrefs: 616ABBAF

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: LocalTime_errno_invalid_parameter_noinfo
String ID: gfff
API String ID: 2620414595-1553575800
Opcode ID: 9abdde9af9b367a4c9f98997121f4d03e67ff3daa30c7ba94f56ef38c3d6c7a6
Instruction ID: 46c8aee5241bac1a9f7aaa3737593fc0dab65cee399ab0c83b8dc9b61e5f662d
Opcode Fuzzy Hash: 9abdde9af9b367a4c9f98997121f4d03e67ff3daa30c7ba94f56ef38c3d6c7a6
Instruction Fuzzy Hash: 4C21079632429583D705DF39E41229AB3B1FBB8B59B48C222EB85CBB58EB3CC511C715

Function 616CC354 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616CC38A
_invalid_parameter_noinfo.LIBCMT ref: 616CC395

Strings

Z, xrefs: 616CC3CE
A, xrefs: 616CC3C8

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: A$Z
API String ID: 2959964966-4098844585
Opcode ID: 0c0cdae60050f44e30f8366b71d67bdc4e4d608330d7a609ee378136ddaeb956
Instruction ID: 585ff04011459297de40f70d8c8f47348c82bc986d97b306821086929e6576a6
Opcode Fuzzy Hash: 0c0cdae60050f44e30f8366b71d67bdc4e4d608330d7a609ee378136ddaeb956
Instruction Fuzzy Hash: 9A21F67AA1639181EB109B55A1401BAFAA1F790FD4BD8C212EFDE47788D728C541C707

Function 61675D34 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 61675D6A

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

SignalObjectAndWait.KERNEL32 ref: 61675DE6
SetEvent.KERNEL32 ref: 61675DF7

Strings

pContext, xrefs: 61675D57

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: EventExceptionObjectRaiseSignalWaitstd::exception::exception
String ID: pContext
API String ID: 3632571201-2046700901
Opcode ID: 38c05a3982ac2d149f5e98c529b74f2db09d2856e0875f078e6cc596b4dc4318
Instruction ID: f2b857652cd90c3e7e797c47943439f1d7231546b4331b17e3d8fa1725931e58
Opcode Fuzzy Hash: 38c05a3982ac2d149f5e98c529b74f2db09d2856e0875f078e6cc596b4dc4318
Instruction Fuzzy Hash: 752198BB605B0586DB15EF1AE448A89337AF788FD8F568122CE6D47710DF38C856C744

Function 61754490 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCR100 ref: 617544DE
??_V@YAXPEAX@Z.MSVCR100 ref: 6175450E
??1critical_section@Concurrency@@QEAA@XZ.MSVCR100 ref: 61754526

Strings

<Oua, xrefs: 617544AB

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??1critical_section@??3@Concurrency@@
String ID: <Oua
API String ID: 3830451205-2290257541
Opcode ID: 5c79020e55c7a4ce56d8a31645825d633e7b64d5ca8e7162515303591b72b5cb
Instruction ID: 9f972d31ec01040badb39c029bb15dae107e2b1d8ced2fc8ee379eb775d9b744
Opcode Fuzzy Hash: 5c79020e55c7a4ce56d8a31645825d633e7b64d5ca8e7162515303591b72b5cb
Instruction Fuzzy Hash: 69114C32205F40A6EB408F65E69436C7371FB85BA4F584225CB6E4BAA8DF79C0B9D300

Function 617585F8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 6175865E
_CxxThrowException.MSVCR100 ref: 6175867C

Strings

bad locale name, xrefs: 61758648
tOua, xrefs: 61758664

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0exception@std@@ExceptionThrow
String ID: bad locale name$tOua
API String ID: 2684170311-2242159295
Opcode ID: ff96c3a7fce93406529931524acf35a7dabe9a2ce31771fba6f750c671629a09
Instruction ID: c4d24cb13d3bbd6e7acafbaa21a2d41950d515c158438ec402cc76252f340039
Opcode Fuzzy Hash: ff96c3a7fce93406529931524acf35a7dabe9a2ce31771fba6f750c671629a09
Instruction Fuzzy Hash: C5119132209B8195C750CF25F440289BBB5F7987B8F684325DA9C4376DDF38C665C740

Function 61758554 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 617585B3
_CxxThrowException.MSVCR100 ref: 617585D1

Strings

bad locale name, xrefs: 6175859D
tOua, xrefs: 617585B9

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0exception@std@@ExceptionThrow
String ID: bad locale name$tOua
API String ID: 2684170311-2242159295
Opcode ID: aa5a48903c2ef2c54578a7dbfe0cd3c15bbd205c7ae3ebcb04e667172f750a2a
Instruction ID: b113c4c426f350fca9e5355191523d8c2c06e1fb26497dcecc62af9608985564
Opcode Fuzzy Hash: aa5a48903c2ef2c54578a7dbfe0cd3c15bbd205c7ae3ebcb04e667172f750a2a
Instruction Fuzzy Hash: 7E018E32209B8195CB51CF24F940289BB75F7987B8F588325DAAC437ACDF38C668C740

Function 61765060 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

??_V@YAXPEAX@Z.MSVCR100 ref: 61765098
??3@YAXPEAX@Z.MSVCR100 ref: 617650C1
??3@YAXPEAX@Z.MSVCR100 ref: 617650D8

Strings

`Pva, xrefs: 617650A7

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??3@
String ID: `Pva
API String ID: 613200358-890145041
Opcode ID: 44990f12423e89bd0c46bbaa0f2fe255ea8b0002a56c8b01c4eb255fd2fb2a8a
Instruction ID: b6dd15764d4b64177b91ed4e5f031c0cd17f31875ff9febd67ef1b42285e1f28
Opcode Fuzzy Hash: 44990f12423e89bd0c46bbaa0f2fe255ea8b0002a56c8b01c4eb255fd2fb2a8a
Instruction Fuzzy Hash: E1018432605A4681EB04DB26F75436DE724EBC4BC8F54C5219E5D07B29DF39C985C7C0

Function 617574BE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 617574F2
_CxxThrowException.MSVCR100 ref: 61757510

Strings

tOua, xrefs: 617574F8
_PTarget, xrefs: 617574DF

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0exception@std@@ExceptionThrow
String ID: _PTarget$tOua
API String ID: 2684170311-1708587465
Opcode ID: 9bb742f893de5bb2f33ccc39002113f05adcb911e49d2c9fe2f9e7db7a2487e5
Instruction ID: 67a4efb935453f6641213a90f8f9eb36cfa6a9eafb010b21b7dc2fe853e878b5
Opcode Fuzzy Hash: 9bb742f893de5bb2f33ccc39002113f05adcb911e49d2c9fe2f9e7db7a2487e5
Instruction Fuzzy Hash: 00F03172704E4A91DB00CF25E5582887376F748BE8F548631DA7D477A4EF79C919C740

Function 617527D8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

??0invalid_operation@Concurrency@@QEAA@PEBD@Z.MSVCR100 ref: 6175282D
_CxxThrowException.MSVCR100 ref: 6175283F
??_V@YAXPEAX@Z.MSVCR100 ref: 6175284E

Strings

Deleting link registry before removing all the links, xrefs: 61752821

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0invalid_operation@Concurrency@@ExceptionThrow
String ID: Deleting link registry before removing all the links
API String ID: 1760184552-1123019286
Opcode ID: efa38d65373d54f048c1e5feeb2265f468bd0183870c8c16099e9bd34af17c24
Instruction ID: 5fcf6fdc8dbace4dd19343e1d1bd84f78baa70add506d6511ea8da0730261c25
Opcode Fuzzy Hash: efa38d65373d54f048c1e5feeb2265f468bd0183870c8c16099e9bd34af17c24
Instruction Fuzzy Hash: 02019E72605F05C2EF14CF74E4403A96771F7A8B6CF148720A66E062E8DF78C5AAC340

Function 6175743C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 61757465
_CxxThrowException.MSVCR100 ref: 61757483

Strings

tOua, xrefs: 6175746B
_PTarget, xrefs: 61757452

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0exception@std@@ExceptionThrow
String ID: _PTarget$tOua
API String ID: 2684170311-1708587465
Opcode ID: eb98254f5452796fa6b4e84d64a12f1dcaf250ffc6638c5f51253f64d5f6e25a
Instruction ID: 6fca570b836d18e93ca20dbf2d296deda75c1049ceb68ddf5ee8f4276d79f39f
Opcode Fuzzy Hash: eb98254f5452796fa6b4e84d64a12f1dcaf250ffc6638c5f51253f64d5f6e25a
Instruction Fuzzy Hash: D5F08132204B4A91DF00CF28E5442887775F745BA8F99C221DA7D077A4DF39CA59C740

Function 6167F2B8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6167F324: QueryDepthSList.KERNEL32(?,?,?,?,?,?,?,?,6167F2DD), ref: 6167F47A
Part of subcall function 6167F324: InterlockedPushEntrySList.KERNEL32(?,?,?,?,?,?,?,?,6167F2DD), ref: 6167F495
Part of subcall function 6167F324: QueryDepthSList.KERNEL32(?,?,?,?,?,?,?,?,6167F2DD), ref: 6167F49F

DeleteCriticalSection.KERNEL32 ref: 6167F2E5
DeleteCriticalSection.KERNEL32 ref: 6167F2F3
~ListArray.LIBCMT ref: 6167F2FE

Part of subcall function 6167E958: InterlockedFlushSList.KERNEL32 ref: 6167E96F
Part of subcall function 6167E958: InterlockedFlushSList.KERNEL32 ref: 6167E992

Strings

Xga, xrefs: 6167F30E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: List$Interlocked$CriticalDeleteDepthFlushQuerySection$ArrayEntryPush
String ID: Xga
API String ID: 3921795151-1661330454
Opcode ID: cb992a1d8034790c10aa62a8ca82f1cebec671518fb15a026ac12193be1e6b84
Instruction ID: cad1de779e668522d34c0baa10f6da253177687cd226c1eab4981addd9f2c390
Opcode Fuzzy Hash: cb992a1d8034790c10aa62a8ca82f1cebec671518fb15a026ac12193be1e6b84
Instruction Fuzzy Hash: 4BF0FE76509B41A2DB10DF60E8543987375E7CA739F889331CAAD466F4DF39C999C304

Function 61690904 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,000000FF,61690951,?,?,00000028,616D8D05,?,?,?,616D8AC0,?,?,?,616916B5), ref: 61690913
GetProcAddress.KERNEL32(?,?,000000FF,61690951,?,?,00000028,616D8D05,?,?,?,616D8AC0,?,?,?,616916B5), ref: 61690928

Strings

mscoree.dll, xrefs: 6169090C
CorExitProcess, xrefs: 6169091E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: f5e7144a0dbabb1b0310676d189bee26da54ff8d2db811a9b8651794c1f918a6
Instruction ID: 4cd8b716fe14df12c79fed59e589a4850e08c3dd3bf91f1df2bc6b32c1ad9027
Opcode Fuzzy Hash: f5e7144a0dbabb1b0310676d189bee26da54ff8d2db811a9b8651794c1f918a6
Instruction Fuzzy Hash: 61D05EB072778182FF199BA0A9843A413B65F4C756F4C642D986E46350EF2DC5E9C700

Function 617563BC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 617563DB
_CxxThrowException.MSVCR100 ref: 617563F9

Strings

tOua, xrefs: 617563E1
_PTarget, xrefs: 617563C5

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0exception@std@@ExceptionThrow
String ID: _PTarget$tOua
API String ID: 2684170311-1708587465
Opcode ID: 8ab5f92b40608df5da033e3dbbdb2b49445460f98562f6ca3b4a523d0ad32be1
Instruction ID: 7e54421939a40ab948843812d0f18781af9eed410abc19b4d465f2280a82dedb
Opcode Fuzzy Hash: 8ab5f92b40608df5da033e3dbbdb2b49445460f98562f6ca3b4a523d0ad32be1
Instruction Fuzzy Hash: 39E0ED71608B8ED6CE109B04F5503896376F785348F844516E68C43B28DF3DD36ACB40

Function 6175200C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

??0invalid_operation@Concurrency@@QEAA@PEBD@Z.MSVCR100 ref: 6175202D
_CxxThrowException.MSVCR100 ref: 6175203F

Strings

P ua, xrefs: 61752015
Deleting link registry before removing all the links, xrefs: 61752021

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0invalid_operation@Concurrency@@ExceptionThrow
String ID: Deleting link registry before removing all the links$P ua
API String ID: 1760184552-1598919298
Opcode ID: f61898936c8828ebd8dbea2f47a72beb8649083210f35fa31a45dc87fa94fb7a
Instruction ID: f8b23223816735ce30d788fc2cb3dd0f784756783014837b29bf65e82a22aeb9
Opcode Fuzzy Hash: f61898936c8828ebd8dbea2f47a72beb8649083210f35fa31a45dc87fa94fb7a
Instruction Fuzzy Hash: 24E08C3222DA8AD1EE10AF14E8403C86332F748308F988521824D42238EF7EC26FC340

Function 6175E388 Relevance: 6.3, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

memmove.MSVCR100 ref: 6175E406
memmove.MSVCR100 ref: 6175E418
memmove.MSVCR100 ref: 6175E42C
memmove.MSVCR100 ref: 6175E437

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: memmove
String ID:
API String ID: 2162964266-0
Opcode ID: 42d25b2acc0f902252affb7a088fffec5a7a1446a0b1d35f89e9e6680b8f0983
Instruction ID: 58e6d602921532ca3627ff94136bebdbff308f5992ffca396442051a07cac10d
Opcode Fuzzy Hash: 42d25b2acc0f902252affb7a088fffec5a7a1446a0b1d35f89e9e6680b8f0983
Instruction Fuzzy Hash: 5A315276314B1892DB948F22E980359AB75F74ABC8F485015EE8D5BB24CF3AC0BAC340

Function 61676D50 Relevance: 6.3, APIs: 4, Instructions: 327synchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 61676D72
TlsSetValue.KERNEL32 ref: 61676D85

Part of subcall function 6167FF48: QueryDepthSList.KERNEL32 ref: 6167FF64
Part of subcall function 6167FF48: InterlockedPushEntrySList.KERNEL32 ref: 6167FF84

WaitForSingleObject.KERNEL32 ref: 61677189
std::exception::exception.LIBCMT ref: 61677265

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: List$CurrentDepthEntryInterlockedObjectPushQuerySingleThreadValueWaitstd::exception::exception
String ID:
API String ID: 890536162-0
Opcode ID: 7d9ec98e6694df63d2050f4b733ffa2aaeb247695c6f06becf87eb02f7406aec
Instruction ID: b231a1cfd98b4e274cf00cdb4cb863e36bb1a424507a58d27297f0ba7eacce77
Opcode Fuzzy Hash: 7d9ec98e6694df63d2050f4b733ffa2aaeb247695c6f06becf87eb02f7406aec
Instruction Fuzzy Hash: DDE1697A314B869BDB19CF6AC6842AC3772F789B89F448422CF2947B60DF35D4A5C740

Function 6168C2C8 Relevance: 6.2, APIs: 4, Instructions: 208sleepCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32 ref: 6168C2ED
InterlockedPopEntrySList.KERNEL32 ref: 6168C431
SetEvent.KERNEL32 ref: 6168C48D
Sleep.KERNEL32 ref: 6168C59D

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: EntryEventInterlockedListSleepValue
String ID:
API String ID: 269733676-0
Opcode ID: 4675c20b68672025b78725f39fb2e5fa131a56fc5689f11eb494c355aee0ed74
Instruction ID: d68a6ec212fb437eaf7af8363946620cdd9ae5cbd84d6d22996270ac127793f7
Opcode Fuzzy Hash: 4675c20b68672025b78725f39fb2e5fa131a56fc5689f11eb494c355aee0ed74
Instruction Fuzzy Hash: 8091587A715B8486DB958F2AC5403AD7BB0F789F98F058126CE4E47724CF35C5A6C3A0

Function 616B0694 Relevance: 6.2, APIs: 4, Instructions: 195COMMON

Download Yara Rule

APIs

Part of subcall function 616AC9B8: _getptd.LIBCMT ref: 616AC9CA

_errno.LIBCMT ref: 616B06D4
_invalid_parameter_noinfo.LIBCMT ref: 616B06DF
iswctype.LIBCMT ref: 616B0718
_errno.LIBCMT ref: 616B088E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_getptd_invalid_parameter_noinfoiswctype
String ID:
API String ID: 2104083562-0
Opcode ID: a6e55d4a0ff82af1fe6d45b1126caa4d6b315b495e87971f129b611f735bf034
Instruction ID: bb79ea328c8fbb1127d4099d71e9a6ddde1b672cb3eea8cc61657d43afa8a7db
Opcode Fuzzy Hash: a6e55d4a0ff82af1fe6d45b1126caa4d6b315b495e87971f129b611f735bf034
Instruction Fuzzy Hash: C851F82EA443A145EF218AA5D71036B7DB5B740BB4F11C321DFB6C72C4E778C9A58782

Function 616E0D04 Relevance: 6.2, APIs: 4, Instructions: 159COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616E0D52
_invalid_parameter_noinfo.LIBCMT ref: 616E0D5D
DecodePointer.KERNEL32(?,?,?,?,?,616E61AC,?,?,?,?,616CFAB2,?,?,?,?,6168F666), ref: 616E0E0C
_lock.LIBCMT ref: 616E0E37

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: DecodePointer_errno_invalid_parameter_noinfo_lock
String ID:
API String ID: 27599310-0
Opcode ID: 7b40ab884bb90c8c538e9d4ab8f9d1e71b586063621ae82fa35502bdd3d8e61e
Instruction ID: aee70aed7c0edf84f7691c74c7e9b48a52ab593c3a502e2ae6a05019b844cb23
Opcode Fuzzy Hash: 7b40ab884bb90c8c538e9d4ab8f9d1e71b586063621ae82fa35502bdd3d8e61e
Instruction Fuzzy Hash: F151D53A70E74086EB16CB68A4983AE7A72F385754F18C729D96AC3724DF3AD446C300

Function 6167DC7C Relevance: 6.2, APIs: 4, Instructions: 153COMMON

Download Yara Rule

APIs

Part of subcall function 616D8DBC: malloc.LIBCMT ref: 616D8DD6

InitializeSListHead.KERNEL32 ref: 6167DD92
InitializeSListHead.KERNEL32 ref: 6167DD9C
InitializeSListHead.KERNEL32 ref: 6167DE9C
InitializeSListHead.KERNEL32 ref: 6167DEA9

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: HeadInitializeList$malloc
String ID:
API String ID: 1846274232-0
Opcode ID: 09737e4875840acf759cc6d2dd6b7c46040c4068539c3d5c4d397246791607b3
Instruction ID: 486704f306df5c30dab94a7911f2daae42c9484a72787e0475bfa415650c7333
Opcode Fuzzy Hash: 09737e4875840acf759cc6d2dd6b7c46040c4068539c3d5c4d397246791607b3
Instruction Fuzzy Hash: 57615776601B849BDB49CF29EA447C9B7A8F388B84F448529CBAD47360DF38E476C744

Function 6169F238 Relevance: 6.1, APIs: 4, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169F25D
_invalid_parameter_noinfo.LIBCMT ref: 6169F268
_fileno.LIBCMT ref: 6169F275

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_fileno_invalid_parameter_noinfo
String ID:
API String ID: 3179357039-0
Opcode ID: 0ba1e478f22c78a0c12f78685aecdc13367e6f3c6cde09c2ae2b7218a1f58790
Instruction ID: bd7419713bb35374448411ecd1f75011226418fc988db623483ce4e14e8c9b3e
Opcode Fuzzy Hash: 0ba1e478f22c78a0c12f78685aecdc13367e6f3c6cde09c2ae2b7218a1f58790
Instruction Fuzzy Hash: D0411C3F20878687EB158FA9C8403597F62F785B98F5AC986EE1407398CB38C881C380

Function 616A29B0 Relevance: 6.1, APIs: 4, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A29D8

Part of subcall function 61691654: _FF_MSGBANNER.LIBCMT ref: 6169167B

_errno.LIBCMT ref: 616A29FC
_lock.LIBCMT ref: 616A2A0A
_errno.LIBCMT ref: 616A2B3E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_lock
String ID:
API String ID: 8016435-0
Opcode ID: 17541e99e492ccfe075d3c7f316dada5a7af0050a81eca648a121d2ed84a3818
Instruction ID: e2a642b76a9bf6b63f980ef721f74d7dc10c6e8c67d564f9ec70f5329f31e410
Opcode Fuzzy Hash: 17541e99e492ccfe075d3c7f316dada5a7af0050a81eca648a121d2ed84a3818
Instruction Fuzzy Hash: FF41BC7A38875287EB168F77A55031E76A2ABC1B88F14C41EDF494BB54DF38CC028708

Function 6169F90C Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169F943
_invalid_parameter_noinfo.LIBCMT ref: 6169F94E
_flush.LIBCMT ref: 6169FA03
_fileno.LIBCMT ref: 6169FA24

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_fileno_flush_invalid_parameter_noinfo
String ID:
API String ID: 329365992-0
Opcode ID: 155a3b2bb8fd8af8dbcbeed46e358f5799099d7b88e4ca3ae67badc79c313885
Instruction ID: 6a8a4f4294b535e7c2cf10bad2567f5ca3b71752af70cf9448dc11d47a910a69
Opcode Fuzzy Hash: 155a3b2bb8fd8af8dbcbeed46e358f5799099d7b88e4ca3ae67badc79c313885
Instruction Fuzzy Hash: E0313C393057838BEB148EA7A54021EBE51B789FE8F19CA74BEA587B94DB3CC4418704

Function 6169D91C Relevance: 6.1, APIs: 4, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 6169D937

Part of subcall function 6169CCA8: _errno.LIBCMT ref: 6169CCB1
Part of subcall function 6169CCA8: _invalid_parameter_noinfo.LIBCMT ref: 6169CCBC

_errno.LIBCMT ref: 6169D947
_errno.LIBCMT ref: 6169D965
_isatty.LIBCMT ref: 6169D9C6

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_fileno_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574541689-0
Opcode ID: ba965836f550b104dcadfee2c0bd1b3307381d7633f4c6d4e21d39592f1b018e
Instruction ID: ee8338dfde9a6c3f2d2ea186cfe04971f3c70c9bc25e6fea066befe592fefac0
Opcode Fuzzy Hash: ba965836f550b104dcadfee2c0bd1b3307381d7633f4c6d4e21d39592f1b018e
Instruction Fuzzy Hash: 5D41D37A60470387DB14AF69D48135D3762E785BA8F14CA35CE68473D8DB38C561C784

Function 6169D788 Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

_fileno.LIBCMT ref: 6169D7A5

Part of subcall function 6169CCA8: _errno.LIBCMT ref: 6169CCB1
Part of subcall function 6169CCA8: _invalid_parameter_noinfo.LIBCMT ref: 6169CCBC

_errno.LIBCMT ref: 6169D7B5
_errno.LIBCMT ref: 6169D7D1
_isatty.LIBCMT ref: 6169D832

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_fileno_invalid_parameter_noinfo_isatty
String ID:
API String ID: 2574541689-0
Opcode ID: a3ecec0936ae52fb62f28c33dda23f45c455b79e9b23fa836f18f7afec715cf8
Instruction ID: a2ed2e41c12f7bd0f01be96f202ab19832167e701ff85baef74d974773f13998
Opcode Fuzzy Hash: a3ecec0936ae52fb62f28c33dda23f45c455b79e9b23fa836f18f7afec715cf8
Instruction Fuzzy Hash: F541117AA14B468BEB049F78C55036C3B71E785FA8F19CA26CA6D4B3D5EB38C451C780

Function 616EE6A0 Relevance: 6.1, APIs: 4, Instructions: 115COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 616AC9B8: _getptd.LIBCMT ref: 616AC9CA

_errno.LIBCMT ref: 616EE6DE
_invalid_parameter_noinfo.LIBCMT ref: 616EE6E8
_errno.LIBCMT ref: 616EE70C
_invalid_parameter_noinfo.LIBCMT ref: 616EE716

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd
String ID:
API String ID: 1297830140-0
Opcode ID: 90387319a6deea1b9078bb54e8312ce0b444f73ee487a531a176097275950fa5
Instruction ID: 573d3acb64025b1a1347f340d6ac1b3c809bca7386da804543b6e64f7fa2a28d
Opcode Fuzzy Hash: 90387319a6deea1b9078bb54e8312ce0b444f73ee487a531a176097275950fa5
Instruction Fuzzy Hash: E041237A20E7C486DB01CFA6D58826E7BA2F7C5BD4F15C222DB8A43B14EB38C445C705

Function 61682484 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 616824C7
LeaveCriticalSection.KERNEL32 ref: 6168258C

Part of subcall function 616828AC: TlsGetValue.KERNEL32 ref: 616828C8

LeaveCriticalSection.KERNEL32 ref: 616825E5
SetEvent.KERNEL32 ref: 616825EF

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CriticalSection$Leave$EnterEventValue
String ID:
API String ID: 2684762084-0
Opcode ID: 88f80baeef4df852fa209ef5790501df1a632f92b306f52c9fb113064e4658ae
Instruction ID: 402c837b8a1b6b264de9daa2dab49c2046acb9d9bcb6b79de01a85424a76e403
Opcode Fuzzy Hash: 88f80baeef4df852fa209ef5790501df1a632f92b306f52c9fb113064e4658ae
Instruction Fuzzy Hash: 16418A76200B808BDBA4CF26E95035EB7B5F789BA8F485529DFAA47764CF38E051C704

Function 6169FFF8 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A0035
_invalid_parameter_noinfo.LIBCMT ref: 616A0040
_errno.LIBCMT ref: 616A011B
_invalid_parameter_noinfo.LIBCMT ref: 616A0126

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: 36a28013d147ec98e09c178db27981f34bfea9d59d89f8f65a76edcb220de536
Instruction ID: 63e7476721ed860a7a424706759dde879fd17a20b819d90d8b83f33f05cc4f46
Opcode Fuzzy Hash: 36a28013d147ec98e09c178db27981f34bfea9d59d89f8f65a76edcb220de536
Instruction Fuzzy Hash: 1C31246921938382EB128FA1A40017EB26ABF853E9F44C525FD9ADB754DB38CC50C309

Function 616A0BBC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A0BE3
_invalid_parameter_noinfo.LIBCMT ref: 616A0BEE
_fileno.LIBCMT ref: 616A0C09
_ftbuf.LIBCMT ref: 616A0D06

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_fileno_ftbuf_invalid_parameter_noinfo
String ID:
API String ID: 4065164806-0
Opcode ID: f142aa21c89c37b56bd70e8030f0f404b63680d7be577103d7ea0ecfc05ce134
Instruction ID: 76ea9c09d9789e2d58739d24d8cbd5ba72528d7ff0d106ce315cdf0d5967c083
Opcode Fuzzy Hash: f142aa21c89c37b56bd70e8030f0f404b63680d7be577103d7ea0ecfc05ce134
Instruction Fuzzy Hash: 7031E269615B4383DB45CBA5D4903AC3636FBC9B68F94A952CA1EC7784DF39CA01C305

Function 61777418 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

memmove.MSVCR100 ref: 617774F0

Part of subcall function 6175F9AC: ??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 6175F9BF
Part of subcall function 6175F9AC: _CxxThrowException.MSVCR100 ref: 6175F9DD
Part of subcall function 6175F9AC: ??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 6175F9FF
Part of subcall function 6175F9AC: _CxxThrowException.MSVCR100 ref: 6175FA1D
Part of subcall function 6175F9AC: ??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100 ref: 6175FA3F
Part of subcall function 6175F9AC: _CxxThrowException.MSVCR100 ref: 6175FA5D
Part of subcall function 6175F9AC: ??1bad_cast@std@@UEAA@XZ.MSVCR100 ref: 6175FA7B
Part of subcall function 6175F9AC: ??3@YAXPEAX@Z.MSVCR100 ref: 6175FA89

memset.MSVCR100 ref: 6177752B

Strings

string too long, xrefs: 6177745F, 6177747F
invalid string position, xrefs: 61777446

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0exception@std@@ExceptionThrow$??1bad_cast@std@@??3@memmovememset
String ID: invalid string position$string too long
API String ID: 2450945051-4289949731
Opcode ID: 023339bb6215dc0192a5d2d2e882723a01f600168f00204fa8a384e1c8e3657f
Instruction ID: 5a5d3599970627a6cd4896c4b1cfe9cf0f7fe83765e201b17402fe8a4954e6cb
Opcode Fuzzy Hash: 023339bb6215dc0192a5d2d2e882723a01f600168f00204fa8a384e1c8e3657f
Instruction Fuzzy Hash: D231E731205F8480DF258F59D688248BB31F341FE8FA88A66CB6D477A9DF78C562C381

Function 6168A9D4 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32 ref: 6168AAAF
GetLastError.KERNEL32 ref: 6168AAC1
CreateEventW.KERNEL32 ref: 6168AAFB
GetLastError.KERNEL32 ref: 6168AB0D

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CreateErrorEventLast
String ID:
API String ID: 545576003-0
Opcode ID: 3fad355bc8c792c19e9f253a2635f8d3c0c7bbf6c4af792903f71668c48edda8
Instruction ID: 23b008f09cd6eba10f747f586ed259b9288a6fca6f1368bcbf5b6e37f403c6e7
Opcode Fuzzy Hash: 3fad355bc8c792c19e9f253a2635f8d3c0c7bbf6c4af792903f71668c48edda8
Instruction Fuzzy Hash: 17418B76609B4197E718CF24E84038A73B6FB88355F588226CBAD83764EF3DD566C740

Function 6169CDF0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169CE1B
_invalid_parameter_noinfo.LIBCMT ref: 6169CE26
_fileno.LIBCMT ref: 6169CE48
_ftbuf.LIBCMT ref: 6169CEF5

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_fileno_ftbuf_invalid_parameter_noinfo
String ID:
API String ID: 4065164806-0
Opcode ID: ee7c3bb0c2d08fe3d98f4b16fa9318fe047a81ab60a8941c215c098cbe6d719f
Instruction ID: 49a54643e93c397346c0a61e661fbe5d0208777a094be560cc44e650edb85c0c
Opcode Fuzzy Hash: ee7c3bb0c2d08fe3d98f4b16fa9318fe047a81ab60a8941c215c098cbe6d719f
Instruction Fuzzy Hash: 3221F5A930964343EF08C77599503383662AB95FE4F54DA26DD2B877E4DF38C5528304

Function 616A1E20 Relevance: 6.1, APIs: 4, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

_lock.LIBCMT ref: 616A1E34

Part of subcall function 61691740: _amsg_exit.LIBCMT ref: 6169176A

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,?,00000002,6169E2C3), ref: 616A1EEC
free.LIBCMT ref: 616A1F01
EnterCriticalSection.KERNEL32(?,?,?,?,00000002,6169E2C3), ref: 616A1F23

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeSpin_amsg_exit_lockfree
String ID:
API String ID: 3786353176-0
Opcode ID: b8c0acab20c1877b9eab895778b03246fe098f662bef5671257646fd088640f7
Instruction ID: 97fe3720041d0a668e7752e08fccf0f11202e373615d6f0c263f9e779c03bc96
Opcode Fuzzy Hash: b8c0acab20c1877b9eab895778b03246fe098f662bef5671257646fd088640f7
Instruction Fuzzy Hash: 2441D4BA718B8182EB008F29D44436C77B7F794B98F598629CF590B3A4CF39C952C784

Function 61693AAC Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 61693AD2
_invalid_parameter_noinfo.LIBCMT ref: 61693ADE
_errno.LIBCMT ref: 61693B08
_errno.LIBCMT ref: 61693B72

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 77ba763c7978289997b330012ca0ff6cfda83dcfb3affc864c699fdcaba76758
Instruction ID: bf049bbe378e40cea353a4677daec86a5e7c61fc9ec4526d4b5920dfeaabbc5f
Opcode Fuzzy Hash: 77ba763c7978289997b330012ca0ff6cfda83dcfb3affc864c699fdcaba76758
Instruction Fuzzy Hash: E421007AB143938BD704CFB5E46019E73A1FBA4794B49C823DB4987719EB78C841C746

Function 61693C34 Relevance: 6.1, APIs: 4, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 61693C5B
_invalid_parameter_noinfo.LIBCMT ref: 61693C67
_errno.LIBCMT ref: 61693C91
_errno.LIBCMT ref: 61693CFF

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 95cedca84f0b827ad0e8ea9efa26340ba4356d1aa31ef34912344bfc6313f597
Instruction ID: 2f863ebce6f9528bf2aa0faca529aa5836b4ccee275c2544638aae72aa9b2de3
Opcode Fuzzy Hash: 95cedca84f0b827ad0e8ea9efa26340ba4356d1aa31ef34912344bfc6313f597
Instruction Fuzzy Hash: EA21007A724BD3CBEB04CFB6E16419E7361EB54B84B14C822DB0A47745FB38C8458709

Function 616AD634 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616AD653
_invalid_parameter_noinfo.LIBCMT ref: 616AD65E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID:
API String ID: 2959964966-0
Opcode ID: 37fcf8849d695ca3b340b1cb9d1aa87f1696f9c72735649fecb2532382a65d61
Instruction ID: d51644013d9e947aaf7454dac264644fa4cd559378c06657eb084bb2f962e203
Opcode Fuzzy Hash: 37fcf8849d695ca3b340b1cb9d1aa87f1696f9c72735649fecb2532382a65d61
Instruction Fuzzy Hash: 0B31B77A20C7D186E7168B65D44436D7F61E382FE8F18D321DAB907AD8DB78C842CB45

Function 616937A4 Relevance: 6.1, APIs: 4, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616937C4
_invalid_parameter_noinfo.LIBCMT ref: 616937D0
_errno.LIBCMT ref: 616937FA
_errno.LIBCMT ref: 61693860

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 8b40b97763dbe363fd0800401e97d86c307e917b260881eb9b68fd75c99b7896
Instruction ID: 1ac543a62c5ded3e9fa739f6131701e764249f426b6a1008b3b53bf89b3e9303
Opcode Fuzzy Hash: 8b40b97763dbe363fd0800401e97d86c307e917b260881eb9b68fd75c99b7896
Instruction Fuzzy Hash: F421496A7093C24BEB05CAB9D25039D6B52E756BC0F0ACC22DB494BB46E769C409C742

Function 61693638 Relevance: 6.1, APIs: 4, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 61693657
_invalid_parameter_noinfo.LIBCMT ref: 61693663
_errno.LIBCMT ref: 6169368D
_errno.LIBCMT ref: 616936EF

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 67aefcb6c8c0de217b620bbb79b73b3c58349fde19f3a5ba9fef4ba1e4bf48a6
Instruction ID: c574f6d6fdd9736d6c2ba073f2badebb53d3fe82a0f8a401826769dfd4eccedd
Opcode Fuzzy Hash: 67aefcb6c8c0de217b620bbb79b73b3c58349fde19f3a5ba9fef4ba1e4bf48a6
Instruction Fuzzy Hash: F721077A7083E24BE705CBB9D45079D7B52D366784F19C823D7498B742D765C8098B82

Function 616A11C4 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A11DB
_invalid_parameter_noinfo.LIBCMT ref: 616A11E6
_lock.LIBCMT ref: 616A11F8

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo_lock
String ID:
API String ID: 2363482343-0
Opcode ID: 4d6067b043aba2348aa763226549cfe07aa076fa5f92d3adea0a51406397a9c4
Instruction ID: 8d57475175af996da8bb2db1f5d4c5f51752c6efb63bab0f168e5e8a675977e9
Opcode Fuzzy Hash: 4d6067b043aba2348aa763226549cfe07aa076fa5f92d3adea0a51406397a9c4
Instruction Fuzzy Hash: 1331DBF971960286EB108FA9D58039CB7B2F7C5794F14C729D658873E4CB3DC9928744

Function 617615FC Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_fsopen.MSVCR100 ref: 6176168D
fclose.MSVCR100 ref: 6176169B
_fsopen.MSVCR100 ref: 617616B1
fseek.MSVCR100 ref: 617616CC

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: _fsopen$fclosefseek
String ID:
API String ID: 410343947-0
Opcode ID: e53bd93f32b37ab3c50b8d6566e41d003510ac255b5b34b5140189a9ad2ccd36
Instruction ID: 5e20da909a3ce65b3ebe0a5af88726aab5d855a3f13036d75b7961604d5aeb55
Opcode Fuzzy Hash: e53bd93f32b37ab3c50b8d6566e41d003510ac255b5b34b5140189a9ad2ccd36
Instruction Fuzzy Hash: 4321DE35B25A4085FB048B1AE658756ABB9FBC9FC4F0CC534DE5943B20DE39C855C380

Function 61761700 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wfsopen.MSVCR100 ref: 61761791
fclose.MSVCR100 ref: 6176179F
_wfsopen.MSVCR100 ref: 617617B5
fseek.MSVCR100 ref: 617617D0

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: _wfsopen$fclosefseek
String ID:
API String ID: 1261181034-0
Opcode ID: 2488b0c6903d3d695e7a23e5a6e97a63245f56dbf052b95c12573ddc7f984301
Instruction ID: 6cf61360f785f0e3ee53ed6a3532e157662923ec47660f0d7676dbeec66a7670
Opcode Fuzzy Hash: 2488b0c6903d3d695e7a23e5a6e97a63245f56dbf052b95c12573ddc7f984301
Instruction Fuzzy Hash: C921DC31721A4085FB048B1AEA4875AABBAFBC6FC4F18C535AE1943B24DE3EC445C380

Function 6168039C Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,6167FBD4,?,?,?,?,?,?,?,61686C64), ref: 616803C6
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,6167FBD4,?,?,?,?,?,?,?,61686C64), ref: 6168040D

Part of subcall function 616741FC: std::exception::exception.LIBCMT ref: 61674216

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

InterlockedPopEntrySList.KERNEL32(?,?,?,?,?,?,?,6167FBD4,?,?,?,?,?,?,?,61686C64), ref: 6168042A
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,6167FBD4,?,?,?,?,?,?,?,61686C64), ref: 61680482

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Value$EntryExceptionInterlockedListRaisestd::exception::exception
String ID:
API String ID: 2395153271-0
Opcode ID: fbbea772cc9ea658c73e52fb113ce605bd8f3c25eca5e3fad87adf43bc6639c4
Instruction ID: 42bebf19cec081d2c5d75a65667fad5bbd785a3513960a98406d3231813890e7
Opcode Fuzzy Hash: fbbea772cc9ea658c73e52fb113ce605bd8f3c25eca5e3fad87adf43bc6639c4
Instruction Fuzzy Hash: 5721B17630AB4282EB20CF55E8503AAB772F788B94F488625DAAE437A4DF38C015C300

Function 616804A8 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32 ref: 616804D6
QueryDepthSList.KERNEL32 ref: 616804E8
CloseHandle.KERNEL32 ref: 6168050E
InterlockedPushEntrySList.KERNEL32 ref: 61680527

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: List$CloseDepthEntryHandleInterlockedPushQueryValue
String ID:
API String ID: 94243546-0
Opcode ID: 2f1dc77d981f104ee02e60c74d6eda0225605432a96e389e9b7d4d9101529c4d
Instruction ID: b3d5e456983db88edb10c879c801c79798b1a77221d57b1a7ae1fdb7be8a8cca
Opcode Fuzzy Hash: 2f1dc77d981f104ee02e60c74d6eda0225605432a96e389e9b7d4d9101529c4d
Instruction Fuzzy Hash: 4121897A305A8182EB45CF26E2403AD7332FB88F95F448421DB5A87B24CF39C4A5C361

Function 6178876C Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

_malloc_crt.MSVCR100(?,?,?,6178898B,0000003F,00000000,00000024,00000001,00000000,617618CA), ref: 617887D2
_free_locale.MSVCR100 ref: 61788828
free.MSVCR100 ref: 61788831
free.MSVCR100 ref: 61788840

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: free$_free_locale_malloc_crt
String ID:
API String ID: 1992631977-0
Opcode ID: ca3f7e55e054feab2b5ed1b97c1b55e9d18c77d8224a45eb631032ee5022f90e
Instruction ID: 068e0548dc7b89f0f5843e83253333e85d66eb3e1c6b8afc67bfb7aa276e5459
Opcode Fuzzy Hash: ca3f7e55e054feab2b5ed1b97c1b55e9d18c77d8224a45eb631032ee5022f90e
Instruction Fuzzy Hash: 1221A936328B9082EB499FA6E600609BBB4FB48B94F588439DE6907B54EF39D461C740

Function 616A47C4 Relevance: 6.1, APIs: 4, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A47F5
_invalid_parameter_noinfo.LIBCMT ref: 616A4800
_errno.LIBCMT ref: 616A4839
_errno.LIBCMT ref: 616A484C

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 73b4fe6cae36d93dad86e1509df3c797a2c676510e3b57b9dc6f6bfe4c179abe
Instruction ID: 54f2fcba311941ac1bc86e2fc740c45974baa5b9f4b4b2be51006d3f9bd841df
Opcode Fuzzy Hash: 73b4fe6cae36d93dad86e1509df3c797a2c676510e3b57b9dc6f6bfe4c179abe
Instruction Fuzzy Hash: 0A11C86D30678282EB018F56BD0021FB6767BC5BD8F09C5219E484B714EFBCC851C754

Function 6169E590 Relevance: 6.1, APIs: 4, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169E5BF
_invalid_parameter_noinfo.LIBCMT ref: 6169E5CA
_errno.LIBCMT ref: 6169E5FC
_errno.LIBCMT ref: 6169E60E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$_invalid_parameter_noinfo
String ID:
API String ID: 2819658684-0
Opcode ID: 951ed9446791b3c094cdcfd5e11f673d2690e65391338c55ddcbfbf4b897c742
Instruction ID: 340bd72c165b9f0bccbe3b843cd504ed4c2929c8d9d711ad70eae2f3e063ee24
Opcode Fuzzy Hash: 951ed9446791b3c094cdcfd5e11f673d2690e65391338c55ddcbfbf4b897c742
Instruction Fuzzy Hash: D311867971979387EB018B66A80020EB6A6B785BC4F08DD21DE8887754FF7CC5518754

Function 6169FF3C Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 6169FF62
_invalid_parameter_noinfo.LIBCMT ref: 6169FF6D
feof.LIBCMT ref: 6169FFBF
ferror.LIBCMT ref: 6169FFCB

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfofeofferror
String ID:
API String ID: 3595984924-0
Opcode ID: 93b58ee8661a2f28bf59d627f247f3d75615adbbcfb0a017b538fb590da9292c
Instruction ID: 3fe29bab18159548e08ed4cb1a6b1501903f17afb553e9f6f0b8be2a17f223a5
Opcode Fuzzy Hash: 93b58ee8661a2f28bf59d627f247f3d75615adbbcfb0a017b538fb590da9292c
Instruction Fuzzy Hash: 8F11E93A20974383D7119F6AB81012D7BA1A7C6BB8B198971BE5687394DF38C401C7D4

Function 61755340 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

??0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QEAA@AEAV123@@Z.MSVCR100(?,?,?,?,?,?,?,?,61753296), ref: 61755368
??1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100(?,?,?,?,?,?,?,?,61753296), ref: 6175537E
??0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QEAA@AEAV123@@Z.MSVCR100(?,?,?,?,?,?,?,?,61753296), ref: 61755393
??1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100(?,?,?,?,?,?,?,?,61753296), ref: 617553BF

Part of subcall function 6175F0D0: ??0exception@std@@QEAA@XZ.MSVCR100(?,?,?,?,?,?,?,?,61752AFD), ref: 6175F0D9
Part of subcall function 6175F0D0: _CxxThrowException.MSVCR100 ref: 6175F0F7
Part of subcall function 6175F0D0: ??0exception@std@@QEAA@AEBV01@@Z.MSVCR100(?,?,?,?,?,?,?,?,?,?,?,?,61752AFD), ref: 6175F10D

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: Concurrency@@Lock@details@ReentrantScoped_lock@_$??0_??0exception@std@@??1_V123@@$ExceptionThrowV01@@
String ID:
API String ID: 2218300590-0
Opcode ID: acbdb0ff125961634cdda4f638d9cdf68cce6967b588eec088e0c652dad7ef41
Instruction ID: f2d276b02ecc48f1d8a2d13e74c85a5102887e75d8985e72ad16c81af5f9630e
Opcode Fuzzy Hash: acbdb0ff125961634cdda4f638d9cdf68cce6967b588eec088e0c652dad7ef41
Instruction Fuzzy Hash: 3F214932205F41D2EB448F29E54438DB370F745BA8F688222DBAC437A5DF78D9AAC740

Function 6167A220 Relevance: 6.0, APIs: 4, Instructions: 50synchronizationCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6167A2AC
LeaveCriticalSection.KERNEL32 ref: 6167A2BD
SetEvent.KERNEL32 ref: 6167A2C7
WaitForSingleObject.KERNEL32 ref: 6167A2D4

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CriticalSection$EnterEventLeaveObjectSingleWait
String ID:
API String ID: 4060455350-0
Opcode ID: 7ca8ee030e8c51aea62903f1655bab1dd090e062ff7678b1343c36a621b3a562
Instruction ID: 632401487848cf2f2d7db7c7352c577bc0688191c88e2d8b8eb4d879eb57ea21
Opcode Fuzzy Hash: 7ca8ee030e8c51aea62903f1655bab1dd090e062ff7678b1343c36a621b3a562
Instruction Fuzzy Hash: 6121B736208B6483EB11CF56E95035973B1F748794F488226DA6E43B74DF7AC661CB44

Function 6169DFE0 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

_lock.LIBCMT ref: 6169DFF4

Part of subcall function 61691740: _amsg_exit.LIBCMT ref: 6169176A

fclose.LIBCMT ref: 6169E024
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6169D653), ref: 6169E048
free.LIBCMT ref: 6169E059

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CriticalDeleteSection_amsg_exit_lockfclosefree
String ID:
API String ID: 594724896-0
Opcode ID: 1fd5a7a6854435361f159e9ea5941f12d54ce2938623eb7f55bd651f403f7640
Instruction ID: e2aae441f3b7120063bdf130d55863124ff14a1dbb89223d8bebd6ebd40a380f
Opcode Fuzzy Hash: 1fd5a7a6854435361f159e9ea5941f12d54ce2938623eb7f55bd651f403f7640
Instruction Fuzzy Hash: 2211867A61864283DB00CB5AE48035CB772F7C4B98F149615CAAA477B4CF36C5A3C718

Function 616B3EF4 Relevance: 6.0, APIs: 4, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 616B3EFE

Part of subcall function 616920F0: _amsg_exit.LIBCMT ref: 61692106

_lock.LIBCMT ref: 616B3F2C
free.LIBCMT ref: 616B3F62
_amsg_exit.LIBCMT ref: 616B3F9B

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _amsg_exit$_getptd_lockfree
String ID:
API String ID: 2148533958-0
Opcode ID: 535f75801336ded27ffc7af263844d90e666d939a571b1782aaf103fd6435e6a
Instruction ID: a8da0c06e3ed920cdb5dccf4114104e7c63aa3a51ed547ab2b2e89306d896ad2
Opcode Fuzzy Hash: 535f75801336ded27ffc7af263844d90e666d939a571b1782aaf103fd6435e6a
Instruction Fuzzy Hash: 4511A03A715A81C3EB44CF65E8403A9737AF788B84F4C8425EA9E43769CF38C165D740

Function 6167F7CC Relevance: 6.0, APIs: 4, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 6167F7E9
GetLastError.KERNEL32 ref: 6167F7FA

Part of subcall function 616740A8: std::exception::exception.LIBCMT ref: 616740C8

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

TlsAlloc.KERNEL32 ref: 6167F82A
GetLastError.KERNEL32 ref: 6167F83B

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: AllocErrorLast$ExceptionRaisestd::exception::exception
String ID:
API String ID: 2854767267-0
Opcode ID: da144e47f22ff3d8022b29bb8d039d395542ebdb6450739efad89f9c98c9d48f
Instruction ID: 9df7d6d535e7d312aa9ce7cf69d51df61ba8e11144cfb6a5fe836dadcb29fc84
Opcode Fuzzy Hash: da144e47f22ff3d8022b29bb8d039d395542ebdb6450739efad89f9c98c9d48f
Instruction Fuzzy Hash: 8901B575A18B4286EB20EB74EC4439923B3FBC832DF948612D199831A8EF3DC216C751

Function 61765784 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

??_V@YAXPEAX@Z.MSVCR100 ref: 617657BC
??_V@YAXPEAX@Z.MSVCR100 ref: 617657D5
??_V@YAXPEAX@Z.MSVCR100 ref: 617657DE
??3@YAXPEAX@Z.MSVCR100 ref: 617657F6

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 145e927d14c327b6151ae36ad8016a935f64d904d0f28ce5ea326b3e36186d12
Instruction ID: 11ece338d9474bb196f9dcfda6dba99a2425ed7284faabbf016f5189329b91ac
Opcode Fuzzy Hash: 145e927d14c327b6151ae36ad8016a935f64d904d0f28ce5ea326b3e36186d12
Instruction Fuzzy Hash: 9F017831205A8284EB00CB26F55478DA724EB84B98F98C521AE5E43729DF3DCA9AC780

Function 616E1BD4 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_getptd.LIBCMT ref: 616E1BDA

Part of subcall function 616920F0: _amsg_exit.LIBCMT ref: 61692106

_getptd.LIBCMT ref: 616E1BFA
_lock.LIBCMT ref: 616E1C0D
_amsg_exit.LIBCMT ref: 616E1C3B

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _amsg_exit_getptd$_lock
String ID:
API String ID: 3670291111-0
Opcode ID: f1d8197a13a7dea5c9b82f1c47d9e5a09afc84ea647693a769e087af0fca8de4
Instruction ID: 8600b097eca3108fc96749f542c3e13e10ec4f90029416c39f33ce844f41d0d7
Opcode Fuzzy Hash: f1d8197a13a7dea5c9b82f1c47d9e5a09afc84ea647693a769e087af0fca8de4
Instruction Fuzzy Hash: BBF05E6964B142C2FB049B65C8547E92633EB88F48F0CC738CE088B390EF288562E354

Function 6168AB9C Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,6168AB78), ref: 6168ABCC
CloseHandle.KERNEL32(?,?,?,6168AB78), ref: 6168ABD9
CloseHandle.KERNEL32(?,?,?,6168AB78), ref: 6168ABE6

Strings

$Jga, xrefs: 6168ABF3

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CloseHandle
String ID: $Jga
API String ID: 2962429428-1662010317
Opcode ID: 06d69424ff3bcc261a61ebf9de66d214d33d95d8dd8c98559bb1c204cf7cfa08
Instruction ID: 21379b3e46519e7fdb70daba0e27bdc23de5ab5932115ebbeb0243b7c010c1c4
Opcode Fuzzy Hash: 06d69424ff3bcc261a61ebf9de66d214d33d95d8dd8c98559bb1c204cf7cfa08
Instruction Fuzzy Hash: 1CF042B6605B4596DB449F61E8843D8337AFB9CB1AF984022895D46334DF3AC5AAC350

Function 61790074 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCR100 ref: 61790240
??3@YAXPEAX@Z.MSVCR100 ref: 6179025B

Strings

0, xrefs: 617900F7

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??3@
String ID: 0
API String ID: 613200358-4108050209
Opcode ID: 542a3963797acd87fbcaf35a689e799bf37e554b2ecb5b114f54cf74f55a1229
Instruction ID: 33d22a44c39e1b8f24faa795c66a3d9cf6bb52caef7839979eb91e748e876dbe
Opcode Fuzzy Hash: 542a3963797acd87fbcaf35a689e799bf37e554b2ecb5b114f54cf74f55a1229
Instruction Fuzzy Hash: B4518862B14A808EEB10CFB1E5402CD77B6F74578CF948926DF4A67A59DB38C54AC780

Function 617925DC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCR100 ref: 617927A8
??3@YAXPEAX@Z.MSVCR100 ref: 617927C3

Strings

0, xrefs: 6179265F

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??3@
String ID: 0
API String ID: 613200358-4108050209
Opcode ID: cb31bec95d02c64150e8d738a25053354717a73b942c3b7f87e5d65522e0f4a2
Instruction ID: 29a105ba526267f4bea689030b49432145cd1156ed47c50e61dee9accd795bc2
Opcode Fuzzy Hash: cb31bec95d02c64150e8d738a25053354717a73b942c3b7f87e5d65522e0f4a2
Instruction Fuzzy Hash: AD519823B04B808AEB10DFB1E5402CD77B2F74579CB948926DF4A27A58EB34C55AC780

Function 617811D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

sprintf_s.MSVCR100 ref: 6178136A

Strings

%, xrefs: 617812E6
+, xrefs: 617812FC

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: sprintf_s
String ID: %$+
API String ID: 2907819478-2626897407
Opcode ID: f3b81febd445594a3beba0b29fb2e6b14740acfbc4935524849a720cb3a75fb5
Instruction ID: b34e70194bfeb2c904a33f2bd49ec7cfb1a21115e986cff0c17009d5bc43cdb8
Opcode Fuzzy Hash: f3b81febd445594a3beba0b29fb2e6b14740acfbc4935524849a720cb3a75fb5
Instruction Fuzzy Hash: BB5140A371CB848DEB62CB35E85079AF735FB56380F04C321AE9963A55EB2CD195C700

Function 617830E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

sprintf_s.MSVCR100 ref: 6178327A

Strings

+, xrefs: 6178320C
%, xrefs: 617831F6

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: sprintf_s
String ID: %$+
API String ID: 2907819478-2626897407
Opcode ID: 0777a7d8031b4873c84056c28c14669974b80d0b187d75c600f7025e10b3e6e0
Instruction ID: ac8a0691c85522a3479b7142c8364697989fe18cea80627278bfa6e8e485fc30
Opcode Fuzzy Hash: 0777a7d8031b4873c84056c28c14669974b80d0b187d75c600f7025e10b3e6e0
Instruction Fuzzy Hash: DE512223A18F8089D762CB38E95079AF735FB56B80F44C325AE8923A55EB3DD196C700

Function 6168FF78 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 6168FFE2

Strings

bad allocation, xrefs: 61690087
csm, xrefs: 61690047

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: FileHeader
String ID: bad allocation$csm
API String ID: 104395404-2003371537
Opcode ID: 85fdfe9c9d8aa921537eb76f9e3dc14a5c614eb48c185f0928743b8e3bf84e6f
Instruction ID: d1a0ace44811a916fc030e0c3d9cd216b46f52acc1702ee80026bcfa9383a37d
Opcode Fuzzy Hash: 85fdfe9c9d8aa921537eb76f9e3dc14a5c614eb48c185f0928743b8e3bf84e6f
Instruction Fuzzy Hash: 1351CC77209B8582EB50CF45E48039AB7B4F7897A8F448625EB8D87B68EF7CC044CB40

Function 61673AF8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 61673B7A

Part of subcall function 6167186C: TlsGetValue.KERNEL32(?,?,?,?,61673472), ref: 61671882

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 61673BE2

Strings

D?ga, xrefs: 61673BB4

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Base::Concurrency::details::ContextCurrentScheduler$Value
String ID: D?ga
API String ID: 890930104-168566389
Opcode ID: 95d88c8fd06dcf440ba13e91c2b6267d9639a61797af47b2c1e6ac880e3e3df2
Instruction ID: 7d7308e597f4698707f2d64748d3da8e47b3d962d3635e5ecc318a132f1378d1
Opcode Fuzzy Hash: 95d88c8fd06dcf440ba13e91c2b6267d9639a61797af47b2c1e6ac880e3e3df2
Instruction Fuzzy Hash: 8C41EB3A206F819AD670CF15F98035AB7B8F718758F548229CBDE07B60EB39E0A5D304

Function 617961B4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

sprintf_s.MSVCR100 ref: 61796268
??3@YAXPEAX@Z.MSVCR100 ref: 61796313

Strings

%.0Lf, xrefs: 61796258

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??3@sprintf_s
String ID: %.0Lf
API String ID: 766125096-1402515088
Opcode ID: 355a1d53f4b989609fa35598d078fdd8d30dea4c6ccfffc60b2fc031baed9e86
Instruction ID: 98a3d0dc02acdab3a159505466484568f8cb2c9f233f7e5ea97164a55948ff4c
Opcode Fuzzy Hash: 355a1d53f4b989609fa35598d078fdd8d30dea4c6ccfffc60b2fc031baed9e86
Instruction Fuzzy Hash: 8441F323619BC089E711CB75E95038EB771F7857A8F448321EEA927B98DF38C14AC780

Function 61674E14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96threadCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32 ref: 61674E50
GetCurrentThread.KERNEL32 ref: 61674EFD

Strings

$Jga, xrefs: 61674F6E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: CurrentThreadValue
String ID: $Jga
API String ID: 1644696904-1662010317
Opcode ID: ab15f80c0339b7629d725edc6bff802809e6e99f4d7f9ee1bab9d18b4d6a0705
Instruction ID: 92c2ad6d38aa19741f1f633b13e03995dd5639dfcfb757cfb61d18dedadacc9d
Opcode Fuzzy Hash: ab15f80c0339b7629d725edc6bff802809e6e99f4d7f9ee1bab9d18b4d6a0705
Instruction Fuzzy Hash: FF41687B205B858BCB90CF6AE048A8C77B5F788FA8B158216DE5E47758EB75C891C700

Function 616A4144 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A4185
_invalid_parameter_noinfo.LIBCMT ref: 616A4190

Strings

B, xrefs: 616A41A7

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: ff9756a063d3a76d9bc8f42e705eb1b23fa8d1c172608c79a605ece4bac65e72
Instruction ID: c445f1f2f6009f70eee07a1b0cbf769507d190f2ecca8be1e9e4a7833d2d6863
Opcode Fuzzy Hash: ff9756a063d3a76d9bc8f42e705eb1b23fa8d1c172608c79a605ece4bac65e72
Instruction Fuzzy Hash: 5931AE3AB10B2189E701CFB5AC8059D3BB5F7097ACB58C226EE2957B88DF70D842C310

Function 616A2208 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A2244
_invalid_parameter_noinfo.LIBCMT ref: 616A224F

Strings

B, xrefs: 616A2267

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: 6b56c739efd0c32d84e253c6d09e273835d7e46ac64104b60e23da20cdba6dd1
Instruction ID: 8c2d8846398b67b368a5474bb0940fedecc7b7edf3319112b3d6545cba44694a
Opcode Fuzzy Hash: 6b56c739efd0c32d84e253c6d09e273835d7e46ac64104b60e23da20cdba6dd1
Instruction Fuzzy Hash: 3B21283AB50B5189F715CFB6E8805DD3B75BB097ACB48C329EE2917A98DB34C851C314

Function 616A3A40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A3A81
_invalid_parameter_noinfo.LIBCMT ref: 616A3A8C

Strings

B, xrefs: 616A3ABD

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: 62fd80cbf674f8c677e4304678635afd64de5f0c5ee499c450fdbdec5ce05189
Instruction ID: b56b9655cafdc5dca55bcac81aa8d05d6ebc761836ef2743d0e18393c19df605
Opcode Fuzzy Hash: 62fd80cbf674f8c677e4304678635afd64de5f0c5ee499c450fdbdec5ce05189
Instruction Fuzzy Hash: 3621073AB14B61C9E701CFB6E94048D3BB5F749BE8B588126EF6857B48DB34C842C740

Function 616A3E18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A3E58
_invalid_parameter_noinfo.LIBCMT ref: 616A3E63

Strings

B, xrefs: 616A3E7A

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: f4bd842a8f7c62f0d1a1598acbc2674f8fd3f734648b1609cb4a4cea884fa4bb
Instruction ID: 3ac5cdf3d6c5d2f98587aec9248e8699b1c3de2c08cac51d65f4a6f071e5c191
Opcode Fuzzy Hash: f4bd842a8f7c62f0d1a1598acbc2674f8fd3f734648b1609cb4a4cea884fa4bb
Instruction Fuzzy Hash: 5621B13AB10B648AEB01CFA5E84069C7BB5F749B98F588212EF691BB48CF34C841C714

Function 616A1780 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A17B7
_invalid_parameter_noinfo.LIBCMT ref: 616A17C2

Strings

B, xrefs: 616A17DD

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: 8885d899943db37ac735e4ac855c6ad06dfe000a1bb393152a31618c74ba3262
Instruction ID: a24b3ff569709c7dafeb1ce650141b7172cf8c8adb19f1aa81c946e57cd3b8c8
Opcode Fuzzy Hash: 8885d899943db37ac735e4ac855c6ad06dfe000a1bb393152a31618c74ba3262
Instruction Fuzzy Hash: CA21B67AB04A6589FB02CBB4E8407DC3B75B7457A8F558225EE1A1BB98DF34C845C710

Function 61675A68 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64synchronizationCOMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 61675A93

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

WaitForSingleObject.KERNEL32 ref: 61675B2F

Strings

pContext, xrefs: 61675A80

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ExceptionObjectRaiseSingleWaitstd::exception::exception
String ID: pContext
API String ID: 953030470-2046700901
Opcode ID: 48422e2e88a9754292114c5c848b9847d505ed741737c146c0eeae30b9dfd650
Instruction ID: 340383acfd0e75ae2907a1efe06a0c7484d7da51db877d3139128bca3a7fe6d9
Opcode Fuzzy Hash: 48422e2e88a9754292114c5c848b9847d505ed741737c146c0eeae30b9dfd650
Instruction Fuzzy Hash: 7B212476205B0692DF21DF65E4803AC7372F784B98F948122C76E03674DF78C98AC380

Function 616A3F38 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A3F78
_invalid_parameter_noinfo.LIBCMT ref: 616A3F83

Strings

B, xrefs: 616A3F9F

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: f3b80824ad5fc5e2f86dab2a9134d882f5a42c6d15f71ff207a0f899b5dfda73
Instruction ID: 973347d21b3a32f4f4de23319f6ca0424f381318cf45ebf527be4c19ccb30805
Opcode Fuzzy Hash: f3b80824ad5fc5e2f86dab2a9134d882f5a42c6d15f71ff207a0f899b5dfda73
Instruction Fuzzy Hash: D2218336B2076089E701CFB9E84069C7BB5F789B98F588215EF9957B88CF34C441C754

Function 61675980 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 616759AE

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

SetEvent.KERNEL32 ref: 61675A4C

Strings

pContext, xrefs: 6167599B

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: EventExceptionRaisestd::exception::exception
String ID: pContext
API String ID: 734980841-2046700901
Opcode ID: ce5117218795bda241ae72ffda777ed7f514ef09418d2f91208706a85f9b3e3e
Instruction ID: 4f11154ec7cbd96606f0ef6b97f7cd5cafc16082711468dd942d6cb48e1464cf
Opcode Fuzzy Hash: ce5117218795bda241ae72ffda777ed7f514ef09418d2f91208706a85f9b3e3e
Instruction Fuzzy Hash: CD21577A705B4682DF10DF25E4943586376FB88FC8F648122CA5E47728EF78C986C380

Function 61755468 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@AEAV123@@Z.MSVCR100 ref: 617554BD
??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QEAA@XZ.MSVCR100 ref: 61755523

Strings

0hua, xrefs: 6175548F

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: Concurrency@@Lock@details@ReentrantScoped_lock@_$??0_??1_V123@@
String ID: 0hua
API String ID: 1298863651-4283851096
Opcode ID: 025b806e9920571f8073229df8b91cf41c33c25b25e8401021d7b96538bcc0fc
Instruction ID: 65d805e7d262693193ba3eec946c4c488fd3231cf245edec0f76dabe23c0e821
Opcode Fuzzy Hash: 025b806e9920571f8073229df8b91cf41c33c25b25e8401021d7b96538bcc0fc
Instruction Fuzzy Hash: D921DF76620E148AEB00CF65E88439C7774F748FA9F145226DE1E577A8DF38C5A9C300

Function 61760500 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 6175F96C: ??0exception@std@@QEAA@AEBQEBD@Z.MSVCR100(?,?,?,?,?,?,?,?,61777A33,?,?,?,6178C78B), ref: 6175F97F
Part of subcall function 6175F96C: _CxxThrowException.MSVCR100 ref: 6175F99D

memmove.MSVCR100 ref: 61760570
??3@YAXPEAX@Z.MSVCR100 ref: 61760578

Strings

string too long, xrefs: 61760525

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0exception@std@@??3@ExceptionThrowmemmove
String ID: string too long
API String ID: 67166081-2556327735
Opcode ID: 73489119696fe5f553fe85044a6ceb494f9929addc97cf9b07994c93d4f73d85
Instruction ID: 25a5a10dc5a2ef2ca5839889879f29040152197ae16ceda39bd1caae8540a034
Opcode Fuzzy Hash: 73489119696fe5f553fe85044a6ceb494f9929addc97cf9b07994c93d4f73d85
Instruction Fuzzy Hash: 2711B172240B8084EB098F2AA600649B725F344FD8B78C925DE698B79ADF35C592C3C0

Function 616A3950 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A3989
_invalid_parameter_noinfo.LIBCMT ref: 616A3994

Strings

B, xrefs: 616A39C6

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: fd70e68437294ce24e0502ceac3f8ffa97b4719b149e5d013b888bd6d0919adf
Instruction ID: 28922a3d72733fc9ffcf631a359df5e3d845d767587e2d2468854cd7fa99cc2b
Opcode Fuzzy Hash: fd70e68437294ce24e0502ceac3f8ffa97b4719b149e5d013b888bd6d0919adf
Instruction Fuzzy Hash: 6911727A708B8086DB21CF55E14435DBAA1F789BD4F548225AF9C4BB58DF38C941CB04

Function 61675B60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 61675B84

Part of subcall function 616D1470: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,616D8E5E), ref: 616D14EB

VirtualProtect.KERNEL32 ref: 61675C31

Strings

pContext, xrefs: 61675B6E

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ExceptionProtectRaiseVirtualstd::exception::exception
String ID: pContext
API String ID: 943871803-2046700901
Opcode ID: 0ede94647194be007bec9bef93f1d9aa4e5a65f3a0e7663c96d4ef468b746c94
Instruction ID: 7c5e59ea73c21c735bc5bb4818ba03159d78bcaf05e5b5f0dd41557cf718abca
Opcode Fuzzy Hash: 0ede94647194be007bec9bef93f1d9aa4e5a65f3a0e7663c96d4ef468b746c94
Instruction Fuzzy Hash: 1A21A5BA609B4A91EF20CF54E4903A86371F798B8CF948112C68D03B74DF79C69ACB40

Function 616D8DBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.LIBCMT ref: 616D8DD6

Part of subcall function 616D8CBC: _FF_MSGBANNER.LIBCMT ref: 616D8CEC
Part of subcall function 616D8CBC: HeapAlloc.KERNEL32(?,?,?,616D8AC0,?,?,?,616916B5,?,?,?,61691763), ref: 616D8D11
Part of subcall function 616D8CBC: _errno.LIBCMT ref: 616D8D35
Part of subcall function 616D8CBC: _errno.LIBCMT ref: 616D8D40

std::exception::exception.LIBCMT ref: 616D8E43

Strings

bad allocation, xrefs: 616D8E13

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno$AllocHeapmallocstd::exception::exception
String ID: bad allocation
API String ID: 2053901039-2104205924
Opcode ID: 7b2c61581332c5792a539410a85cb21a7610f945f0257a39d9af8be4b55b30d0
Instruction ID: 83b3acea53356157e67787290ac7596489fb72430b1b03c82b390167d6e42f59
Opcode Fuzzy Hash: 7b2c61581332c5792a539410a85cb21a7610f945f0257a39d9af8be4b55b30d0
Instruction Fuzzy Hash: 9E019AB9A19B4691EF00CB20F85038863B6F799388F8C9021D88983671EF3EC265DB40

Function 616892BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

QueryDepthSList.KERNEL32 ref: 6168930F
InterlockedPushEntrySList.KERNEL32 ref: 6168932C

Strings

'pa, xrefs: 616892EB

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: List$DepthEntryInterlockedPushQuery
String ID: 'pa
API String ID: 3968893850-64452907
Opcode ID: e8fa7c13f2b97c4216050b2e452195e370f23fe7c6c64f66dcbe516ec15ed827
Instruction ID: f2823b7740bb5404b78fb4936a564dd82cfe96c4fe246b9319f3d41b953fbada
Opcode Fuzzy Hash: e8fa7c13f2b97c4216050b2e452195e370f23fe7c6c64f66dcbe516ec15ed827
Instruction Fuzzy Hash: C101CC79B1969083EB45CF55E08439D7332FB88BC9F88D022DE1A07B18DF38D6A68714

Function 616A1C8C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A1CC5
_invalid_parameter_noinfo.LIBCMT ref: 616A1CD0

Strings

I, xrefs: 616A1D05

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: I
API String ID: 2959964966-3707901625
Opcode ID: f3f683a624852e7756d5a2ba4cabae06811cd88ce15b72dfe64c9e18231206ca
Instruction ID: 872088616d72e4fc0a7935ee37edd90f71e97f4844e0d95b0dc331b0ee91eccb
Opcode Fuzzy Hash: f3f683a624852e7756d5a2ba4cabae06811cd88ce15b72dfe64c9e18231206ca
Instruction Fuzzy Hash: 31018B76708B8086DB108B52E544259B6A5F7D4FE4F188222EB9947BA4DF38C9408B04

Function 617654D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

??_V@YAXPEAX@Z.MSVCR100 ref: 6176550E
??3@YAXPEAX@Z.MSVCR100 ref: 61765571

Strings

4Sva, xrefs: 6176554D

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??3@
String ID: 4Sva
API String ID: 613200358-1931980733
Opcode ID: 907532f2f411d86193c6b4bd8f9d125c985021017529857384229004fa576521
Instruction ID: 4e80dad574f721ed160a953af708d927de8d2de87f56d2485db73657c872de85
Opcode Fuzzy Hash: 907532f2f411d86193c6b4bd8f9d125c985021017529857384229004fa576521
Instruction Fuzzy Hash: 26114F71741F8694DF00CB19E6853AC7776EB84BA8F69C2219B1D033A5DF39C6A5C380

Function 61689468 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateTimerQueueTimer.KERNEL32 ref: 616894B7

Strings

, xrefs: 61689493
bad allocation, xrefs: 616894C1

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: Timer$CreateQueue
String ID: $bad allocation
API String ID: 3971536239-1441640566
Opcode ID: 671e0e34dbf1f66f73f3b0ff7b74fabb4bb19bc79d7513cc69e3f4cf072d7906
Instruction ID: f04fb56f3d1ab6b49a92b80628b9826a2bb7253ef03b682237fe944681b3bf7b
Opcode Fuzzy Hash: 671e0e34dbf1f66f73f3b0ff7b74fabb4bb19bc79d7513cc69e3f4cf072d7906
Instruction Fuzzy Hash: EA11707660978592DB50CF25E44438AB7B5F3C578CFA88016EA8C43B14DB39C656CB90

Function 616A38E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_errno.LIBCMT ref: 616A4075
_invalid_parameter_noinfo.LIBCMT ref: 616A4080

Strings

B, xrefs: 616A40AC

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo
String ID: B
API String ID: 2959964966-1255198513
Opcode ID: a0f5ba1dd46c0c78c752ee56d2362c1b3d35ccf07d8bc960f8fa0a645e4c5816
Instruction ID: d4b1012ad417db3cb78fbe6e2189b7fb0b55cc534ddf08e4dae6474cf27f7e62
Opcode Fuzzy Hash: a0f5ba1dd46c0c78c752ee56d2362c1b3d35ccf07d8bc960f8fa0a645e4c5816
Instruction Fuzzy Hash: 3501C0B6714B4086DB10CF52E844389B661F798FE8F588321AF5807B95CF38C541CB04

Function 6168F670 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 6168F6AA
free.LIBCMT ref: 6168F6DB

Strings

csm, xrefs: 6168F676

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: DecodePointerfree
String ID: csm
API String ID: 2443025543-1018135373
Opcode ID: 8c83f119f041715e4f99f1d6a67663bb67be95b69dba9afda8f08761c30a74e0
Instruction ID: 0a28270170ad8c495681ad92f0d32ac46053d95723ec1793473f76dd61aaab4d
Opcode Fuzzy Hash: 8c83f119f041715e4f99f1d6a67663bb67be95b69dba9afda8f08761c30a74e0
Instruction Fuzzy Hash: BEF0AF7BA0222086EF929FB5848071C37B4EF94F4EF78D655CA0D8A330DB22C4C2C691

Function 61765334 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

??_V@YAXPEAX@Z.MSVCR100 ref: 6176536A
??3@YAXPEAX@Z.MSVCR100 ref: 617653A5

Strings

4Sva, xrefs: 61765381

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??3@
String ID: 4Sva
API String ID: 613200358-1931980733
Opcode ID: c5dee6811d069498a959eb84a213cd3563798e2671e9cbb6e64e617c0f1afdf8
Instruction ID: 4c31ac9d1a39c84859a64338c76c86f207bf32b2ef1a6ef7fd397815290d0122
Opcode Fuzzy Hash: c5dee6811d069498a959eb84a213cd3563798e2671e9cbb6e64e617c0f1afdf8
Instruction Fuzzy Hash: B7018F32240A4691DF008B2AF6553A97325EB84BA8F58C6219E2903399DF3AC296C380

Function 6176544C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

??_V@YAXPEAX@Z.MSVCR100 ref: 61765482
??3@YAXPEAX@Z.MSVCR100 ref: 617654BD

Strings

LTva, xrefs: 61765499

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??3@
String ID: LTva
API String ID: 613200358-3638767947
Opcode ID: 7b193f7ef22d12c059281ceb9bb85c74f85de7fc24e5361df874878b7c98dde0
Instruction ID: 83483be8b22d64962c0d21dc3cf4c4e471ce46c4a18a14ca495a202c5c2c2f2e
Opcode Fuzzy Hash: 7b193f7ef22d12c059281ceb9bb85c74f85de7fc24e5361df874878b7c98dde0
Instruction Fuzzy Hash: 73017C31305B4694DF00CB29E6453A97721EB84BE8F5896219A6D033A9DF3AC699C780

Function 617640C8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCR100 ref: 617640F3
DeleteCriticalSection.KERNEL32(?,?,?,?,?), ref: 61789EB8

Strings

`Pva, xrefs: 617640D6

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??3@CriticalDeleteSection
String ID: `Pva
API String ID: 1993430471-890145041
Opcode ID: d251c0dc6fdae0a04a41f8a50ed209528e459f70d572c196185d80c1781711d8
Instruction ID: 46a21b3faeac048ba2ad2380de7107bac93492d5e3f0fa27be63b4c168b3f253
Opcode Fuzzy Hash: d251c0dc6fdae0a04a41f8a50ed209528e459f70d572c196185d80c1781711d8
Instruction Fuzzy Hash: 42F0A072719A8580CB05DB6BE79417DA324E79CFC8B18D420AE5D0BB18DF29C5AAC340

Function 6168C658 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::~InternalContextBase.LIBCMT ref: 6168C67C

Strings

`wga, xrefs: 6168C671
$tga, xrefs: 6168C662

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ContextInternal$BaseBase::~Concurrency::details::
String ID: $tga$`wga
API String ID: 3275300208-3529988675
Opcode ID: 75a2c1aee81ba2faf6acea8ab25a5790ae065af0dc1be0dd1ff45697606643d5
Instruction ID: 8eb9550ff123559e4dd5c9307bc0585e081d16cafa5acd469b30acfc30376284
Opcode Fuzzy Hash: 75a2c1aee81ba2faf6acea8ab25a5790ae065af0dc1be0dd1ff45697606643d5
Instruction Fuzzy Hash: EEE08636704B4095DB048B65F6853A8736AEB4C7D4F5C8021DE5C07734DFB9C8E18300

Function 61687FB4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::~InternalContextBase.LIBCMT ref: 61687FD8

Strings

$tga, xrefs: 61687FBE
`wga, xrefs: 61687FCD

Memory Dump Source

Source File: 00000002.00000002.1422050574.0000000061671000.00000020.00000001.01000000.00000009.sdmp, Offset: 61670000, based on PE: true

Associated: 00000002.00000002.1422036250.0000000061670000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422104815.0000000061701000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422129466.0000000061722000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422144265.0000000061724000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422160764.0000000061727000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422174692.000000006172A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422189582.0000000061732000.00000010.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.1422205942.0000000061736000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61670000_Virtual.jbxd

Similarity

API ID: ContextInternal$BaseBase::~Concurrency::details::
String ID: $tga$`wga
API String ID: 3275300208-3529988675
Opcode ID: c3cab98079217739ed3b5ee2a452f82c7e070a0172a1fe06e894a558e62e94cb
Instruction ID: 2c2485abf0906a500083dc363f4d07b61ecaefeac7f33ff76b7d0e82bb5467ca
Opcode Fuzzy Hash: c3cab98079217739ed3b5ee2a452f82c7e070a0172a1fe06e894a558e62e94cb
Instruction Fuzzy Hash: 58E04F36705B4581DA058B56F6943A873BAEB487D4F589021DE5807B74EF79C5A2C300

Function 61788718 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

_ui64toa_s.MSVCR100 ref: 61788741
_create_locale.MSVCR100 ref: 6178874E

Strings

., xrefs: 6178873C

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: _create_locale_ui64toa_s
String ID: .
API String ID: 194611966-248832578
Opcode ID: ada23b2c40d147092175328c6575631cca01c615405fc107c14a7d5aa3393a1d
Instruction ID: 5440f8d35079d6ebe45ba9938029c67bc2389223d7969e6d3948dc479230111b
Opcode Fuzzy Hash: ada23b2c40d147092175328c6575631cca01c615405fc107c14a7d5aa3393a1d
Instruction Fuzzy Hash: 01E09276708AC092EB249B20F81538D7372F78D748F800105DA8E07704DF2DC219CF01

Function 61752050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

??0invalid_link_target@Concurrency@@QEAA@PEBD@Z.MSVCR100 ref: 6175206C
_CxxThrowException.MSVCR100 ref: 6175207E

Strings

_Link, xrefs: 61752060

Memory Dump Source

Source File: 00000002.00000002.1422237688.0000000061751000.00000020.00000001.01000000.00000008.sdmp, Offset: 61750000, based on PE: true

Associated: 00000002.00000002.1422223161.0000000061750000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422273891.000000006179F000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422306958.00000000617DC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422322768.00000000617DE000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422336285.00000000617DF000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.1422349476.00000000617E1000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_61750000_Virtual.jbxd

Similarity

API ID: ??0invalid_link_target@Concurrency@@ExceptionThrow
String ID: _Link
API String ID: 3916662256-3418048212
Opcode ID: e11f34464883971bb0a2e310631cab853e4cb5b8ebeae76faa4d1c8dd5e4df9d
Instruction ID: b66b4bc7502b32b11e969158bf4297532de1d9d08f6fb774c7401062e66bc8e1
Opcode Fuzzy Hash: e11f34464883971bb0a2e310631cab853e4cb5b8ebeae76faa4d1c8dd5e4df9d
Instruction Fuzzy Hash: FDE086B1105A46D1EE149B00D944388A332F780388FA4C121926C02578DF3DC66EC340

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report orderconfirmation.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\35453018

C:\Users\user\AppData\Local\Temp\VBoxDDU.dll

C:\Users\user\AppData\Local\Temp\VBoxRT.dll

C:\Users\user\AppData\Local\Temp\Virtual.exe

C:\Users\user\AppData\Local\Temp\ckmfqeimpicbuy

C:\Users\user\AppData\Local\Temp\msvcp100.dll

C:\Users\user\AppData\Local\Temp\msvcr100.dll

C:\Users\user\AppData\Local\Temp\orvhk

C:\Users\user\AppData\Local\Temp\qtu

C:\Users\user\AppData\Roaming\fmBrowserumz_test\VBoxDDU.dll

C:\Users\user\AppData\Roaming\fmBrowserumz_test\VBoxRT.dll

C:\Users\user\AppData\Roaming\fmBrowserumz_test\Virtual.exe

C:\Users\user\AppData\Roaming\fmBrowserumz_test\msvcp100.dll

C:\Users\user\AppData\Roaming\fmBrowserumz_test\msvcr100.dll

C:\Users\user\AppData\Roaming\fmBrowserumz_test\orvhk

C:\Users\user\AppData\Roaming\fmBrowserumz_test\qtu

Static File Info

Windows Analysis Report
orderconfirmation.exe

Function 00401626 Relevance: 22.8, APIs: 15, Instructions: 304
COMMON

Function 0040301A Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Function 00411DEF Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111
COMMON

Function 00401B37 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 47
timewindowCOMMON

Function 0040B163 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 160
COMMON

Function 00403354 Relevance: 10.6, APIs: 7, Instructions: 145
stringtimeCOMMON

Function 00404405 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91
COMMON

Function 00408EA4 Relevance: 8.0, APIs: 3, Strings: 2, Instructions: 464
COMMON

Function 00410CD0 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 23
COMMONLIBRARYCODE

Function 004096C7 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 388
COMMON

Function 00402844 Relevance: 6.4, APIs: 5, Instructions: 118
stringCOMMON

Function 0040150B Relevance: 6.1, APIs: 4, Instructions: 100
synchronizationthreadCOMMON

Function 00401986 Relevance: 6.0, APIs: 4, Instructions: 27
COMMON

Function 00404A44 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 81
COMMON

Function 0040ADC3 Relevance: 4.5, APIs: 3, Instructions: 35
COMMON